Control unit for a control system of a vehicle, steering actuator for a vehicle, vehicle, method for a control system of a vehicle, and computer program

Abstract

The invention relates to a control unit for a control system of a vehicle, a steering actuator for a vehicle, a vehicle, a method for a control system of a vehicle and a computer program. The control unit comprises a first interface and a second interface. The control unit further comprises a data processing circuit configured to control the first interface and the second interface. The data processing circuitry is further configured to transmit an inspection signal indicative of an inspection parameter and to receive the inspection parameter. An inspection signal is transmitted via a first interface and an inspection parameter is received via a second interface.

Description

Technical Field

[0001] The invention relates to a control unit for a control system of a vehicle, a steering actuator for a vehicle, a vehicle, a method and a computer program for a control system of a vehicle. Background Art

[0002] Today's control systems require higher safety integrity levels (ASIL) and therefore require architecturally specific measures such as redundant chains of subcomponents, signal paths and functional traces. Such systems and even subsystems are often not adequately protected against manipulation in the sense of cybersecurity (hardware and software protection). In particular, cable harness connections are poorly protected and there is a risk of signal manipulation after a plug has been loosened.

[0003] The communication path is based, for example, on a bidirectional bus system (SENT = Single Edge Nibble Transmission, which has address-synchronized communication as follows (simplified). In the case of a "steering behavior manipulation", it is possible to release the plug of the redundant signal connection so that the trigger sensor signal from the control system is read and the manipulation signal can be induced into the control system by contacting the disconnected plug with an external hardware component (e.g. a signal generator). Such a manipulation may not be detected due to the internal diagnosis of the control system and may lead to safety-critical faults. Summary of the invention

[0004] Against this background, it is an object of the present invention to enable improved monitoring of a control system.

[0005] The object according to the invention is achieved by a control unit for a control system of a vehicle, a steering actuator for a vehicle, a vehicle, a method for a control system of a vehicle and a computer program according to the independent claims. Further aspects and developments of the invention are explained in the dependent claims, the following description and the drawings.

[0006] According to a first aspect of the present invention, a control unit for a control system of a vehicle is proposed. The control unit includes a first interface and a second interface. The control unit also includes a data processing circuit, which is configured to control the first interface and the second interface. The data processing circuit is also configured to send a check signal indicative of a check parameter and receive the check parameter. The check signal is sent via the first interface and received via the second interface. The first interface and the second interface are two separate interfaces. By sending the check signal via the first interface and receiving the check parameter via the second interface, the correct contact of the first interface and the second interface can be checked. For example, the control unit can determine the specific assignment relationship between the first interface and the second interface for sending the check signal and receiving the check parameter. Correspondingly, the control unit can send the check signal via the first interface in a targeted manner and expect to receive the check parameter via the second interface. If an operation is performed, such as connecting an external hardware component to the first interface or the second interface, the external hardware component may lack information about which interface the check parameter should be sent via. Correspondingly, if the check parameter is not received via the second interface, it can be determined that a possible operation has occurred, that is, for example, an external device is connected.

[0007] In one embodiment, the data processing circuit can be configured to: if the check parameter is not received via the second interface within a predetermined time after being sent, a part of the control system is deactivated. Deactivating a part of the control system can prevent improper use. For example, data can be prevented from being read out and / or entered into the part of the control system.

[0008] In one embodiment, the first interface and the second interface may be included by the interface module. The control unit may also include another interface module, and the other interface module includes another interface. The data processing circuit may be configured to send another inspection signal indicative of another inspection parameter via another interface. In addition, the data processing circuit may also be configured to receive another inspection parameter via the interface module. The first interface and the second interface may be included by a hardware component, such as a plug. The hardware component may, for example, include two pins, namely the first interface and the second interface. By using another interface module, redundancy in terms of signal transmission may be established, for example. Based on this redundancy, protection against manipulation may be improved. In particular, it may be checked whether a large number of interface modules have not been manipulated. By receiving another inspection parameter via the interface module, it may be checked whether another interface module is correctly connected. When another interface module is manipulated, for example, when the plug is unplugged from another interface module, another inspection parameter may no longer be received via the interface module. The safety of the control system may be improved by using another interface module and the interface module.

[0009] In one embodiment, the additional inspection parameters can be received via the second interface or the third interface. For example, the additional inspection parameters can be received together with the inspection parameters via the second interface of the interface module. The structure of the interface module can be simplified thereby. Alternatively, the additional inspection parameters can be received via the third interface of the interface module. In particular, the control unit can determine the third interface for receiving the attachment relationship of the additional inspection parameters. The control unit can thus check whether the additional inspection parameters are received via the correct interface. The safety of the control system can thus be improved.

[0010] In one embodiment, if the check parameter or the further check parameter is not received via the interface module within a predetermined time after sending, the part of the control system associated with the check parameter or the further check parameter is deactivated. This makes it possible to selectively switch off a part of the control system. For example, the control unit may not be able to receive the further check parameter and selectively deactivate the part of the control system connected to the further interface module.

[0011] In one embodiment, the data processing circuit can be configured to enable data transmission of the sensor data via the interface module only after receiving the check parameter. This ensures that information exchange occurs only after the safety of the connection has been verified.

[0012] According to a second aspect of the invention, a steering actuator for a vehicle is proposed, the steering actuator comprising a control unit as described above. The control unit can thus be included in the steering actuator, for example the steering axle or the steering wheel. This can improve the safety of the structure of the vehicle's onboard power system.

[0013] According to a third aspect of the present invention, a vehicle having a control unit as described above or a steering actuator as described above is provided. In the vehicle, the control unit provides the advantage that the safety of the vehicle's onboard electrical system can be improved.

[0014] According to a fourth aspect of the invention, a method for a control unit of a control system of a vehicle is provided. The method comprises sending a check signal indicative of a check parameter via a first interface. Furthermore, the method comprises receiving the check parameter via a second interface. The first interface is different from the second interface.

[0015] According to a fifth aspect of the present invention, a computer program is provided, which is used to execute any one of the above methods when the computer program is run on a computer, a processor or a programmable hardware component. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The present invention will be described hereinafter by way of example only with reference to any of the accompanying drawings. In the drawings:

[0017] Figure 1 A block diagram showing one embodiment of a control unit for a control system of a vehicle;

[0018] Figure 2a~2e shows the signal path structure and existing information exchange from the prior art;

[0019] Figure 3a~3c An embodiment of a signal path according to the invention and of an information exchange according to the invention is shown;

[0020] Figure 4 An embodiment of a vehicle is shown; and

[0021] Figure 5 A block diagram of an embodiment of a method is shown. DETAILED DESCRIPTION

[0022] Figure 1 A block diagram of an embodiment of a control unit 130 for a control system of a vehicle is shown. The control unit 130 includes a first interface 134a and a second interface 134b. The control unit 130 also includes a data processing circuit 132, which is configured to control the first interface 134a and the second interface 134b. The data processing circuit 132 is also configured to send a check signal indicative of a check parameter.

[0023] The check signal may be based on an interrogation signal which is exchanged between the control unit and other components of the vehicle as a standard. In some communication protocols, in particular those based on an interrogation-response basis, a certain coding or identification code may be sent together. This coding or identification code may be used to characterize the interrogation and ensure that components such as sensors and / or control units exchange the correct data.

[0024] The control unit can send an inquiry, i.e. an inquiry signal, to a specific sensor. Such an inquiry can be a specific query for specific data required by the control unit. The inquiry can include a coding or identification code, which indicates which sensor the inquiry relates to and which type of data is expected. The sensor can receive the inquiry, decrypt the inquiry and evaluate the identification code and determine which data is requested. The sensor can then respond with the requested data, which can also be coded or can be in a specific format. This form of transmission can be used in particular in bidirectional bus systems.

[0025] The inspection signal can extend the inquiry signal with an inspection parameter. The inspection signal includes, for example, the inspection parameter and the inquiry signal from the prior art. The inspection parameter may not be the encoding of the inquiry of the data in particular. The inspection parameter may only be used to check the connectivity between the control unit 130 and another component, such as a sensor. The inspection parameter may not be associated with the inquiry of the data. The control unit 130 can therefore receive the same inspection parameter sent via the first interface 134a via the second interface 134b.

[0026] Correspondingly, the data processing circuit 134 is also configured to receive a check parameter. The check parameter can be a value, an identifier or a data structure. The check parameter can be used in the communication process to check the integrity, correctness and / or credibility of the connection. The check parameter can be used to check the correct connection between the control unit 130 and other components of the vehicle.

[0027] The inspection signal is sent via the first interface 134a, and the inspection parameter is received via the second interface 134b. The first interface 134a and the second interface 134b are two separate interfaces.

[0028] The check signal and the check parameter can therefore be used in particular to check the hardware configuration of the control unit 130 or the control system. For example, the control unit 130 can detect whether a component of the vehicle's control system, such as the onboard power system, connected to the control unit 130 has been unplugged from the control unit 130. Thus, for example, the loosening or removal of the plug (for example, due to the removal of the cable harness) can be detected by means of the control unit 130. Detecting the loosening of the plug can help to improve the safety of the vehicle or the vehicle's control system. Hardware manipulation can be particularly difficult. The control unit 130 can be used to detect the disconnection of the connection system, such as the cable harness. In addition, access to the control unit 130 by manipulation signals can be prevented.

[0029] The control unit 130 can be constructed in the manner of existing signal path structure and existing information exchange as described with reference to FIG2. In the existing signal path structure, in particular only one interface is used for information exchange. One discovery of the inventor is that the safety of the control system of the vehicle can be improved by using additional signal lines, a second interface 134b and check parameters. In particular, a dedicated processor sensing port can be used for external and internal verification of the check parameters as shown in reference to FIG3. The second interface 134b can be designated, for example, for receiving the check parameters. The interfaces 132a, 132b of the control unit 130 can therefore be designated for sending a check signal or for receiving a check parameter and / or another check parameter.

[0030] By using control unit 130, cable harness paths of the vehicle that are connected to other components (e.g., steering sensors, steering actuators, environmental sensors) can be particularly protected. In particular, fault-tolerant behavior with secure data transmission can be ensured. In particular, fault-tolerant, redundant behavior with secure data transmission can be ensured by using additional check parameters.

[0031] In one embodiment, the data processing circuit 134 can be configured to deactivate a part of the control system if the check parameter is not received via the second interface within a predetermined time after the transmission. For example, the part of the control system that belongs to the control unit 130 can be deactivated. That is, the control unit 130 can be at least partially deactivated. Alternatively, the control unit 130 can be completely deactivated. Optionally or alternatively, it is also possible to at least partially deactivate another control unit of the control system on the basis of at least partially deactivating the control unit 130. For example, another control unit can be responsible for the same process as the control unit 130 or process the same process as the control unit 130. That is to say, another control unit can be a redundant control unit of the control unit 130. If a possible manipulation of the control unit 130 is detected, then the redundant other control unit can also be at least partially, in particular completely, deactivated as a precaution. The safety of the control system can be improved thereby.

[0032] In one embodiment, the first interface 134a and the second interface 134b may be included in an interface module. The interface module may be a hardware component. The first interface 134a and the second interface 134b may be collected in the interface module. The interface module may, for example, include an encapsulation unit for the first interface and the second interface. By releasing the interface module, the first interface 134a and the second interface 134b may be released at the same time. The interface module may, for example, be a plug, such as a bus plug, a connector and / or a hybrid connector.

[0033] The control unit 130 may also include another interface module, which includes another interface. The other interface module may be constructed separately from the interface module. That is, the interface module may be a first hardware component, and the other interface module may be a second hardware component. The interface module and the other interface module may be connected to the control system of the vehicle separately.

[0034] The data processing circuit 134 can be configured to send additional test signals indicative of additional test parameters via additional interfaces. In addition, the data processing circuit 134 can also be configured to receive additional test parameters via the interface module. By sending additional test signals via the additional interface module, the correct connection of the interface module and / or the additional interface module can be checked.

[0035] Optionally or alternatively, the control unit 130 can be used to detect a malfunction of the first interface 134a and / or the second interface 134b. For example, the first interface 134a may be a plug pin that is no longer functioning and is assigned to receive a check parameter. Thus, although the control unit 130 may always receive additional check parameters in redundant components, it may no longer receive the check parameters. Therefore, the mere receipt of additional check parameters may indicate that the first interface 134a is faulty.

[0036] By using additional check parameters, the control unit 130 can check the various interfaces at least partially independently of each other. For example, the control unit 130 can only receive the additional check parameters via the second interface 134b. Thus, the control unit 130 can determine that the first interface 134a used to send the first check parameter may not be working correctly. Therefore, the control unit 130 can selectively detect the failure of the interface.

[0037] By using additional check parameters, the fault-tolerant strategy for redundant signal paths can be maintained. Furthermore, it can be ensured that the redundancy of the control system is maintained in "normal" operating mode.

[0038] In one embodiment, the additional inspection parameters can be received via the second interface 134b or the third interface. For example, the additional inspection parameters can be combined with the inspection parameters by multiplexing and simultaneously received via the second interface 134b. Alternatively, the third interface of the control unit 130 can be used to receive the additional inspection parameters. The third interface can be, for example, a dedicated processor sensing port for receiving the additional inspection parameters. In this case, the second interface 134b can be a dedicated processor sensing port for receiving the inspection parameters.

[0039] In one embodiment, if the inspection parameter or the further inspection parameter is not received via the interface module within a predetermined time after transmission, the part of the control system associated with the inspection parameter or the further inspection parameter can be deactivated. That is, the control unit 130 can be at least partially deactivated when the inspection parameter or the further inspection parameter is not received. Alternatively, the control unit 130 can be completely deactivated.

[0040] In one embodiment, the data processing circuit 134 can be configured to enable data transmission of the sensor data via the interface module only after receiving the check parameter. This ensures that information exchange only occurs when the safety of the connection is verified.

[0041] like Figure 1As shown, the interface 134 can be coupled to the corresponding data processing circuit 132 of the control unit 130. In an example, the control unit 130 can be implemented by one or more processing units, one or more processing devices, any device for processing, such as a processor, a computer or a programmable hardware component that can be run with corresponding matching software. The functions of the data processing circuit 132 can also be implemented in software, which is then implemented on one or more programmable hardware components. These hardware components can be a multi-purpose processor, a digital signal processor (DSP), a microcontroller, etc. The data processing circuit 132 can have the ability to control the interface 134, so that each data transmission completed via the interface 134 and / or each interaction in which the interface 134 can participate can be controlled by the data processing circuit 132.

[0042] In one embodiment, the control unit 130 may include a memory 136 and at least one data processing circuit 132 operatively coupled to the memory 136 and configured such that it performs the method described below.

[0043] In an example, the interface 134 may correspond to any device for acquiring, receiving, transmitting or providing analog or digital signals or information, such as various terminals, contacts, pins, registers, input terminals, output terminals, conductors, channels, etc., which enable providing or acquiring signals or information. The interface 134 may be wireless or wired and may be configured such that it can communicate with another internal or external component, such as sending or receiving signals or information.

[0044] Even though it has been described in these embodiments that the inspection signal also includes data other than the inspection parameters, the inspection signal is not limited thereto. The inspection signal may alternatively not be based on an inquiry signal from the prior art. For example, the inspection signal may only include the inspection parameters. Therefore, the inspection parameters may be sent separately from other data, such as data inquiries.

[0045] The control unit may be a central control device of the vehicle or may be comprised in this central control device.

[0046] Figure 2a to Figure 2e The signal path structure and existing information exchange from the prior art are shown.

[0047] exist Figure 2a 2 shows a basic configuration of an onboard power supply system of a vehicle known from the prior art. The onboard power supply system comprises a control device 200 (also referred to as an electronic control unit, ECU), a sensor system 202 and a connecting element 204 . Figure 2aA redundant sensor system according to the prior art is shown in combination with a redundant connection system having a control device 200. For the sake of illustration, only the signal transmission, the power supply 206 and the ground (GND) connection 208 are shown.

[0048] As in Figure 2b As can be seen in the figure, the signal path is based on a modern bidirectional bus system (SENT = Single Edge Nibble Transmission with address synchronized communication). The signal can be designed as a query signal.

[0049] Figure 2c The data query by the control unit 202 is shown, which is initiated by a first or second triggering event. The data query is intended for the first sensor or the second sensor.

[0050] Figure 2d The data transmission of the corresponding sensor is shown. The data transmission is started due to the corresponding trigger event and is determined for the controller 200.

[0051] Figure 2e An example is shown in which the connection of the first interface module 204 to the onboard power supply is released. In addition, an external hardware component 290 is connected to the first interface module 204. Based on the signal path shown in FIG. 2 , the control device 200 can be operated with the help of the external hardware component 290. Therefore, in order to increase the safety of the onboard power supply of the vehicle, the control unit according to the invention can be used. The use of two control units according to the invention in an onboard power supply with redundancy is shown in FIG. 3 .

[0052] Figure 3a to Figure 3c An embodiment of a signal path structure according to the invention and of an information exchange according to the invention is shown.

[0053] Figure 3a Shown based on Figure 2b The transmission signal additionally includes a check parameter.

[0054] As in Figure 3bAs shown, before the sensor data are exchanged on the connection, a plurality of test signals can be sent for the first sensor 370 and the second sensor 372. A test parameter (i.e. part of the test signal), i.e. a proprietary random digital code, can be sent via each connection or each signal path 340, 342. The test signal can be sent via signal path 340 and the further test signal can be sent via signal path 342. The test parameters can be received again via separate connections or signal paths 350, 352, 354, 356. The test parameters can be received via signal paths 350, 352 and the further test parameters can be received via signal paths 354, 356.

[0055] Each test parameter can be returned via two cable bundles 360, 362. The control unit 300 can compare the received test parameters with the "sensing" port, that is, the assigned interface 380, 382. When the test parameter is received at the correct interface, the control unit 300 can start the data query and sensor data transmission. In this way, data exchange can be carried out.

[0056] For clarification purposes, only the signal transmission portion, the power supply 306 and the ground (GND) connection portion 308 are shown.

[0057] Figure 3c The shutdown of a part of the control unit 300 is shown when manipulation occurs. If the connection part of the first interface module 396 of the control unit 300, i.e. the cable harness 360, is disconnected, for example unplugged or not in contact, then no check parameters are received at the second interface 380 and the third interface 382. In order to prevent further manipulation, for example to prevent the introduction of signal induction, the control unit 300 can be at least partially deactivated. In particular, the part of the control unit connected to the interface module 396 can be deactivated. Optionally, system-critical parts of the control unit, such as the driver stage, can be deactivated. Deactivation can be performed when the received check parameters are different from the sent check parameters or when no check parameters are received at all.

[0058] Inductively introduced check parameters on the sensing line will also not be accepted by the control unit 300 , since randomly generated check parameters can also be checked internally in the control unit.

[0059] Since unplugging the two cable harnesses 360 , 362 blocks both drive stages and inhibits the entire communication, the control unit 300 can then be switched into a safe mode, for example switched offline. The control unit 300 can thus be completely deactivated.

[0060] Furthermore, a missing plug or an improperly inserted plug can also be detected. This ensures that an incorrect connection does not affect the fault-tolerant strategies and diagnostics integrated into the control unit 300 during operation.

[0061] It is also possible, for example, to selectively identify only failed interfaces. The control unit can, for example, obtain two test parameters via the second interface module 398, and obtain only the first test parameter at the second interface 380 via the first interface module. Accordingly, the control unit 300 can determine that the third interface 382 is failed.

[0062] Even though it is described in the exemplary embodiments that the inspection signal may also include data other than the inspection parameters, the inspection signal is not limited thereto. The inspection signal may alternatively not be based on the query signal from the prior art. The inspection signal may, for example, only include the inspection parameters. The inspection parameters may therefore be sent separately from other data, such as data queries.

[0063] Figure 4 An embodiment of a vehicle 400 is shown. The vehicle comprises a steering actuator 410, which is configured to drive a steering axle of the vehicle 400. The steering actuator 410 or the vehicle 400 comprises a control unit 420, as described with reference to Figure 1 As described. In particular in the field of application in vehicles, the control unit 420 according to the invention has the additional advantage that the safety of the onboard electrical system of the vehicle 400 can be improved. Manipulation of connections between various components of the vehicle 400, such as a cable harness, can be made more difficult.

[0064] Figure 5 A block diagram of an embodiment of a method 500 is shown. The method 500 is for a control unit of a control system for a vehicle. The method 500 includes sending 510 a check signal indicative of a check parameter via a first interface. The method 500 also includes receiving 520 the check parameter via a second interface. The first interface is different from the second interface. The method may be performed by the control unit as described above, for example with reference to Figure 1 Execute with instructions.

[0065] Another embodiment is a computer program for executing the methods described herein when the computer program is run on a computer, a processor or a programmable hardware component. Depending on the specific implementation requirements, embodiments of the invention may be implemented in hardware or in software. The implementation may be performed using a digital storage medium, such as a floppy disk, DVD, Blu-ray disc, CD, ROM, PROM, EPROM, EEPROM or flash memory, hard disk or other magnetic or optical memory, on which electronically readable control signals are stored, which cooperate or can cooperate with the programmable hardware component to enable the execution of the corresponding method.

[0066] List of reference numerals (part of the description)

[0067] 130 Control unit

[0068] 132a First interface

[0069] 132b Second interface

[0070] 134 Data Processing Circuit

[0071] 136 Memory

[0072] 200 Controller

[0073] 202 Sensor System

[0074] 204 Connecting elements

[0075] 206 Power Supply

[0076] 208 Ground connection

[0077] 300 Control Unit

[0078] 302 Sensor System

[0079] 306 Power Supply

[0080] 308 Ground connection

[0081] 360, 362 Cable harness

[0082] 340, 342 signal path, check signal

[0083] 350, 352, 354, 356 signal paths, check parameters

[0084] 370, 372 Sensors

[0085] 396, 398 interface

[0086] 400 vehicles

[0087] 410 Steering Actuator

[0088] 420 Control Unit

[0089] 500 Method for controlling a control unit

[0090] 510 Send check signal

[0091] 520 Receive check parameters.

Claims

1. A control unit for a control system of a vehicle, the control unit comprising: A first interface (132a) and a second interface (132b); and A data processing circuit, the data processing circuit being configured to control the first interface (132a) and the second interface (132b), and further configured to: sending an inspection signal, wherein the inspection signal is indicative of an inspection parameter; Receive inspection parameters, where The inspection signal is sent via the first interface (132a), and the inspection parameter is received via the second interface (132b).

2. The control unit (130) according to claim 1, wherein: The data processing circuit is configured to: If the check parameter is not received via the second interface (132b) within a predetermined time after being sent, a portion of the control system is deactivated.

3. The control unit (130) according to any of the preceding claims, wherein: The first interface (132a) and the second interface (132b) are included in the interface module; wherein, The control unit (130) further comprises another interface module, wherein the other interface module comprises another interface; wherein, The data processing circuit is configured to: sending, via the further interface, a further inspection signal indicative of a further inspection parameter; and The further inspection parameters are received via the interface module.

4. The control unit (130) according to claim 3, wherein: The further test parameters are received via the second interface (132b) or the third interface.

5. The control unit (130) according to claim 3 or 4, wherein: If the check parameter or the further check parameter is not received via the interface module within a predetermined time after transmission, only that part of the control system which is associated with the check parameter or the further check parameter is deactivated.

6. The control unit (130) according to any of the preceding claims, wherein: The data processing circuit is configured to: Only after receiving the check parameters is the data transmission of the sensor data via the interface module enabled.

7. A steering actuator (410) for a vehicle (400), comprising a control unit (130) according to any one of the preceding claims.

8. A vehicle (400) comprising a control unit (130) according to any one of claims 1 to 6 or a steering actuator (410) according to claim 7.

9. A method (500) for a control unit of a control system of a vehicle, the method comprising: Sending (510) an inspection signal via a first interface, the inspection signal being indicative of an inspection parameter; and The inspection parameters are received (520) via the second interface.

10. Computer program for executing the method (500) according to claim 9 when the computer program is run on a computer, a processor or a programmable hardware component.

Images