Control unit for a vehicle's control system, steering actuator for a vehicle, vehicle, method for a vehicle's control system and computer program

Abstract

A control unit for a vehicle control system is proposed. The control unit comprises a first interface and a second interface. Furthermore, the control unit includes a data processing circuit configured to control the first and second interfaces. The data processing circuit is also configured to send a verification signal indicating a verification parameter and to receive the verification parameter. The verification signal is sent via the first interface, and the verification parameter is received via the second interface.

Description

[0001] The present invention relates to a control unit for a control system of a vehicle, a steering actuator for a vehicle, a vehicle, a method for a control system of a vehicle and a computer program.

[0002] Today's control systems require a high level of safety integrity (ASIL) and therefore design-specific measures such as redundant chains of subcomponents, signal paths, and functional pathways. Such systems and even subsystems are often designed with inadequate protection against tampering in terms of cybersecurity (hardware and software protection). Wire harness connections, in particular, are weakly protected and pose the risk of signal tampering after a connector is removed.

[0003] For example, one communication path is based on a bidirectional bus system (SENT = Single Edge Nibble Transmission, with address-synchronized communication as follows (simplified)). In the event of "manipulation of the steering behavior," the connector of a redundant signal connection could be removed, allowing a trigger sensor signal to be read from the control system and a manipulated signal to be induced into the control system by contacting the open connector with an external hardware component (e.g., a signal generator). Depending on the control system's internal diagnostics, this modification may go undetected and lead to safety-critical failures.

[0004] Against this background, it is an object of the present invention to enable improved monitoring of a control system.

[0005] The object of the invention is achieved by a control unit for a vehicle control system, a steering actuator for a vehicle, a vehicle, a method for a vehicle control system, and a computer program according to the independent claims. Further aspects and developments of the invention are set forth in the dependent claims, the following description, and the figures.

[0006] According to a first aspect of the invention, a control unit for a control system of a vehicle is proposed. The control unit comprises a first interface and a second interface. Furthermore, the control unit comprises a data processing circuit configured to control the first interface and the second interface. The data processing circuit is further configured to send a verification signal indicative of a verification parameter and to receive the verification parameter. The verification signal is sent via the first interface, and the verification parameter is received via the second interface. The first interface and the second interface are two separate interfaces.By sending the verification signal via the first interface and receiving the verification parameter via the second interface, correct contact between the first interface and the second interface can be verified. For example, the control unit can determine a specific assignment of the first interface and the second interface for sending the verification signal and receiving the verification parameter. Accordingly, the control unit can specifically send the verification signal via the first interface and expect the verification parameter to be received via the second interface. If manipulation occurs, for example, an external hardware component is connected to the first interface or the second interface, the external hardware component may lack information about which interface the verification parameter should be sent via.Accordingly, a possible manipulation, for example connecting an external device, can be determined if the verification parameter is not received via the second interface.

[0007] In one embodiment, the data management circuit can be configured to deactivate a portion of the control system if the verification parameter is not received via the second interface within a predefined time after transmission. Deactivating a portion of the control system can prevent misuse. For example, it can prevent data from being read and / or imported from that portion of the control system.

[0008] In one embodiment, the first interface and the second interface can be comprised by an interface module. The control unit can further comprise a further interface module comprising a further interface. The data management circuit can be designed to send a further verification signal indicative of a further verification parameter via the further interface. Furthermore, the data management circuit can be designed to receive the further verification parameter via the interface module. The first interface and the second interface can be comprised by a hardware component, for example a connector. The hardware component can, for example, comprise two pins, i.e. the first interface and the second interface. By using a further interface module, for example, redundancy in the signal transmission can be established.Based on this redundancy, protection against tampering can be improved. In particular, it is possible to check whether a large number of interface modules have not been tampered with. By receiving the additional verification parameter via the interface module, it is possible, in particular, to check whether the additional interface module is correctly connected. If the additional interface module is tampered with, for example, by removing a connector from the additional interface module, the additional verification parameter can no longer be received via the interface module. The use of the additional interface module and the interface module can therefore improve the security of the control system.

[0009] In one embodiment, the additional verification parameter can be received via the second interface or a third interface. For example, the additional verification parameter can be received together with the verification parameter via the second interface of the interface module. This can simplify the design of the interface module. Alternatively, the additional verification parameter can be received via a third interface of the interface module. In particular, the control unit can determine an assignment of the third interface for receiving the additional verification parameter. This allows the control unit to check whether the additional verification parameter was received via the correct interface. This can increase the security of the control system.

[0010] In one embodiment, if the verification parameter or the additional verification parameter is not received via the interface module within a predefined time after transmission, the part of the control system correlated with the verification parameter or the additional verification parameter can be deactivated. This allows a part of the control system to be selectively shut down. For example, the control unit can not receive the additional verification parameter and can selectively deactivate the part of the control system connected to the additional interface module.

[0011] In one embodiment, the data management circuit can be configured to enable data transmission of sensor data via the interface module only after receiving the verification parameter. This ensures that information exchange only takes place once the security of the connection has been verified.

[0012] According to a second aspect of the invention, a steering actuator for a vehicle comprising a control unit as described above is proposed. The control unit can thus be included in a steering actuator, for example, a steering axle or a steering wheel. This can improve the safety of a vehicle's electrical system.

[0013] According to a third aspect of the invention, a vehicle with a control unit as described above or a steering actuator as described above is proposed. In a vehicle, the control unit offers the advantage of increasing the safety of the vehicle's electrical system.

[0014] According to a fourth aspect of the invention, a method for a control unit for a vehicle control system is proposed. The method comprises sending a verification signal via a first interface, the verification signal being indicative of a verification parameter. The method further comprises receiving the verification parameter via a second interface. The first interface is different from the second interface.

[0015] According to a fifth aspect of the invention, a computer program is proposed. The computer program is designed to perform one of the methods described above when the computer program runs on a computer, a processor, or a programmable hardware component.

[0016] The present invention will be described below by way of example only, with reference to the accompanying figures. They show: Fig. 1 shows a block diagram of an embodiment of a control unit for a control system of a vehicle; Fig. 2a-2e show a signal path structure and an existing information exchange from the state of the art; Fig. 3a-3c show an embodiment of a signal path structure according to the invention and an information exchange according to the invention; Fig. 4 shows an embodiment of a vehicle; and Fig. 5 shows a block diagram of an embodiment of a method.

[0017] Fig. Figure 1 shows a block diagram of an embodiment of a control unit 130 for a control system of a vehicle. The control unit 130 includes a first interface 134a and a second interface 134b. Furthermore, the control unit 130 includes a data processing circuit 132 configured to control the first interface 134a and the second interface 134b. The data processing circuit 132 is further configured to send a verification signal indicative of a verification parameter.

[0018] The verification signal may be based on a standard request signal exchanged between a control unit and another component of the vehicle. For example, some communication protocols, particularly those based on a request-response basis, may include some type of coding or identification code. This coding or identification code may serve to identify a request and ensure that the component, such as a sensor, and / or the control unit are exchanging the correct data.

[0019] A control unit can send a request, i.e., a request signal, to a specific sensor. This request can be a specific query for specific data that the control unit requires. The request can include an encoding or identification code that indicates which sensor the request concerns and what type of data is expected. The sensor can receive the request, decode it, evaluate the identification code, and determine what data is requested. The sensor can then respond with the requested data, which can also be encoded or in a specific format. This form of transmission can be used particularly in bidirectional bus systems.

[0020] The verification signal can extend a request signal with the verification parameter. For example, the verification signal comprises a prior art request signal and the verification parameter. In particular, the verification parameter cannot be an encoding of a data request. The verification parameter can be used solely to verify the connectivity between the control unit 130 and another component, for example, a sensor. The verification parameter cannot be linked to the data request. Thus, the control unit 130 can receive the same verification parameter that was sent via the first interface 134a via the second interface 134b.

[0021] Accordingly, the data processing unit 134 is further configured to receive the verification parameter. A verification parameter can be a value, an identifier, or a data structure. The verification parameter can be used in a communication process to verify the integrity, correctness, and / or authenticity of a connection. The verification parameter can be used to verify a correct connection between the control unit 130 and another component of the vehicle.

[0022] The verification signal is sent via the first interface 134a, and the verification parameter is received via the second interface 134b. The first interface 134a and the second interface 134b are two separate interfaces.

[0023] The verification signal and the verification parameter can therefore be used in particular to verify a hardware configuration of the control unit 130 or the control system. For example, the control unit 130 can detect whether a component of the control system of a vehicle, for example an on-board electrical system, connected to the control unit 130 has been disconnected from the control unit 130. This can, for example, detect the loosening or removal of a connector (e.g., by removing a wiring harness) by the control unit 130. Detecting the loosening of a connector can contribute to increasing the safety of the vehicle or the vehicle's control system. In particular, hardware-based manipulation can be made more difficult. The control unit 130 can be used to detect the decoupling of a connection system, e.g., a wiring harness.Furthermore, access to the control unit 130 with manipulated signals can be prevented.

[0024] The control unit 130 can access the existing signal path structure and the existing information exchange as described with reference to Fig. 2. In the existing signal path structure, in particular, only one interface is used for information exchange. It is a finding of the inventors that an additional signal line, the second interface 134b, and the use of a verification parameter can increase the security of the vehicle's control system. In particular, specific processor sense ports for external and internal checks of the verification parameter, as described with reference to Fig. 3. For example, the second interface 134b can be specified for receiving the verification parameter. The interfaces 132a, 132b of the control unit 130 can thus be specified for sending the verification signal or for receiving the verification parameter and / or the further verification parameter.

[0025] By using the control unit 130, wiring harness paths of a vehicle that are connected to other components (e.g., a steering sensor, a steering actuator, an environmental sensor) can be specially protected. This ensures fault-tolerant performance with secure data transmission. In particular, by using the additional verification parameter, fault-tolerant, redundant performance with secure data transmission can be ensured.

[0026] In one embodiment, the data management circuit 134 can be configured to deactivate part of the control system if the verification parameter is not received via the second interface within a predefined time after transmission. For example, the part of the control system that belongs to the control unit 130 can be deactivated. This means that the control unit 130 can be at least partially deactivated. Alternatively, the control unit 130 can be completely deactivated. Optionally or alternatively, a further control unit of the control system can also be at least partially deactivated based on the at least partial deactivation of the control unit 130. For example, the further control unit can be responsible for the same processes or process the same processes as the control unit 130. This means:The additional control unit can be a redundant control unit to the control unit 130. If possible manipulation of the control unit 130 is detected, the redundant additional control unit can also be deactivated at least partially, in particular completely, as a precautionary measure. This can increase the security of the control system.

[0027] In one embodiment, the first interface 134a and the second interface 134b can be comprised of an interface module. The interface module can be a hardware component. The first interface 134a and the second interface 134b can converge in the interface module. For example, the interface module can comprise a housing for the first interface and the second interface. By detaching the interface module, the first interface 134a and the second interface 134b can be detachable simultaneously. The interface module can be, for example, a plug, for example a bus plug, a plug connector, and / or a hybrid plug connector.

[0028] The control unit 130 can further comprise a further interface module comprising a further interface. The further interface module can be formed separately from the interface module. That is, the interface module can be a first hardware component and the further interface module can be a second hardware component. The interface module and the further interface module can be connected separately to the vehicle's control system.

[0029] The data management circuit 134 can be configured to send a further verification signal indicative of a further verification parameter via the further interface. Furthermore, the data management circuit 134 can be configured to receive the further verification parameter via the interface module. By sending a further verification signal via the further interface module, a correct connection of the interface module and / or the further interface module can be verified.

[0030] Optionally or alternatively, the control unit 130 can be used to detect a defect in the first interface 134a and / or the second interface 134b. For example, the first interface 134a can be a connector pin that is no longer functional and is assigned to receive the verification parameter. In a redundant arrangement, the control unit 130 could then still receive the additional verification parameter, but no longer the verification parameter. Receiving only the additional verification parameter could therefore be indicative of a malfunction in the first interface 134a.

[0031] By using the additional verification parameter, the control unit 130 can thus check the individual interfaces at least partially independently of one another. For example, the control unit 130 can only receive the additional verification parameter via the second interface 134b. This allows the control unit 130 to determine that the first interface 134a, via which the first verification parameter is sent, may not be functioning correctly. The control unit 130 could therefore selectively detect a failure of an interface.

[0032] By using the additional verification parameter, a fault-tolerant strategy for a redundant signal path can be maintained. Furthermore, the redundancy of the control system can be ensured in "normal" operating mode.

[0033] In one embodiment, the additional verification parameter can be received via the second interface 134b or a third interface. For example, the additional verification parameter can be multiplexed with the verification parameter and received simultaneously via the second interface 134b. Alternatively, a third interface of the control unit 130 can be used to receive the additional verification parameter. For example, the third interface can be a specific processor sense port for receiving the additional verification parameter. In this case, the second interface 134b can be a specific processor sense port for receiving the verification parameter.

[0034] In one embodiment, if the verification parameter or the additional verification parameter is not received via the interface module within a predefined time after transmission, the part of the control system correlated with the verification parameter or the additional verification parameter can be deactivated. This means that the control unit 130 can be at least partially deactivated if the verification parameter or the additional verification parameter is not received. Alternatively, the control unit 130 can be completely deactivated.

[0035] In one embodiment, the data management circuit 134 can be configured to enable data transmission of sensor data via the interface module only after receiving the verification parameter. This ensures that information exchange only takes place once the security of the connection has been verified.

[0036] As in Fig. 1, the interface 134 may be coupled to the respective data processing circuitry 132 of the control unit 130. In examples, the control unit 130 may be implemented by one or more processing units, one or more processing devices, any means of processing, such as a processor, a computer, or a programmable hardware component operable with appropriately adapted software. Likewise, the described functions of the data processing circuitry 132 may also be implemented in software, which is then executed on one or more programmable hardware components. Such hardware components may be a general-purpose processor, a digital signal processor (DSP), a microcontroller, etc.The data processing circuit 132 may be capable of controlling the interface 134 such that any data transfer that occurs over the interface 134 and / or any interaction that may involve the interface 134 may be controlled by the data processing circuit 132.

[0037] In one embodiment, the control unit 130 may include a memory 136 and at least one data processing circuit 132 operatively coupled to the memory 136 and configured to perform the method described below.

[0038] In examples, interface 134 may correspond to any means for obtaining, receiving, transmitting, or providing analog or digital signals or information, e.g., any terminal, contact, pin, register, input terminal, output terminal, conductor, trace, etc., that enables the provision or receipt of a signal or information. Interface 134 may be wireless or wired and may be configured to communicate with other internal or external components, e.g., to send or receive signals or information.

[0039] Although the exemplary embodiments describe that the verification signal also includes data other than the verification parameter, the verification signal is not limited to this. Alternatively, the verification signal may not be based on a prior art request signal. For example, the verification signal may only include the verification parameter. The verification parameter may therefore be sent separately from other data, such as a data request.

[0040] The control unit can be a central control unit of a vehicle or be included in it.

[0041] Fig. 2a-2e show a signal path structure and an existing information exchange from the state of the art.

[0042] In Fig. Figure 2a shows a basic configuration of a vehicle's electrical system known from the prior art. The electrical system includes a control unit 200 (also known as an electronic control unit, ECU), a sensor system 202, and connecting elements 204. Fig. Figure 2a shows a prior art redundant sensor system in conjunction with a redundant connection system to the control unit 200. For illustrative purposes, only the signal transmission, power supply 206 and ground (GND) connections 208 are shown.

[0043] As in Fig. As can be seen in Figure 2b, the signal path is based on a modern bidirectional bus system (SENT = Single Edge Nibble Transmission, with address-synchronized communication). The signal can be interpreted as a request signal.

[0044] Fig. Figure 2c shows a data request from control unit 202, enabled by a first or second trigger event. The data request is intended for a first sensor or a second sensor, respectively.

[0045] Fig. Figure 2d shows a data transmission from the respective sensors. The data transmission is enabled by a respective trigger event and intended for control unit 200.

[0046] Fig. Figure 2e shows an example in which a connection of a first interface module 204 to the vehicle electrical system has been removed. Furthermore, an external hardware component 290 has been connected to the first interface module 204. Based on the Fig. 2, the control unit 200 can be manipulated by means of the external hardware component 290. Therefore, a control unit according to the invention can be used to increase the security of a vehicle's electrical system. The use of two control units according to the invention for an electrical system with a redundant part is described in Fig. 3 shown.

[0047] Fig. 3a-3c show an embodiment of a signal path structure according to the invention and an information exchange according to the invention.

[0048] Fig. 3a shows a transmission signal based on the request signal (data request) from Fig. 2b. The transmission signal additionally includes a verification parameter.

[0049] As in Fig. As shown in Figure 3b, before the sensor data is exchanged on the connections for a first sensor 370 and a second sensor 372, several verification signals can be sent. A verification parameter (as part of the verification signal), i.e., an individual random digital code, can be sent via each connection or signal path 340, 342. The verification signal can be sent via signal path 340, and the additional verification signal can be sent via signal path 342. The verification parameters can be received again via separate connections or signal paths 350, 352, 354, 356. The verification parameter can be received via signal paths 350, 352, and the additional verification parameter can be received via signal paths 354, 356.

[0050] Each verification parameter can be returned via both wiring harnesses 360, 362. The control unit 300 can compare the received verification parameters with the "sense" ports, i.e., the assigned interfaces 380, 382. If the verification parameters have been received at the correct interfaces, the control unit 300 can authorize the data request and the sensor data transmission. This allows data exchange to occur.

[0051] For illustration purposes, only the signal transmission, power supply 306 and ground (GND) connections 308 are shown.

[0052] Fig. 3c shows a shutdown of part of the control unit 300 during tampering. If a connection, i.e., the cable harness 360, of the first interface module 396 of the control unit 300 is severed, for example, unplugged or was not contacted, no verification parameter is received at the second interface 380 and the third interface 382. To prevent further tampering, such as signal induction, the control unit 300 can be at least partially deactivated. In particular, a part of the control unit connected to the interface module 396 can be deactivated. Optionally, system-critical parts of the control unit, for example, a drive stage, can be deactivated. Deactivation can occur if the received verification parameter differs from the sent verification parameter or is not received at all.

[0053] An induced verification parameter on the sense line is also not accepted by the control unit 300, since the randomly generated verification parameter can also be checked internally in the control unit.

[0054] By disconnecting the two cable harnesses 360, 362, both drive stages can be blocked and all communication interrupted. The control unit 300 can then switch to a safe mode, for example, by going offline. The control unit 300 can thus be completely deactivated.

[0055] In addition, the loss of a connector or improper insertion of a connector can also be detected. This prevents a faulty connection from affecting the fault-tolerant strategy and diagnostics integrated into the control unit 300 during operation.

[0056] For example, only one defective interface can be selectively detected. For example, the control unit can receive both verification parameters via the second interface module 398 and only receive the first verification parameter at the second interface 380 via the first interface module. Accordingly, the control unit 300 could determine that the third interface 382 is defective.

[0057] Although the exemplary embodiments describe that the verification signal also includes data other than the verification parameter, the verification signal is not limited to this. Alternatively, the verification signal may not be based on a prior art request signal. For example, the verification signal may only include the verification parameter. The verification parameter may therefore be sent separately from other data, such as a data request.

[0058] Fig. 4 shows an embodiment of a vehicle 400. The vehicle includes a steering actuator 410 configured to drive a steering axle of the vehicle 400. The steering actuator 410 or the vehicle 400 includes a control unit 420, such as described with reference to Fig. 1. Especially in the field of vehicle use, the control unit 420 according to the invention offers additional advantages: The security of the vehicle's electrical system 400 can be improved. Manipulation of a connection between various components of the vehicle 400, e.g., a wiring harness, can be made more difficult.

[0059] Fig. 5 shows a block diagram of an embodiment of a method 500. The method 500 is for a control unit for a control system of a vehicle. The method 500 comprises sending 510 a verification signal via a first interface, the verification signal indicative of a verification parameter. Furthermore, the method 500 comprises receiving 520 the verification parameter via a second interface. The first interface is different from the second interface. The method can be carried out by a control unit as described above, for example with reference to Fig. 1 described.

[0060] Further embodiments are computer programs for carrying out one of the methods described herein when the computer program runs on a computer, a processor, or a programmable hardware component. Depending on specific implementation requirements, embodiments of the invention can be implemented in hardware or in software. The implementation can be carried out using a digital storage medium, for example a floppy disk, a DVD, a Blu-ray disc, a CD, a ROM, a PROM, an EPROM, an EEPROM or a FLASH memory, a hard disk, or another magnetic or optical storage device on which electronically readable control signals are stored that can interact or interact with a programmable hardware component in such a way that the respective method is carried out. Reference symbol (part of the description): 130 Control unit 132a first interface 132b second interface 134 Data processing circuit 136 memory 200 control unit 202 Sensor system 204 connecting element 206 Power supply 208 Ground connection 300 control unit 302 Sensor system 306 Power supply 308 Ground connection 360, 362 wiring harness 340, 242 Signal path verification signal 350, 352, 354, 356 Signal path verification parameters 370, 372 Sensor 396, 398 interface 400 vehicles 410 Steering actuator 420 control unit 500 procedures for a control unit 510 Sending a verification signal 520 Receiving a verification parameter

Claims

[1] A control unit for a control system of a vehicle, comprising: a first interface (132a) and a second interface (132b); and a data processing circuit configured to control the first interface (132a) and the second interface (132b) and: to send a verification signal, the verification signal being indicative of a verification parameter; to receive the verification parameter, where the verification signal is sent via the first interface (132a) and the verification parameter is received via the second interface (132b). [2] The control unit (130) according to claim 1, wherein the data processing circuit is configured to deactivate a part of the control system if the verification parameter is not received via the second interface (132b) within a predefined time after transmission. [3] The control unit (130) according to any one of the preceding claims, wherein the first interface (132a) and the second interface (132b) are comprised of an interface module; wherein the control unit (130) further comprises a further interface module comprising a further interface; wherein the data processing circuit is designed to: to send a further verification signal indicative of a further verification parameter via the further interface; and to receive the further verification parameter via the interface module. [4] The control unit (130) according to claim 3, wherein the further verification parameter is received via the second interface (132b) or a third interface. [5] The control unit (130) according to claim 3 or 4, wherein if the verification parameter or the further verification parameter is not received via the interface module within a predefined time after transmission, only the part of the control system that is correlated with the verification parameter or the further verification parameter is to be deactivated. [6] The control unit (130) according to one of the preceding claims, wherein the data processing circuit is designed to enable data transmission of sensor data via the interface module only after receiving the verification parameter. [7] A steering actuator (410) for a vehicle (400), comprising a control unit (130) according to any one of the preceding claims. [8] A vehicle (400) comprising a control unit (130) according to any one of claims 1-6 or a steering actuator (410) according to claim 7. [9] A method (500) for a control unit for a control system of a vehicle, comprising: Sending (510) a verification signal via a first interface, the verification signal indicative of a verification parameter; and Receiving (520) the verification parameter via a second interface. [10] A computer program for performing one of the methods (500) according to claim 9, when the computer program runs on a computer, a processor, or a programmable hardware component.

Images