Checking the functionality of a control device

Abstract

The invention relates to a method (100) for checking the functionality of a control device (10), wherein a checksum is determined (102) on the basis of check results of a hardware-based self-diagnosis of the control device (10). Furthermore, the determined (102) checksum is compared (104) with a specified target checksum. On the basis of the comparison (104), information relating to the functionality of the control device (10) is then determined (106).

Description

[0001] Description

[0002] Checking the functionality of a control device

[0003] The invention relates to a method for checking the functionality of a control device, a control device for carrying out the method, a computer program and a computer-readable medium.

[0004] Verifying the functionality of a control device to ensure it is fault-free is particularly important when it is intended for use in processes with high safety requirements. This verification is typically performed during commissioning. This allows any defects to be identified before the control device is used to manage a safety-critical operation.

[0005] To detect a defective functional state of a control device, software-based test algorithms are frequently used. These are implemented and executed on the control device. For example, predetermined inputs are made, which are then processed based on the test algorithms. The result of this processing is then used to assess the functionality of the control device. However, this only indirectly tests the hardware. Therefore, it is possible that single or multiple hardware defects in the control device may remain undetected by the test algorithms. This may be uncritical for individual applications. However, if other applications are running on the control device, this defect could potentially have significant consequences.While it is generally possible to perform a comprehensive hardware test using software-based test algorithms, achieving sufficient quality requires the development of extensive and complex algorithms. Furthermore, executing these algorithms to achieve the necessary test depth for predetermined safety requirements demands a significant amount of time, resulting in lengthy commissioning processes. Alternatively, or additionally, the functionality of a control device can be verified using statistical methods. For example, statistically determined failure times can be used to guide the regular testing of predetermined control devices.If a regularly inspected control device is to be used, the commissioning time can be shortened based on the previously gained insights into its functionality. However, such a procedure involves a high degree of logistical and planning effort, which may be uneconomical.

[0006] The object of the invention is to enable time-efficient commissioning of a control device, in which, in particular, a defective functional state of the control device can be reliably and cost-effectively detected.

[0007] This problem is solved by a method having the features of claim 1.

[0008] Furthermore, it is an object of the invention to provide a control device for carrying out the method.

[0009] This problem is solved by a control device having the features of the subordinate claim.

[0010] Furthermore, the invention is based on the objectives of providing a computer program and a computer-readable medium.

[0011] These tasks are solved by a computer program having the features of the dependent computer program claim and by a computer-readable medium having the features of dependent claim 15.

[0012] Advantageous further training courses are each the subject of dependent sub-claims.

[0013] The method according to the invention is designed to verify the functionality of a control device. For this purpose, a checksum is determined based on the test results of a hardware-based self-diagnosis of the control device. Furthermore, the determined checksum is compared with a predetermined target checksum. Based on this comparison, information regarding the functionality of the control device is then obtained.

[0014] In this context, the checksum is to be understood in the context of information technology and has a length of several bits. Here, the checksum is intended to compare the actual state of the control device with its target state. Preferably, an algorithm is used to determine the checksum, enabling the detection of single and / or multiple hardware errors in the control device. For this purpose, a test pattern generation and evaluation based on a known compression or decompression method and tailored to specific hardware is suitable, for example.

[0015] This method enables rapid functional testing of the control device. Hardware defects within the control device can thus be reliably detected with a high degree of certainty. In particular, for safety-critical applications, a high level of testing depth and therefore exceptionally high-quality verification of the control device's hardware functionality can be achieved. Furthermore, false positives resulting from overlapping multiple errors can be reliably avoided. This makes it possible to meet the highest safety requirements.

[0016] Advantageously, hardware-based self-diagnostics are performed using an integrated test circuit. An integrated test circuit can be designed to save space and is easy to implement. An external test circuit is not required. In a particularly advantageous implementation, the integrated test circuit is used to check a logic function and / or a memory function of the control device. This allows essential components for the operation of the control device to be checked with high accuracy and reliability.

[0017] In another advantageous embodiment, a logic built-in self-test (LBIST) and / or a memory built-in self-test (MBIST) are provided as integrated test circuitry. A built-in self-test (BIST) is understood here to be a hardware-based self-diagnostic test. This enables the functionality of the control device to be checked cost-effectively and efficiently using known test procedures. Unlike known hardware test methods based on an LBIST and / or MBIST, however, this method does not simply output a 1-bit value, such as true or false. Instead, a checksum is calculated based on the test results. Using an LBIST and / or MBIST, existing integrated test circuits, often in an adapted and / or extended form, can frequently be used to perform the procedure for production testing.This allows the functionality to be verified, at least partially, based on existing hardware test structures. Application-specific solutions for determining the functionality of the control device can therefore be dispensed with. Advantageously, the integrated test circuit can also include an analog and mixed-signal BIST, a boundary scan test, and / or signature analysis. In a further advantageous embodiment, even the smallest electronic component of an electronic circuit within the control device is checked using hardware-based self-diagnostics. This achieves maximum test depth. Furthermore, it allows for precise knowledge of the physical state of the control device at the lowest hardware level.Therefore, checking the functional state of the control device is possible in a particularly reliable and dependable manner. Single and multiple hardware faults can be identified with a high degree of detail in a cost-effective and time-efficient way.

[0018] Preferably, a logic gate and / or a memory cell is checked using hardware-based self-diagnostics. In this context, the logic gate is understood as an integrated implementation of a logical operator. This logical operator can be, for example, an AND gate, an OR gate, an EXCLUSIVE OR gate, or a NOT gate. Furthermore, in this context, the memory cell is understood in the sense of semiconductor technology, specifically as the smallest unit of a physical implementation of a semiconductor memory designed for data storage. This allows for throughput- and coverage-optimized testing of the control device. Particularly preferably, the logic gate and / or the memory cell, along with their respective connecting lines, are checked using hardware-based self-diagnostics.In an advantageous application, a memory is tested by traversing all possible memory starting points and leading to a predetermined memory endpoint. For this purpose, all necessary test vectors are established at the possible memory starting points to reliably detect all errors along the tested paths to the memory endpoint. In particular, the error-free operation of a processor, a memory, and / or other relevant logic functions can be easily and reliably verified in a cost-effective and time-efficient manner. Conversely, a complete state and input space check of the operating software, as would be required in a purely software-based testing method, can be omitted.

[0019] In a further advantageous enhancement, a portion of the checksum is determined based on the test results of a software-based self-diagnosis of the control device. This allows for the improved detection of both multiple and single errors. In addition to in-depth hardware testing, a simple, superficial software test can be used to determine the functionality of the control device. Various application scenarios can thus be quickly and reliably checked for errors. Advantageously, the comparison of the determined checksum with the target checksum is performed using software. A hardware-based implementation of the target checksum is therefore advantageously unnecessary. This prevents any impairment of the comparison quality due to a hardware-based error.

[0020] Furthermore, an advantageous refinement provides that the checksum has a length of at least 16 bits, preferably at least 32 bits, and most preferably at least 64 bits. This allows for the fulfillment of high security requirements. In the preferred application, findings from both hardware-based and software-based self-diagnostics can be efficiently represented in the checksum. The probability of a false positive result being generated by chance can be minimized. Therefore, a defective functional state can be detected with a high degree of certainty.

[0021] The target checksum is preferably determined using a simulation of a virtual representation of the control device. This allows for the cost-effective and reliable determination of an ideal target state. This can then be reliably used as a reference to assess whether the control device is in a defective state. Advantageously, the target checksum is determined using a data processing device separate from the control device. This enables the target state to be determined using diverse methods.

[0022] Furthermore, an advantageous refinement provides that a first checksum is determined based on the test results of a hardware-based self-diagnosis of a first of at least two independent functional units of the control device. In this context, it is further provided that a second checksum is determined based on the test results of a hardware-based self-diagnosis of a second of at least two independent functional units of the control device. Preferably, the first checksum and / or the second checksum are determined not only through hardware-based self-diagnosis but also through software-based self-diagnosis. Subsequently, the determined first checksum is compared with the specified target checksum. Based on this comparison, information regarding the state of the first independent functional unit of the control device is then determined.Furthermore, a second comparison is performed, comparing the second checksum with the specified target checksum. Based on this additional comparison, information regarding the status of the second independent functional unit of the control device is then determined. The independence of the functional unit is understood here in accordance with the standard EN 50129. A functional check can be performed for each independent functional unit. This allows high safety requirements to be met and provides a control device that, in the preferred application, fulfills a high level of safety requirements.In the preferred application, a control device intended for carrying out safety-critical processes with the highest safety requirements, such as SIL 4 according to EN 50129, can therefore be reliably and quickly tested. This enables high-quality commissioning and the associated functional and / or safety testing of the control device. Furthermore, this method allows for the time-efficient and cost-effective commissioning of a safety-relevant control device.

[0023] The control device according to the invention is configured to carry out the methods according to the invention. This allows the control device to be quickly ready for use. A defective functional state of the control device can be detected quickly with high reliability. This enables high safety requirements to be met.

[0024] In a preferred embodiment, the control device comprises at least two functional units that can be operated independently of one another. A functional unit can be, for example, a simple logic function, a memory, or a comprehensive data processing device. Using one of the at least two independently operable functional units, complex safety-relevant control tasks, such as those found in traffic control systems or smoke extraction systems, can be performed while adhering to high safety requirements. In the preferred application, the at least two functional units are an integrated part of one or more single-chip systems. Hardware-based faults can be reliably and quickly detected in independent functional units. In particular, complex control devices can be commissioned efficiently.Therefore, control devices with a low probability of failure can be provided for safety-critical applications.

[0025] Furthermore, the invention provides a computer program which, when executed, causes the control device according to the invention to carry out the method according to the invention. In addition, a computer-readable medium is provided according to the invention. This medium contains instructions which cause the control device according to the invention to carry out the method according to the invention.

[0026] The computer-readable medium is, for example, a CD-ROM, a DVD, a USB or flash memory device, or a non-physical medium such as a data stream and / or a digital carrier signal.

[0027] The properties, features, and advantages of the invention described above, as well as the manner in which they are achieved, are explained in more detail in the following description of an embodiment of the invention and its variations, in conjunction with the figures. Where appropriate, the same reference numerals are used in the figures for the same or corresponding elements of the invention. The embodiment and its variations serve to illustrate the invention and do not limit the invention to the combinations of features specified therein, including functional features. Furthermore, all features specified in the embodiment and its variations can be considered in isolation and combined appropriately with the features of any claim. The figures described below are not to scale and are schematic representations.

[0028] They show:

[0029] FIG 1 illustrates an example of the method according to the invention using a schematic flowchart;

[0030] FIG 2 shows an embodiment of the control device according to the invention.

[0031] FIG 1 illustrates an example of a method 100 for verifying the functionality of a control device 10 using a schematic flowchart.

[0032] Safety-critical applications require a high degree of fault tolerance in the control device 10 used to control the application. To meet stringent safety requirements, and thus reliability and fault tolerance, the example of method 100 described here aims to commission the control device 10 as quickly as possible. For this purpose, a hardware-based self-diagnosis is performed using the control device 10 108. Based on the test results of this hardware-based self-diagnosis, a checksum is then determined 102. For the purpose of determining 102 the checksum, known compression and / or decompression methods are particularly suitable, based on which a test pattern generation and evaluation tailored to specific hardware is performed.This makes it possible to reliably detect both single and multiple errors and to represent them using the checksum.

[0033] In a preferred embodiment of the example of method 100, the hardware-based self-diagnosis is performed using an integrated test circuit 108. Advantageously, a logic function and a memory function of the control device 10 are checked using the integrated test circuit 110. In this way, essential components for the operation of the control device 10 can be tested reliably and safely.

[0034] A built-in self-test circuit is particularly preferred as the integrated test circuit. This allows self-diagnosis to be performed cost-effectively, reliably, and efficiently based on known test procedures.108 In particular, the example of method 100 described here includes a built-in self-test that encompasses the logic, processor, and memory of the control device 10. Built-in self-tests are frequently already incorporated into existing chip designs. In the preferred application, these can be used to implement the method without requiring any modification or redesign of the chip.

[0035] Furthermore, in a preferred embodiment of the method 100 described herein, a smallest electronic component of an electronic circuit of the control device 10 is checked using hardware-based self-diagnostics. Particularly preferably, a logic gate and a memory cell of an integrated circuit of the control device 10 are checked using hardware-based self-diagnostics. For the purpose of such a check, built-in self-tests of a known type can be used. However, unlike previously known test methods based on built-in self-tests, the present method does not simply output a 1-bit test result, such as true or false. Instead, the aforementioned checksum with a length of at least 16 bits is determined.This allows for the display and output of sufficiently detailed information regarding the functionality of the control device 10, as required for high safety standards. Furthermore, a comprehensive self-diagnostic function can be implemented as needed using the checksum. In particular, this prevents potentially false positives from being displayed in the checksum due to multiple errors, such as errors in different logic or memory areas. The probability of existing errors remaining undetected can be advantageously minimized. Moreover, this method allows for maximum test depth regarding the hardware of the control device 10. This makes it possible to obtain knowledge about the physical state of a fundamental hardware level of the control device 10 in a simple and time-efficient manner.Reliable and operationally safe detection of single and / or multiple faults is possible. Furthermore, this provides information regarding the functionality of the control device 10, which allows for a reliable and robust assessment for any application.

[0036] Furthermore, an advantageous embodiment of the example of method 100 described herein provides that, in addition to a hardware-based self-diagnosis of the control device 10, a software-based self-diagnosis of the control device 10 is performed 108. In this way, part of the checksum is determined based on test results from the software-based self-diagnosis of the control device 102. This makes it possible to detect both hardware-related and software-related error sources in a cost-effective and time-efficient manner. A comprehensive hardware-based self-diagnosis can be supplemented by a superficial software-based self-diagnosis. This further improves the reliability in detecting a defective functional state of the control device 10.

[0037] In a further preferred embodiment of method 100, the comparison 104 of the determined checksum 102 with the target checksum is performed using software. This avoids the need to store the checksum 102 in hardware on the control device 10. Furthermore, it prevents any impairment of the quality of the comparison 104.

[0038] Furthermore, it is proposed that the specified target checksum be advantageously determined by means of a simulation of a virtual representation of the control device 10 112. The target checksum can thus be determined independently of any real hardware 112 by representing an ideal target state of the control device 10. This ideal target state can then be used as a reference to perform a reliable and operationally safe verification of the functionality of the control device 10. Therefore, the example of method 100 described here provides that the target checksum 112 determined by means of a simulation of the virtual representation of the control device 10 is used as the specified target checksum. FIG 2 shows an embodiment of a control device 10 in a schematic representation.Furthermore, FIG 2 illustrates that the control device 10 is configured to carry out the method 100.

[0039] For example, the control device 10 is a single-chip system comprising two independently operable functional units 12 and 14. These functional units 12 and 14 can each be logic functions, memory, and / or data processing devices. In this example, the two functional units 12 and 14 include a memory (not shown) and a data processing device (not shown). Furthermore, both functional units 12 and 14, in combination, are configured to control the same safety-critical application while adhering to high, preferably very high, safety requirements. The safety-critical application could, for example, be a traffic control system or a smoke extraction system.The aforementioned functional units 12 and 14 are each implemented as integrated circuits of a single-chip system and are arranged independently of each other on a common semiconductor substrate (not shown in detail). Furthermore, the integrated circuits of the two functional units 12 and 14 each feature built-in self-test circuits, which include logic functions (not shown in detail), a processor, and memory.

[0040] Furthermore, FIG 2 illustrates that the embodiment of the control device 10 is verified by means of the example of method 100 described in connection with FIG 1.

[0041] During the verification of the functionality of the exemplary embodiment of the control device 10, a first checksum is determined based on test results of the hardware-based and software-based self-diagnostics of the first of the two independent functional units 12, 14 102. Furthermore, a second checksum is determined based on test results of the hardware-based and software-based self-diagnostics of the second of the two independent functional units 12, 14 102. Subsequently, a comparison 104 of the determined first checksum 102 with the specified target checksum is carried out, as well as a further comparison 104 of the second checksum with the specified target checksum.Furthermore, based on comparison 104, information concerning the functionality of the first independent functional unit 12 is determined, and based on further comparison 104, information concerning the functionality of the second independent functional unit 14 is determined 106.

[0042] This allows each of the two independent functional units 12, 14 to be checked independently with regard to its respective functionality. If one of the functional units 12, 14 exhibits a defective functional condition, then the entire control device 10 is also defective. Conversely, if it is determined that both independent functional units 12, 14 are free of defects, then the embodiment of the control device 10 described here is also free of defects. In this way, the control device 10 can be reliably and quickly checked for controlling safety-critical applications with a high safety requirement level, such as SIL4 according to EN 50129. This enables time-efficient commissioning of the control device 10 while adhering to high safety requirements.Although the invention has been illustrated and described in detail by the preferred embodiment and its variations, the invention is not limited by the disclosed examples, and other variations can be derived from them by a person skilled in the art without departing from the scope of protection of the invention. Regardless of the grammatical gender of a particular term, persons of male, female, or other gender identities are included.

Claims

Patent claims 1. Method (100) for verifying the functionality of a control device (10), in which - a checksum is determined based on test results of a hardware-based self-diagnosis of the control device (10) (102); - a comparison of the determined (102) checksum with a specified target checksum is carried out (104); - based on the comparison (104) information concerning the functionality of the control device (10) is determined (106).

2. Method (100) according to claim 1, wherein the hardware-based self-diagnosis is performed by means of an integrated test circuit (108).

3. Method (100) according to claim 2, in which a logic function and / or a memory function of the control device (10) is checked by means of the integrated test circuit (110).

4. Method (100) according to claim 2 or 3, wherein a logic BIST and / or a memory BIST is provided as the integrated test circuit.

5. Method (100) according to one of the preceding claims, in which a smallest electronic component of an electronic circuit of the control device (10) is checked by means of hardware-based self-diagnosis (110).

6. Method (100) according to claim 5, in which a logic gate and / or a memory cell is checked by means of hardware-based self-diagnosis (110).

7. Method (100) according to one of the preceding claims, wherein a part of the checksum is determined on the basis of test results of a software-based self-diagnosis of the control device (10) (102).

8. Method (100) according to one of the preceding claims, wherein the comparison (104) of the determined (102) checksum with the target checksum is carried out using software (104).

9. Method (100) according to one of the preceding claims, wherein the length of the checksum is at least 16 bits, preferably at least 32 bits and particularly preferably at least 64 bits.

10. Method (100) according to one of the preceding claims, wherein the specified target checksum is determined by means of a data processing device (112) on a different control device (10).

11. Method (100) according to any one of the preceding claims, wherein - a first checksum is determined based on test results of a hardware-based self-diagnosis of a first of at least two independent functional units (12, 14) of the control device (10) (102); - a second checksum is determined based on test results of a hardware-based self-diagnosis of a second of at least two independent functional units (12, 14) of the control device (10) (102); - a comparison of the determined (102) first checksum with the specified target checksum and a further comparison of the second checksum with the specified target checksum is carried out (104); - based on the comparison (104) information concerning the functionality of the first independent functional unit (12) of the control device (10) and based on the further comparison (104) information concerning the functionality of the second independent functional unit (14) of the control device (10) is determined (106).

12. Control device (10) which is configured to carry out the method (100) according to any of the preceding claims.

13. Control device (10) according to claim 12, characterized by at least two functional units (12, 14) which can be operated independently of each other.

14. Computer program which, when executed, causes the control device (10) according to one of claims 12 to 13 to carry out the method (100) according to one of claims 1 to 11.

15. Computer-readable medium comprising instructions which cause the control device (10) according to any one of claims 12 to 13 to carry out the method (100) according to any one of claims 1 to 11.

Images