Control of a motor vehicle

Abstract

A motor vehicle (105) comprises a control element (140) that can be operated by a driver (130). A method (200) for controlling the motor vehicle (105) comprises steps of acquiring (210) a temporal sequence (305-320) of a control value that may be provided by the control element (140); determining (220) whether the sequence (305-320) contains at least one predetermined characteristic indicating that the control value was effected by the driver (130); and determining (230) that the control value has been manipulated if none of the predetermined characteristics could be found.

Description

[0001] The present invention relates to the control of a motor vehicle. In particular, the invention relates to determining a manipulated control value for controlling the motor vehicle.

[0002] A motor vehicle comprises numerous systems, subsystems, and sensors that interact to control the vehicle. Often, one or more interfaces are provided that can allow the wired or wireless connection of another device. For example, an attacker can use such an interface to penetrate and manipulate a processing system of the vehicle. For example, the attacker can execute a function that influences the movement of the vehicle, such as changing a steering angle or controlling a drive or braking system. This can pose a danger to a person on board or in the vicinity of the vehicle.

[0003] One object underlying the present invention concerns the provision of an improved technology for securing a motor vehicle against unauthorized control. The invention achieves this object by means of the subject matter of the independent claims. Subclaims specify preferred embodiments.

[0004] A motor vehicle includes a control element operable by a driver. According to a first aspect of the present invention, a method for controlling the motor vehicle comprises the steps of detecting a time history of a control value, which may be provided by the control element; determining whether the history contains at least one predetermined characteristic indicating that the control value was caused by the driver; and determining that the control value has been tampered with if none of the predetermined characteristics could be found.

[0005] It has been found that the way in which a control value changes over time can be characteristic of whether the control value is physically controlled by a human or controlled by some other means, such as programmatically. Based on the temporal progression, it can thus be determined whether the control value is likely controlled by the driver or by an attacker who can manipulate the control value. The genuine, driver-controlled progression can contain numerous details that may be missing in a replica.

[0006] In a further development of the invention, it can also be determined that the control value has been manipulated if fewer than a predetermined number of characteristics could be found over time. Multiple characteristics can also be weighted individually. The weight of a characteristic found over the course of the control signal can be multiplied by one, and the weight of a characteristic not found can be multiplied by zero. The sum of the resulting weights can then be compared to a threshold value. If the threshold value is not reached by the sum, it can be determined that the control value has been manipulated.

[0007] The method can be used to detect malicious code loaded into a motor vehicle's processing system that can imitate or modify individual values ​​or perform individual functions. The method can also be used to detect control of the control value by a person outside the motor vehicle. Since the remote person operates in a different context and typically does not have a comparable control element available or cannot operate it in the same way as a driver of the motor vehicle, the authenticity of the control value can be determined based on the history.

[0008] The characteristic can include a rate of change, an absolute value, a noise component, a noise distribution, a duration, or a monotony of the control signal. For each tested property, it can be determined whether it exceeds a predetermined minimum value and / or lies below a predetermined maximum value. The noise distribution can indicate, for a number of frequency ranges, how strongly noise frequencies are represented in the control signal. For example, it can be determined whether frequencies in a predetermined frequency range are particularly strong or particularly weak. If the noise distribution does not correspond to a predetermined distribution, the characteristic may not be fulfilled. The monotony can indicate whether the signal behaves monotonously or strictly monotonously. For a fluctuating signal, it can be determined how often it fluctuates within a certain time period or how strong the fluctuations are.Absolute values ​​or rates of change can be taken into account.

[0009] The control element can comprise a brake pedal, an accelerator pedal, a clutch pedal, or a gear selector lever. Preferably, any control element that the driver can operate intentionally, for example, with a hand or a foot, is used. It is further preferred that the control element provide a control value in analog or multi-stage form to allow for improved analysis of the temporal progression.

[0010] The motor vehicle may further comprise a sensor for scanning the driver. The method may include a temporal progression of a sensor value of the sensor; wherein it is determined that the control value has been manipulated if a predetermined relationship between the temporal progressions of the control value and the sensor value is not maintained.

[0011] For example, the control value can act on the motor vehicle in such a way that the sensor value is influenced by the control value. If the control value relates to a steering angle, for example, a change in the control value can lead to centrifugal forces acting on the driver, so that the sensor value can reflect the centrifugal force. In the selected example, the relationship between the control value and the sensor value depends on the driving speed of the motor vehicle. The relationship is known and can be determined either mathematically or experimentally. If the relationship between the control value and the sensor value deviates from a predetermined relationship by more than a predetermined amount, it can be determined that the control signal has been manipulated.

[0012] The control signal may be dependent on an actuating force applied by the driver to the element; and the sensor value may be dependent on a supporting force between the driver and the motor vehicle. For example, the sensor may comprise a pressure sensor between the driver and the motor vehicle, for example in the form of a pressure-sensitive mat incorporated into a driver's seat. The mat may comprise one or more pressure sensors that may be distributed throughout a seat surface. If the driver presses a pedal with a foot, they can support themselves against the motor vehicle via the seat. The pressure sensors can provide an indication of a supporting force. If the supporting force deviates by more than a predetermined amount from a supporting force determined on the basis of the control signal, it can be determined that the control signal has been tampered with.

[0013] If the motor vehicle is stationary while the control value is determined to be manipulated, the vehicle can be prevented from moving. For example, starting a drive motor or changing a steering angle can be prevented.

[0014] In one embodiment, it is necessary to perform a predetermined control using the control element to start the motor vehicle. For example, it may be necessary to operate a clutch pedal or a brake pedal to start an internal combustion engine. If the control signal indicates an operation, but a characteristic is missing that indicates that the operation was actually performed by the driver, the motor vehicle can be immobilized in place. Personal injury or property damage due to a collision can thus be virtually eliminated. It can also significantly complicate the theft of the motor vehicle.

[0015] The motor vehicle can be placed in a secure state if the control value is determined to be tampered with while the motor vehicle is in motion. An attack on the motor vehicle can be particularly dangerous if the motor vehicle is already in motion. For example, an attacker could be driving another motor vehicle and penetrate the motor vehicle's processing system via a wireless interface. In such a case, the motor vehicle can be secured, for example, by slowing it down. Optionally, the motor vehicle can be driven closer to the edge of the road and, optionally, further stopped.

[0016] A signal can be provided as an indication of the potential attacker. In various embodiments, the signal can be emitted acoustically, visually, or haptically, or it can be directed to an interior or exterior of the motor vehicle. The signal can also be directed to a control system on board the motor vehicle and evaluated, for example, by another control device.

[0017] In a further embodiment, automatic control of the motor vehicle can be terminated if the control value is determined to be manipulated. For example, a speed assistant, a lane keeping assistant, or a parking or reversing assistant can be deactivated. The driver can immediately assume control of the motor vehicle, thus reducing the risk of unauthorized control of the motor vehicle.

[0018] According to a further aspect of the present invention, a device for controlling a motor vehicle, which includes a control element operable by a driver, comprises: a detection device for detecting a temporal progression of a control value that may be provided by the control element; and a processing device. The processing device is configured to determine a predetermined characteristic in the progression, wherein the characteristic indicates that the control value was caused by the driver; and to determine that the control value has been tampered with if none of the predetermined characteristics could be found.

[0019] The processing device can be located on board the motor vehicle and perform the described processing directly there. In another embodiment, the processing device is located at an external location outside the motor vehicle. The processing can be implemented, for example, by a server or a service in a cloud. A result of the processing can be transmitted back to the motor vehicle. This can make it easier to train or educate the processing device to make a clear distinction between a human-made and an artificially generated control value.

[0020] The processing device is preferably configured to partially or completely execute a method described herein. For this purpose, the processing device can be implemented electronically and, for example, comprise an integrated circuit, a programmable logic module, or a programmable microcomputer. The method can be implemented in the form of a configuration or as a computer program product with program code means for the processing device. The configuration or the computer program product can be stored on a computer-readable data carrier. Features or advantages of the method can be transferred to the device, or vice versa.

[0021] The processing device may comprise an artificial neural network (ANN) trained to determine whether a temporal progression of a control value exhibits at least one predetermined characteristic. The network may be trained based on control signals acquired on board a plurality of motor vehicles while the control signals were safely controlled by drivers. The network may also be trained based on control signals that do not originate from drivers of the motor vehicles and are, for example, provided programmatically. The network may be trained using supervised learning to distinguish a genuine control signal, i.e., one controlled by a driver of the motor vehicle, from a manipulated control signal, which is, for example, programmatically controlled.

[0022] The device can include an interface for connection to a control device for controlling the motor vehicle. This allows the motor vehicle to be controlled more effectively into a safe state if a manipulated control signal has been detected. The safe state can include deceleration, slow driving, or stopping. The safe state can also include deactivation of one or more control systems designed to assist a driver in controlling the motor vehicle. Such control systems can, in particular, intervene in the longitudinal or lateral control of the motor vehicle.

[0023] According to yet another aspect of the present invention, a motor vehicle comprises a device described herein. The motor vehicle may, in particular, comprise a motorcycle, a passenger car, a truck, or a bus.

[0024] The invention will now be described in more detail with reference to the accompanying drawings, in which: Fig. 1 a device on board a motor vehicle; Fig. 2 a flow diagram of a method; and Fig. 3 exemplary control signal curves illustrated.

[0025] Fig. 1 shows a device 100 on board a motor vehicle 105. The motor vehicle 105 may include a processing system 110, which may include a control device 115 and / or an interface 120. The processing system 110 may be configured to control the motor vehicle 105, in particular to control a movement of the motor vehicle 105 in the longitudinal and / or transverse direction. The processing system 110 may include a data bus 125 for communication between components or for communication with another device on board the motor vehicle 105.

[0026] A driver 130 of the motor vehicle 105 can sit in a driver's seat 135 and control the motor vehicle 105 by actuating a control element 140. A first exemplary control element 140 comprises a steering wheel, and a second exemplary control element 140 comprises a pedal, in particular a clutch pedal or a brake pedal. Other control elements 140 are also possible.

[0027] The control element 140 can act on an actuator of the motor vehicle 105. Optionally, a control value is determined based on an actuation of the control element 140. The control value can be evaluated to support an actuation of the actuator. For example, the steering wheel can act directly on a steering gear to change a steering angle of steered wheels. At the same time, a steering force or a steering wheel angle can be determined, and electric or hydraulic steering assistance can contribute to controlling a desired steering angle. Should the steering assistance fail, the desired steering angle can still be set manually. A similar procedure can be followed with regard to the actuation of a brake using a brake pedal.

[0028] The device 100 comprises a processing device 145 configured to determine a temporal profile of a control signal, which may be caused by a control element 140. In particular, the processing device 145 is configured to determine, based on a profile, whether the control signal was—probably—controlled by the driver 130 using the control element 140 or, for example, originated from the processing system 110 through manipulation. If manipulation is determined, a corresponding signal can be output via an optional interface 150. The interface 150 can be connected to the processing system 110, and the processing device 145 can control a predetermined function of the motor vehicle 105 or prevent the control of a predetermined function.

[0029] Optionally, a sensor 155 is provided, which is configured to sense the driver 130. In this case, the sensor 155 is embodied as an occupancy sensor or pressure sensor to determine the occupancy state of the driver's seat 135. Several pressure sensors can be provided, which can determine partial loads of the driver 130 on the driver's seat 135 at different locations. In one embodiment, the sensor 155 can be used to determine a supporting force on the driver 130 relative to the motor vehicle 105. In another embodiment, a distribution of the supporting force can also be determined.

[0030] Fig. 2 shows a flowchart of an exemplary method for controlling a motor vehicle 105. In a step 205, an impending start-up of the motor vehicle 105 can be determined. At this time, the motor vehicle 105 can be stationary, and the start-up can include starting a drive motor or aligning steered wheels in a direction of travel.

[0031] In a step 210, a control signal, which can be controlled by the driver using a control element 140, and optionally a sensor signal from a sensor 155 can be detected. Multiple control signals and / or multiple sensor signals can also be detected. More preferably, temporal profiles of the signals are detected.

[0032] In a step 215, it can be determined whether two signals correspond to each other. This is the case if the signals maintain a predetermined relationship and do not deviate from it by more than a predetermined amount. The relationship can, for example, include equivalence or direct proportionality.

[0033] Furthermore, in a step 220, it can be determined whether a temporal profile of a signal, in particular a control signal, is realistic. This is the case if at least one predetermined characteristic can be determined from the profile, which indicates that the control signal is controlled by a human, and in particular by a driver 130 of the motor vehicle 105. For this purpose, several characteristics can be predetermined.

[0034] If it has been determined in step 215 that the signals correspond to one another and in step 220 that a signal is realistic, then in a step 225, the start-up of the motor vehicle 105 can be permitted. In one embodiment, no further intervention in the control of the motor vehicle 105 can take place for this purpose. Otherwise, if it has been determined in step 215 that the signals do not correspond to one another or in step 220 that a signal is not realistic, then in a step 230, start-up of the motor vehicle 105 can be prevented. For example, it can prevent a drive motor of the motor vehicle 105 from being started, a vehicle door from being closed, or a steering angle from falling below a predetermined value.

[0035] Method 200 can also be executed while the motor vehicle 105 is moving. In this case, steps 205 and 230 can be omitted. Instead, in a step 235, the motor vehicle 105 can be brought into a safe state, which can include, for example, slowing down, driving at a predetermined maximum speed, stopping, or deactivating a driver assistance system.

[0036] Fig.3 shows exemplary curves of control signals on board the motor vehicle 105. A first curve 305 and a second curve 310 can be unrealistic and controlled with the mathematical precision of a process. The first curve 305 transitions abruptly from a first to a second value, and a rate of change can exceed a predetermined threshold. The second curve 310 is less steep but runs linearly between the first and second values, so that at the beginning and end of the change, a change in the rate of change (the second derivative of the signal, the jerk) can be large. This is at least atypical for human operation. Furthermore, both curves 305, 310 are practically noise-free; the signals are apparently neither subject to measurement noise nor to inaccurate or difficult-to-reproduce operation.

[0037] A third curve 315 and a fourth curve 320 each carry at least one characteristic indicating that the corresponding control signal is controlled by a driver 130 on board the motor vehicle 105. The third curve 315 follows the shape of an S-curve. It is superimposed with a certain amount of noise, with the amount of noise being within predetermined limits. A rate of change is within predetermined limits.

[0038] The fourth curve is similar to the third, except that this curve includes a short passage in which the control value drops briefly before rising again. Such irregularities can be typical of human activity. For example, the driver 130 may have slipped slightly off a pedal at this point of actuation, a driving situation may have caused him to hesitate, or he may have deliberately steered the motor vehicle 105 in the manner shown. Reference symbol 100 device 105 Motor vehicle 110 Processing system 115 Control device 120 interface 125 data bus 130 drivers 135 Driver's seat 140 Control 145 Processing device 150 interface 155 Sensor 200 procedures 205 Record commissioning 210 Control signal, sample sensor signal 215 signals correspond to each other? 220 Course of a control signal is realistic? 225 Allow commissioning 230 Prevent commissioning 235 Bring the vehicle into a safe condition 305 first course 310 second course 315 third course 320 fourth course

Claims

[1] Method (200) for controlling a motor vehicle (105) comprising a control element (140) operable by a driver (130); the method (200) comprising the following steps: - detecting (210) a time profile (305-320) of a control value that may be provided by the control element (140); - determining (220) whether the curve (305-320) contains at least one predetermined characteristic indicating that the control value was effected by the driver (130); - determining (230) that the control value is manipulated if none of the predetermined characteristics could be found. [2] The method (200) of claim 1, wherein the characteristic comprises a rate of change, an absolute value, a noise component, a noise distribution, a duration and / or a monotony of the control signal. [3] Method (200) according to claim 1 or 2, wherein the control element (140) comprises a brake pedal, an accelerator pedal, a clutch pedal and / or a gear selector lever. [4] Method (200) according to one of the preceding claims, wherein the motor vehicle (105) comprises a sensor (155) for sensing the driver (130); wherein a temporal profile (305-320) of a sensor value of the sensor (155) is determined; wherein it is determined that the control value is manipulated if a predetermined relationship between the temporal profiles of the control value and the sensor value is not maintained. [5] The method (200) according to claim 4, wherein the control signal is dependent on an actuating force applied to the element by the driver (130); wherein the sensor value is dependent on a supporting force between the driver (130) and the motor vehicle (105). [6] Method (200) according to one of the preceding claims, wherein the motor vehicle (105) is prevented (230) from being started if the control value is determined to be manipulated while the motor vehicle (105) is at a standstill. [7] Method (200) according to one of the preceding claims, wherein the motor vehicle (105) is brought into a safe state (235) if the control value is determined to be manipulated while the motor vehicle (105) is in motion. [8] Method (200) according to one of the preceding claims, wherein an automatic control of the motor vehicle (105) is terminated (235) if the control value is determined to be manipulated. [9] Device (100) for controlling a motor vehicle (105), comprising a control element (140) operable by a driver (130); the device (100) comprising: - a detection device for detecting a time profile (305-320) of a control value which can be provided by the control element (140); and - a processing device (145) configured to determine a predetermined characteristic in the history (305-320), the characteristic indicating that the control value was effected by the driver (130); and to determine that the control value has been tampered with if none of the predetermined characteristics could be found. [10] The apparatus (100) of claim 9, wherein the processing means (145) comprises an artificial neural network trained to determine whether a time course (305-320) of a control value has at least one predetermined characteristic. [11] Device (100) according to claim 9 or 10, further comprising an interface (150) for connection to a control device (115) for controlling the motor vehicle (105). [12] Motor vehicle (105) comprising a device (100) according to one of claims 9 to 11.

Images