FAULT ENTRY UNIT

Description

[0001] The invention relates to a fault introduction unit for connection to an object to be tested connected to a bus or network interface, wherein the object to be tested can be subjected to fault voltages by means of the fault introduction unit that are greater than the maximum voltage for which the bus or network interface is designed.

[0002] So-called HIL simulators are known from the prior art, which are used particularly for testing control units ("HIL" derives from "Hardware in the Loop"). HIL simulators each comprise at least one computer unit, with the computer unit(s) having the particular task of executing models that at least partially replicate the environment of an electronic device or a more complex technical system.

[0003] HIL simulators enable a testing procedure in which an embedded system, in particular an electronic control unit (ECU), or a mechatronic module, is connected via its inputs and outputs to a customized counterpart, namely the HIL simulator, which serves to replicate the real environment of the embedded system. Within the context of an HIL simulation, the embedded system is also referred to as the device under test (DUT). During testing of the embedded system, at least some of the input signals for the embedded system are provided by the HIL simulator, and at least some of the output signals of the embedded system are sent to the HIL simulator. In "Implementation of OPEN TC8 with CANoe, vTESTstudio and VT System", Version 1.0 2019-04-18 Application Note AN-IND-1-022, 18.For example, Vector Informatik GmbH's document XP093079360, published in April 2019 (2019-04-18), describes an implementation of tests for HIL systems according to the "Automotive Ethernet Test Specification" of Technical Committee 8 (TC8). Such tests are intended to verify the compatibility of Automotive Ethernet with existing ECU standards.

[0004] For example, the temporal behavior of the environment of the system under test can be simulated using an environment model running on a HIL simulator. For example, if an HIL simulator is intended to test an embedded system, in particular an ECU, the HIL simulator is designed to at least partially replicate the ECU's real environment. In this case, the HIL simulator can communicate with the ECU via its inputs and outputs equipped with a bus or network interface, or via bidirectional communication channels, and thus function as an adapted counterpart to the ECU.

[0005] HIL simulation must generally run in real time and is used in development to shorten development times and save costs. In particular, recurring processes can be simulated and / or automated. This has the advantage that a new development version of a control or regulation program can be tested under the same criteria as the previous version. This allows detailed verification of whether a fault has been corrected. This significantly reduces the number of tests on real systems, such as a motor vehicle's braking system, and also allows system limits to be determined without endangering the real system and its users (e.g., the car and driver).

[0006] HIL simulation is always only a simplification of reality and therefore cannot replace testing on a real system. If excessive discrepancies arise between a HIL test and reality, the underlying models in the simulation are oversimplified. In this case, the simulation models must be further developed.

[0007] A key component of HIL testing is fault simulation, which is used to test the ECU's response to fault situations. To simulate cable breaks or similar faults, additional plug-in cards for HIL systems or external devices, which can be connected to the HIL systems via bus or network interfaces, are usually available. These are called Failure Insertion Units (FIUs), also referred to below as fault insertion units. They comprise circuits with remotely and automatically controllable switches for simulating, for example, cable breaks, short circuits, swapped ECU connections and / or contact bounce, which can lead to unwanted modulation. FIUs are available for both sensors and actuators; for actuators, they are additionally combined with load devices. FUIs can therefore be used, in particular, to generate simulation signals that represent non-normal, i.e. faulty, operating states.This allows an electrical component to be tested not only for normal operation, but also for various error and / or fault conditions. Such a FUI is described, for example, in DE 10 2009 048 981 A1.

[0008] This document describes a device for testing an electronic component, comprising a simulation device for generating a simulation signal, a test device for connecting the electronic component, two connecting devices, and a selection device for selecting the connecting device. The simulation device and the test device can be electrically connected to one of the connecting devices by means of the selection device, and the individual connecting devices differ from one another with respect to at least one electrical property. The simulation device is configured such that simulation signals can be generated for different operating states of the electronic component, and in particular, simulation signals for faulty operating states of the electrical component can be provided by means of a FUI.

[0009] In an FIU, the signal lines are typically connected to ground potential or the positive potential line, i.e., to 0 V or up to +60 V, so that an object under test can be subjected to a corresponding voltage. The signal lines, especially in bus or network connections, typically operate at lower voltages, e.g., voltages less than or equal to 5 V. Although the communication transceivers required for the buses are generally protected against overvoltage, there is a risk that high voltages from an FIU could irreversibly damage them, rendering the bus interfaces of the simulator or the ECUs under test unusable.

[0010] The aforementioned problem that bus transceivers cannot withstand the maximum voltages used in the FIU without damage is well known. Therefore, the individual channels of the bus and network interfaces have previously been protected against overvoltages. This means that passive components were integrated into the signal path of the bus or network interfaces in the form of protective circuits.

[0011] A suppressor circuit is an electrical circuit accessory consisting of various electronic components that prevents damaging high voltages, such as those generated when electromagnetic devices are switched off, from occurring. A suppressor circuit is designed to reduce voltage spikes to such an extent that no components are damaged. Components used as suppressor circuits do not affect normal operating processes but can divert interference voltages or currents. Suppressor circuits are well known in the technical field of automotive electronics and in many areas of electrical control technology.

[0012] The aforementioned solution of equipping bus or network interfaces with protective circuitry works well for buses that operate at lower speeds and with low bandwidths, such as the low-speed CAN bus. A well-known solution for the CAN bus provides a protective circuit in front of the interface card's CAN transceiver. This protective circuit consists of a semiconductor component that, when an excessive voltage is detected, uses an analog circuit to create a short circuit in front of the transceiver input to protect it. In addition, the input is disconnected using a relay after the overvoltage is detected. This approach requires measuring resistors in the signal path to detect high currents. These resistors can be overloaded due to the high current in the event of a short circuit. Furthermore, depending on the external circuitry, high self-induction voltages can occur after the protective relay in front of the transceiver input opens.

[0013] The higher the bandwidth of the buses and thus the frequencies used, the more disruptive the effect of protective circuits becomes. When using buses and networks with higher speeds, such as Ethernet, it is no longer possible to integrate such protective circuits on a network interface card, as such protective circuits would degrade signal integrity to such an extent that communication is disrupted to an intolerable extent. Therefore, in the past it was problematic to use FIUs on buses with higher bandwidths, particularly in combination with Ethernet. Bub Sergej et al. address the increasing demands on protection against electrostatic discharge and the associated problems with signal integrity in high-speed interfaces in the automotive sector.In "Automotive High-Speed ​​Interfaces: Future Challenges for System-level HV-ESD Protection and First-Time-Right Design," 2021 43rd Annual EOS / ESD Symposium (EOS / ESD), September 26, 2021 (2021-09-26). The article recommends simulation for the design of corresponding protection circuits.

[0014] The "VT System User Manual Version 3.0.1" for HIL systems from Vector GmbH describes interface modules for a HIL that provide options for introducing faults. In particular, an interface module is described that provides interfaces for Ethernet and Automotive Ethernet, including circuits for switching electrical faults to the signal connections. To protect the HIL simulator interface, a switch is provided that allows the interface to be disconnected from the power supply. Protection for the object under test is not disclosed in this document.

[0015] Based on this, the object of the invention is to provide a possibility to use fault introduction units even in systems that operate with buses with high bandwidths, without the risk of bus or network interfaces, in particular of the HIL simulator, but also of the object to be tested, being damaged due to overvoltages.

[0016] This problem is solved by the subject matter of the independent patent claims. Preferred developments are found in the subclaims.

[0017] According to the invention, a fault introduction unit is thus provided for connection to an object to be tested connected to a bus or network interface, wherein the object to be tested can be subjected to fault voltages that are greater than the maximum voltage for which the bus or network interface is designed by means of the fault introduction unit, with a protection circuit that protects a bus or network interface connected to the fault introduction unit from voltages that are greater than the maximum voltage for which the bus or network interface is designed.

[0018] In the conventional solution described above, all bus signals are always routed through the protection circuit, even when the fault introduction unit is not activated. This always leads to poor signal integrity values, regardless of whether a fault is activated or not, or whether a fault introduction unit is connected to the object under test. In contrast, the invention shifts the protection circuit to the fault introduction unit. This means that the protection circuit is only used when a fault is activated. Since signal integrity is unimportant when the fault is activated, the protection circuit does not affect the bus behavior.

[0019] The inventive division has a further advantage: In the conventional solution described above, the protection circuit is installed in each interface, which not only results in poorer signal behavior but also in additional production and component costs. This means that in the prior art, a high-quality protection circuit is always installed, regardless of whether the interface is used in combination with a fault introduction unit. With the invention, the effort is shifted to the fault introduction unit, i.e., wherever it is actually needed. As a result, a key aspect of the invention is to arrange the protection circuit not where a device is to be protected, but where the danger to the device to be protected arises.

[0020] According to the invention, the fault introduction unit has inputs for connection to supply voltage lines and outputs for connection to the object to be tested for applying a fault voltage to the object to be tested, wherein a protective circuit arranged between the inputs and the outputs is provided as a safety circuit, which is designed such that voltage peaks or high voltages applied for testing are reduced in such a way that no voltages occur at the outputs that would damage a bus or network interface connected to the object to be tested, for example of a HIL simulator.

[0021] According to the invention, the protective circuit can be used to determine the error voltage to be applied to the object under test before the object under test is subjected to the error voltage. The protective circuit can only output the error voltage to the outputs if the error voltage is below a voltage that would damage a bus or network interface connected to the object under test. This preferred embodiment of the invention provides particular security that the object under test is not actually subjected to voltages for which the object under test is not designed and which would therefore with a high probability lead to damage to the object under test.

[0022] In principle, the fault introduction unit can have multiple outputs. For example, the object to be tested can be connected to the bus or network interface (e.g., the interface of a HIL simulator) via at least one additional output of the fault introduction unit.

[0023] According to this preferred embodiment of the invention, a protective circuit known per se is provided as the protection circuit, which, however, is not arranged in the bus or network interface, but in the fault introduction unit itself. According to a preferred development of the invention, a plurality of different protective circuits, each for a different bus or network interface, are arranged between the inputs and the outputs, wherein the protective circuits are designed such that, with regard to the respective bus or network interface for which they are provided, voltage peaks are reduced in such a way that no voltages occur at the outputs which would damage a respective bus or network interface connected to the object to be tested, and wherein each of these protective circuits can be selectively activated for function in the fault introduction unit.

[0024] If in this case it is said that a plurality of different protective circuits are arranged between the inputs and the outputs, each intended for a different bus or network interface, then the term "other bus or network interface" means a different type of interface, e.g. Ethernet on the one hand and FlexRay on the other.

[0025] Furthermore, it means that each of these protective circuits can be activated for function in the fault injection unit, and that the protective circuits can be activated individually, specifically those that correspond to the respective bus or network types present in the existing bus or network interface. This provides a universally applicable fault injection unit that can be used with different types of bus or network interfaces.

[0026] In principle, it is possible to manually activate one of the protective circuits offered by the fault introduction unit for operation in the fault introduction unit. However, according to a preferred development of the invention, the fault introduction unit is provided with a detection and activation device that can identify the type of bus or network interface connected to the object under test and can activate the respective protective circuit provided for the respective bus or network interface. This preferred embodiment of the invention significantly reduces the risk of activating a protective circuit that is unsuitable for the respective bus or network interface.

[0027] In addition to the last-described preferred development of the invention, according to a preferred embodiment, the protective circuit is variable with regard to the maximum voltage possible at the outputs, so that this maximum voltage can be adjusted.

[0028] According to another preferred embodiment of the invention, the fault introduction unit is provided with inputs for connection to supply voltage lines, first outputs for connection to the object to be tested for applying a fault voltage to the object to be tested, and second outputs for connecting the object to be tested, which is connected to the first outputs, to the bus or network interface. A switching device arranged between the first outputs and the second outputs is provided as a safety circuit, and can be used to switch a connection between the first outputs and the second outputs. According to this preferred embodiment of the invention, the switching device can therefore be used to galvanically connect the first outputs to the second outputs and also to separate them again. This embodiment of the invention makes it possible to establish the connection to the bus or network interface before the fault voltage is applied.Network interface so that the object to be tested can be subjected to the fault voltage while at the same time the bus or network interface is completely protected.

[0029] This inventive approach is highly universal and does not require the configuration of a protective circuit depending on the bus or network interface used. The timely disconnection of the connection to the bus or network interface is preferably controlled by suitable logic (implemented on an FPGA or other suitable computing unit) located on the fault introduction unit or on a HIL simulator connected to the fault introduction unit. The disconnection is triggered, for example, based on a signal applying a fault voltage—for example, from the HIL simulator or from a host PC connected to the HIL simulator—or based on a measurement of an impermissibly high voltage.

[0030] If the connection is a multi-wire connection, the switching device is designed in such a way that the simultaneous switching of several wires is possible.

[0031] This embodiment of the invention is preferably further developed such that the switching device is arranged such that it separates the connection between the first outputs and the second outputs before the object to be tested is subjected to a fault voltage via the first outputs, and closes the connection again after the fault voltage has been applied.

[0032] The bus or network interface can, in principle, be any interface. However, according to a preferred embodiment of the invention, the error introduction unit is provided for an interface that is an Ethernet interface. In particular, according to a preferred embodiment of the invention, the bus or network interface is designed for a maximum voltage of 5 V. The use of the error introduction unit according to the invention is particularly efficient with such bus or network interfaces.

[0033] The invention also relates to a use of a previously described fault introduction unit for a HIL simulator.

[0034] Furthermore, the invention relates to a HIL simulator with a fault introduction unit as described above.

[0035] The invention is explained in more detail below using two preferred embodiments of the invention with reference to the drawings.

[0036] The drawings show Fig. 1 schematically shows an error introduction unit according to a first preferred embodiment of the invention, Fig. 2 a detection and activation device of the error introduction unit from Fig. 1 for selecting various protective circuits, Fig. 3 schematically shows a fault introduction unit according to an example helpful for understanding the invention, and Fig. 4 shows the use of a fault introduction unit according to a preferred embodiment of the invention for a HIL simulator.

[0037] Out of Fig. 1 1 schematically shows a fault introduction unit 1 according to a first preferred embodiment of the invention. The fault introduction unit 1 is connected to a bus or network interface 2 and to an object 3 to be tested via outputs 7. The connection to the bus or network interface 2 is made via a connection 16 of the bus or network interface 2, which leads to a transceiver 14, also referred to as a communications transceiver, which in turn is connected to the actual controller 15 of the bus or network interface 2. While conventional bus or network interfaces are sometimes provided with a protective circuit to protect against high voltages, the present bus or network interface 2 is provided which does not itself have such a protective circuit.

[0038] Rather, the fault introduction unit 1 is provided with a protection circuit 4 in the form of a protective circuit 8. This ensures that voltages applied to the object 3 to be tested, and thus also to the bus or network interface 2, are not greater than the maximum voltage for which the bus or network interface 2 is designed. In other words, the protective circuit 8 limits the voltages supplied to the fault introduction unit 1 via supply voltage lines 6 connected to inputs 5 of the fault introduction unit 1. This also means that the object 3 to be tested can only be subjected to voltages as high as the respective bus or network interface 2 permits. However, it is advantageous that destruction of or damage to the bus or network interface 2 by high voltages can be avoided with a high degree of probability.

[0039] A special design is given to the Fig. 1 visible error introduction unit 1 in Fig. 2 This is achieved by arranging a plurality of different protective circuits 8 between the inputs 5 and the outputs 7. These different protective circuits 8 are each provided for a different type of bus or network interface. In this way, a universally applicable fault introduction unit 1 is provided, in which a setting can be made that is suitable for the respective type of connected bus or network interface 2. In order to select the appropriate protective circuit 8 in each case, the fault introduction unit 1 has a detection and activation device 9 with which it can be detected what type of bus or network interface 2 is connected to the object 3 to be tested and with which the respective protective circuit 8 suitable for the respective bus or network interface 2 can then be activated.

[0040] In addition, the Fig. 1 The error introduction unit 1 shown has a function according to which the protective circuit 8 can determine the error voltage to be applied to the object 3 to be tested, before the object 3 to be tested is actually subjected to this error voltage. In this way, it can be provided that the error voltage is only output to the outputs 7 if the error voltage is below a voltage that would damage the bus or network interface 2 connected to the object 3 to be tested.

[0041] Out of Fig. 3 A fault introduction unit 1 is now shown schematically. This fault introduction unit 1 does not require a protective circuit 8. Rather, the fault introduction unit 1, in addition to the inputs 5 for connection to the supply voltage lines 6, has, on the one hand, first outputs 10 for connection to the object 3 to be tested for applying the fault voltage to the object 3 to be tested, and, on the other hand, second outputs 11 for connecting the object 3 to be tested, which is connected to the first outputs 10, to the bus or network interface 2. In order to protect the bus or network interface 2 against excessively high voltages, a switching device 12 is arranged as a protection circuit 4 between the first outputs 10 and the second outputs 11. This switching device 12 is designed such that it can be used to switch the connection between the first outputs 10 and the second outputs 11.Thus, a galvanically conductive connection between the first outputs 10 and the second outputs 11 can be established and opened again using the switching device 12.

[0042] This allows the fault introduction unit 1 to operate in such a way that the connection to the bus or network interface 2 is disconnected before the object 3 under test is subjected to a fault voltage. Furthermore, this also allows the object 3 under test to be protected from high voltages by the protection circuit and thus actually be subjected to voltages higher than fault voltages, which may be necessary depending on the intended test.

[0043] Finally, it should be pointed out again that according to a preferred embodiment of the invention, the use of an error introduction unit 1, as is known, for example, from Fig. 1 can be seen, is intended for a HIL simulator 13, which is shown schematically Fig. 4 is evident. List of reference symbols

[0044] 1 Fault introduction unit 2 Bus or network interface 3 Object to be tested 4 Protection circuit 5 Inputs for connection to supply voltage lines 6 Supply voltage lines 7 Outputs for connection to the object to be tested 8 Protective circuit 9 Detection and activation device 10 First outputs for connection to the object to be tested 11 Second outputs for connecting the object to be tested connected to the first outputs to the bus or network interface 12 Switching device 13 HIL simulator 14 Transceiver 15 Controller 16 Connection of the bus or network interface

Claims

1. A fault insertion device (1) for connecting to an object under test (3) connected to a bus or network interface (2), error voltages greater than the maximum voltage for which the bus or network interface (2) is designed being able to be applied to the object under test (3) by means of the fault insertion unit (1), having a fuse circuit (4) for protecting a bus or network interface (2) connected to the fault insertion unit (1) against voltages greater than the maximum voltage for which the bus or network interface (2) is designed, having inputs (5) for connecting to supply voltage lines (6) and outputs (7) for connecting to the object under test (3) for applying a fault voltage to the object under test (3), a protective circuit (8) disposed between the inputs and the outputs being provided as a fuse circuit (4) and being designed such that voltages are reduced in such a way that no voltages occur at the outputs (7) which would damage a bus or network interface (2) connected to the object under test (3), the protective circuit (8) being able to be used to determine the fault voltage to be applied to the object under test (3) before the fault voltage is applied to the object under test (3), and the protective circuit (8) being able to be used to output the fault voltage to the outputs (7) only when the fault voltage is below a voltage which would damage a bus or network interface (2) connected to the object under test (3).

2. The fault insertion unit (1) according to claim 2, a plurality of different protective circuits (8), each provided for a different bus or network interface, being disposed between the inputs (5) and the outputs (7), wherein the protective circuits (8) are designed in such a way that, with regard to the respective bus or network interface (2) for which said circuits are provided, voltages are reduced in such a way that no voltages occur at the outputs (5) which could damage a respective bus or network interface (2) connected to the object under test (3), and wherein in each case at least one of said protective circuits (8) can be selectively activated to function in the fault insertion unit (1).

3. The fault insertion unit (1) according to claim 3, wherein the fault insertion unit (1) has a detection and activation device (9) by means of which it is possible to recognize what type of bus or network interface (2) is connected to the object under test (3), and by means of which the respective protective circuit (8) provided for the respective bus or network interface (2) can be activated.

4. The fault insertion unit (1) according to any one of the claims 2 to 4, wherein the protective circuit (8) is variable with respect to the maximum voltage possible at the outputs (5), so that said maximum voltage is adjustable.

5. The fault insertion unit (1) according to any one of the preceding claims, wherein the bus or network interface (2) is an Ethernet interface.

6. The fault insertion unit (1) according to any one of the preceding claims, wherein the bus or network interface (2) is designed for a maximum voltage of 5 V.

7. A use of a fault insertion unit (1) according to any one of the preceding claims for a HIL simulator (13).

8. A HIL simulator (13) comprising a fault insertion unit (1) according to any one of the preceding claims 1-6.