Communication process, control unit system and motor vehicle

Abstract

The invention relates to a communication method (9) for a control unit system (4) comprising a plurality of control units (3), in particular of a motor vehicle (1), in which the control units (3) are configured as a master-slave architecture and in which at least one actuator (7) is assigned to each of the slave control units (6). The master control unit (5) is configured such that, in order to actuate an actuator (7) to perform an action, it generates a command in accordance with the bus protocol and transmits this command via the data bus (8). In order to make unauthorized access to the control unit system (4) more difficult, it is proposed - that the respective slave control unit (6) regularly selects a predetermined question (11) based on a predetermined question-answer assignment (10) and sends this question (11) to the master control unit (5) via the data bus (8), - that the master control unit (5) selects the predetermined answer (12) matching the question (11) according to the predetermined question-answer assignment (10) and sends this answer together with the command via the data bus (8), - that the slave control unit (6) checks the response (12) transmitted by the master control unit (5) together with the command using the predetermined question-response assignment (10) and executes the command only if the response (12) transmitted with the command matches the question (11) generated by the slave control unit (6).

Description

The present invention relates to a communication method for a control device system comprising a plurality of control devices, in particular of a motor vehicle. The invention also relates to a control device system comprising a plurality of control devices and to a motor vehicle equipped with such a control device system.Complex electromechanical apparatuses, such as motor vehicles, for example, can have a plurality of control units in order to be able to actuate a plurality of different actuators, such as electromechanical actuators or electrical switches or the like, for example. For this purpose, the control units can communicate with one another via a data bus and form a control unit system. Communication via a data bus is effected via bus protocols or communication protocols which have a predetermined bit length, each bit having a specific function defined in the respective bus protocol. If an unauthorized third party has access to the data bus, he can comparatively easily find out which function is assigned to the respective bit within the respective bus protocol. As soon as the bus protocol is known, an unauthorized third party can also actuate the control units of the control unit system for actuating the actuators. This can lead to malfunctions and hazardous operating states within the control unit system. In particular, this also makes it possible to abuse the control device system, for example, in order to actuate individual actuators in a targeted manner, for example, in order to bypass target specifications.The present invention is concerned with the problem of specifying an improved or at least one other embodiment for a communication method or for a control unit system or for a motor vehicle, which is distinguished in particular by increased protection against access by unauthorized third parties.This problem is solved according to the invention by the subject matter of the independent claims. Advantageous embodiments are the subject of the dependent claims.The invention is based on the general idea of configuring the control units within the control unit system as a master-slave architecture, wherein the actuators are actuated via the slave control units, while the master control unit sends corresponding commands to the slave control units for actuating the actuators. In order to now improve the access security against unauthorized persons or third parties, the command is encoded or encrypted on the basis of a predetermined question-response assignment. For this purpose, the respective slave control device transmits a predetermined question to the master control device. The master control device determines the response matching the question and sends this response together with the command to the respective slave control device. The slave controller now receives a record that includes the command and the response. The slave controller now checks whether the response matches the question and executes the command only if so. In other words, the command appended to the command encrypts the command, which at best can only be decrypted by the respective slave control device. The master control device and the respective slave control device access the same question-response assignment, so that only a single response always matches the respective question, whereby a high level of security for the communication within the control device system is achievable.In the present context, a "configuration" corresponds to a "configuration" and / or a "device" and / or a "programming", such that the phrase "configured such that" is synonymous with the phrase "configured such that" and / or "configured such that" and / or "programmed such that".In particular, the invention proposes for the communication method that the control units are configured as a master-slave architecture, so that the control units form at least one master control unit and a plurality of slave control units. At least one actuator is assigned to each of the slave control devices. The respective actuator can be, in particular, an electromechanical actuator or an electrical switch. By means of the respective actuator, it is possible, for example, to move, switch on or switch off a component or specify a target variable for open-loop or closed-loop control. The respective slave control device is configured to actuate the associated actuator or actuators. The control units are coupled to one another with the aid of a data bus, so that they communicate with one another with the aid of the data bus. Data is transmitted in the data bus using a bus protocol. The master control device is configured such that, in order to actuate an actuator for carrying out an action, it generates a command in accordance with the bus protocol and sends it via the data bus. The respective action can be a movement in one direction or in the other in the case of an electromechanical actuator and a switching on or switching off in the case of an electrical switch. The action may also be more complex, such as setting a target value, e.g. a temperature or a pressure or the like, which target value is then set or adjusted. The slave control device assigned to the respective actuator can actuate the corresponding actuator for carrying out the action in order to execute the command. According to the invention, it is now also the case that the respective slave control device regularly selects a predetermined question on the basis of a predetermined question-answer assignment and sends it to the master control device via the data bus. The periodic selection and sending of a question follows a predetermined rule and can take place at regular or non-uniform time intervals. In particular, these distances can be newly determined each time by means of a predetermined algorithm or by means of a random generator. The selection of the question can be carried out by means of a predetermined algorithm or by means of a random generator. The predetermined question-answer assignment includes a plurality of predetermined questions and assigns these exactly one matching answer. The master control device now selects the predetermined response matching the question according to the predetermined question-response assignment and sends it together with the command via the data bus to the respective slave control device. The respective slave control device now checks the response transmitted together with the command on the basis of the predetermined question-response assignment and executes the command only if the response transmitted with the command matches the question generated or sent by the slave control device.According to an advantageous embodiment, the slave control units can each independently of one another regularly select a predetermined question on the basis of the predetermined question-answer assignment and send it to the master control unit via the data bus. Here, too, the question can be selected for each individual slave control device by means of a predetermined algorithm or by means of a random generator. The master control device can now be configured such that it addresses the command for actuating the respective actuator to the slave control device assigned to the respective actuator and, on the basis of the question-response assignment, selects the response to the question transmitted by the addressed slave control device and transmits the selected response with the command. This results in a plurality of codings which are independent of one another within the communication, which significantly complicates unauthorized access.According to another advantageous embodiment, it can be provided that the respective slave control device selects the respective question only for a predetermined period of time and selects another predetermined question after the predetermined period of time on the basis of the question-answer assignment. This does not result in fixed assignments between the commands and the responses, which makes unauthorized access to the control device system more difficult.According to an advantageous embodiment, it can be provided that the question-answer assignment specifies a predetermined number of questions and answers. Expediently, the time period can now be selected such that a clock rate of the data bus multiplied by the number of responses predefined by the question-response assignment is greater than the time period. In the event of unauthorized access to the data bus, it is therefore not possible, even if all responses are known, to test all responses within the time period, for example in order to specifically actuate an actuator.Expediently, the respective response can have a predetermined bit length. The bit length may be, for example, between 12 bits and 24 bits, each inclusive. Preferably, the bit length may be 16 bits. Thereby, the bit length of the response specifies a maximum number of responses. Expediently, the time period can now be selected such that a clock rate of the data bus multiplied by the maximum number of responses predefined by the bit length of the responses is greater than the time period. This also makes unauthorized access to the control device system more difficult. For example, a bit length of 16 bits results in more than 65,000 possible responses. At a clock rate of about 40 ms, a test takes about 100 ms, namely about 40 ms for transmission, about 40 ms for reception, and about 20 ms for processing the test. For the 65,000 variants, about 6500 seconds, i.e. more than 100 minutes, are thus required. If a time period of approximately 1 hour is now selected for the slave control device, it is no longer possible to test all possible responses within this time period. The clock rate of the data bus can be, for example, between 10 ms and 100 ms, each inclusive. Preferably, the clock rate may be 20 ms or 40 ms. The time interval can be, for example, between 10 min and 100 min. The time interval can preferably be 60 min.In an advantageous embodiment, the question-response assignment can be designed as a table for looking up the response matching the question. The respective table is advantageously stored both in the respective master control device and in each individual slave control device. In principle, a central storage of the question-response assignment to which all control units have access is also conceivable. As an alternative to a table, the question-response assignment can also be designed as a mathematical formula for calculating the response matching the question. Here too, the respective formula can be stored decentrally in each individual control device or centrally in a memory to which all control devices have access.The data bus can be designed as a CAN bus or as a LIN bus. In principle, another bus configuration is also conceivable. The CAN bus or the associated CAN protocol is defined in ISO 11898. The LIN bus or the associated LIN protocol is defined in ISO 15765-2.Expediently, the command that the master control device generates for actuating an actuator for carrying out an action can contain an address of the respective actuator and / or an address of the slave control device assigned to the respective actuator and / or the action to be carried out by the respective actuator. The slave controllers all receive this command, wherein only the addressed slave controller executes the command, provided that the sent response matches the current question.A control device system according to the invention, which can be embodied in a motor vehicle in particular, comprises a plurality of control devices which are configured as a master-slave architecture, such that the control devices form at least one master control device and a plurality of slave control devices. At least one actuator is assigned to each of the slave control devices, wherein the respective slave control device is configured to actuate the associated actuator or the associated actuators. The control units communicate with one another with the aid of a data bus, which transmits data with the aid of a bus protocol. The master control device is configured such that, in order to actuate an actuator for carrying out an action, it generates a command in accordance with the bus protocol and sends it via the data bus. The slave control device assigned to the respective actuator controls the corresponding actuator for carrying out the action in order to execute a command. The respective slave control device regularly selects a predetermined question on the basis of a predetermined question-answer assignment and sends it to the master control device via the data bus. The master control device selects the predetermined response matching the question according to the predetermined question-response assignment and sends it together with the command via the data bus to the respective slave control device. The slave control device now checks the response transmitted by the master control device together with the command on the basis of the predetermined question-response assignment and executes the command only if the response transmitted with the command matches the question generated by the slave control device. This makes unauthorized access by third parties difficult within the control device system.A motor vehicle according to the invention is equipped with a control device system of the type described above. Furthermore, the motor vehicle has components, each of which is assigned at least one control device of the control device system. The components can be formed by any desired electrically actuatable or actuatable component. For example, the components of the motor vehicle, each of which is assigned at least one control unit, can be cooling circuits, refrigeration circuits, air conditioning systems, lighting devices, vehicle assistance systems, driver assistance systems and the like.Further important features and advantages of the invention are evident from the dependent claims, from the drawings and from the associated description of the figures with reference to the drawings.It is understood that the features mentioned above and those still to be explained below can be used not only in the respectively specified combination, but also in other combinations or alone, without departing from the scope of the invention. The above-mentioned components of a superordinate unit, such as a device, a device or an arrangement, which are designated separately, can form separate components or components of this unit or can be integral regions or sections of this unit, even if this is illustrated differently in the drawings.Preferred exemplary embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description, wherein the same reference numerals refer to the same or similar or functionally the same components.They show, in each case schematically, FIG. 1 shows a greatly simplified schematic diagram of a motor vehicle with a control device system, FIG. 2 shows a greatly simplified flow diagram for a communication method.According to FIG. 1, a motor vehicle 1, which is only shown in a rudimentary manner here, comprises a plurality of components 2 which can be actuated or actuated electrically or electronically. Each component 2 is assigned at least one control device 3 for this purpose. In the control device system 4 presented here, the control devices 3 are configured according to a master-slave architecture, so that the control devices 3 form at least one master control device 5 and a plurality of slave control devices 6. At least one actuator 7 is assigned to each of the slave control units 6. The respective actuator 7 can be formed by an electromechanical actuator or by a switch or by another electromechanical component which can be controlled electrically. The control device system 4 also has a data bus 8, which is coupled to all control devices 3, so that the control devices 3 can communicate with one another with the aid of the data bus 8. The data bus 8 transmits data with the aid of a bus protocol.The master control device 5 is configured such that, in order to actuate an actuator 7 for carrying out an action, it generates a command corresponding to the bus protocol and sends it via the data bus 8 to the respective slave control device 6. The respective command is represented by a data record which is constructed according to the bus protocol. The action represents a command that is suitable for the configuration of the respective actuator 7 and that the actuator 7 can perform. For example, an actuator 7 designed as an actuator can comprise as an action a command for extending or retracting or for left-hand rotation or for right-hand rotation. An actuator 7 designed as a switch can contain a command for switching on or switching off or setting a desired value.The slave control device 6 assigned to the respective actuator 7 can actuate the corresponding actuator 7 for carrying out the action in order to execute a command. The control device system 4 presented here is configured here to carry out a communication method 9 explained in more detail below with reference to FIG. 2. This communication method 9 uses a predetermined question-response assignment 10, which assigns a matching response 12 to a plurality of predetermined different questions 11 in each case. Depending on the length of the bus protocol, the question-answer association 10 may include multiple 1000 questions 11 and multiple 1000 matching answers 12.In any case, the respective slave control device 6 can regularly select a predetermined question 11 on the basis of the question answer with respect to assignment 10 and send it to the master control device 5 via the data bus 8. The selection of the respective question 11 on the basis of the question-answer assignment can be effected with the aid of a predetermined algorithm or with the aid of a random generator. The master control device 5 can now select the predetermined answer 12 matching the question 11 according to the predetermined question-answer assignment 10 and then send it together with the command for actuating an actuator 7 via the data bus 8 to the respective slave control device 6 which is assigned to the respective actuator 7. The slave control device 6 assigned to the respective actuator 7 can now check the response 12 transmitted by the master control device 5 together with the command on the basis of the predetermined question-response assignment 10. The slave control device 6 is now configured such that it executes the respective command only if the response 12 transmitted with the command matches the question 11 selected or sent by the slave control device 6. If the response 12 transmitted with the command does not match the question 11 selected and sent by the slave control device 6, the slave control device 6 assigned to the respective actuator 7 does not execute the command of the master control device 5.According to FIG. 2, the communication method 9 proceeds from a control device system 4 having a plurality of control devices 3, in which the control devices 3 are configured as a master-slave architecture, so that the control devices 3 form at least one master control device 5 and a plurality of slave control devices 6. As explained above with reference to FIG. 1, at least one actuator 7 is assigned to each of the slave control units 6, wherein the respective slave control unit 6 is configured to actuate the assigned actuator 7 or the assigned actuators 7. Furthermore, the control units 3 communicate with one another with the aid of the data bus 8, which transmits data with the aid of the bus protocol. The master control device 5 is configured such that, for actuating an actuator 7 in such a way that it carries out an action, it generates a command in accordance with the bus protocol and transmits this command via the data bus 8 to the slave control device 6 assigned to the respective actuator 7. The slave control device 6 assigned to the respective actuator 7 can actuate the corresponding actuator 7 for carrying out the respective action in order to execute the command. Here, the inclusion of the question-response assignment 10 now begins.According to FIG. 2, the section of the communication method 9 shown in FIG. 2 begins with a starting step 13. In a step 14, the respective slave control device 6 regularly selects a predetermined question 11 on the basis of the question-response assignment 10 according to a predetermined algorithm or according to a random generator and sends it in the form of a corresponding data set according to the bus protocol via the data bus 8 to the master control device 5.In a subsequent step 15, the master control device 5 generates a command which serves to actuate an actuator 7 for carrying out an action. The generation of such a command may be triggered, for example, by a driver (male / female / divers) of the vehicle 1. It is likewise conceivable for the generation of the command to be triggered by another control device. The triggering of the master control unit 5 to generate the command takes place in FIG. 2 via a path 16.In a step 17, the master control device 5 selects the answer 12 matching the question 11 of the respective slave control device 6 on the basis of the question-answer assignment 10. In a step 18, the master control device 5 then transmits the command and the response together via the data bus 8 to the respective slave control device 6. In a step 20, the slave control device 6 checks the response 12 transmitted with the command to determine whether it matches the question 11 that has been asked or selected and sent according to the question-response assignment 10. If this is the case, the query in step 20 is positive, which is symbolized in FIG. 2 by a plus (+). The communication method 9 then follows a path 21 and reaches a step 22, in which the command is executed. In a subsequent stop step 23, the section of the communication method 9 shown in FIG. 2 is ended. If, on the other hand, the result of the query in step 20 is negative, which is symbolized by a negative (-) in FIG. 2, the response 12 transmitted with the command does not match the selected and sent question 11. Subsequently, the method 9 again reaches a stop step 26, which ends the section of the method 9 shown in FIG. 2.The question-answer assignment 10 can be stored in each slave control device 6 and also in the master control device 5. It is likewise conceivable to store the question-answer assignment 10 in a separate memory which can be accessed by the control units 3 via the data bus 8.The slave control units 6 can each independently of one another regularly select a predetermined question 11 on the basis of the predetermined question-answer assignment 10 and send it to the master control unit 5 via the data bus 8. The algorithm or random generator responsible for the selection of the respective question 11 ensures that the different slave control units 6 generally send different questions 11 to the ground control unit 5. Furthermore, it can also be provided that the different slave control units 6 send the respective question 11 in each case for different time periods and / or send it at different times. In any case, the master control device 5 addresses the command for actuating the respective actuator 7 to the slave control device 6 assigned to the respective actuator 7 and selects the answer 12 on the basis of the question-answer assignment 10, which answer matches the question 11 transmitted by the addressed slave control device 6. The response 12 selected in this way is then sent to the addressed slave control device 6 with the command.Expediently, it can be provided that the respective slave control device 6 selects the respective question 11 only for a predetermined period of time, for example for 1 hour. After the predetermined period of time, the respective slave control device 6 selects another predetermined question 11 on the basis of the question-answer assignment 10. As mentioned, the respective question 11 which is to be sent to the master control device 5 for the respective time period can be selected on the basis of a predetermined algorithm or on the basis of a random generator.The question-answer assignment 10 can specify a predetermined number of answers 12. For example, the respective response 12 can have a predetermined bit length. The bit length, i.e. the number of bits within the response 12, specifies a maximum number of different responses 12. The bit length of the responses 12 may be dictated by the bus protocol. In any case, the time period for which the respective slave control device 6 selects the respective question 11 can be selected in a targeted manner such that a clock rate of the data bus 8 multiplied by the number of answers 12 predefined by the question-answer assignment 10 or multiplied by the maximum number of answers 12 predefined by the bit length of the answers 12 is greater than the time period. In the event of an unauthorized access to the data bus 8, this makes it difficult to find the correct response 12 within the time interval, so that abuse of the control device system 4 is made more difficult.The question-answer mapping 10 may be configured as a table for looking up the answer 12 matching the question 11 or as a mathematical formula for calculating the answer 12 matching the question 11. The data bus 8 can be designed as a CAN bus or as a LIN bus. The command that the master control device 5 generates for actuating an actuator 7 for carrying out an action can include an address of the respective actuator 7 and / or an address of the slave control device 6 assigned to the respective actuator 7 and the action to be carried out by the respective actuator 7. The address of the respective actuator 7 is basically only required if a plurality of actuators 7 are assigned to the respective slave control device 6.

Claims

Communication method (9) for a control device system (4) comprising a plurality of control devices (3), in particular of a motor vehicle (1), - in which the control devices (3) are configured as a master-slave architecture, such that the control devices (3) form at least one master control device (5) and a plurality of slave control devices (6), - in which at least one actuator (7) is assigned in each case to the slave control devices (6), - in which the respective slave control device (6) is configured to actuate the assigned actuator (7) or the assigned actuators (7), - in which the control devices (3) communicate with one another with the aid of a data bus (8) in which data are transmitted with the aid of a bus protocol, - in which the master control device (5) is configured in such a way, generating a command corresponding to the bus protocol for actuating an actuator (7) for performing an action and sending it via the data bus (8), in which the slave control device (6) assigned to the respective actuator (7) controls the corresponding actuator (7) for performing the action for executing a command, in which the respective slave control device (6) regularly selects a predetermined question (11) on the basis of a predetermined question-response assignment (10) and sends it to the master control device (5) via the data bus (8), in which the master control device (5) selects the predetermined response (12) matching the question (11) according to the predetermined question-response assignment (10) and sends it together with the command via the data bus (8), in which the slave control device (6) checks the response (12) transmitted from the master control device (5) together with the command on the basis of the predetermined question-response assignment (10) and executes the command only if the response (12) transmitted with the command matches the question (11) generated by the slave control device (6).Communication method (9) according to Claim 1, characterized - in that the slave control units (6) independently of one another in each case frequently select a predetermined question (11) on the basis of the predetermined question-answer assignment (10) and transmit this question to the master control unit (5) via the data bus (8), - in that the master control unit (5) addresses the command for actuating the respective actuator (7) to the slave control unit (6) assigned to the respective actuator (7) and selects the answer (12) to the question (11) transmitted by the addressed slave control unit (6) on the basis of the question-answer assignment (10) and transmits it with the command.Communication method (9) according to Claim 1 or 2, characterized - in that the respective slave control device (6) selects the respective question (11) only for a predetermined period of time and selects another predetermined question (11) after the predetermined period of time on the basis of the question-response assignment (10).Communication method (9) according to Claim 3, characterized - in that the question-answer assignment (10) specifies a predetermined number of answers (12), - in that the time period is chosen such that a clock rate of the data bus (8) multiplied by the number of answers (12) specified by the question-answer assignment (10) is greater than the time period.Communication method (9) according to Claim 3 or 4, characterized - in that the respective response (12) has a predetermined bit length, - in that the bit length of the response (12) specifies a maximum number of responses (12), - in that the time period is chosen such that a clock rate of the data bus (8) multiplied by the maximum number of responses (12) specified by the bit length of the responses (12) is greater than the time period.Communication method (9) according to one of Claims 1 to 5, characterized - in that the question-response assignment (10) is designed as a table for looking up the response (12) matching the question (11) or as a mathematical formula for calculating the response (12) matching the question (11).Communication method (9) according to one of the preceding claims, characterized - in that the data bus (8) is a CAN bus or a LIN bus.Communication method (9) according to one of the preceding claims, characterized - in that the command which the master control device (5) generates for actuating an actuator (7) for carrying out an action contains an address of the respective actuator (7) and / or an address of the slave control device (6) assigned to the respective actuator (7) and / or the action to be carried out by the respective actuator (7).Control device system (4), in particular of a motor vehicle (1), - having a plurality of control devices (3) which are configured as a master-slave architecture, such that the control devices (3) form at least one master control device (5) and a plurality of slave control devices (6), - wherein at least one actuator (7) is assigned in each case to the slave control devices (6), - wherein the respective slave control device (5) is configured to actuate the assigned actuator (7) or the assigned actuators (7), - wherein the control devices (3) communicate with one another with the aid of a data bus (8) which transmits data with the aid of a bus protocol, - wherein the master control device (5) is configured such that, to actuate an actuator (7) for carrying out an action, it generates a command corresponding to the bus protocol and transmits it via the data bus (8), wherein the slave control device (6) assigned to the respective actuator (7) controls the corresponding actuator (7) for carrying out the action for executing a command, - wherein the respective slave control device (6) regularly selects a predetermined question (11) on the basis of a predetermined question-response assignment (10) and sends it to the master control device (5) via the data bus (8), - wherein the master control device (5) selects the predetermined response (12) matching the question (11) according to the predetermined question-response assignment (10) and sends it together with the command via the data bus (8), - wherein the slave control device (6) checks the response (12) transmitted from the master control device (5) together with the command on the basis of the predetermined question-response assignment (10) and only then executes the command, if the response (12) transmitted with the command matches the question (11) sent by the slave control device (6).Motor vehicle (1), - having a control device system (4) according to Claim 9, - having a plurality of components, to each of which at least one control device (3) of the control device system (4) is assigned.

Images