DRIVING SAFETY SYSTEM WITH SECURE TRANSMISSION CHANNEL

Abstract

Disclosed is a driving safety system (100) for a motor vehicle (200), comprising at least one wheel speed sensor (111) configured to determine the current actual wheel speed of a wheel (121), and a driving safety control unit (130) configured to receive a wheel speed signal generated by the wheel speed sensor (111), wherein the wheel speed signal represents a determined actual wheel speed. The wheel speed signal is transmitted via an unsecured transmission channel (131) between the wheel speed sensor (111) and the driving safety control unit (130). The driving safety control unit (130) is configured to receive a travel signal (150) that correlates with the current actual speed of the vehicle (200) and to compare the travel signal (150) with the wheel speed signal in order to check the wheel speed signal for plausibility.The movement signal (150) is transmitted to the driving safety control unit (130) via a secure transmission channel (160).

Description

[0001] The innovative concept described herein relates to a driving safety system for a vehicle, such as ABS (anti-lock braking system), ASR (anti-skid control) and ESP (electronic stability program), whereby a signal indicating the wheel speed, the speed or the acceleration of the vehicle is transmitted to the associated control unit via a secure transmission channel.

[0002] The aforementioned driving safety systems, such as ABS, ASR and ESP, are now fitted as standard in almost every modern vehicle and in some cases are even required by law. Known driving safety systems use the wheel speed signal from corresponding wheel speed sensors located in the immediate vicinity of a wheel. For this purpose, incremental gears or magnetic encoders or pole wheels, for example, can be mounted on the wheel axle and rotate along with the wheel axle or wheels. The respective wheel speed sensor measures the wheel speed using the incremental gear or pole wheel and transmits this wheel speed signal to one or more control units, such as the ABS or ESP control unit.

[0003] Wheel speed sensors are usually simple inductive or magnetoresistive sensors that transmit the detected speed signal to the respective control unit via a conventional two-wire cable. This type of wheel speed sensor is very cost-effective, making it ideal for use in mass-produced vehicles. Furthermore, these sensors exhibit very low latency, which is particularly important for driver safety systems such as ABS, ESP, or ASR.

[0004] With the increasing electrification of today's vehicles, the detected wheel speed signal can also be used for other purposes. For example, the actual speed of the vehicle can be determined based on the detected wheel speed, which in turn can be used to implement electronically implemented speed limits or to determine mileage.

[0005] Due to the aforementioned simple design of the wheel speed sensors, as well as the use of insecure standard transmission protocols, conventional wheel speed sensors are an easy target for tampering, usually by criminals. In these attacks, so-called man-in-the-middle attacks are used to intercept or manipulate the data traffic between the wheel speed sensors and the respective control unit. By manipulating the wheel speed signal, for example, an electronically implemented speed limit can be circumvented or the actual mileage can be reduced. In particularly serious situations, the driving safety systems (e.g., ABS, ESP, ASR) or a speed-dependent drive-by-wire steering system can be disrupted or deliberately deactivated, which can lead to uncontrollability of the vehicle and thus to serious accidents.

[0006] For this reason, the ISO 21434 standard, which addresses cybersecurity in vehicles, was developed. However, the ISO 21434 standard does not provide a solution to the aforementioned problem of man-in-the-middle attacks on standardized wheel speed sensors.

[0007] It is therefore the aim of the innovative concept described herein to provide a driving safety system for a motor vehicle which solves the problems mentioned above.

[0008] This object is achieved by a driving safety system according to claim 1 and by a corresponding method according to claim 15.

[0009] The innovative driving safety system has at least one wheel speed sensor designed to determine the current actual wheel speed of a wheel. Furthermore, the driving safety system has a driving safety control unit configured to receive a wheel speed signal generated by the wheel speed sensor, wherein the wheel speed signal represents a determined actual wheel speed. The wheel speed signal is initially transmitted via an unsecured transmission channel between the wheel speed sensor and the driving safety control unit. However, according to the innovation, the driving safety control unit is configured to receive a movement signal that correlates with the current actual speed of the vehicle and to compare the movement signal with the wheel speed signal in order to check the wheel speed signal for plausibility.The movement signal is transmitted to the driving safety control unit via a secure transmission channel.

[0010] Furthermore, a method for checking the plausibility of a wheel speed signal received from a wheel speed sensor via an insecure transmission channel in a driving safety system for a motor vehicle is proposed. The method includes, among other things, receiving the wheel speed signal from the wheel speed sensor, wherein the wheel speed signal represents the determined actual wheel speed, and wherein the wheel speed signal is transmitted via an insecure transmission channel. According to the innovation, a movement signal is also received that indicates the current actual speed of the vehicle, wherein the movement signal is transmitted via a secure transmission channel. The wheel speed signal received via the insecure transmission channel is then compared with the movement signal transmitted via the secure transmission channel in order to check the wheel speed signal for plausibility.

[0011] Further embodiments and advantageous aspects of this driving safety system and of the corresponding method for plausibility testing are mentioned in the respective dependent patent claims.

[0012] Some exemplary embodiments are shown in the drawings and are explained below. They show: Fig. 1 a schematic partially transparent plan view of a vehicle with a conventional driving safety system according to an example, Fig. 2 a schematic partially transparent plan view of a vehicle with a driving safety system according to an embodiment, Fig. 3 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 4 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 5 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 6 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 7 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 8 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 9 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, Fig. 10 a schematic partially transparent plan view of a vehicle with a driving safety system according to a further embodiment, and Fig. 11 is a schematic block diagram illustrating a method according to a further embodiment.

[0013] In the following, embodiments are described in more detail with reference to the figures, wherein elements with the same or similar function are provided with the same reference numerals.

[0014] Method steps depicted or described within the scope of the present disclosure may also be performed in a different order than that depicted or described. Furthermore, method steps relating to a specific feature of a device are interchangeable with that same feature of the device, and vice versa.

[0015] In the exemplary embodiments described herein, it is shown purely schematically that a wheel speed sensor is arranged on each individual wheel of a vehicle. However, this is not to be understood as limiting. The innovative concept presented here also generally works with just a single wheel speed sensor arranged on a single wheel of a vehicle.

[0016] Fig. 1 initially shows a schematic, partially transparent top view of a vehicle 20 equipped with a conventional driving safety system 10. The driving safety system 10 can, for example, be a conventional ABS, ESP, or ASR system.

[0017] The driving safety system 10 has four wheel speed sensors 11, 12, 13, 14, which are also labeled S1, ..., S4. Each sensor 11, 12, 13, 14 is assigned to exactly one wheel 21, 22, 23, 24.

[0018] Each wheel speed sensor 11, 12, 13, 14 is connected to a control unit 30 via an unsecured physical signal line 31, 32, 33, 34, for example, using a simple two-wire cable. The control unit 30 is also referred to as an ECU (Electronic Control Unit). The wheel speed sensors 11, 12, 13, 14 can communicate with the control unit 30 via these signal lines 31, 32, 33, 34 and transmit their respective detected speed signals to the control unit 30.

[0019] Transmission typically occurs via a pulse interface. This is continuous-value and continuous-time, as the actual information is transmitted in the time between two consecutive pulses, but two or three discrete current levels are used. In addition, additional information, such as the direction of rotation, is transmitted digitally in the case of an AK protocol, and discretely in the form of different pulse lengths in the case of a PWM protocol.

[0020] As previously mentioned, the signal lines 31, 32, 33, and 34 are unsecured transmission channels. This means that the wheel speed data detected by the respective speed sensors 11, 12, 13, and 14 are transmitted in the form of unsecured analog and / or digital signals to the control unit 30. This unsecure transmission channel makes the entire driving safety system 10 vulnerable to unauthorized cybersecurity attacks at precisely this point, as discussed in the introduction to this publication.

[0021] For example, the signal lines 31, 32, 33, 34 can be tapped or interrupted, allowing the unsecured communication between the wheel speed sensors 11, 12, 13, 14 and the control unit 30 to be intercepted or manipulated. This form of cyber attack is also referred to as a man-in-the-middle attack. Such a man-in-the-middle attack can be implemented with conventional wheel speed sensors 11, 12, 13, 14 by simply cutting the physical signal lines 31, 32, 33, 34. Since this could lead to the manipulation of driving safety-relevant systems, this poses an increased security risk.

[0022] Fig. Figure 2 shows an embodiment of an innovative driving safety system 100 with which the aforementioned cybersecurity problems can be solved. The driving safety system 100 can be installed in any motor vehicle 200, such as a passenger car (car) or a truck (lorry), but also in a two-wheeler. Within the present disclosure, the innovative driving safety system 100 is discussed using the non-limiting example of a passenger car 200.

[0023] The driving safety system 100 has at least one wheel speed sensor 111, which is also represented here by the symbol S1. The wheel speed sensor 111 is configured to determine the current actual wheel speed of a wheel 121. This can be a driven wheel or a non-driven wheel.

[0024] The driving safety system 100 also includes a driving safety control unit 130 configured to receive a wheel speed signal generated by the wheel speed sensor 111, wherein the wheel speed signal represents a determined actual wheel speed.

[0025] The wheel speed signal can be transmitted, as usual, via an unsecured transmission channel 131 between the wheel speed sensor 111 and the driving safety control unit 130.

[0026] According to the innovation, the driving safety control unit 130 is configured to receive a movement signal 150 independent of the wheel speed signal or the wheel speed sensor 111, wherein this movement signal 150 correlates with the current actual speed of the vehicle 200. The movement signal 150 can be in the form of a speed signal, a speed signal, or an acceleration signal, for example.

[0027] According to the innovative concept disclosed here, the movement signal 150 is transmitted to the driving safety control unit 130 via a secure transmission channel 160. A secure transmission channel is characterized, among other things, by the fact that measures have been taken to protect the data transmitted over it against unauthorized external access, such as cyber attacks. Therefore, the secure transmission channel 160 is also referred to here with the symbol CS - for cyber security.

[0028] According to the innovation, the driving safety control unit 130 is designed to compare the movement signal 150 received via the secure transmission channel 160 with the wheel speed signal received via the unsafe transmission channel 131 in order to check the wheel speed signal for plausibility.

[0029] During the plausibility check, a target-actual value comparison can be performed. This means that the movement signal 150 transmitted via the secure transmission channel 160 can represent a target value, such as a target rotational speed, a target speed, or a target acceleration, and the speed signal transmitted by the wheel speed sensor 111 via the non-secure transmission channel 131 can represent an actual value.

[0030] The pulsed wheel speed signal generated by the wheel speed sensor 111 can, by applying suitable conversion rules, be transformed into a speed signal or an acceleration signal, and transformed back.

[0031] The time between two consecutive pulses corresponds to a specific distance traveled by the rotating wheel. Thus, the speed is determined, for example, as the quotient of the distance divided by the time between the two consecutive pulses.

[0032] Thus, if the movement signal 150 transmitted via the secure transmission channel 160 is in the form of a speed signal, the innovative driving safety control unit 130 can, for example, be designed to compare the movement signal 150 with the actual wheel speed signal transmitted by the wheel speed sensor 111.

[0033] If, however, the movement signal 150 transmitted via the secure transmission channel 160 is in the form of a speed signal, the innovative driving safety control unit 130 can, for example, be designed to convert the actual wheel speed signal transmitted by the wheel speed sensor 111 into a speed signal and to compare this with the movement signal 150.

[0034] If the movement signal 150 transmitted via the secure transmission channel 160 is in the form of an acceleration signal, the innovative driving safety control unit 130 can be designed to convert the actual wheel speed signal transmitted by the wheel speed sensor 111 into an acceleration signal and to compare this with the movement signal 150.

[0035] According to the innovation, the driving safety control unit 130 can be configured to compare the wheel speed signal received via the non-secure transmission channel 131 with the movement signal 150 received via the secure transmission channel 160 for the purpose of a plausibility check. If the driving safety control unit 130 detects a deviation, it can generate an error message. Alternatively or additionally, the driving safety control unit 130 can initiate a specific action. For example, if, as explained above, the wheel speed is manipulated in such a way that the maximum speed limit (e.g., Vmax <= 250 km / h) is circumvented, the driving safety control unit 130 can limit the maximum speed of the vehicle, e.g., based on the movement signal.

[0036] Several non-limiting exemplary embodiments are described below to clarify how the movement signal 150 can be obtained and which secure transmission channels 160 can be used for this purpose. According to innovations, the secure transmission channel 160 can, for example, include an authentication method for the transmitted movement signal 150. Alternatively or additionally, the secure transmission channel 160 can include encryption of the transmitted movement signal 150. Furthermore, the secure transmission channel 160 can comply with the specifications of the ISO / SAE 21434 standard for cybersecurity in vehicles.

[0037] Fig. 3 shows an exemplary embodiment of an innovative driving safety system 100. The driving safety system 100 can have a conventional wheel speed sensor 111, 112, 113, 114 on each wheel 121, 122, 123, 124 of the vehicle 200. The conventional wheel speed sensors 111, 112, 113, 114 can, for example, be standard ABS sensors. As already mentioned at the beginning, however, this is purely optional. The innovative concept presented here also functions in principle with just a single wheel speed sensor arranged on a single wheel.

[0038] The conventional wheel speed sensors 111, 112, 113, 114 are each connected to the driving safety control unit 130 via an insecure transmission channel 131, 132, 133, 134, such as a conventional two-wire line.

[0039] In the exemplary embodiment depicted here, the driving safety system 100 has an additional sensor 310 configured to generate the aforementioned travel signal. The additional "safe" sensor 310 can, for example, be a wheel speed sensor arranged on one of the wheels 121, 122, 123, 124 of the vehicle 200. In this case, the travel signal can be in the form of a wheel speed signal.

[0040] The additional sensor 310 is connected to the driving safety control unit 130 via a secure transmission channel 160. Therefore, the secure transmission channel 160 is again designated with the abbreviation CS - for Cyber ​​Security.

[0041] The movement signal transmitted from the additional sensor 310 to the driving safety control unit 130 is transmitted via the secure transmission channel 160. Accordingly, the transmitted movement signal is a "secure" movement signal. For ease of differentiation, the additional sensor 310 is therefore also referred to herein as a "secure" sensor and is accordingly labeled CSS - for Cyber ​​Security Sensor.

[0042] The installed conventional wheel speed sensors 111, 112, 113, 114, however, transmit their respective wheel speed signal via an unsafe transmission channel 131, 132, 133, 134. They are therefore also referred to as “unsafe” wheel speed sensors, and the wheel speed signals generated by them are accordingly also referred to as “unsafe” wheel speed signals.

[0043] According to the Fig. 3, the additional “safe” wheel speed sensor 310 can be present in addition to an already existing wheel speed sensor 111 belonging to a specific wheel 121 of the motor vehicle 200, and in addition to the already existing wheel speed sensor 111, can also detect the wheel speed of this same wheel 121.

[0044] The driving safety control unit 130 can be configured to receive the movement signal generated by the additional wheel speed sensor 310 in the form of a “safe” wheel speed signal via the safe transmission channel 160.

[0045] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the help of the "safe" wheel speed signal. The driving safety control unit 130 receives the "safe" movement signal directly from the additional "safe" wheel speed sensor 310 via the secure transmission channel 160.

[0046] Advantageously, the "safe" wheel speed sensor 310 can have a lower update rate requirement. Furthermore, a certain latency that may arise due to the algorithms used to achieve channel safety plays a negligible role, since the plausibility check, unlike driving safety applications (ABS, ESP, ASR), is not time-critical.

[0047] Fig. 4 shows a further embodiment of an innovative driving safety system 100. In comparison to the one previously described with reference to Fig. In the exemplary embodiment discussed in Figure 3, one of the conventional "unsafe" wheel speed sensors 111, 112, 113, 114 in this driving safety system 100 was replaced by a "safe" wheel speed sensor 310. This offers the advantage that one of the conventional "unsafe" wheel speed sensors 111, 112, 113, 114 can be dispensed with, which results in cost savings. However, compared to the previously mentioned example, the latency is not negligible here, since the "safe" wheel speed sensor 310 now also performs safety-critical driving safety tasks (ABS, ESP, ASR).

[0048] In Fig. Figure 4 shows, purely as an example, a four-circuit brake control system in which a wheel speed sensor is present on each of the four wheels 121, 122, 123, and 124 of the vehicle 200. However, a dual-circuit brake control system would also be conceivable, e.g., for a two-wheeler in which a wheel speed sensor would be arranged on only two wheels.

[0049] According to the innovation, the driving safety control unit 130 can therefore be part of a dual-circuit or four-circuit brake control system with two or four wheel speed sensors 111, 112, 113, 114, wherein the innovative additional “safe” wheel speed sensor 310 replaces one of the two or four “unsafe” wheel speed sensors 111, 112, 113, 114.

[0050] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the help of the "safe" wheel speed signal. The driving safety control unit 130 receives the "safe" movement signal directly from the additional "safe" wheel speed sensor 310 via the secure transmission channel 160.

[0051] Fig. 5 shows a further embodiment of an innovative driving safety system 100. Here, the driving safety control unit 130 is configured to communicate with at least a second control unit 510 installed in the motor vehicle 200 via the secure transmission channel 160. In this case, the secure transmission channel 160 can be, for example, a bus system installed in the vehicle, such as CAN, Ethernet, Flexray, and the like.

[0052] The second control unit 510 can also be configured to receive a wheel speed signal from the additional wheel speed sensor 310 via a different second secure transmission channel 161 and to forward the movement signal in the form of this wheel speed signal to the driving safety control unit 130 via the secure transmission channel 160.

[0053] Instead of the Fig. 5, the additional “safe” wheel speed sensor 310 can also replace one of the existing conventional “unsafe” wheel speed sensors 111, 112, 113, 114, as previously described with reference to Fig. 4 was explained.

[0054] According to the innovative concept presented here, an “unsafe” wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the aid of the “safe” wheel speed signal.

[0055] The driving safety control unit 130 receives the “safe” movement signal via the safe transmission channel 160 from the second control unit 510, which in turn receives the “safe” movement signal via a second safe transmission channel 161 directly from the additional “safe” wheel speed sensor 310.

[0056] Fig. 6 shows a further embodiment of an innovative driving safety system 100. Here, the driving safety control unit 130 is configured to communicate with at least one second control unit 520 installed in the motor vehicle 200 via the secure transmission channel 160, such as CAN, Ethernet, or Flexray. The driving safety control unit 130 is configured to receive the movement signal from this second control unit 520 in the form of a speed signal received via a different, second secure transmission channel.

[0057] What is crucial here is that it is a "safe" speed signal, i.e., the second control unit 520 should have received the "safe" speed signal via a secure transmission channel. For example, the second control unit 520 can receive the "safe" speed signal from a speed sensor (not shown here), which transmits the speed signal to the second control unit 520 via a secure external transmission channel (e.g., a bus line). Alternatively or additionally, it would be conceivable for the second control unit 520 itself to implement a speed sensor. In this case, the detected speed signal could be transmitted to the second control unit 520 via a secure internal transmission channel (e.g., an internal or integrated data line).

[0058] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the aid of the "safe" speed signal. If necessary, the "unsafe" wheel speed signal can be converted into an "unsafe" speed signal, or the "safe" speed signal received from the second control unit 520 can be converted into a "safe" speed signal. The driving safety control unit 130 receives the "safe" speed signal from the second control unit 520 via the secure transmission channel 160.

[0059] Fig. 7 shows a further embodiment of an innovative driving safety system 100. Here, the driving safety control unit 130 is designed to communicate with at least a second control unit 530 installed in the motor vehicle 200 via the secure transmission channel 160, such as CAN, Ethernet or Flexray. Compared to Fig. 6, however, the driving safety control unit 130 receives a "safe" acceleration signal instead of the "safe" speed signal. Accordingly, in this exemplary embodiment, the driving safety control unit 130 is configured to receive the movement signal from the second control unit 530 in the form of an acceleration signal received via a different, second, safe transmission channel.

[0060] Here again, it is crucial that it is a “safe” acceleration signal, i.e. the second control unit 530 should have received the “safe” acceleration signal via a safe (internal and / or external) transmission channel.

[0061] For example, the second control unit 530 may be an airbag control unit with an integrated inertial measurement unit (IMU) that is designed to detect the actual acceleration of the motor vehicle 200 and output it as the “safe” acceleration signal.

[0062] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the aid of the "safe" acceleration signal. If necessary, the "unsafe" wheel speed signal can be converted into an "unsafe" acceleration signal, or the "safe" acceleration signal received from the second control unit 530 can be converted into a "safe" speed signal. The driving safety control unit 130 receives the "safe" acceleration signal from the second control unit 530 via the secure transmission channel 160.

[0063] In the cases referred to in the Fig. 5 to 7, embodiments were described in which the driving safety control unit 130 receives the "safe" movement signal from other control units 510, 520, 530. However, it would also be conceivable for the driving safety control unit 130 to receive a "safe" movement signal directly from a rotational speed detection device (e.g., a wheel speed sensor), a speed detection device, or an acceleration detection device, provided that the corresponding rotational speed signal, speed signal, or acceleration signal is transmitted to the driving safety control unit 130 via a secure transmission channel 160. The corresponding rotational speed detection device, speed detection device, or acceleration detection device can be present as a separate device, i.e., external to the driving safety control unit 130.However, it would also be conceivable that the corresponding rotational speed detection device, speed detection device or acceleration detection device is integrated in the driving safety control unit 130.

[0064] In addition to the wheel speed sensors described above, a speed detection device can also be configured, for example, in the form of an engine control sensor or a transmission sensor. Both can measure the engine or transmission speed, which in turn can be used to determine the wheel speed, vehicle speed, and vehicle acceleration.

[0065] A speed detection device can be implemented, for example, in the form of a GPS module, which transmits the “safe” movement signal in the form of a GPS-supported speed signal to the driving safety control unit 130.

[0066] One advantage of the innovative concept presented here is that, unlike driving safety applications (ABS, ESP, ASR), the plausibility check is not time-critical. For example, if GPS reception is temporarily interrupted while driving through a tunnel, the plausibility check can also be performed after exiting the tunnel, for example, to detect and neutralize a cyberattack. This means that an occasional comparison of the measured wheel speed with the "safe" wheel speed signal is sufficient to detect tampering.

[0067] However, a speed detection device can also be implemented, for example, in the form of a camera or RADAR or LIDAR system, which is equipped, for example, with an ego motion algorithm. In this case, the "safe" movement signal could be transmitted to the driving safety control unit 130 in the form of an ego motion signal representing the vehicle speed.

[0068] An acceleration detection device can be implemented, for example, in the form of an acceleration sensor, such as an inertial measurement unit (IMU). In the vehicle, for example, there is the so-called inertial cluster, in which the current actual acceleration of the vehicle is recorded. Various functions or control units, such as the ABS, ESP, ASR, or airbag control unit, can access this inertial cluster. The innovative driving safety control unit 130 could therefore be configured to obtain a "safe" acceleration signal from this inertial cluster via a secure transmission channel (e.g., CAN, Ethernet, FlexRay).

[0069] The following Fig. 8 and Fig. 9 each show embodiments in which the driving safety control unit 130 receives the “safe” movement signal from a speed detection device ( Fig. 8) or by an acceleration detection device ( Fig. 9) receives.

[0070] Fig. 8 shows a conceivable embodiment in which the driving safety system 100 has a speed detection device 820 for measuring the actual speed of the vehicle 200. The speed detection device 820 can, as in Fig. 8 as an example, be integrated into the driving safety control unit 130.

[0071] Alternatively, the speed detection device 820 could be configured externally of the driving safety control unit 130, for example in the form of an external ego motion camera, wherein the external speed detection device 820 is shown here in dashed lines.

[0072] However, the speed detection device 820 can also be a GPS module, for example. An external speed detection device 820 can be configured, for example, in the form of an external GPS module that is installed as part of a navigation system in the vehicle 200. An internal speed detection device 820, on the other hand, can be configured, for example, in the form of a GPS module that is integrated into the driving safety control unit 130.

[0073] In the case of an (internal or external) GPS module 820, the driving safety control unit 130 in this embodiment can be configured to receive the travel signal in the form of a “safe” speed signal generated by the GPS module 820 via the secure transmission channel 160.

[0074] Here again, it is crucial that this is a "secure" speed signal, i.e., the driving safety control unit 130 receives the "secure" speed signal from the speed detection device 820 via a secure transmission channel 160. In the case of a speed detection device 820 integrated into the driving safety control unit 130, the secure transmission channel 160 can be, for example, an internal transmission channel (not shown here), such as an internal or integrated data line. In the case of an external speed detection device 820, the secure transmission channel 160 can be, for example, an external data line that has, for example, authentication and / or encryption.

[0075] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the aid of the "safe" speed signal. If necessary, the "unsafe" wheel speed signal can be converted into an "unsafe" speed signal, or the "safe" speed signal received from the speed detection device 820 can be converted into a "safe" speed signal. The driving safety control unit 130 receives the "safe" speed signal directly from the speed detection device 820 via the secure transmission channel 160.

[0076] Fig. 9 shows a conceivable embodiment in which the driving safety control unit 130 has an acceleration detection device 810 for measuring the actual acceleration of the vehicle 200. The acceleration detection device 810 can, for example, be an integrated inertial measurement unit (IMU). The acceleration detection device 810 can, as in Fig. 9 as an example, be integrated into the driving safety control unit 130.

[0077] Alternatively, the acceleration detection device 810 could be configured externally from the driving safety control unit 130, for example in the form of an external IMU from the inertia cluster, wherein the external acceleration detection device 810 is shown here in dashed lines.

[0078] Here again, it is crucial that this is a "secure" acceleration signal, i.e., the driving safety control unit 130 should receive the "secure" acceleration signal from the acceleration detection device 810 via a secure transmission channel 160. In the case of an acceleration detection device 810 integrated into the driving safety control unit 130, the secure transmission channel 160 can be, for example, an internal transmission channel (not shown here), such as an internal or integrated data line. In the case of an external acceleration detection device 810, the secure transmission channel 160 can be, for example, an external data line that has, for example, authentication and / or encryption.

[0079] However, it would also be conceivable for the acceleration detection device 810 to detect (or receive) a wheel speed signal or a speed signal and to convert this into an acceleration signal by means of time differentiation (e.g., dv / dt).

[0080] According to the innovative concept presented herein, an "unsafe" wheel speed signal received from one of the conventional wheel speed sensors 111, 112, 113, 114 can now be checked for plausibility with the aid of the "safe" acceleration signal. If necessary, the "unsafe" wheel speed signal can be converted into an "unsafe" acceleration signal, or the "safe" acceleration signal received from the acceleration detection device 810 can be converted into a "safe" speed signal. The driving safety control unit 130 receives the "safe" acceleration signal directly from the acceleration detection device 810 via the safe transmission channel 160.

[0081] In the previous exemplary embodiments, it has been described that the secure transmission channel 160 can be configured in the form of a physical data line. In all embodiments, however, it is conceivable that the driving safety control unit 130 can be configured to receive the "safe" movement signal wirelessly, e.g., via Bluetooth LE (LE: Low Energy) or via a TPMS (Tire Pressure Monitoring System) protocol. In this case, the secure transmission channel 160 would be configured in the form of a secure radio transmission channel.

[0082] Fig. 10 shows a corresponding non-limiting embodiment in which an additional wheel speed sensor 310 communicates with the driving safety control unit 130 via a secure radio protocol and thereby transmits the "safe" movement signal wirelessly to the driving safety control unit 130. This means that the secure transmission channel 160 would be configured here in the form of a secure radio transmission channel. The use of such a secure radio transmission channel 160 would, in principle, also be conceivable in all other embodiments, alternatively or in addition to the secure transmission channels 160 described therein, which were represented in the form of physical data lines.

[0083] Finally, Fig.11 is a schematic block diagram illustrating an innovative method for checking the plausibility of a wheel speed signal received from a wheel speed sensor 111, 112, 113, 114 via an insecure transmission channel 131, 132, 133, 134 in a driving safety system 100 for a motor vehicle 200.

[0084] In block 201, a wheel speed signal is first received from a wheel speed sensor 111, wherein the wheel speed signal represents the determined actual wheel speed, and wherein the wheel speed signal is transmitted via an unsecured transmission channel 131.

[0085] In block 202, a travel signal is received that indicates the current actual speed of the vehicle 200, wherein the travel signal is transmitted via a secure transmission channel 160.

[0086] In block 203, the wheel speed signal received via the unsafe transmission channel 131 is then compared with the movement signal transmitted via the secure transmission channel 160 in order to check the “unsafe” wheel speed signal of the wheel speed sensor 111 for plausibility.

[0087] The above-described embodiments are merely illustrative of the principles of the innovative concept described herein. It is understood that modifications and variations of the arrangements and details described herein will be apparent to others skilled in the art. Therefore, it is intended that the concept described herein be limited only by the scope of the following claims and not by the specific details presented in the description and explanation of the embodiments herein.

[0088] Although some aspects have been described in connection with a device, it should be understood that these aspects also represent a description of the corresponding method, so that a block or component of a device can also be understood as a corresponding method step or as a feature of a method step. Analogously, aspects described in connection with or as a method step also represent a description of a corresponding block, detail, or feature of a corresponding device.

[0089] Some or all of the method steps may be performed by (or using) a hardware device, such as a microprocessor, a programmable computer, or an electronic circuit. In some embodiments, some or more of the essential method steps may be performed by such a device.

[0090] Depending on specific implementation requirements, embodiments may be implemented in hardware or in software, or at least partially in hardware or at least partially in software. The implementation may be carried out using a digital storage medium, for example a floppy disk, a DVD, a Blu-ray disc, a CD, a ROM, a PROM, an EPROM, an EEPROM, or a FLASH memory, a hard disk, or other magnetic or optical storage on which electronically readable control signals are stored that can interact or interact with a programmable computer system such that the respective method is carried out. Therefore, the digital storage medium may be computer-readable.

[0091] Some embodiments thus comprise a data carrier having electronically readable control signals capable of interacting with a programmable computer system such that one of the methods described herein is carried out.

[0092] In general, embodiments may be implemented as a computer program product having a program code, wherein the program code is effective to perform one of the methods when the computer program product is run on a computer.

[0093] The program code can, for example, also be stored on a machine-readable medium.

[0094] Other embodiments include the computer program for performing one of the methods described herein, wherein the computer program is stored on a machine-readable medium. In other words, an embodiment of the method described herein is thus a computer program that has program code for performing one of the methods described herein when the computer program is executed on a computer.

[0095] A further embodiment of the method described herein is thus a data carrier (or a digital storage medium or a computer-readable medium) on which the computer program for performing one of the methods described herein is recorded. The data carrier or the digital storage medium or the computer-readable medium is typically tangible and / or non-transitory.

[0096] A further embodiment of the method described herein is thus a data stream or a sequence of signals representing the computer program for performing one of the methods described herein. The data stream or the sequence of signals can be configured, for example, to be transferred via a data communication connection, for example, via the Internet.

[0097] A further embodiment comprises a processing device, for example a computer or a programmable logic device, which is configured or adapted to carry out one of the methods described herein.

[0098] A further embodiment comprises a computer on which the computer program for performing one of the methods described herein is installed.

[0099] A further embodiment comprises a device or system configured to transmit a computer program for performing at least one of the methods described herein to a recipient. The transmission may, for example, be electronic or optical. The recipient may, for example, be a computer, a mobile device, a storage device, or a similar device. The device or system may, for example, comprise a file server for transmitting the computer program to the recipient.

[0100] In some embodiments, a programmable logic device (e.g., a field-programmable gate array, an FPGA) may be used to perform some or all of the functionality of the methods described herein. In some embodiments, a field-programmable gate array may interact with a microprocessor to perform any of the methods described herein. In general, in some embodiments, the methods are performed by any hardware device. This may be general-purpose hardware, such as a computer processor (CPU), or method-specific hardware, such as an ASIC.

Claims

[1] Driving safety system (100) for a motor vehicle (200), comprising: at least one wheel speed sensor (111) which is designed to determine the current actual wheel speed of a wheel (121), a driving safety control unit (130) configured to receive a wheel speed signal generated by the wheel speed sensor (111), the wheel speed signal representing a determined actual wheel speed, wherein the wheel speed signal is transmitted via an unsecured transmission channel (131) between the wheel speed sensor (111) and the driving safety control unit (130), wherein the driving safety control unit (130) is configured to receive a travel signal (150) that correlates with the current actual speed of the vehicle (200) and to compare the travel signal (150) with the wheel speed signal in order to check the wheel speed signal for plausibility, wherein the movement signal (150) is transmitted to the driving safety control unit (130) via a secure transmission channel (160). [2] Driving safety system (100) according to claim 1, wherein the secure transmission channel (160) includes an authentication method for the transmitted travel signal (150). [3] Driving safety system (100) according to one of the preceding claims, wherein the secure transmission channel (160) includes encryption of the transmitted movement signal (150). [4] Driving safety system (100) according to one of the preceding claims, wherein the secure transmission channel (160) complies with the specifications of the ISO / SAE 21434 standard for cyber security in vehicles. [5] Driving safety system (100) according to one of the preceding claims, wherein the driving safety control unit (130) is configured to compare the wheel speed signal received via the unsafe transmission channel (131) with the movement signal (150) received via the secure transmission channel (160) for the purpose of the plausibility check, and to generate an error message and / or initiate a specific action in the event of a deviation. [6] Driving safety system (100) according to one of the preceding claims, further comprising an additional wheel speed sensor (310), wherein the driving safety control unit (130) is designed to receive the movement signal (150) in the form of a wheel speed signal generated by the additional wheel speed sensor (310) via the secure transmission channel (160). [7] Driving safety system (100) according to claim 6, wherein the additional wheel speed sensor (310) is present in addition to an already existing wheel speed sensor (111, 112, 113, 114) belonging to a specific wheel (121, 122, 123, 124) of the motor vehicle (200), and in addition to the already existing wheel speed sensor (111, 112, 113, 114) also detects the wheel speed of this same wheel (121, 122, 123, 124), or wherein the driving safety control unit (130) is part of a dual-circuit or four-circuit brake control system with two or four wheel speed sensors (111, 112, 113, 114), and wherein the additional wheel speed sensor (310) replaces one of the two or four wheel speed sensors (111, 112, 113, 114). [8] Driving safety system (100) according to claim 6 or 7, wherein the additional wheel speed sensor is designed to transmit the movement signal wirelessly (e.g. TPMS, Bluetooth LE) to the driving safety control unit, and wherein the secure transmission channel is designed in the form of a secure radio transmission channel. [9] Driving safety system (100) according to one of claims 6 to 8, wherein the driving safety control unit (130) is designed to communicate with at least one second control unit (510) installed in the motor vehicle (200) via the secure transmission channel (160), and wherein the second control unit (510) is designed to receive a wheel speed signal from the additional wheel speed sensor (310) via a different second secure transmission channel (161) and to forward the movement signal in the form of this wheel speed signal to the driving safety control unit (130) via the secure transmission channel (160). [10] Driving safety system (100) according to one of the preceding claims, further comprising a GPS module (820), wherein the driving safety control unit (130) is designed to receive the movement signal (150) in the form of a speed signal generated by the GPS module (820) via the secure transmission channel (160). [11] Driving safety system (100) according to one of the preceding claims, wherein the driving safety control unit (130) is designed to communicate with at least one second control unit (520) installed in the motor vehicle (200) via the secure transmission channel (160), and wherein the driving safety control unit (130) is designed to receive the movement signal (150) from this second control unit (520) in the form of a speed signal received via a different second secure transmission channel (161). [12] Driving safety system (100) according to one of the preceding claims, further comprising an acceleration sensor (810), wherein the driving safety control unit (130) is designed to receive the movement signal (150) in the form of an acceleration signal generated by the acceleration sensor (810) via the secure transmission channel (160). [13] Driving safety system (100) according to one of the claims, wherein the driving safety control unit (130) is designed to communicate with at least one second control unit (530) installed in the motor vehicle (200) via the secure transmission channel (160), and wherein the driving safety control unit (130) is designed to receive the movement signal (150) from this second control unit (530) in the form of an acceleration signal received via a different second secure transmission channel (161). [14] Driving safety system (100) according to claim 13, wherein the second control unit (530) is an airbag control unit with an integrated inertial measuring unit which is designed to detect the actual acceleration of the motor vehicle (200) and to output it as the acceleration signal. [15] Method for the plausibility check of a wheel speed signal received from a wheel speed sensor (111) via an insecure transmission channel (131) in a driving safety system (100) for a motor vehicle (200), the method comprising the following steps: Receiving the wheel speed signal from the wheel speed sensor (111), wherein the wheel speed signal represents the determined actual wheel speed, and wherein the wheel speed signal is transmitted via an unsecured transmission channel (131), Receiving a movement signal (150) via which the current actual speed of the vehicle (200) can be determined, wherein the movement signal is transmitted via a secure transmission channel (160), and Comparing the wheel speed signal received via the insecure transmission channel (131) with the movement signal transmitted via the secure transmission channel (160) in order to check the wheel speed signal for plausibility. [16] A computer-readable digital storage medium having stored thereon a program code for carrying out the method according to claim 15 when the program runs on a computer.

Images