Method and device for connecting a diagnostic device to a control unit in a motor vehicle

Abstract

To connect a diagnostic device (7) to a vehicle control unit (3) of a motor vehicle (2) via a network connection, a check is performed when the diagnostic device (7) and the vehicle control unit (3) are established to verify whether the diagnostic device (7) is directly connected to the vehicle control unit (3). The diagnostic device (7) only receives diagnostic data from the vehicle control unit (3) if the connection is direct.

Description

[0001] The invention relates to a method and a device for connecting a diagnostic device to a control unit in a motor vehicle. The invention particularly relates to connecting a diagnostic device to a control unit in the form of a network connection.

[0002] Modern vehicles are equipped with numerous electronic control units (ECUs) that are interconnected via data buses. These data buses can be network-enabled, such as a Controller Area Network (CAN) bus or a bus based on the Ethernet or IP standard.

[0003] For the analysis and diagnosis of control units and other electronic components of a motor vehicle, data transmitted via the respective bus can be recorded, for example, in the form of data logging. This data can then be evaluated directly at the vehicle manufacturer, in a service organization, or in a repair shop. For this purpose, data packets sent via the respective data bus are read and recorded using a connected reader. The read bus data can be temporarily or permanently stored, partially or completely, or mirrored (mirrored) in suitable storage devices, particularly on a local data logger or a central, decentralized, or mobile computer.The term diagnostic data in the following includes all data sent on buses from control units or from the diagnostic device, and thus also data that is not explicitly generated for diagnostic purposes, but is exchanged between the control units during normal operation of the vehicle.

[0004] To read bus data, a vehicle diagnostic system with a corresponding standardized connector was developed under the name On-Board Diagnostics (OBD). This interface allows not only the transmission of data from the respective buses to a diagnostic device, but also the sending of external data to the vehicle's data buses. For example, the use of an interface connector according to the OBD standard is described in DE 10 2009 027 673 A1.

[0005] When fully reading or logging bus data from a vehicle, a very large amount of data can be generated, for example, when numerous control units regularly query complete operating data during vehicle operation. Furthermore, particularly when transferring operating data from Ethernet buses to a diagnostic device, the problem can arise that data packets from the Ethernet bus flow into another Ethernet or IP network to which the diagnostic device or a vehicle-side control unit is additionally connected. This could be, for example, a company network such as the intranet of the repair shop, service provider, or vehicle manufacturer, or even an internet connection provided by the vehicle. If Ethernet data packets flow into such a network, this can lead to interference or even the collapse of the other Ethernet network.due to the large data deluge or due to conflicting data packet conventions or contents during diagnostic-related readout of bus data.

[0006] The object of the invention is to prevent data packets of the diagnostic data from unintentionally penetrating into another network to which the control unit or the diagnostic device is connected when transmitting diagnostic data from a vehicle control unit located in a motor vehicle to a diagnostic device.

[0007] This problem is solved by the invention specified in the independent claims. Advantageous embodiments of the invention are specified in the dependent claims.

[0008] According to the invention, to connect a diagnostic device to a vehicle control unit of a motor vehicle via a network connection, it is provided that when the connection is established between the diagnostic device and the vehicle control unit, a check is carried out to see whether the diagnostic device is directly connected to the vehicle control unit and that the diagnostic device only receives diagnostic data from the vehicle control unit if the connection is direct.

[0009] The invention enables the vehicle to determine, from its perspective, whether it is directly connected to the diagnostic device or indirectly, for example, via one or more other network components. The invention is based on the understanding that verifying whether such a direct or indirect connection exists is possible with reasonable effort. Furthermore, it was recognized that this effort is justified by the advantage that another network, to which, for example, the diagnostic device and / or the vehicle control unit is additionally connected, is not disrupted in its function by the transmission of large quantities of diagnostic data between the vehicle control unit and the diagnostic device, including potentially disruptive data packets. The invention also prevents the vehicle control unit from being accidentally or improperly activated to output diagnostic data while the vehicle or the diagnostic device is in operation.The vehicle control unit is connected to a different network. This also prevents damage to such a different network caused by unauthorized input of diagnostic data.

[0010] The invention also makes it possible to ensure that the vehicle control unit is not connected to any other network or network-enabled device located outside the vehicle via the same network connection. The invention is particularly advantageous when the network connection is an Ethernet connection, a Wireless Local Area Network (WLAN) connection, or another wireless connection over which Ethernet packets are transmitted.

[0011] A direct connection or network connection between the vehicle control unit and the diagnostic device within the meaning of the invention can, for example, be characterized by one or more of the following properties: - the connection is not made via another network - The network connection only allows for one predefined configuration of switching elements, for example a) only a predetermined number or maximum number n of switches (n>= 0), b) only registered switches, c) only switches that forward only predefined switching commands, for example, only predefined Bridge Protocol Data Units (BPDUs) if the network is an Ethernet network, and do not forward other switching commands and / or d) only switches that have a specific configuration, e.g. regarding Virtual Local Area Networks (VLANs), port forwarding or other switching mechanisms. - Only participants with predefined Internet Protocol (IP) and / or Media Access Control (MAC) addresses are present in the network connection. As soon as participants with other IP or MAC addresses send data over the network connection, the connection is no longer considered direct.

[0012] A direct connection between the vehicle control unit and the diagnostic device can be established in particular by means of an access device connected between the vehicle control unit and the diagnostic device, in which the access device has a switching device through which a point-to-point connection between the vehicle control unit and the diagnostic device is established in such a way that only specified, but no further network components interfere in the communication of the network connection.

[0013] In a first preferred embodiment of the invention, the vehicle control unit outputs diagnostic data to the diagnostic device only if a direct connection has been established. In a second preferred embodiment of the invention, an access device is connected between the diagnostic device and the vehicle control unit, whereby a direct connection between the diagnostic device and the vehicle control unit can nevertheless be established via this access device, in accordance with the invention. In this embodiment, the vehicle control unit outputs diagnostic data to the access device. However, the access device only forwards the diagnostic data to the diagnostic device if a direct connection between it and the vehicle control unit has been established, in accordance with the invention.However, the connection is not considered direct, and the access device does not forward the diagnostic data, if the access device is connected via the network connection to at least one network component independent of the diagnostic device and / or unauthorized, in particular to a multitude of network components independent of the diagnostic device. These network components can be, in particular, switches and / or components that are addressable by a network address, such as ports, routers, servers, or other components of a computer network.

[0014] The diagnostic device can be, for example, a personal computer, a laptop, or a data logger that establishes a connection to a diagnostic computer and / or stores the diagnostic data in its own memory. Within the diagnostic device, the transmitted and, if applicable, stored diagnostic data can be processed using appropriate computer programs, in particular, displayed, analyzed, and / or used to generate derived data.

[0015] The invention provides, in particular, control and verification mechanisms that ensure a direct connection between the vehicle control unit and the diagnostic device. These control and verification mechanisms can include measures in one or more layers of a network connection, for example, in the physical layer, the data link layer, or the network layer according to the Open Systems Interconnection (OSI) Reference Model.

[0016] According to a first control or verification mechanism, which operates, for example, in the physical layer of the network connection, at least one characteristic of the physical layer, in particular the transmission rate, is switched to predefined values ​​between the network interfaces of the diagnostic device, the vehicle control unit, and / or the access device (if present) in a predefined time sequence. Full communication between the vehicle control unit and the diagnostic device is then only enabled if the vehicle control unit and / or the access device (if present) receives the predefined sequence. During the connection establishment process, the diagnostic device and / or the access control unit (if present) switches the data transmission rate between the respective network interfaces to predefined values ​​in a predefined time sequence.The vehicle control unit and / or the access control unit (if present) only enables full communication with the diagnostic device if it receives the specified sequence and can validate it according to its stored control parameters.

[0017] According to a second control or verification mechanism, which operates at a higher layer of the network connection, for example in the data link layer (Layer 2, Ethernet) or the network layer (Layer 3, IP), additional communication data with predefined content and / or according to predefined communication rules is exchanged between the diagnostic device and the vehicle control unit for verification purposes. For example, it may be stipulated that predefined BPDU data packet contents and / or data packets with predefined network addresses, especially multicast addresses, are exchanged.

[0018] The content and communication rules can be designed so that they are not normally forwarded by network switches. This means they only reach the respective target device if the connection between the diagnostic tool and the vehicle control unit is direct, without the involvement of network switches, especially standard network switches. For example, the access device then only sends diagnostic data via the network connection to the diagnostic tool if it has previously received a BPDU data packet sent by the diagnostic tool, which, by its nature, is not forwarded by network switches.

[0019] The content or communication rules can also be designed so that the vehicle control unit immediately stops outputting diagnostic data if it receives data packets via the network connection that, according to their content or communication method, originate from intermediate network switches, i.e., that were not transmitted directly from the diagnostic device to the vehicle control unit.

[0020] In addition to verifying the existence of a direct network connection, a cryptographic authorization check can be performed before and / or during the transmission of diagnostic data. The vehicle control unit and the diagnostic device can each have an encryption or decryption routine (cryptography routine) for encrypting or decrypting data transmitted over the network connection, and / or other authentication mechanisms, such as a signature-based mechanism, a challenge-response procedure, or a method based on the IEEE 802.1X standard for authenticating devices on a network.

[0021] In an advantageous embodiment of the invention, the diagnostic device or a connection device connected between the diagnostic device and the vehicle control unit has a first network port for the connection between the diagnostic device and the vehicle control unit and a second network port of the same network type for connection to other network devices. The network type can be, for example, Ethernet. However, the network ports can be of different types, e.g., the first network port wired and the second wireless, and in particular a WLAN port.The second network connection is at least temporarily physically or functionally separated from the first network connection in such a way that, while a communication link exists between the diagnostic device and the vehicle control unit via the first network connection, the diagnostic device and / or the vehicle control unit cannot simultaneously communicate via the second network connection. This temporary physical or functional separation can be switchable. Additional network devices, such as routers, servers, clients, switches, etc., of a larger network, for example, a corporate network, can be used.

[0022] Further embodiments of the invention are explained in more detail below with reference to the figures. The figures show: Fig. 1 a vehicle with connected diagnostic equipment, Fig. 2 a process for the transfer of diagnostic data and Fig. 3 a vehicle with a diagnostic device connected via an access device.

[0023] In the Fig. In the configuration shown in Figure 1, a diagnostic device 7 is connected to a motor vehicle 2, which can record diagnostic data output by the motor vehicle 2 (data logging). The diagnostic data is provided in the motor vehicle 2 by a vehicle control unit 3, which in turn receives corresponding data from various component control units 4 via an internal vehicle data network 5, for example, via a CAN bus. On the one hand, the diagnostic data can be transmitted from the vehicle control unit 3 to the diagnostic device 7. Conversely, certain data can also be transmitted from the diagnostic device 7 to the vehicle control unit 3. This transmission can occur in response to received data.

[0024] The vehicle control unit 3 contains an Ethernet network interface with an Ethernet network driver 8a. A network cable 8b runs from the vehicle control unit 3 to an access point 6, e.g., a network socket, to which an Ethernet network cable 8c is connected, establishing the network connection to the diagnostic device 7. The network connection between the vehicle control unit 3 and the diagnostic device 7 can be implemented not only via an Ethernet network cable, but also, for example, via a wireless network connection (WLAN), a Bluetooth connection, or another wireless and / or radio transmission technology.

[0025] For communication with the vehicle control unit 3, the diagnostic device 7 has a corresponding network driver 8d. After connecting the cable 8c to the access point 6, the diagnostic device 7's access to the vehicle control unit 3 is activated by a command and communication via the network drivers 8a and 8d is started.

[0026] In Fig. Figure 2 shows the further communication sequence. After communication starts in step S1, an authentication step S2 cryptographically checks or verifies whether the diagnostic device 7 is authorized to communicate with the vehicle control unit 3. For this purpose, the vehicle control unit 3 expects the diagnostic device 7 to send a predefined key to the vehicle control unit 3. If this is not the case, the communication is terminated by the vehicle control unit 3 (step S7). If the correct key is received by the vehicle control unit 3, the communication continues, and in step S3, further verification of the communication between the vehicle control unit 3 and the diagnostic device 7 takes place in the physical layer of the Ethernet network connection. For this purpose, the network driver 8d in the diagnostic device 7 measures the data rate of the Ethernet data access according to a predefined time pattern, e.g.Every second, the transmission speed switches back and forth between different speeds, e.g., between 100 Mbit / s and 10 Mbit / s. The vehicle's network driver 8a anticipates and verifies this change in transmission speed. Only if it detects the change according to the specified timing pattern can the network connection between vehicle control unit 3 and diagnostic device 7 be enabled as a direct connection and the process proceed to step S4. If diagnostic device 7 were not directly connected to vehicle control unit 3 via network components such as switches, routers, or servers, and if diagnostic device 7 were to change its transmission speed, vehicle control unit 3 would not detect this change, as it would affect a network link located far from vehicle control unit 3. Therefore, vehicle control unit 3 would not be able to detect the change.The network driver 8a does not allow data access and terminates communication (step S7).

[0027] In steps S4 and S5, a further check is performed to verify that a direct connection exists between vehicle control unit 3 and diagnostic device 7. For this purpose, in step S5, diagnostic device 7 cyclically sends a BPUD data packet with the multicast destination address 01-80-C2-00-00-01 to vehicle control unit 3 every second. In step S6, vehicle control unit 3 checks whether the BPUD data packet has arrived. Such a BPUD data packet would not be forwarded by the switches in a typical Ethernet network between diagnostic device 7 and vehicle control unit 3. Therefore, the receipt of this BPUD data packet also signals to vehicle control unit 3 that a direct connection to diagnostic device 7 exists. Only if the checks in steps S3 and S5 yield positive results is access for diagnostic device 7 to vehicle control unit 3 enabled in step S6 to read the diagnostic data from vehicle control unit 3.

[0028] When diagnostic device 7 has access to vehicle control unit 3, the network connection is continuously monitored for events that could jeopardize the proper transmission of diagnostic data or indicate that the network connection is no longer direct. This monitoring preferably takes place in vehicle control unit 3. In the event of a fault, vehicle control unit 3 immediately stops the transmission of diagnostic data, particularly in the case of the following events: - In the event of a link-down, i.e., when the network connection in the physical layer is temporarily or completely interrupted. - In the event of a reset or standby state of the diagnostic device 7. - If the vehicle control unit receives Ethernet data packets, especially BPDU packets, with a network address (MAC address) that cannot be assigned to diagnostic device 7 or that do not correspond to the addresses stored in the vehicle control unit 3. Examples of such BPDU packets are Spanning Tree Protocol (STP) packets or Cisco Discovery Protocol (CDP) packets, or packets with the multicast destination addresses 01-80-C2-00-00-xx (where xx: 00, 02...0F), which are typically used as messages for establishing network structures in a network with a large number of network participants.

[0029] In Fig. 3 is one to Fig. Figure 1 shows an alternative configuration for a motor vehicle 2 with a connected diagnostic device. The connection between the vehicle control unit 3 and the diagnostic device 7 is established via a diagnostic access device 9, which is directly connected to the access point 6 of the motor vehicle 2 by a line 8e. It has an access control 11 with which the Fig. The measures described in section 1 for enabling the transmission of diagnostic data can be carried out. In a first embodiment of the access control 11, the measures described in section 11 can be carried out. Fig. The measures described in section 1 of the vehicle control unit 3 are carried out, in particular enabling the transmission of diagnostic data from the vehicle control unit 3 to the diagnostic device 7. This can occur, for example, when the diagnostic device 7 cyclically switches the transmission speed of the network connection, in the case of the Fig. 3. The transmission speed of the network connection between diagnostic device 7 and diagnostic access device 9. The diagnostic access device 9 can alternatively or additionally send diagnostic data to the diagnostic device 7 via the network connection only if it has previously received a BPDU data packet sent by the diagnostic device 7 that, by its nature, is not forwarded by the network switches.

[0030] In a second embodiment of the access control 11, it can be used to control the in Fig. The measures described in section 1 of the diagnostic device 7 result, in particular, in the cyclical switching of the transmission speed of the network connection from the diagnostic access device 9 to the access point 6. This allows the access control 11 to ensure that the vehicle control unit 3 releases or activates the data interface and that diagnostic data is transmitted directly to the diagnostic device 7 via the coupling arrangement 10 of the diagnostic access device 9. Alternatively or additionally, it can also be provided that the diagnostic access device 9 only sends or forwards diagnostic data to the diagnostic device 7 via the network connection if it has previously received a BPDU data packet that was sent by the diagnostic device 7 and which, by its nature, is not forwarded by the network switches.

[0031] The coupling arrangement 10 can be implemented as a filter and / or switching device, and in particular in the form of a network switch arrangement. The coupling arrangement 10 allows network connections to be established via ports 13, 14, and 15 between the vehicle control unit 3, the diagnostic device 7, and a larger enterprise network 12. The access control 11 also allows the coupling arrangement 10 to be configured so that a direct network connection is established between the vehicle control unit 3 and the enterprise network 12. However, for diagnostics and / or recording of vehicle diagnostic data using the diagnostic device 7, the connection between the vehicle control unit 3 and the enterprise network 12 via ports 13 and 15 is blocked.Thus, on the one hand, it is possible to establish control access to the vehicle 2 via the company network 12, for example to install firmware updates in the vehicle control unit 3 and / or in the component control units 4. On the other hand, it is possible to carry out data transmission between the vehicle control unit 3 and the diagnostic device 7 that is shielded from the company network 12, thereby, for example, protecting the company network 12 from being flooded with diagnostic data from the vehicle control unit 3.

[0032] It is clear that if a direct network connection is established between vehicle control unit 3 and diagnostic device 7 as a point-to-point connection, which is physically or control-wise separated from the company network 12, the connection between vehicle control unit and diagnostic device 7 can be established directly as described above. Fig. 1 can be described. The diagnostic access device 9 can establish a direct point-to-point network connection between the vehicle control unit 3 and the diagnostic device 7 using the coupling arrangement 10, such that only authorized network components, in particular ports 14 and 15, can intervene in the communication of the network connection, but no other network components, in particular port 13 and no components of the company network 12.

[0033] Several measures have been described to establish a direct network connection between a vehicle control unit and a diagnostic device, enabling the seamless exchange of diagnostic data. These measures include both checks for the network connection during its establishment and for monitoring it afterward. Further measures can be implemented. For example, before establishing the network connection, the vehicle control unit can check what type of device will be connected to the network port. If, for instance, a network component with an active wireless connection (WLAN) is connected, access can be blocked entirely.Before or during the activation of data access, the vehicle control unit may actively search for specific network components that are known in advance and incompatible with a direct network connection to the diagnostic device, such as DHCP servers of a previously known corporate network. If such network components are found, access to the vehicle control unit may also be blocked entirely. (Referring to...) Fig.Step 2 could be used to check, even before step S2, whether a legally relevant OBD diagnostic session is in operation. To further secure the verification of a direct connection between the diagnostic device and the vehicle control unit, if the diagnostic device's access line to the vehicle is an OBD line, the diagnostic device could set the OBD activation line to a high-low level in a specific pattern to signal that the diagnostic device is directly connected. Similarly, parallel signaling via an additional data bus (e.g., CAN bus) integrated into the access line would be conceivable to indicate that the connection is direct.

[0034] The described devices and system components are controlled, in particular, by computer programs and may therefore include further elements of computers and digital control devices that are known per se, such as a microprocessor, volatile and non-volatile memory, interfaces, etc. The invention can therefore also be realized wholly or partially in the form of a computer program product that, when loaded and executed on a computer, wholly or partially effects a process according to the invention. It can, for example, be provided in the form of a data carrier such as a CD / DVD or in the form of one or more files on a server from which the computer program can be downloaded.

Claims

[1] Method for connecting a diagnostic device (7) to a vehicle control unit (3) of a motor vehicle (2) via a network connection, wherein, when establishing a connection between the diagnostic device (7) and the vehicle control unit (3), a check is carried out to determine whether the diagnostic device (7) is directly connected to the vehicle control unit (3), and wherein the diagnostic device (7) only receives diagnostic data from the vehicle control unit (3) if the connection is direct, characterized by , - that the vehicle control unit (3) does not output any diagnostic data if it is connected via the network connection to at least one network component that is independent of the diagnostic unit (7) and / or is not authorized, and - that the diagnostic device (7) or a connection device (9) connected between the diagnostic device (7) and the vehicle control unit (3) has a first network connection (8d, 14, 15) for the connection between the vehicle control unit (3) and the diagnostic device (7) and has a second network connection (13) of the same network type for the connection to further network devices (12), wherein the second network connection (13) is at least temporarily physically or functionally separated from the first network connection (8d, 14, 15) in such a way that while a communication connection exists between the diagnostic device (7) and the vehicle control unit (3) via the first network connection (8d, 14, 15), the diagnostic device (7) and / or the vehicle control unit (3) cannot communicate simultaneously via the second network connection (13). [2] Method according to claim 1, characterized bythat the connection is not considered direct and the connecting device (9) does not forward the diagnostic data to the diagnostic device (7) if the connecting device (9) is connected via the network connection to a plurality of network components independent of the diagnostic device (7). [3] Method according to claim 1 or 2, characterized by that for verification purposes, during the establishment of a connection between the diagnostic device (7), the connecting device (9) and / or the vehicle control unit (3), at least one characteristic of the physical connection between the network interfaces (8a, 8d, 14, 15) of the diagnostic device (7), the connecting device (9) and / or the vehicle control unit (3) is switched to predetermined values ​​in a predetermined time sequence, and the connecting device (9) and / or the vehicle control unit (3) only enables complete communication if it receives the predetermined sequence. [4] Method according to claim 3, characterized by that the characteristic of the physical connection is the transmission rate. [5] Method according to one of the preceding claims, characterized by that a network switch (10) is connected between a network interface (8d) of the diagnostic device (7) and a network interface (8a) of the vehicle control unit (3), by means of which the diagnostic device (7) is selectively connected either to the vehicle control unit (3) or to at least one other network device (12). [6] Diagnostic device with means for carrying out a method according to one of claims 1 to 5. [7] Vehicle control device for a motor vehicle, comprising means for carrying out a method according to one of claims 1 to 5. [8] Motor vehicle comprising a vehicle control unit (3) according to claim 7.

Images