Overview
HIL testing is the most critical verification step before vehicle integration. By connecting real ECUs to simulated plant models, HIL testing validates ECU behavior under realistic conditions including edge cases impossible to test on real vehicles.
This course covers the complete HIL workflow: from plant model development and signal conditioning through automated test execution and fault injection. You'll work with all major HIL platforms used in the industry.
With extensive hands-on labs, you'll learn to design test benches, create plant models, write automated test cases, and generate test reports compliant with ASPICE and ISO 26262 requirements.
Course Modules
1
HIL Testing Fundamentals
HIL Architecture & ComponentsFREE PREVIEW
40 min read
▸ HIL system overview: Hardware-In-the-Loop = real ECU connected to real-time simulation replacing physical plant (engine, motor, vehicle dynamics); ECU pins connected to HIL I/O board; plant simulation runs in real-time on FPGA+CPU (e.g., dSPACE SCALEXIO DS6001 with FPGA); HIL loop: plant model → simulated sensor signals → ECU → ECU outputs → I/O board → back to plant model; timing: complete loop must execute in ≤ 1 ms (typical); benefits: repeatable, safe fault injection, no physical test vehicle required; usage: integration testing, safety validation, regression testing; HIL vs SIL vs PIL: SIL = software only on PC, PIL = SW on target processor without HW, HIL = real ECU with real I/O; HIL provides highest fidelity short of vehicle testing
▸ Core HIL hardware components: Real-Time Processor (RTP): multi-core x86 or PowerPC running QNX/RTX/RTOS at deterministic 1ms cycle; FPGA subsystem: handles high-speed I/O (PWM generation/measurement, encoder simulation, CAN timestamping) at sub-microsecond accuracy; I/O boards: DS2655 (FPGA analog/digital I/O), DS4340 (motor simulation), DS5203 (FPGA-based CAN/LIN/FlexRay), DS6601 (Ethernet); signal conditioning: ECU receives real analog voltages (5V sensor outputs), not digital values - HIL generates real ±12V/0–5V analog signals via DAC; load simulation: resistive loads simulate actuators (injectors, solenoids) to prevent ECU overcurrent protection triggering; electrical system: 12V/24V supply with programmable power supply for voltage fault injection
▸ System integration & wiring harness: ECU connector (e.g., 150-pin Molex MX150L) connected via wiring harness to HIL I/O board breakout; wiring harness: ECU-specific, maps ECU pin → HIL signal name (e.g., "ECU_TorqueSensor1_AN" → DS2655 CH_AN_01); HIL configuration file: .cdx (ControlDesk) or .xml maps model ports to I/O channels; calibration: ADC/DAC offsets calibrated at bench setup; CAN network: real CAN bus (500 kbps) with Vector VN1610 or DS5203 CAN card; residual bus simulation: additional ECUs simulated by HIL sending CAN messages from DBC model; FlexRay: DS6302 board for FlexRay cycle-accurate simulation; Ethernet: DS6614 for Automotive Ethernet (100BASE-T1) I/O board supporting up to 4 ports
▸ HIL software layers: Host PC: dSPACE ControlDesk (experiment management, parameter tuning, signal monitoring), ECU-TEST (test automation), DOORS (requirements traceability); Real-Time OS (QNX on SCALEXIO): executes compiled Simulink plant model (generated by Simulink Coder + dSPACE Firmware); I/O layer: dSPACE FPGA I/O firmware handles DMA transfers between CPU and FPGA at 1MHz; communication: host PC ↔ RTP via Gigabit Ethernet (DSAPI, ModelDesk); data acquisition: time-stamped at 1 MHz; HIL system variants: component HIL (single ECU), network HIL (multiple ECUs + real bus), full-vehicle HIL (all ECUs + full network); NI VeriStand alternative: NI PXIe-8840 RTP + NI PXIe-6674T sync + NI-XNET CAN card + LabVIEW Real-Time system deployment
Real-Time Simulation ConceptsFREE PREVIEW
45 min read
▸ Real-time constraints: plant model must execute in fixed time step (e.g., 1 ms); if model takes 1.2 ms → overrun → test invalid; base sample time: minimum step size determined by fastest dynamics (motor electrical = 10 μs, vehicle dynamics = 1 ms); SCALEXIO max FPGA rate: 10 MHz (100 ns step), CPU rate: 1 MHz (1 μs step); multi-rate simulation: fast rate (FPGA, 10 μs) for PWM measurement, slow rate (CPU, 1 ms) for vehicle dynamics; rate transition blocks in Simulink for inter-rate data passing; determinism: QNX RTOS guarantees task deadline; interrupt latency < 10 μs; jitter: clock jitter < 1 μs (SCALEXIO uses hardware sync via IEEE 1588 PTP or IRIG-B for multi-box sync)
▸ Solver settings for HIL: Simulink solver: Fixed-step, Runge-Kutta 4 (ode4) or Euler (ode1) for HIL deployment; ode4 (4th order RK): better accuracy for stiff systems; ode1 (Euler): fastest, sufficient for slow plant dynamics; step size: 1e-4 s (100 μs) for powertrain, 1e-3 s (1 ms) for vehicle dynamics; algebraic loops: prohibited in HIL models → cause solver hang; detect with Simulink Diagnostics → Error on algebraic loop; stiff dynamics: battery model with RC time constant 10 μs at 1 ms step → aliasing; solution: operator splitting - fast state solved on FPGA, slow state on CPU; code generation: Simulink Coder (ert.tlc target) → C code; dSPACE DS_RTIMP.tlc custom template for SCALEXIO deployment
▸ Time synchronization in multi-ECU HIL: multi-ECU HIL: multiple ECU-TEST instances + one SCALEXIO; sync: SCALEXIO provides master clock via hardware trigger; ECU test execution synchronized to 1ms tick; CAN timestamps: SCALEXIO CAN card timestamps CAN frames with 1 μs resolution; Simulink data acquisition: MDF4 format (ASAM MDF), channels logged at base sample rate; data overrun monitoring: SCALEXIO DIAG_PROC monitors execution time; overrun count accessible via ControlDesk signal MDLREF_EXEC_OVERRUN; action on overrun: fail test, write event log entry; time base: internal oscillator accuracy ±5 ppm; GPS sync (optional): NovAtel GPS → IRIG-B → SCALEXIO sync card (DS6401) for absolute time reference
▸ FPGA-based real-time processing: dSPACE SCALEXIO FPGA (Xilinx Kintex-7): executes bit-accurate models at 100 MHz; FPGA models: PWM capture (duty cycle, frequency measurement to 1 μs accuracy), encoder simulation (quadrature A/B/Z at up to 10 MHz), ADC signal generation (14-bit DAC at 1 MHz update), resolver simulation; Simulink FPGA Coder (MATLAB HDL Coder + dSPACE XSG library): generates VHDL from Simulink → synthesized to FPGA bitstream; FPGA latency: < 100 ns from input sample to output update; CPU↔FPGA interface: BRAM (block RAM) shared memory, DMA transfer 1 Gbit/s; NI FlexRIO (NI PXIe-7961R): alternative FPGA platform with LabVIEW FPGA programming; FPGA critical for: encoder simulation (requires <1 μs timing), back-EMF simulation for motor ECU testing, high-frequency CAN timestamp
Signal Conditioning & I/O Boards
50 min read
▸ I/O board types & signal ranges: Analog Output (DAC): dSPACE DS2655 - 32 channels, ±10V, 16-bit resolution (0.3 mV), update rate 1 MHz; used to simulate: torque sensor voltage (0.5–4.5V), throttle position sensor (0–5V), temperature sensor NTC equivalent voltage; Analog Input (ADC): same board - reads ECU analog outputs (e.g., PWM filtered to analog); Digital I/O: DS2655 - 32 DI/DO, 0–5V/0–12V; PWM measurement: FPGA board DS5203 - measures PWM duty cycle/frequency up to 1 MHz, 1 μs resolution; used for: injector control signal, motor PWM command; Encoder simulation: DS4340 - generates quadrature A/B/Z signals at up to 10 MHz; used for: BLDC motor position feedback
▸ Signal conditioning circuits: ECU expects real-world signals; signal conditioning: voltage divider (5V DAC → 0–1V Hall sensor), op-amp buffer (low-impedance output), differential pair (LVDT/resolver simulation); load simulation: ECU injector pin (solenoid 8Ω) → HIL dummy load resistor 8Ω 5W + current sense; SIB (Simulation Interface Board): dSPACE SIB - 192 channels, each switchable to Open/GND/VBAT/specific voltage; Pickering PXI SIB, Vector VT7010; fault injection relay matrix: activate fault by switching channel via ECU-TEST command
▸ I/O assignment & HIL configuration: dSPACE ControlDesk: .cdx project file maps model variables to I/O channels; example: model signal "TorqueSensor1_V" → DS2655 AO_Channel_1 (0–5V, gain=1.0, offset=0.0); calibration: at startup, output 0V, 2.5V, 5V → measure ECU ADC reading → compute offset/gain correction; DS2655 Python API: scalexio.set_analog_output("AO_01", 2.5); scalexio.get_analog_input("AI_01"); .cdx channel mapping: SignalName="TorqueSensor1_V", IOBoard="DS2655_1", Channel="AO_01", Range="±10V", Resolution="16bit"; review: I/O assignment sheet reviewed and signed by HIL engineer before ECU power-up
▸ Power supply & protection: programmable power supply: Regatron TC.GSS (0–20V, 0–100A) for VBAT simulation; profile: battery discharge curve or fixed 13.8V; voltage fault injection: ramp to 6V (undervoltage), 18V (overvoltage), 24V (load dump); ECU reverse polarity protection: SIB relay switches polarity for test; fusing: SIB provides per-channel 5A/10A fuses to protect ECU; ADAS ECU power: 48V supply for mild hybrid; current measurement: shunt + differential ADC on SIB; safety interlock: hardware E-stop disconnects VBAT if ECU draws >20A (protection relay); all power signals logged via ControlDesk for post-test analysis
Bus Simulation (CAN, LIN, Ethernet)
45 min read
▸ CAN residual bus simulation: ECU connected to real CAN bus (500 kbps); other ECUs simulated by HIL; DBC file loaded into CANdb++ / CAPL / ECU-TEST; HIL sends periodic CAN messages: e.g., 0x200 "VehicleSpeed" @ 10 ms, 0x300 "BrakePressure" @ 20 ms; CAPL script in CANoe: on start { setTimer(timerVehSpeed, 10); } on timer timerVehSpeed { msg.VehicleSpeed = 80.0; output(msg); setTimer(timerVehSpeed, 10); }; dSPACE SCALEXIO DS5203 CAN card: RTCAN interface in Simulink model; bus load simulation: 500 kbps, 64 messages/cycle = ~70% bus load; error frame injection: DS5203 FPGA generates dominant bit error frames; CAN-FD support: dSPACE DS6604 for CAN-FD at 5 Mbit/s data phase
▸ LIN bus simulation: LIN master/slave simulation: DS5203 LIN channel or Vector VN1630A; LBF (LIN Description File) loaded → HIL knows frame IDs, checksum types, response schedules; ECU as LIN slave: HIL provides master schedule (frame 0x2A @ 20 ms); unconditional frames, event-triggered frames, sporadic frames; slave response simulation: HIL generates slave response with calculated checksum (enhanced checksum = CRC over PID + data); LIN fault injection: no response (slave absent), wrong checksum, wrong length; ControlDesk: monitor LIN bus load, frame error count; AUTOSAR LIN: LINIF_RX_INDICATION callback verified via HIL response timing measurement
▸ Ethernet residual bus simulation: dSPACE DS6614 100BASE-T1 automotive Ethernet board (4 ports); SOME/IP message simulation: vsomeip on SCALEXIO (Linux RT partition) offers services to DUT; SOME/IP SD: OfferService for service 0x1234; ECU subscribes via FindService; HIL verifies ECU sends correct Subscribe request; DoIP simulation: HIL acts as DoIP gateway; sends Vehicle Announcement (0x0001) to ECU; ECU responds with routing activation; automated test: ECU-TEST DoIP library sends 0x10 0x02 DiagnosticSessionControl and verifies positive response; Ethernet capture: pcap recording on SCALEXIO or tap via Wireshark mirror port; gPTP synchronization: HIL acts as grandmaster (DS6614 gPTP master), ECU synchronizes within ±1 μs; verify gPTP offset via SOME/IP SD timing
▸ Residual bus simulation configuration: Vector CANoe .cfg file: defines virtual ECUs (PE nodes), DBC/LDF/ARXML references; CANoe as HIL gateway: CAPL scripts handle signal manipulation; ECU-TEST integration: ECU-TEST signals bus simulation start via Python API; dSPACE ConfigurationDesk: .cdf project with bus configuration, signal definitions; AUTOSAR COM signal simulation: ECU-TEST sets AUTOSAR signal value via XCP: xcp_connection.writeValue("COM_VehicleSpeed", 80.0); UDS simulation: CANoe DiagnosticConsole sends diagnostic requests to DUT (ECU); response validation: ECU-TEST checks response payload within 200 ms; bus monitoring: all raw bus traffic logged to MDF4 format for post-test signal analysis
Hands-On: HIL Bench Setup
55 min read
▸ ConfigurationDesk project setup: create .cdf file, add DS6001 chassis (IP 192.168.140.10), assign DS2655 I/O board to slot 2 (32 DAC + 32 ADC channels), DS5203 FPGA to slot 3 (CAN-FD + PWM), DS4340 motor simulation to slot 4; map Simulink signals to physical pins (ThrottleAngle → DS2655_Slot2_DAC_Ch1 ±10V); generate .sdf real-time application via Ctrl+B
▸ Wiring harness & signal connections: ECU connector pinout mapped to DS2655 channels; analog inputs: throttle position 0-5V → DS2655 ADC Ch1 (scale 0-5V → 0-90°); DS4340 encoder A/B/Z (5V TTL, 48 pulses/rev) via differential receiver; power supply VBAT 12V/VIGN 12V switched via SIB relay ch1; Regatron TC.P power supply for VBAT profile during cranking (8V dip, 14V charge)
▸ ControlDesk setup: create CDX project; add Numeric Display instruments for EngineRPM, MAP, ThrottleAngle; add 2D-Plotter (64 signals @ 100Hz); connect to DS6001 (Ethernet); load .sdf application; configure CANoe residual bus gateway (DBC import, CAPL node for missing ECUs); XCP calibration: load A2L file → map calibration parameters to ControlDesk variables
▸ Validation checklist: SIB relay continuity (DMM pin-to-DS2655, target <0.5Ω); CAN loopback test (CAPL loopback node verifies message round-trip <1ms); DS2655 DAC accuracy (0V/±5V/±10V vs Fluke 87V, target ±10mV); DS5203 PWM capture resolution (1μs via 100MHz FPGA clock); cycle time overrun counter = 0 after 60s run; ECU NvM read-back after power cycle confirms clean startup
2
Plant Model Development
Physical Plant Modeling Concepts
50 min read
▸ ODE state-space representation: ẋ = f(x,u), y = g(x,u); step size selection: 1ms for mechanical systems, 100μs for electrical; stiffness: engine combustion (fast) + vehicle dynamics (slow) → use ode14x or ode23tb; causality: power flow direction determines implicit/explicit equations; HIL constraint: no variable-step solvers (QNX real-time OS requires fixed-step)
▸ Model fidelity levels: low-fidelity (lookup table: throttle_opening→torque, ±5% accuracy, runs at 1ms easily); medium-fidelity (2nd-order transfer function, validated against dyno data, ±2% error); high-fidelity (Simscape/Modelica physics-based, <1% error but may require 100μs step); HIL tradeoff: medium fidelity at 1ms → sufficient for ECU closed-loop validation without overruns
▸ Model interface requirements: dSPACE RTI blocks: DS_SCALEXIO_Analog_In/Out, DS_SCALEXIO_CAN_Tx/Rx; I/O latency budget: 100μs DAC update + 100μs ADC sample = 200μs total; model must complete within 1ms cycle budget; Simulink execution profiling: DSP_ExecutionTime block; timing analysis: ControlDesk → DS6001 Monitor → Task Duration histogram (max vs period)
▸ Model validation methodology: open-loop comparison: run same input stimulus in HIL plant vs GT-Power/AVL CRUISE reference; KPIs: max error <5%, RMSE <2% at 10 operating points; MIL vs SIL vs HIL correlation: Simulink scope vs ControlDesk plotter; model audit: sample time consistency (Ctrl+D), no algebraic loops (red highlights), direct feedthrough audit; accepted model libraries: Powertrain Blockset, Vehicle Dynamics Blockset
Simulink Plant Models for HIL
55 min read
▸ Simulink model architecture: top-level subsystems: Environment (plant) + Controller Interface; solver: ode4 (Runge-Kutta) fixed-step 1ms; Simulink Coder ERT target; RTI SCALEXIO library blocks: RTI_SCALEXIO_Analog_Out (DS2655 slot 2, ch 1-4), RTI_SCALEXIO_CAN_Tx (DS5203 slot 3 CAN1); sample times: plant 1ms, I/O interrupt-driven; SCALEXIO build: Ctrl+B → .sdf application file
▸ RTI block configuration: RTI_SCALEXIO_Analog_Out parameters: Slot=2, Channel=1, OutputRange=±10V, SampleTime=0.001; RTI_SCALEXIO_CAN_Tx: Slot=3, Channel=CAN1, MsgID=0x100, DLC=8, Period=0.01s; RTI_SCALEXIO_PWM_Capture: Slot=3, Channel=1, Resolution=100MHz (10ns); signal naming convention in ConfigurationDesk must match Simulink signal labels exactly
▸ Signal conditioning in model: scale DAC output: ThrottleVoltage = ThrottleAngle_deg * 5.0/90.0; saturation block: min=0.0, max=5.0 V; sensor noise addition: Band-Limited White Noise (Seed=0, Power=1e-6, SampleTime=0.001); engine speed PWM generation: Freq_Hz = EngineRPM/60 * PulsesPerRev; DS5203 PWM generation block: frequency_Hz input, duty_cycle=0.5; resolver simulation: DS4340 SinCos output at 2kHz carrier
▸ Build, download & troubleshoot: MATLAB command: rtwbuild('hil_engine_model') → generates .sdf; ControlDesk: Applications → Download → select .sdf → Start; check overruns: ControlDesk → Status → MaxDuration vs Period; algebraic loop fix: insert Unit Delay block; rate transition mismatch: add Rate Transition block; common error: "RTI block not found" → verify RTI SCALEXIO toolbox license; execution profile: 1ms budget target ≤800μs actual
Electric Motor & Battery Simulation
45 min read
▸ PMSM motor model (d-q axis): vd = Rs*id + Ld*did/dt − ωe*Lq*iq; vq = Rs*iq + Lq*diq/dt + ωe*(Ld*id + λf); torque: Te = 1.5*P*(λf*iq + (Ld−Lq)*id*iq); parameters: Rs=0.1Ω, Ld=0.5mH, Lq=0.8mH, λf=0.08Wb, P=4 pole pairs; 100μs Simulink subsystem (faster than plant 1ms); DS5203 captures 6 IGBT gate signals → reconstructs phase voltages; DS2655 injects back-EMF via 3 analog outputs (3-phase ±10V)
▸ Battery Thevenin equivalent circuit: OCV(SOC) lookup table from HPPC test data + R0 (5mΩ) + R1||C1 (10mΩ||1000F); SOC integration: SOC(t) = SOC(0) − ∫(Ibat/Qnom)dt; Qnom=100Ah; temperature effect: R0 *= (1+α*(T−25)); α=0.002/°C; HIL provides cell voltages to BMS ECU via 12ch DS2655 analog outputs (each cell group: 3.0-4.2V); BMS CAN: 0x350 "CellVoltage" @ 100ms validated against plant output
▸ 3-phase inverter simulation: SVM (Space Vector Modulation) at 10kHz PWM; DC link: 400V (EV) or 48V (mild hybrid); DS5203 PWM capture: 6 channels at 100MHz (10ns resolution) captures gate drive signals from motor controller ECU; HIL reconstructs phase currents from PWM pattern; back-EMF injection: 3-phase sinusoidal via DS2655 DAC at motor frequency; DC link voltage monitored via DS2655 ADC Ch1 (400V via voltage divider 80:1)
▸ EV powertrain HIL validation: test ECU torque request vs motor response (CAN 0x3A0 "MotorTorque" @ 5ms, tolerance ±2%); fault injection: DS2655 DAC clamp → simulate resolver failure → verify P0500 DTC stored; thermal runaway test: force cell temp >60°C via HIL thermal model → verify BMS contactors open; SoC boundary: force SoC→0% → ECU enters power-limit mode; regen braking: negative torque request validated via plant energy balance
Vehicle Dynamics Models
40 min read
▸ Single-track (bicycle) model: states: lateral velocity vy, yaw rate r; equations: m*(dvy/dt + vx*r) = Fyf + Fyr; Iz*dr/dt = a*Fyf − b*Fyr; tyre forces: Fyf = Cf*(δ − β − a*r/vx); β = vy/vx; parameters: m=1500kg, Iz=2500 kg·m², Cf=60000 N/rad, Cr=70000 N/rad; a=1.2m (CG to front axle), b=1.4m; sample time 1ms; validated against Carsim reference at ±2% lateral acceleration
▸ Pacejka Magic Formula tyre model: Fy = D*sin(C*arctan(B*α − E*(B*α − arctan(B*α)))); parameters: B=8, C=1.3, D=μ*Fz, E=−0.5; slip angle α from velocity states; longitudinal slip ratio: κ = (ωw*Reff − vx)/vx; combined slip: AMB model; validated against MF-Tyre 6.1 dataset; HIL runtime: 1ms budget: Magic Formula lookup table (pre-computed 100×100 grid) vs real-time polynomial (faster)
▸ Sensor models for ADAS/ESC HIL: yaw rate sensor: r_meas = r + N(0, 0.02 rad/s) + offset(0.005 rad/s); wheel speed sensor: WSS_FL = ωFL * Reff / circumference [pulses/s] → DS4340 generates TTL pulses at 48 pulses/rev; longitudinal acceleration: ax_meas = ax + 9.81*sin(θ_road) + N(0, 0.05 m/s²); CAN signals: 0x155 "YawRate" @ 10ms, 0x1A0 "WheelSpeeds" @ 10ms, 0x1B0 "LateralAcc" @ 10ms
▸ ESC/ABS validation on HIL: test scenario: sine-sweep steering input 0.1 Hz, amplitude 90°; HIL logs yaw rate vs ECU yaw estimate (RMSE < 2%); ABS test: braking from 100 km/h → HIL plant computes slip ratio → ABS ECU modulates brake pressure via solenoid valve simulation (DS2655 current output); ESC intervention test: double lane change → yaw rate deviation > threshold → ESC activates; lateral acceleration validation: DS2655 ADC captures ECU accelerometer vs plant model
Sensor & Actuator Modeling
45 min read
▸ Resistive & voltage sensor simulation: NTC thermistor: V_out = Vcc * RNTC(T)/(RNTC(T)+R_ref); RNTC(T) = R25*exp(B*(1/T−1/298)); B=3950K, R25=10kΩ; DS2655 DAC outputs V_out (0-5V 16-bit); MAP sensor: V_out = 0.5 + 4.0*(P_kPa−10)/290; O2 narrowband: switching 0.1V lean/0.9V rich; wideband: Nernst voltage 0.5-4.5V → ETAS ES652.2 lambda amplifier simulation; all channels calibrated vs reference Fluke 87V DMM
▸ Actuator measurement on HIL: fuel injector PWM: DS5203 PWM capture ch1 (pulse width 1-15ms @ 100Hz, resolution 10ns); throttle servo: DS2655 DAC drives throttle motor simulation + DS2655 ADC reads TPS feedback voltage; VVT solenoid: DS5203 PWM capture duty cycle (0-100%); knock sensor: DS5203 AWG generates 5-15kHz sinusoidal burst (simulated engine knock); IGBT gate drive: DS5203 50ns resolution captures switching events
▸ HIL actuator load simulation: DC motor back-EMF: DS4340 provides encoder pulses + DS2655 DAC injects back-EMF voltage; solenoid load: R+L circuit simulation (L=10mH, R=5Ω → DS2655 injects current feedback via precision current source); linear actuator LVDT: DS2655 ratiometric 3-wire output (Vex, Va, Vb); fault simulation: OC = DS2655 Hi-Z relay; SC_GND = DS2655 0V; SC_VBAT = DS2655 14V output; SIB relay switches all modes in <1ms
▸ Calibration & accuracy verification: reference instrument: NI DAQ USB-6289 (18-bit ±10V); calibration procedure: DS2655 DAC command → NI DAQ measure → compute gain/offset error; correction in Simulink: V_corr = (V_cmd − offset)/gain; accuracy target: ±20mV for 0-5V sensors; temperature drift: 50ppm/°C → compensation lookup table in ControlDesk; calibration record stored in CMDB with next-due date; sensor simulation accuracy verified at 3 temperature points (−40°C, 25°C, 85°C using temperature chamber)
Hands-On: Engine Plant Model
60 min read
▸ Build 4-cylinder SI engine plant model: subsystems: Throttle Body (Cd*Av(θ)*√(P_manifold)), Intake Manifold (dP/dt = RT/V*(ṁin−ṁout)), Combustion (Torque = BMEP*Vd/4π), Crankshaft (dω/dt=(Te−Tload)/J); 6 states: MAP, MAF, RPM, 4 cylinder pressures; Simulink: ode4 fixed-step 1ms; add Powertrain Blockset SI Engine block as reference for parameter tuning
▸ Calibration with dyno data: load GT-Power reference CSV (RPM vs torque at WOT, 10 operating points); create volumetric efficiency lookup table VE_lut(RPM, MAP) 16×16; tune Cd coefficient until ṁair matches Bosch HFM5 MAF sensor data; RMSE target <3%; ControlDesk: online-tunable calibration variable P_VE_table; INCA XCP calibration: inca.setValue("VE_Table", ve_data) during HIL run to optimize in real time
▸ RTI code generation & download: add RTI_SCALEXIO blocks: Analog_In ch1 (throttle angle 0-5V → 0-90°), Analog_Out ch1 (MAP sensor voltage 1-5V), CAN_Tx slot3-CAN1 (0x100 "EngineStatus" @ 10ms DLC=8: RPM[15:0], MAP[23:8], ThrottlePos[31:24]); MATLAB rtwbuild('hil_engine_model') → .sdf; ControlDesk download → start; RPM plotter tracks throttle input with <50ms lag
▸ Validation & fault injection: MAP sensor open circuit: DS2655 ch2 Hi-Z → ECU enters limp mode → CAN 0x100 EngineMode=0x03 (LIMP) within 500ms; injector PW capture on DS5203 ch1: WOT=12ms ±0.5ms; knock advance test: DS5203 AWG generates 7kHz burst → ECU retards ignition timing 3°CA → verify CAN 0x1A0 IgnitionAdvance; pitfalls: engine stall at startup → initialize states MAP=101kPa RPM=0 via ControlDesk init script; overrun if VE table size >32×32
3
HIL Platforms & Configuration
dSPACE SCALEXIO Platform
55 min read
▸ SCALEXIO hardware: DS6001 Processing Unit (Intel Core i7, QNX 7.1 RTOS, 16GB RAM, PCIe IOCNET backplane 48Gbps); DS2655 IOCNET I/O board (32 DAC ±10V 16-bit 1MHz, 32 ADC ±10V 16-bit 1MHz, 8 PWM capture); DS5203 FPGA (Xilinx Kintex-7, 2x CAN-FD at 5Mbps data phase, 2x LIN, 32 PWM channels, 100MHz clock); DS4340 motor simulation (4ch encoder A/B/Z at 10MHz, resolver at 2-16kHz); DS6614 automotive Ethernet (4x 100BASE-T1, gPTP grandmaster)
▸ ConfigurationDesk workflow: .cdf project file; Step 1: Add DS6001 chassis → IP 192.168.140.10; Step 2: Add I/O boards (DS2655 slot 2, DS5203 slot 3, DS4340 slot 4); Step 3: Map signals: Simulink signal "ThrottleAngle" → DS2655_Slot2_DAC_Ch1 (range ±10V); Step 4: CAN config: DS5203_CAN1 → 500kbps, CAN2 → CAN-FD 2Mbps nominal/5Mbps data; Step 5: Generate .sdf real-time application; Step 6: ControlDesk download & start
▸ QNX task scheduler: 3 tasks on DS6001: 1ms model task (priority 50), 100μs I/O task (priority 60), background (priority 10); timing analysis: ControlDesk → DS6001 Monitor → Max Duration, Task Overruns, Jitter histogram; PCIe IOCNET latency: DS2655 I/O round-trip 100μs; synchronization: IRIG-B (time code) or IEEE 1588 PTP for multi-chassis HIL; DS6001 as PTP sync master → DS4340 slave jitter <1μs
▸ ControlDesk operation & automation: CDX project; instruments: Numeric Display (real-time @ 100Hz), 2D-Plotter (64 signals), 3D Animator; Calibration: CAL/MAP variable access (compatible with INCA A2L); data acquisition: MEAS files (MDF4 format, 500Hz); Python automation: dSPACE REST API (dspace.com/rest/api); IronPython ControlDesk scripting: Application.Start(), Measurement.Start(), Variables["EngineRPM"].Value; Jenkins CI: dSPACE CLI for nightly test runs
ETAS LABCAR Configuration
50 min read
▸ ETAS LABCAR hardware: RTPC (Real-Time PC): NI PXIe-8840 controller (Intel Core i7, RT Linux); LABCAR-NIC (NI PXIe-6674T timing & synchronization); LABCAR-IO analog (NI PXIe-6738: 32ch DAC 16-bit ±10V); LABCAR-IO digital (NI PXIe-6535: 32ch TTL DIO); LABCAR-CAN (NI PXIe-8512: 2ch CAN-FD); LABCAR-AUTOMATION software for Python scripting; ETAS ES922 I/O module for mixed-signal expansion
▸ LABCAR-OPERATOR project setup: Step 1: New project → Add Real-Time Target (PXIe-8840 IP); Step 2: Import Simulink model .slx → LABCAR code generation (NI Linux RT target, ERT + NI SIT toolbox); Step 3: Map I/O: drag signal "ThrottlePos" → NI PXIe-6738 AO Ch0 (0-10V, scale 0-90°); Step 4: CAN config: NI-XNET → DBC import → residual bus simulation CAPL or Python; Step 5: Download & run → LABCAR executes at 1ms fixed-step
▸ LABCAR scripting & stimulation: LABCAR Python API: import labcar; lc = labcar.connect("192.168.1.100"); lc.set_signal("ENV.VehicleSpeed", 80.0); lc.start_measurement(); lc.wait(10.0); data = lc.get_signal("ECU.ThrottlePos"); lc.stop(); LABCAR signal editor: define ramp/sine/step stimulation; LABCAR-REPORTER: automated HTML/PDF test report with verdict PASS/FAIL per measurement
▸ LABCAR vs dSPACE comparison & migration: LABCAR uses standard NI PXI hardware (lower cost, PXIe backplane, broader COTS availability); dSPACE proprietary hardware (better automotive signal fidelity, DS4340 motor sim, DS6614 100BASE-T1); LABCAR: NI-XNET for CAN/LIN (industry standard library); ETAS INCA integration for XCP/CCP calibration; LABCAR supports AUTOSAR ARXML import; migration: LABCAR .lcf project signal map → ConfigurationDesk .cdf (manual re-mapping required)
NI VeriStand Setup
45 min read
▸ VeriStand architecture: System Definition (.nivssdf): target (PXIe-8840 NI Linux RT), models (Simulink .dll via NI SIT), channels, aliases, procedures; NI-XNET CAN/LIN plugin; DAQmx analog I/O plugin (NI PXIe-6738 DAC); VeriStand Engine runs on RT controller at 1ms; workspace (.nivsworkspace): instrument panels, alarms, stimulus profiles; VeriStand Gateway for distributed multi-target HIL via shared memory (NI PXIe-1473)
▸ System Definition configuration: Step 1: Add target PXIe-8840 (IP 192.168.1.5, rate 1ms); Step 2: Add Simulink model .dll (Simulation Target → Generate .dll via NI SIT toolchain); Step 3: Map channels: model outport "EngineTorque" → DAQmx AO1 (±10V, scale 0-500Nm→0-5V); Step 4: XNET CAN → load engine.dbc → map VehicleSpeed signal to model inport; Step 5: Deploy system definition to RT target; Step 6: Open workspace → verify instrument panels
▸ VeriStand Python scripting (NIVS API): import nivs_mlpluginsupport as nivs; ws = nivs.open("engine_test.nivsworkspace"); ws.start(); ws.set_value("Aliases/ThrottleAngle", 45.0); time.sleep(5.0); torque = ws.get_value("Aliases/EngineTorque"); ws.stop(); ASTF (Automated Software Test Framework): .vs3 test script steps: SetChannel, Measure, Compare (tolerance ±2%), Log; ASTF reports: JUnit XML for Jenkins integration
▸ Common NI VeriStand pitfalls & solutions: model rate mismatch: Simulink 1ms ≠ VeriStand 500μs → add Rate Transition block; XNET DBC signal bit order: Intel vs Motorola endianness setting; DAQmx calibration: NI MAX → Self-Calibrate PXIe-6738 (30-minute warmup); alarm configuration: High/Low limit interlocks for VBAT overvoltage; synchronization: PXI-6683H IRIG-B card for multi-target timing (<1μs jitter); VeriStand vs dSPACE: VeriStand better for NI hardware ecosystem, dSPACE better for automotive signal fidelity
Real-Time Code Generation
40 min read
▸ Simulink Coder configuration for HIL: ERT (Embedded Real-Time) system target file ert.tlc; Configuration Parameters: Solver=ode4, FixedStep=0.001, Language=C, Optimize for speed (O2), Inline parameters; dSPACE RTI target: RTISC6x.tlc (DS1006) or RTI_SCALEXIO.tlc; Code Generation Advisor: check target hardware, solver settings, floating-point compliance; generated files: model_step(), model_initialize(), rtwtypes.h (real_T=double, boolean_T=uint8_T)
▸ dSPACE RTI build workflow: add RTI_SCALEXIO_Analog_Out block (Slot=2, Ch=1, Range=±10V); RTI_SCALEXIO_CAN_Tx (Slot=3, CAN1, MsgID=0x100, DLC=8, Period=0.01); MATLAB: cfg=dspaceRTIConfig('SCALEXIO'); cfg.SampleTime=0.001; rtwbuild(bdroot); output: model.sdf (SCALEXIO application), model.cdx (ControlDesk project); build time ~2min; download via ControlDesk: Applications → Download → .sdf → Start
▸ Avoiding execution overruns: profiling: ControlDesk → DS6001 Monitor → Task Duration histogram (target ≤800μs/1ms); avoid dynamic memory (malloc/free), avoid printf/blocking OS calls; replace trigonometric functions with CORDIC or polynomial approximations; pre-compute lookup tables offline; split model: 1ms slow task (plant states) + 100μs fast task (I/O update); measure: DS6001 baseline overhead ~50μs; common overrun cause: too many RTI I/O blocks (each adds ~10μs)
▸ NI VeriStand code generation: Simulink → Simulation Target → Generate S-function; NI SIT (Simulation Interface Toolkit) toolchain: produces model.dll + model_ni.h; VeriStand imports .dll → maps model inports/outports to channels; requirements: no global state outside model structure, no C++ exceptions, no blocking calls; verify on Windows Simulation first, then deploy to PXIe RT Linux; NI SIT compile command: NIVeriStand_ModelInterface generate model.slx → model_verifytarget.dll
Hands-On: Multi-ECU HIL Configuration
65 min read
▸ Multi-ECU HIL scenario setup: 3 ECUs: Engine Control Module (ECM), Transmission Control Module (TCM), Body Control Module (BCM); SCALEXIO DS6001 + 2x DS5203 (4 CAN channels total); DS5203_1 CAN1 → Powertrain CAN 500kbps (ECM+TCM); DS5203_1 CAN2 → Chassis CAN 500kbps (ABS/ESC residual); DS5203_2 CAN1 → Body CAN 125kbps (BCM); DBC files: powertrain.dbc, chassis.dbc, body.dbc loaded in ConfigurationDesk
▸ ConfigurationDesk multi-bus residual bus: CAPL residual bus script per network: simulate missing ECUs; shared signal routing: ECM→TCM via CAN 0x280 "EngineTorque_Actual" @ 10ms; HIL gateway CAPL: on message EngineTorque_Actual { forwardTo(CAN_TCM_CHANNEL, thisMessage); }; SIB relay sequence: BCM VIGN → 0ms, ECM VIGN → 100ms, TCM VIGN → 200ms (startup order per harness spec); verify ECU boot messages on ControlDesk CAN monitor
▸ Simulink multi-rate plant model: ECM plant 1ms, BCM plant 10ms; shared state variables via Simulink Data Store Memory; Simulink Rate Transition blocks between 1ms and 10ms subsystems; single .sdf with QNX multi-task scheduling; ControlDesk: separate instrument panels per ECU (ECM_panel.cdx, BCM_panel.cdx); INCA multi-ECU DAQ: 3 A2L files loaded simultaneously for concurrent calibration from ECM+TCM+BCM
▸ Integration test & pitfalls: synchronization test: ECM→TCM CAN message latency ≤2ms (measure CAN jitter via DS5203 timestamp); CAN ID collision: check all 3 DBC files for duplicate message IDs in CANdb++ merge; bus load >80%: reduce BCM message rates from 20ms to 50ms for non-critical signals; ECU watchdog reset: verify residual bus provides all required messages within ECU timeout window; startup DTC check: after HIL cold start, confirm 0 active DTCs on all 3 ECUs via UDS SID 0x19
4
Test Automation & Fault Injection
Automated Test Frameworks (ECU-TEST, TPT)
55 min read
▸ ECU-TEST architecture: test bench: ECU-TEST + CANoe + INCA + ControlDesk; project structure: .pkg (project), .tsp (test spec), .tcf (test config), .prj (package browser); tool connections defined in bench config: CANoe=socket://localhost:22001, INCA=tcp://192.168.0.10, ControlDesk=localhost; ECU-TEST Python API: etapi.setSignal("CAN.VehicleSpeed", 80.0); etapi.waitForSignal("ECU.EngineMode", "RUNNING", timeout=5.0); verdict: PASS/FAIL/ERROR/BLOCKED
▸ TPT (Time Partition Testing): test case as signal/time diagram; assessments: SignalAssessment with tolerance bands; TPT TestAutomation: platform-independent execution (dSPACE, NI, ETAS); TPT2ECU-TEST import: .tpt project → .tsp ECU-TEST package; TPT signal generation: step, ramp, sinus, random noise; TPT replay: import measured MDF4 signal → play back to HIL as stimulus; regression comparison: MDF4 baseline vs current run → automatic verdict
▸ Test case structure in ECU-TEST: steps: @Action Signal.set("ThrottleAngle", 45.0); @Wait 2000ms; @Check CAN.EngineRPM in [1500, 2000]; @Requirement("SysRS_042") tag; preconditions: ECU in NORMAL_OPERATION state; cleanup: reset all signals to default values; parallel actions: Signal.setParallel(["Signal1", "Signal2"], [val1, val2]); error handling: try/catch with fallback state reset; test step timeout: 10s default configurable per step
▸ CI/CD pipeline integration: Jenkins: stage("HIL Test") { sh "ecutest.exe -s bench1.cfg -p engine_tests.pkg -r results/junit.xml" }; ECU-TEST CLI parameters: -s (bench config), -p (package), -r (report dir), --debug; Jenkins plugins: JUnit test result publisher, HTML publisher for ECU-TEST HTML report; Allure plugin for trend charts (pass rate over 30 builds); Jenkins Lockable Resources: mutex per HIL bench; nightly trigger: cron("H 22 * * 1-5"); Teams/Slack notification on first failure
Test Case Design for HIL
45 min read
▸ HIL test case taxonomy: black-box functional (ECU I/O behavior without internal state knowledge); grey-box (state machine transitions validated via CAN); boundary value analysis (sensor min/max: MAP 10kPa/300kPa, throttle 0°/90°); error guessing (known ECU bugs from field DTC data); equivalence partitioning (engine load 0-20% / 20-60% / 60-100%); ISO 26262 Part 4: 100% requirement-based coverage mandatory for ASIL-B+ functions
▸ Test case specification elements: ID (TC_EMS_042), title ("Engine Overspeed Protection"), preconditions (ECU_State=RUNNING, EngineRPM>2000), test data (RPM ramp rate 100 rpm/s), steps (Set HIL.EngineRPM > 6500 rpm), expected result (CAN 0x100 EngineMode=LIMP within 100ms), tolerance (±10ms timing), ASIL level (ASIL-B); tools: ECU-TEST Test Specification Editor, TPT test case diagram; review: 2-engineer independent review per ASPICE SWE.6
▸ Requirement-to-test traceability: tool chain: IBM DOORS (system requirements) → ECU-TEST (test cases) → Polarion ALM (traceability); DOORS module link: SysRS_042 → HIL_TS_042 (test spec) → HIL_TC_042_001 through _005; @Requirement("SysRS_042") tag in ECU-TEST step; ECU-TEST report Requirements tab: pass/fail per requirement; Polarion REST API import: curl -X POST http://polarion/import -d @coverage.xml; gate: 100% coverage before delivery
▸ Parametric test cases & coverage analysis: ECU-TEST Parameter Set (.pst) CSV: test_speed, test_load, expected_response; test step reads @Parameter test_speed; repeat across all rows; TPT variation tree: parameter combinations; regression suite: 500 parameter combinations overnight; coverage gap: requirement without test case → DOORS report filter "no linked TC"; structural coverage metrics: branch coverage 100% for ASIL-C/D (VectorCAST), MC/DC 100% for ASIL-D; ECU-TEST Coverage Analyzer plugin for HIL branch coverage
Fault Injection Techniques (Pin, Bus, Model)
50 min read
▸ Pin-level fault injection: dSPACE SIB (Signal Interface Box) relay matrix - 192 programmable relays; fault types: OC (relay open → pin floating → Hi-Z), SC_GND (relay connects pin to chassis ground 0V), SC_VBAT (relay connects to VBAT 12V/14V), SC_SIGNAL (relay shorts two ECU pins); relay switching time <1ms; ControlDesk SIB script: SIB.setRelay(channel=5, state=GND); Vector VT7010 fault injection module as alternative; ISO 26262-6 Table D.4 fault injection evidence
▸ Bus-level fault injection: CAN error injection: DS5203 FPGA generates dominant error frame at specified bit position; corrupt CRC field (last 15 bits); truncate DLC; inject at specific CAN ID 0x200; Vector VN8900 CAN disturbance: CAPL: triggerDisturbance(CAN_CHANNEL_1, ERR_FRAME, 0x200, bit_pos=47); CAN-FD bit rate switching fault: inject during data phase to trigger form error; LIN: simulate missing slave response (no pullup on LIN bus); Ethernet: Linux tc qdisc netem: tc qdisc add dev eth0 root netem delay 200ms loss 10% reorder 5%
▸ Model-level fault injection: Simulink fault injection subsystem: Manual Switch + Step signal → inject bias/gain fault into plant model; example: MAP sensor drift: MAP_fault = MAP_true + FaultMagnitude * FaultActive; FaultActive=1 controlled from ControlDesk at runtime; AUTOSAR DEM test: inject fault → verify DTC storage via UDS SID 0x19 0x02 (ReadDTCByStatusMask=0x09); observer-based fault detection KPI: ECU diagnostic coverage verified by fault injection results documented in FMEDA
▸ Fault injection automation in ECU-TEST: ECU-TEST Fault Injection plugin: @Action FI.inject("MAP_Sensor_Open", timing=500ms, duration=2000ms); @Check DTC.P0100 == STORED within 3000ms; @Check ECU.EngineMode == LIMP; fault catalog XML: FaultID, TargetSignal, FaultType, Magnitude, Timing; test matrix: each sensor failure mode × 3 operating points = 60 test cases; ISO 26262 Part 5 Annex D: fault injection confirms DC (diagnostic coverage) values used in SPFM/LFM calculations; pitfall: ECU recovery faster than test window → extend @Wait before assertion
Failure Simulation & Diagnostics Validation
45 min read
▸ AUTOSAR Dem diagnostic lifecycle: DTC states: TEST_FAILED → PENDING_DTC → CONFIRMED_DTC → AGED_DTC → CLEARED; debounce algorithm: counter-based (threshold=3 consecutive failures) or time-based; event memory: 20 primary DTCs + 40 secondary per OEM spec; OBD-II readiness monitors: Catalyst, EGR, O2 sensor, Evap; UDS read DTCs: SID 0x19 0x02 statusMask=0x09 (confirmed + pending); DTC clear: SID 0x14 0xFF 0xFF 0xFF
▸ HIL-based OBD readiness drive cycle testing: ECU-TEST OBD library: obd.clearAllDTCs(); obd.runDriveCycle("FTP75"); obd.checkReadinessFlags(expected=0x0000); FTP75 cycle: HIL plays speed trace via CAN 0x1A0 "WheelSpeeds" (1870 seconds, 0-90 km/h); catalyst monitor: O2 sensor switch count ≥8 at λ=0.98±0.02 (wideband signal from DS2655 DAC); readiness flag validation: all 8 monitors complete = PASS; ECU log: MDF4 file with λ trace + upstream/downstream O2 voltages
▸ Sensor failure validation test matrix: 5 sensors × 4 failure modes = 20 HIL test cases; failure modes: open circuit (DS2655 Hi-Z), short to GND (DS2655 0V), short to VBAT (DS2655 14V), signal stuck (DS2655 fixed voltage); verification points: DTC stored within debounce time (≤3s); limp mode activated (CAN EngineMode=0x03); CAN warning message broadcast; recovery behavior: fault removed → DTC status PENDING → ECU exits limp after 3 consecutive good-cycle readings; ECU-TEST assertion: etapi.getDTCStatus("P0107") == "CONFIRMED"
▸ Advanced diagnostic validation: ISO 15031-6 Mode $02 freeze frame: verify ECU stores correct snapshot at DTC event (RPM, MAP, VSS, coolant temp); SID 0x2F (I/O control by identifier): HIL validates ECU-controlled actuator override (injector cutoff, fan relay); DTC aging: 40 warm-up cycles without fault → CONFIRMED_DTC → AGED; continuous monitoring: HIL 8-hour endurance test tracking DTC false-positive rate; XCP/INCA: verify DTC debounce threshold calibration values match HARA requirements; DR (Deviation Report) opened for any DTC debounce failure
Hands-On: Automated HIL Test Suite
65 min read
▸ ECU-TEST project structure: packages/engine/ (80 TCs), packages/diagnostics/ (40 TCs), packages/safety/ (30 TCs); bench config: engine_bench.cfg (CANoe=socket://localhost:22001, INCA=tcp://192.168.0.10:1234, ControlDesk=localhost:8080); test data CSVs: speed_load_matrix.csv (10 speed × 5 load points), fault_scenarios.csv (20 fault modes); CI Jenkinsfile in repo root; test execution: ecutest.exe -s engine_bench.cfg -p all_tests.pkg -r results/
▸ Core test case implementation: TC_Engine_Idle: HIL.set("ThrottleAngle", 0°); wait(3s); assert CAN.EngineRPM in [750±50 rpm]; TC_WOT_Power: HIL.set("ThrottleAngle", 90°); wait(2s); assert CAN.EngineRPM > 5500; TC_MAP_Fault: FI.inject("MAP_Open"); wait(3s); assert DTC.P0107 == CONFIRMED; TC_ColdStart: power VBAT 0→12V via SIB relay; assert CAN.EngineMode == RUNNING within 500ms; TC_OverSpeed: ramp RPM to 6600; assert EngineMode == LIMP within 100ms ±10ms
▸ Automated report & CI integration: ECU-TEST report: JUnit XML (results/junit.xml) + HTML (results/html/report.html); Jenkins: post { always { junit 'results/junit.xml'; publishHTML([reportDir:'results/html', reportFiles:'report.html', reportName:'HIL Report']) } }; Allure trend charts: pass rate over last 30 nightly builds; email notification: mailer plugin → send on FAILURE to hil-team@company.com; test time: 120 TCs in 45min on 1 bench; test farm: 3 benches run in parallel via Jenkins matrix job
▸ Debugging failing tests: ECU-TEST error log: "Signal timeout: CAN.EngineRPM not in [700,800] after 5s" → check ControlDesk task overruns; CANoe bus capture: auto-trigger MDF4 recording on FAIL verdict → analyze missing CAN messages; common failures: ECU not in expected state (add precondition Init sequence); CAN bus-off after fault injection (add bus recovery step); tolerance too tight (widen to ±5% based on measurement noise histogram); re-run failing TC: ecutest.exe --testCase TC_Engine_Idle --debug; pitfall: bench config mismatch between local and Jenkins agent
5
Reporting & CI/CD Integration
Test Reporting Standards (ASPICE, ISO 26262)
40 min read
▸ ASPICE SWE.6 test documentation requirements: Test Summary Report (TSR): test strategy, scope, test cases executed, pass/fail counts, requirement coverage %; Test Specification (TS): document ID, version, author, review date, test environment; Test Case (TC): ID, requirement link, preconditions, steps, expected result, actual result, verdict, tester, date; ASPICE BP5: test cases cover all requirements; audit evidence: TS reviewed by QA engineer independent of author
▸ ISO 26262 Part 4 test evidence for HIL: System test report (Part 4 clause 10): test environment description (dSPACE SCALEXIO DS6001 FW 2.6, CANoe 15.0.0, ECU HW revision B SW v1.5); test completeness: 100% safety requirement coverage, 0 open critical anomalies; anomaly list: open issues with severity (S1=Minor, S2=Moderate, S3=Major, S4=Critical); tool qualification: ECU-TEST TQL-2, CANoe TQL-1 per ISO 26262-8 clause 11
▸ Test report structure: Section 1 - Introduction (scope, ECU SW v1.5, HIL SW versions, test campaign dates); Section 2 - Test Environment (HW config, SW config, calibration cert dates for DS2655); Section 3 - Execution Summary (total=250, pass=247, fail=3, blocked=0, coverage=100% safety, 98% functional); Section 4 - Defect List (DR_001 severity S2 open, DR_002 severity S1 closed); Section 5 - Conclusion (certification-ready: Yes/No); Section 6 - Appendix (raw MDF4 data, tool screenshots, traceability matrix)
▸ Reporting tool integration: Polarion ALM: test cases linked to system requirements; execution results imported from ECU-TEST JUnit XML via Polarion Importer plugin; auto-create Jira issue for each FAIL verdict (Jenkins-Jira plugin); Polarion dashboard: live report (pass rate trend chart, requirement coverage pie chart); export PDF for TÜV/VDA assessor; Jira workflow: FAIL → DR OPEN → engineering fix → retest → DR CLOSED; retention: test artifacts (MDF4 + HTML reports) archived 10 years per ISO 26262-4 clause 7.4.6
Requirements Traceability in HIL
45 min read
▸ Traceability chain: Product Req → System Req → SW/HW Req → Test Spec → Test Case → Test Result → Sign-off; tool chain: IBM DOORS (requirements) → ECU-TEST (test execution) → Polarion ALM (traceability); DOORS module structure: SysRS_042 "Engine Speed Limiting" → HIL_TS_042 (test spec) → HIL_TC_042_001 through _005; DOORS macro counts linked TCs per requirement; 100% coverage mandatory for ASIL-B+ per ISO 26262-4 clause 7.4.4
▸ ECU-TEST requirement tagging & export: @Requirement("SysRS_042", "HIL_TS_042") in test step description; ECU-TEST report: Requirements tab → pass/fail count per requirement ID; export: ECU-TEST → File → Export → Requirements Coverage XML; import to Polarion via REST API: curl -X POST http://polarion/ws/services/import -H "Content-Type: application/xml" -d @coverage.xml; Polarion: SysRS_042 shows 5 linked TCs all PASS → green coverage indicator
▸ Change impact analysis & maintenance: requirement change SysRS_042_v2 (speed limit 6500→6200 RPM) → DOORS impact analysis → linked TCs auto-flagged "requires retest"; review gate: traceability matrix 100% complete → QA sign-off before delivery; DOORS baseline: lock baseline v1.5 before HIL campaign start → link all test results to that baseline; deviation report: TC fails → DR opened → linked to requirement SysRS_042 → tracked to closure; version-controlled HIL project branch per ECU SW release
▸ Coverage gap analysis & metrics: gap identification: DOORS report filter: requirements with 0 linked TCs → highlighted red; gap resolution: either create missing TC or document "infeasible in HIL" rationale; coverage metrics: requirement-based coverage (# covered / total), ASIL coverage (safety reqs 100%, functional 98%); Python gap analysis: parse DOORS CSV export → compute coverage per ASIL level → generate HTML dashboard; ECU-TEST Coverage Analyzer plugin: HIL branch coverage vs VectorCAST SIL unit test coverage combined reporting
CI/CD Pipeline for HIL Tests
50 min read
▸ Jenkins HIL pipeline architecture: Git webhook (on PR merge to main) → Jenkins trigger → checkout → build ECU SW (cmake --build) → SIL tests (VectorCAST 30min) → upload to HIL bench (vFlash CLI) → HIL tests (ECU-TEST 60min) → publish report → notify Teams; Jenkins agents: HIL bench PCs (Windows, ECU-TEST installed) connect as JNLP agents; Jenkins Lockable Resources plugin: bench_1/bench_2/bench_3 mutex; matrix job: 3 benches run 3 test suites in parallel
▸ Pipeline stages & commands: stage("Build"): cmake --build ./build --target engine_ecm_app --config Release; stage("SIL"): vectorcast --env engine_sil --run --report junit_sil.xml; stage("Flash ECU"): vflash.exe -project Engine_v1.5.vflash -flash -serial COM3; stage("Verify SW Version"): ecutest ReadDID 0xF189 == "v1.5"; stage("HIL Test"): ecutest.exe -s bench1.cfg -p engine_tests.pkg -r results/; stage("Report"): junit results/junit.xml; estimated total pipeline runtime: 2.5h; nightly: cron("H 22 * * 1-5")
▸ ECU software deployment & artifact management: vFlash CLI: vflash.exe -project Engine.vflash -flash → 45s programming time; verify ECU SW via UDS: SID 0x22 0xF189 returns "v1.5.0"; rollback on flash failure: vflash previous.vflash -flash; test artifacts: JUnit XML + MDF4 measurements (500MB/bench/night) → Jenkins workspace → NAS archive; S3 alternative: aws s3 sync results/ s3://hil-artifacts/${BUILD_NUMBER}/; retention: 30 days local + 1 year S3; artifact metadata: ECU HW rev, SCALEXIO FW, CANoe version in build.properties
▸ Defect management & pipeline gates: Jenkins Jira plugin: auto-create Jira issue on first TC failure (jiraIssue(projectKey:"ECU", summary:"HIL FAIL: ${TC_NAME}", priority:"High")); gate: SIL pass rate >99% before HIL stage proceeds; HIL gate: 0 ASIL-related failures before merge; Allure report: trend chart 30 builds; quality dashboard: Grafana + InfluxDB for real-time KPIs (pass rate, test duration, bench utilization); pipeline failure escalation: PagerDuty alert if nightly build fails 2 consecutive nights
HIL Lab Management Best Practices
35 min read
▸ HIL bench asset management: CMDB (Configuration Management Database) tracks: bench ID, DS6001 S/N, DS2655 S/N, DS5203 S/N, ECU type, harness version, last calibration date, next calibration due; calibration schedule: DS2655 DAC/ADC → accredited laboratory annual certification (DAKKS/A2LA); SIB relay cycle count logged: max 1M operations per relay → predictive replacement; bench utilization KPI: target >80% (booked hours / available hours); bench booking: Jira Service Management or GitLab issues
▸ HIL software version control: ControlDesk project (.cdx): Git repo; Simulink plant model (.slx): Git LFS (Large File Storage); ConfigurationDesk project (.cdf): Git; DBC/LDF/ARXML bus description files: Git; CAPL scripts: Git; A2L calibration databases: Git LFS; versioning rule: HIL project branch named after ECU SW release (e.g., feature/ecm_v1.5); tag HIL project at each ECU SW delivery; Git pre-commit hook: validate .cdf against SCALEXIO HW inventory; PR review mandatory before merging HIL config changes
▸ Preventive maintenance schedule: weekly: check DS6001 LED status (green=OK), verify SIB relay continuity via automated self-test script, clean IOCNET optical fiber connectors (DS6001 ↔ I/O boards); monthly: DS2655 DAC calibration check (command 0V/±5V/±10V → measure with Fluke 8846A reference DMM, target ±10mV); quarterly: power supply accuracy verification (Regatron ±0.1%); annually: full bench re-calibration; maintenance log in CMDB; ControlDesk hardware watchdog alert if DS6001 offline >5min
▸ Lab safety, process & handover: electrical safety: ECU 12V/14V nominal; harness IEC 61010-1 CAT II; HV HIL (EV >60VDC): area interlock, warning signs, PPE required, dedicated safety SOP; bench SOP: power-up sequence (SCALEXIO → ECU → CANoe → INCA), emergency shutdown procedure (E-stop cuts all VBAT); incident log: near-miss reporting per IEC 62368-1; bench handover checklist: all signals verified, 0 active DTCs, MDF4 log files cleared, INCA offline sessions closed; access control: bench locked via badge-reader when unmanned
Hands-On: Complete HIL Validation Project
70 min read
▸ Project scope & entry criteria: EMS ECU validation to ISO 26262 ASIL-B; HIL bench: SCALEXIO DS6001 + DS2655 + DS5203 + DS4340; plant model: 4-cylinder SI engine + powertrain; test suite: 250 TCs (functional: 180, safety: 50, OBD: 20); entry criteria: ECU SW v1.5 flashed and verified (UDS 0x22 0xF189), plant model validated (RMSE <3% vs GT-Power at 10 OPs), HIL bench calibrated (DS2655 cert valid), all test cases reviewed and approved in Polarion
▸ Day 1-3 hardware integration: Day 1: connect ECU harness to DS2655/DS5203/DS4340 (48 signals), verify with DMM (resistance <0.5Ω per wire, no cross-shorts); Day 2: software integration - download .sdf plant model, import engine.dbc to CANoe, UDS basic comm test (SID 0x10 0x01 → positive response 0x50 0x01); Day 3: plant model validation - compare HIL engine output vs GT-Power at 10 OPs, fix pin assignment error found on DS2655 ch17 (throttle feedback inverted polarity), re-verify RMSE <3%
▸ Day 4-10 test execution: Day 4-5: functional tests (180 TCs) - 176 PASS, 4 FAIL (DR_001: idle speed 750±100 RPM out of spec ±50, DR_002: MAP DTC debounce 3.2s vs req 3.0s); Day 6-7: safety tests (50 TCs) - 48 PASS, 2 FAIL (DR_003: overspeed response 125ms vs req <100ms, closed after ECU SW fix v1.5.1); Day 8: OBD readiness (20 TCs) - 20 PASS; Day 9: regression after SW fix v1.5.1 - all 6 failed TCs now PASS; Day 10: final audit verification
▸ Test closure & ISO 26262 evidence package: test summary: 250 TCs total, 250 PASS (after fixes), 0 FAIL, 0 OPEN defects; requirement coverage: safety 100% (50/50), functional 98% (4 TCs deferred as non-critical with rationale); evidence package: HARA report, test specification (reviewed+approved), test results (JUnit XML + MDF4), defect log (DR_001..DR_003 all CLOSED), traceability matrix (Polarion baseline tag v1.5.1_HIL_PASS), tool qualification records (ECU-TEST TQL-2, CANoe TQL-1), bench calibration certificates; sign-off: QA Manager + Functional Safety Manager + customer representative
Tools Used
What You'll Learn
Design and configure HIL test benches for automotive ECUs
Develop real-time plant models in Simulink
Automate HIL test execution with industry frameworks
Implement fault injection strategies for safety validation
Generate compliant test reports for ASPICE assessments
Integrate HIL testing into CI/CD pipelines
Prerequisites
AUTOSAR or embedded ECU development basics
Simulink modeling fundamentals
Understanding of automotive testing concepts
Full Access
Free with Pro
Enroll Now
Browse Modules
This course includes:
26 detailed documentation chapters
Downloadable resources
Searchable text documentation
Code snippets & technical diagrams
Hands-on exercises
Lifetime access
Certificate of completion