Abstract:
A fault simulation system that has a simulation unit comprising an ECU model including an element fault model made to have a fault by a time setting or external command and all or a portion of a sensor model, actuator model, vehicle model, and driver model and can evaluate vehicle behavior at the time of an element fault according to driving operation based on a set travel scenario, wherein the passage time, vehicle behavior, driving operation, and the like, at each point on a course are determined through non-fault simulation and on the basis of that information, an element fault is inserted according to a fault time setting or fault command for the element fault model.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates to a simulation system that inserts electrical faults, such as open circuits, short circuits, and drifts, into electronic components configuring an on-vehicle electronic control unit (in the following, referred to as ECU) and evaluates the influence of the faults on a vehicle plant, which is a control target. 
       BACKGROUND ART 
       [0002]    In the automobile industry, the application of the functional safety standards ISO 26262 and the compliance with the standards are being required in the development of electrical/electronic components and software of a microcomputer installed on the components. Automobile manufacturers and suppliers are constructing development environments that satisfy the requirements. In ISO 26262 Part 4 8.4.2 (hardware-software integration and testing), in principle, verification is required for all faults of all elements packaged on a printed wiring board by a real vehicle or by simulation. In fault insertion testing by real vehicles, it is difficult to cope with modes, such as a mode in which an ECU is broken one time and a mode in which the accumulation of electrical damage cases no reproducibility. Experiments are conducted on over 10,000 experimental items. Thus, real vehicle testing exerts a serious influence on man-hours, time periods, and costs. In such situations, methods of fault insertion testing using simulation-based virtual ECUs are being investigated. 
         [0003]    Patent Literature 1 discloses a method (Method for Fault Analysis Using Simulation) in which faults in the open circuit and short circuit of electronic components are analyzed by simulation. According to the simulation method of Patent Literature 1, a model of a faulty ECU circuit is created by connecting variable resistors in series or in parallel. A circuit topology is changed for each fault for simulating the faulty ECU circuit. 
       CITATION LIST 
     Patent Literature 
       [0000]    
       
         Patent Literature 1: US Patent Application Publication No. 2006/0041417 
       
     
       SUMMARY OF INVENTION 
     Technical Problem 
       [0005]    Here, in the functional safety standards stated earlier, hazard analysis and risk assessment (in the following, referred to as H &amp; R) are required in the concept phase. In hazard analysis, for example, there are methods, such as a method in which fault modes of components are first considered by bottom-up methods, how the fault modes affect the overall system is examined to find hazards. The extent of damage, the probability of exposure (occurrence), and controllability, which are caused by the extracted hazards, are then evaluated on the extracted hazards in assumed representative situations to determine the severity of a risk. 
         [0006]    In the fault simulation method described in Patent Literature 1, the occurrence of faults based on situations required in H &amp; R and the influence on vehicle behaviors are not readily evaluated. 
       Solution to Problem 
       [0007]    The present invention is embodied by a simulation system including: a simulation unit that executes a plurality of simulations including a simulation of an electronic control unit (ECU) process and a simulation of a vehicle process and generates travel information; an analysis unit that sets a type of fault to the travel information received from the simulation unit; a control unit that causes the simulation unit to perform a simulation when a fault is caused based on the travel information to which the occurrence of the fault is set; and an output unit that outputs an executed result of the simulation unit. 
       Advantageous Effects of Invention 
       [0008]    According to the present invention, the occurrence of faults based on conditions set by a user and the influence on vehicle behaviors can be readily evaluated. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0009]      FIG. 1  is a block diagram of an exemplary fault simulation system according to an embodiment. 
           [0010]      FIG. 2  is an exemplary screen for inputting a travel scenario according to an embodiment. 
           [0011]      FIG. 3  is an exemplary screen for inputting fault conditions according to an embodiment. 
           [0012]      FIGS. 4A and 4B  are examples of a symbol diagram of elements used for fault insertion according to an embodiment and an example of model description using the VHDL-AMS language. 
           [0013]      FIG. 5  is an example of generating fault elements for simulating an open circuit and a short circuit according to an embodiment. 
           [0014]      FIG. 6  is a flowchart of an exemplary fault simulation method according to an embodiment. 
           [0015]      FIG. 7  is an example of an output of a travel result displayed on a screen according to an embodiment. 
           [0016]      FIG. 8  is a flowchart of an exemplary fault simulation method according to an embodiment. 
           [0017]      FIG. 9  is an example of a travel scenario table according to an embodiment. 
           [0018]      FIG. 10  is an exemplary travel information table according to an embodiment. 
           [0019]      FIG. 11  is an exemplary data definition table of fault insertion element models according to an embodiment. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0020]    In the following, embodiments will be described with reference to the drawings. 
       First Embodiment 
       [0021]      FIG. 1  is a block diagram of an exemplary fault simulation system for implementing the present invention. The fault simulation system at least includes an I/O unit  116  that inputs simulation conditions and outputs simulation results to a screen, an external storage device  113  that stores a travel scenario  114  and a fault condition  115  inputted through the I/O unit  116 , a main storage unit  100  that stores a simulation unit  101  including all execution processes of simulation and an analysis unit  111  analyzing simulation results, and a CPU  112  that performs arithmetic operations necessary for simulation. 
         [0022]    Here, the simulation unit  101  can find traveling states based on travel scenarios and travel results by: a driver process  107  that performs driving operation based on the travel scenario  114  through a steering wheel  102 ; a torque sensor process  103  that detects steering torque applied to the steering wheel  102  by electrical signals; a microcomputer process, not shown, performing a program that calculates an assist torque amount based on the steering torque and calculates a required torque amount for the motor process  104 ; an ECU process  108  including processes, such as a mixed signal circuit process, the mixed signal circuit, not shown, having an analog element and a digital element combined, including a driver circuit that drives the motor process  104  based on the output signal in the microcomputer process, a monitor circuit that detects drive electric currents in the motor process  104 , a power supply circuit that supplies electric power, and other circuits; and a vehicle process  109  that can perform a simulation of an electric power assisted steering (EPS) system having all or some of steering gear processes that convert the torque output of the motor process  104  into rack thrust and calculates vehicle behaviors from the output of the EPS process. A flow of a series of these processes is controlled by a simulation control unit  106 . In the analysis unit  111 , based on the fault condition  115  inputted by a user, timing at which a fault is caused is determined based on traveling states outputted from the simulation unit, and then a fault command is transmitted to the ECU process  108 . A flow of all the processes of the fault simulation is controlled by the control unit  110 . 
         [0023]      FIG. 2  is an exemplary screen for inputting a travel scenario according to the embodiment. 
         [0024]    The user inputs information necessary for simulation, such as a driving course, a road surface friction factor, the profile of targeted driving speed, and specifying a type of driver model or a steering pattern of a driver ( 201 ). Alternatively, the selection and display of a vehicle type ( 202 ) and a course geometry ( 200 ) may be included. As described above, the user can set a desired travel scenario through an input screen. 
         [0025]    Next,  FIG. 3  is an exemplary screen for inputting fault conditions according to the embodiment. 
         [0026]    There is a method in which coordinates are specified on a driving course geometry  300  selected by a user by a process of placing a fault marker  301  at a desired position on a course center line (by pressing a button  302 ) for specifying a site where a fault occurs. 
         [0027]    However, other methods of setting conditions for causing faults can be considered. For example, there is a method of setting fault conditions in which the coordinates of two points are specified on the driving course to draw a line and when a vehicle passes the line, this is the occurrence of a fault. For example, there is a method of setting fault conditions in which a distance covered by a vehicle is inputted and a time instant at which the vehicle covers the distance is a fault condition. 
         [0028]    In the case of using an element fault model that can return to a normal state at a set time instant, a transient fault can also be simulated by a method in which the passage time of a vehicle on a certain segment on the set course is a fault period, and a method in which the time instant of ending a fault is set based on elapsed time from the time instant of fault insertion. In addition to manipulating a vehicle of interest or the driver of a vehicle of interest, conditions may be set, such as a relative position and a relative speed, based on the relationship with another vehicle or another object. 
         [0029]      FIG. 4A  is a symbol diagram  400  of elements used for fault insertion according to the embodiment.  FIG. 4B  is an example of a model description  401  using the VHDL-AMS language. 
         [0030]    The elements used for fault insertion shown in  FIG. 4A  and  FIG. 4B  are described so that a resistance value can be switched between a variable Ron and a variable Roff by an external control input (S_IN). 
         [0031]      FIG. 5  is examples of generating fault element models for simulating an open circuit fault and a short circuit fault according to the embodiment. 
         [0032]    The element model  401  shown in  FIG. 4B  is connected to a typical circuit element  500  in series, and hence an open circuit fault element model  501  can be generated. Moreover, the element model  401  is connected to the circuit element  500  in parallel, and hence a short circuit fault element model  502  can be generated. However, at this time, it is necessary to set the variable Ron to a minute value around 0Ω and the variable Roff to a large value, a few MΩ. 
         [0033]      FIG. 6  is a flowchart of an exemplary fault simulation method according to the embodiment. 
         [0034]    When the execution of the control unit  110  is started ( 600 ), first, a travel scenario set by a user is read ( 601 ), and fault conditions corresponding to the travel scenario are also read ( 602 ). A simulation is then started ( 603 ). The control unit  110  transmits a command to the simulation control unit  106  to execute a unit step ( 604 ). 
         [0035]    The simulation control unit  106  having received the command simulates the unit step at the simulation unit  101 , and returns the result to the control unit  101 . After receiving the travel result, the control unit  110  causes the analysis unit  111  to compare the travel result with the fault conditions to determine whether to hold the conditions ( 607 ). 
         [0036]    In the case where the conditions are not held, the simulation control unit  106  starts the execution of the subsequent unit step ( 604 ). In the case where the conditions are held, the control unit  110  begins a fault insertion process. First, the control unit  110  transmits a command to the simulation control unit  106  to set a desired fault on a target element. The simulation control unit  106  sets fault information ( 620 ), and then transmits a notification of completion ( 621 ). 
         [0037]    After receiving the notification of completion, the control unit  110  instructs the simulation control unit to execute a simulation until finish time ( 622 ). After receiving all data of travel trajectories and vehicle behaviors ( 614 ), the control unit  110  ends the simulation ( 615 ). The control unit  110  outputs the result to the screen ( 616 ), and then a series of the processes is ended ( 617 ). 
         [0038]      FIG. 7  is an example of an output of a travel result displayed on a screen according to the embodiment. 
         [0039]    A travel number, which is desired to be displayed, is specified ( 702 ), a button  703  is then pressed, and hence various items of result data  700  and a travel trajectory  701  are displayed. When the travel trajectories are overlapped with each other for display, this provides differences to be easily observed. Thus, the travel trajectories may be overlapped with each other. For example, the result data  700  shows a fault type (FAULT), the setting content of fault conditions (INJECT), time to a lane drift (LD TIME), a yaw rate value increased or decreased by the occurrence of a fault (AYAW), and other parameters. The criteria for determining whether to be hazardous or not are set in advance, and this allows the judgment (JUDGE) whether to pass or fail as well. 
       Second Embodiment 
       [0040]    In the first embodiment, in the flowchart of the control unit, the control unit transmits commands to the simulation control unit so that the fault conditions are determined in each step of executing a simulation, and after the conditions are held, a fault is caused in the subsequent execution step. The embodiment will describe that it is possible to use an element model that causes a fault at preset time instant, not triggered by an external control input (in the following, referred to as a time triggered element fault model). 
         [0041]    In this case, a simulation in normal operation is executed until finish time. At which time instant the conditions are held is analyzed under a plurality of fault conditions. The time instant is set to the time triggered element fault model. Thus, a fault simulation can be again executed. 
         [0042]      FIG. 8  is an exemplary flowchart of the control unit according to the embodiment. Referring to  FIG. 6 , only steps in which processes are changed from ones in the first embodiment are described below. 
         [0043]    In Step  804 , with no sequential execution control over unit steps, the control unit instructs the simulation control unit to execute a simulation until finish time. 
         [0044]    In Step  807 , since a plurality of fault conditions is set, a time instant at which conditions are held is calculated for all the conditions. 
         [0045]    In Step  816 , fault insertion simulation is executed on all the fault conditions. 
         [0046]    Note that, the first embodiment or the second embodiment describes the methods and the systems, which are all off-line simulation-based methods and systems. However, some or all the methods and the systems may be based on a real vehicle. With the combination of a real vehicle and simulation, the influence on vehicle behaviors when a fault occurs can be evaluated in situations much closer to the situations of an actual vehicle. 
         [0047]    Suppose that the influences of target faults on the execution of software of a microcomputer installed on an ECU are in advance evaluated by simulation, for example, the occurrence of faults on the ECU can be simulated by a method in which an input signal to be a trigger to cause a fault on the ECU is connected, and the operation of software can be switched to the operation when a fault occurs based on a change in the signal. In this case, for example, as illustrated in the drawings, hardware or software is installed, which outputs a fault trigger signal based on the positional information from a global positioning system (GPS) and other devices and based on the detected values of driving operation and vehicle behaviors obtained from on-vehicle sensors. Thus, the present invention can also be implemented on a real vehicle and in a real-time simulation environment. 
       REFERENCE SIGNS LIST 
       [0000]    
       
           100  . . . main storage unit 
           101  . . . simulation unit 
           102  . . . steering wheel 
           103  . . . sensor process 
           104  . . . motor process 
           105  . . . steering process 
           106  . . . simulation control unit 
           107  . . . driver process 
           108  . . . ECU process 
           109  . . . vehicle process 
           110  . . . control unit 
           111  . . . analysis unit 
           112  . . . CPU 
           113  . . . external storage device 
           114  . . . travel scenario DB 
           115  . . . fault condition DB 
           116  . . . I/O unit