Plausibility check of a sensor signal with motion information for a vehicle

Abstract

The invention relates to the plausibility check of an analog sensor signal (S) containing motion information for a vehicle (1). The analog sensor signal (S) is detected by a sensor (5) as a function of a change in a magnetic field in response to a movement of an associated pulse wheel (3) coupled to the vehicle's movement. A digital output signal (A) and pulse data (I) are derived from the analog sensor signal (S) by means of an application control unit (7). These pulse data contain a number of pulses of the digital output signal (A) for a predetermined time interval (Δt). The sensor (5) determines plausibility data (P), which contains a state value of the analog sensor signal (S) corresponding to the number of pulses for the predetermined time interval (Δt). The plausibility data (P) are protected, and the pulse data (I) are transmitted to a safety control unit (7).The safety control unit (7) compares the impulse data (I) and the plausibility data (P) with a predefined plausibility criterion to verify the plausibility of the analog sensor signal (S).

Description

[0001] The invention relates to a method for validating an analog sensor signal containing motion information for a vehicle. The analog sensor signal is detected by a sensor as a function of a change in a magnetic field in response to a movement of an associated pulse wheel coupled to the vehicle's movement. The invention also relates to a system for validating a corresponding analog sensor signal containing the motion information for the vehicle.

[0002] Motion information, in this context, is, for example, information about the path or distance a vehicle has traveled and / or its speed. Such information about a vehicle's state of motion or movement is required in various vehicle systems. For instance, motion information is used in tachographs for speed indication and in various driver assistance systems. Several approaches exist for determining or measuring motion information.

[0003] For example, sensors for measuring rotational speed or acceleration can be used that operate on the principle of pulse detection. One possible design for a pulse detection sensor is a sensor that detects changes in the magnetic field of an associated pulse wheel. The sensor can include a pulse generator and is electromagnetically coupled to the pulse wheel. The pulse wheel or gear wheel is connected to or attached to a moving or rotating vehicle component. For example, the pulse wheel in the transmission can be connected to a drive shaft. Such a pulse wheel typically has a disc-shaped form with teeth on its outer edge. As the vehicle moves, the ferromagnetic pulse wheel rotates in front of the sensor, causing the teeth to slide past the sensor.The sensor incorporates, for example, a Hall-effect IC (IC: Integrated Circuit), essentially a Hall probe with a bias magnet. The sensor operates without contact, utilizing the fact that the detected magnetic field changes with the movement of the pulse wheel. Specifically, the magnetic field is stronger in front of a tooth than in front of a gap. The sensor detects this magnetic field as the teeth slide past it and converts it into pulses in real time. The resulting sensor signal is available, for example, as an analog electrical signal, such as a voltage signal and / or a current signal.

[0004] The analog sensor signal is then processed by an application control unit or application controller, generating a digital output signal. This digital output signal, and in particular its waveform, can then be used to calculate or determine the desired motion information. The waveform of the digital output signal changes directly, and especially proportionally, with the vehicle's movement. That is, the signal waveform reflects the vehicle's movement, particularly rotational movements of the vehicle or vehicle components, such as a crankshaft and / or a wheel. The frequency of the output signal pulses can, for example, be used as a measure of the rotational speed. Based on the detected pulses and the known design of the pulse wheel, the vehicle's movement, in particular a travel path or speed, can be calculated using the sensor signals.This method utilizes the fact that the number of teeth on the pulse wheel, and therefore the pulses detected by the sensor, are proportional to the distance or path traveled by the vehicle. The number of pulses per unit of time is proportional to the vehicle speed. The calculation of the actual motion information can be performed, for example, in a tachograph or one of the other vehicle systems mentioned earlier.

[0005] For the purpose of determining movement information, for example in the application of a tachograph, it is important that the integrity of the collected signals is maintained. Various methods are known in the prior art to protect the signals from unauthorized access.

[0006] For example, WO 97 / 35 282 A1 discloses a data transmission device in a vehicle, consisting of a pulse generator and a control unit. In addition to the known transmission from the pulse generator to the control unit via a signal line, the signal generated by a sensor element is also transmitted encrypted via a data line upon request by the control unit.

[0007] Signal reliability is therefore relied upon in the connection between the pulse generator, i.e., the Hall-effect IC, and the application controller. Further security is currently provided, for example, by the processing of the application controller, which is designed to be protected from unauthorized access by its housing.

[0008] DE 10 2004 043 052 B3 describes a method for detecting manipulations on an arrangement consisting of a pulse-generating sensor and a recording unit.

[0009] DE 10 2004 029 941 B3 describes a system for evaluating a sensor signal.

[0010] The standard ISO 16844-3 2004-11 01; Road vehicles - Tachograph systems - Part 3: Motion sensor interface; p. 18 f. describes the use of tachograph systems and motion sensors in road vehicles. The object of the present invention is to further improve the integrity of signals during pulse detection for determining motion information of a vehicle using a previously described sensor and pulse wheels.

[0011] The problem is solved by the subject matter of the independent patent claims. Advantageous embodiments of the invention are disclosed by the dependent patent claims, including the description and figures.

[0012] According to one aspect, the invention relates to a method for verifying the plausibility of an analog sensor signal containing motion information for a vehicle. This motion information is preferably the vehicle's position and / or speed. The analog sensor signal is detected by a sensor as a function of a change in a magnetic field in response to a movement of an associated pulse wheel coupled to the vehicle's movement. The sensor signal is, for example, a current or voltage signal. As mentioned at the outset, the sensor can, for example, comprise a Hall-effect IC with bias magnets.

[0013] To determine the motion information, a digital output signal is derived from the analog sensor signal using an application control unit, i.e., the application controller mentioned earlier. This means that the signal waveform of the analog sensor signal is replicated as a digital signal. A digital signal is a signal represented by discrete values ​​that describe its evolution over time. For this purpose, the sensor signal is sampled and digitized using established methods.

[0014] Furthermore, the application control unit determines pulse data which contains a number of pulses of the digital output signal for a given time interval, i.e. a predetermined time range.

[0015] The sensor is used to determine plausibility data, whereby the plausibility data for the specified time interval contains a state value of the analog sensor signal that is assigned to the number of pulses. The plausibility data thus contains the state value that is assigned to the number of pulses of the sensor signal. "Assigned" here means that it is a value that can be derived from the number of pulses. For example, the state value could contain the number of pulses or the individual state changes of the analog sensor signal.

[0016] A change of state, in this context, refers to a change in the signal's behavior between at least two predefined states. It is therefore a change in the signal's level. The signal thus undergoes a change of direction. Preferably, there are exactly two states, which are designated, for example, as "high" and "low." These can be signal amplitudes that a control unit, such as a microcontroller or microprocessor, interprets or perceives as a logical 1 ("high") or logical 0 ("low"). The "low" state can be detected, for example, when the signal has a predetermined base value or level. The "high" state can be detected, for example, when the signal has a predetermined maximum value or level.

[0017] In this context, an impulse refers specifically to a period of the signal in which its state deviates from the initial state and then returns. During an impulse, the state changes, for example, from "low" to "high" and back to "low," or vice versa. In the context of an impulse wheel, which, for example, has teeth on its outer edge, the respective impulse of the output signal can be, for instance, a rectangular pulse.

[0018] To protect the integrity of the signals, the plausibility data is protected, and the pulse data is transmitted to a safety control unit. The plausibility data is thus transmitted securely, protected against unauthorized access or modification. The pulse data can be transmitted unprotected or also protected. The safety control unit, also known as a safety controller, compares the pulse data and the plausibility data according to a predefined plausibility criterion to verify the validity of the analog sensor signal.

[0019] According to the invention, the plausibility criterion includes a provision which, if fulfilled, indicates that the sensor signal is unmanipulated. By comparing the signal against the plausibility criterion, it can be ensured that the sensor signal has not been manipulated or altered. It can therefore be determined whether the sensor signal was transmitted correctly, exactly as the sensor measured it, and thus whether the motion information derived from it is correct. Naturally, the digital output signal can also be checked for manipulation in this way.

[0020] In other words, the plausibility data, derived from the measured raw data (the sensor signal), is generated within the sensor, for example, the Hall-effect IC. This plausibility data is transmitted securely to the safety controller, while the raw data is transmitted unprotected to the application controller. The application controller processes the raw data and transmits the result, i.e., the number of pulses, to the safety controller. The safety controller then checks whether this result corresponds to the plausibility data.

[0021] This offers the advantage of improved signal transmission security and thus signal integrity through verification of the raw and derived signal data in the safety controller. This is achieved, for example, by establishing an end-to-end security connection between the sensor and the safety controller.

[0022] Preferably, the plausibility data has a significantly reduced amount of data compared to the raw data. This is achieved by implementing a particularly simple signal processing or analysis method within the sensor. The sole purpose is to determine whether the sensor signal has undergone a change of state, i.e., whether a level change has occurred. The sensor may incorporate a signal processing control unit for this purpose.

[0023] In contrast, the application control unit can perform more complex signal processing or analysis of the received sensor signal to generate the output signal. One possible method for signal processing is disclosed, for example, in DE 10 2023 210 763 B3.

[0024] The time interval in which the signals are analyzed to validate the encounter information can be, for example, a few seconds, such as 10, 20, or 30 seconds. However, the time interval can also be in the range of minutes, for example, one minute or more, such as two or five minutes.

[0025] Generating the output signal and checking and comparing the pulse data with the plausibility data can be temporally decoupled. Preferably, the output signal is recorded in real time, i.e., generated while the vehicle is in motion. The plausibility check using the plausibility data, on the other hand, can be performed at any other time. For example, it is sufficient to perform the plausibility check when a regulatory authority needs to verify the movement information.

[0026] The invention includes embodiments that offer additional advantages.

[0027] In one embodiment, the analog sensor signal is only evaluated as plausible according to the predefined plausibility criterion during comparison if the number of pulses in the pulse data and the corresponding state value in the plausibility data are within a predefined approximation range. That is, the sensor signal is classified or marked as unmanipulated only if this condition is met. Otherwise, the sensor signal is evaluated as manipulated in the comparison.

[0028] The approximation range specifies a maximum value or tolerance by which the impulse data and the plausibility data may differ to prevent manipulation. The approximation range is defined, for example, in the plausibility criterion.

[0029] In one embodiment, the analog sensor signal is only evaluated as plausible according to the specified plausibility criterion during the comparison if the number of determining pulses of the pulse data is greater than or equal to the number of pulses of the plausibility data, whereby the pulses of the plausibility data can be determined from the state value.

[0030] This means that the sensor signal is only classified or marked as unmanipulated if this condition is met. Otherwise, the sensor signal is evaluated as manipulated for comparison purposes.

[0031] To convert the state value into a number of pulses, a reference or comparison value can be specified in the plausibility criterion. The determined number of direction changes or state changes in the sensor signal can then be divided by the comparison value to obtain the number of pulses. This result can then be compared with the pulse data. For example, the number 4 can be set as the comparison value, resulting in the following comparison according to the plausibility criterion: Pulse data ≥ State value / 4.

[0032] If, however, the deviation is greater and the plausibility criterion is not met, an error is generated. This means that the sensor signal or the output signal is specifically identified or marked as manipulated. As a result, a control authority attempting to read the movement information can recognize that the integrity of the acquired signals has been compromised and, therefore, that the movement information has not been recorded correctly.

[0033] The benchmark value is determined primarily based on the specific application. It can be established, for example, through tests or simulations.

[0034] The plausibility criterion described can be used particularly in connection with tachograph applications. For other use cases, a different criterion can be selected on an application-specific basis.

[0035] In one embodiment, the state value is determined by identifying a number of state changes of the analog sensor signal within the predetermined time interval.

[0036] As is known, for example, from curve sketching, the number of changes in direction of the sensor signal is determined by identifying local extrema, i.e., minima or maxima, for each pulse of the sensor signal. This means that a change in state or amplitude is counted or recorded whenever the sensor signal switches from the "high" state to the "low" state and vice versa.

[0037] In one embodiment, the number of state changes is determined by comparing the analog sensor signal with a predetermined threshold interval. The amplitude change is only detected if the current signal value of the analog sensor signal falls within or exceeds the threshold interval, preferably in magnitude. That is, the change of direction is detected by comparing the sensor signal with limit values ​​or thresholds that may be predefined within the threshold interval. For example, an upper and a lower limit may be defined within the threshold interval. The upper limit may, for example, be assigned to the level "high," while the lower limit may, for example, be assigned to the level "low." If the sensor signal exceeds the upper limit, the level "high" is assigned to the signal.If the signal falls below the lower limit, the signal is assigned the level "low".

[0038] The range of values ​​for the interval depends primarily on the characteristics of the sensor signal for the specific application. The threshold interval or the associated limit values ​​can be determined, for example, through tests or simulations.

[0039] In one embodiment, the threshold interval is determined based on the hysteresis of the analog sensor signal. This means that, for plausibility checks, changes in direction with hysteresis are counted or determined over the defined period. In other words, a percentage of a relative maximum of the sensor signal is used to determine the limit values. This is specifically the smallest amplitude that the sensor can detect. The value of the respective limit value can be specified, for example, in digits. The magnitude of the limit values ​​can, for instance, be chosen based on the smallest expected duty cycle of a pulse in the sensor signal. For example, if the duty cycle for a typical pulse is 10% for "low" and 90% for "high," the respective limit value is set to the value of the sensor signal at 10%.

[0040] In one embodiment, the digital output signal is transmitted to a tachograph to determine the motion information. The tachograph only confirms the motion information as plausible if a protected release signal is transmitted to the tachograph, according to which the analog sensor signal is validated according to the predefined plausibility criterion.

[0041] The release signal is the result of the security control unit's plausibility check of the sensor signal. This release signal is also protected, meaning it is transmitted to the tachograph securely against unauthorized access. This ensures that no manipulation of the signals has occurred. Based on the release signal, the tachograph can mark or label the movement information for the examined time interval as tamper-free.

[0042] If the safety control unit does not validate the sensor signal, for example due to tampering, it can transmit or send a tampering signal to the tachograph. The tachograph then stores the movement information for the investigated time interval as manipulated, or can transmit or send a tampering notification to the appropriate control authority.

[0043] To determine movement information, the tachograph can, for example, deduce the distance traveled and the speed of the vehicle from the number of pulses of the output signal as well as the known dimensions of the pulse wheel and the vehicle.

[0044] A tachograph, also known as a vehicle tachograph or EC control device, is a device with an integrated measuring recorder that, in the vehicle sector, can record driving and rest times, breaks, kilometers driven, and speed. All data can be read or downloaded by an enforcement authority or the company using the tachograph to detect or penalize violations, for example, in occupational safety regulations.

[0045] In one embodiment, a cryptographic method is used to protect the respective signal.

[0046] This means that the plausibility data, the release signal, and especially the impulse data are protected by encryption, i.e., by being secured with a cryptographic checksum. The checksum is generated cryptographically. For example, asymmetric encryption, also known as public-key encryption, or symmetric encryption, also known as secret-key encryption, can be used. Various cryptographic methods are well-known. For example, AES (Advanced Encryption Standard), MD5 (Message Digest Algorithm 5), SHA (Secure Hash Algorithm), RSA (Rivest Shamir Adleman), Data Encryption Standard (DES), Secure Sockets Layer (SSL), or Transport Layer Security (TLS) can be used, to name just a few.

[0047] For use cases or application situations that may arise during the procedure and are not explicitly described here, it may be provided that, according to the procedure, an error message and / or a request for user feedback is issued and / or a default setting and / or a predetermined initial state is set.

[0048] According to a further aspect, the invention relates to a system for validating an analog sensor signal containing motion information for a vehicle. The system comprises a sensor for detecting the analog sensor signal as a function of a change in a magnetic field in response to a movement of an associated pulse wheel coupled to the vehicle's motion. The system also includes an application control unit for deriving a digital output signal from the analog sensor signal and for determining pulse data, which contains a number of pulses of the digital output signal for a predetermined time interval. The sensor is configured to determine plausibility data, wherein the plausibility data for the predetermined time interval contains a state value of the analog sensor signal corresponding to the number of pulses.The system also includes a safety control unit. The sensor is configured to securely determine plausibility data and transmit it to the safety control unit, while the application control unit is configured to determine pulse data and transmit it to the safety control unit. The plausibility data can be transmitted directly from the sensor to the safety control unit. Alternatively, it can be transmitted to the safety control unit via the application control unit. The safety control unit is then configured to compare the pulse data and the plausibility data according to a predefined plausibility criterion to validate the analog sensor signal.

[0049] The respective control unit can be configured as a data processing device or computing unit. A data processing device can, in particular, comprise one or more computers, one or more microcontrollers, and / or one or more integrated circuits, for example, one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), and / or one or more systems-on-a-chip (SoCs). A data processing device can also contain one or more processors, for example, one or more microprocessors, one or more central processing units (CPUs), one or more graphics processing units (GPUs), and / or one or more signal processors, in particular one or more digital signal processors (DSPs). The data processing device can also comprise a physical or virtual cluster of computers or other devices of the aforementioned type.A data processing device may also include one or more hardware and / or software interfaces, for example for receiving and / or providing data.

[0050] A data processing device may also include one or more storage devices. A storage device may be implemented as volatile memory, such as dynamic random access memory (DRAM) or static random access memory (SRAM), or as non-volatile data storage, such as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or flash EEPROM, ferroelectric random access memory (FRAM), magnetoresistive random access memory (MRAM), or phase-change random access memory (PCRAM).

[0051] Vehicle motion information refers, for example, to information about the movement of the vehicle and / or a vehicle component. This could include, for example, the movement of a tire, the transmission, the drive shaft, or the impulse wheel.

[0052] In one embodiment, the system includes a tachograph for determining the motion information. The application control unit is configured to transmit the digital output signal to the tachograph, and the tachograph is configured to confirm the motion information as plausible only if a protected release signal is transmitted from the safety control unit to the tachograph, according to which the analog sensor signal is validated according to the specified plausibility criterion.

[0053] Additionally or alternatively, it is conceivable to use the system according to the invention with ABS sensors (anti-lock braking system). That is, the system can include ABS sensors.

[0054] The invention also includes further developments of the system according to the invention that exhibit features already described in connection with the further developments of the method according to the invention. For this reason, the corresponding further developments of the system according to the invention are not described again here.

[0055] The described system can be used, for example, in a vehicle, preferably a motor vehicle, a watercraft, or an aircraft. The motor vehicle can be, for example, a car, in particular a passenger car, truck, bus, or motorcycle.

[0056] The described method can, for example, be implemented in a computer program. The computer program can include commands which, when executed by a corresponding control unit, cause it to perform those steps of the method according to the invention that relate to the application control unit and the safety control unit.

[0057] The instructions can be provided, for example, as program code. This program code can be provided, for example, as binary code or assembly language, and / or as source code in a programming language such as C, and / or as a program script, such as Python.

[0058] A computer-readable storage medium may also be provided, which stores a corresponding computer program. The storage medium can be designed as a physical and / or non-volatile computer-readable storage medium.

[0059] The invention also includes combinations of the features of the described embodiments.

[0060] An embodiment of the invention is described below. The following is shown: Fig. 1 a schematic representation of a vehicle with a system for validating a sensor signal with motion information for the vehicle; Fig. 2 a schematic voltage-time diagram with an example of the sensor signal curve, Fig. 3 a schematic voltage-time diagram with an example of an output signal generated from the sensor signal, and Fig. 4 A schematic process flow diagram for a procedure to verify the plausibility of the sensor signal with motion information for the vehicle.

[0061] The embodiment described below is a preferred embodiment of the invention. In this embodiment, the described components each represent individual features of the invention that can be considered independently of one another. Each of these features further develops the invention independently and can therefore be considered part of the invention individually or in a combination other than that shown. Furthermore, the described embodiment can also be supplemented by other features of the invention already described.

[0062] In the figures, functionally identical elements are each provided with the same reference symbols.

[0063] Fig. Figure 1 shows a schematic representation of vehicle 1. Vehicle 1 is, for example, a passenger car. Fig. Figure 1 shows vehicle 1 from a side perspective view. Vehicle 1 includes a drive shaft 2, which serves to transmit power between a gearbox and the respective driven wheel of vehicle 1. To obtain motion information about vehicle 1, vehicle 1 also includes a system 4. The motion information can, for example, include speed information and / or distance information. The motion information thus provides information about the speed of vehicle 1 or the distance or path that vehicle 1 has already traveled.

[0064] System 4 comprises a sensor 5 and an application control unit 6. The application control unit 6 includes, for example, one or more microprocessors or microcontrollers and is designed to perform computational operations. This includes, for example, processing a sensor signal S to determine the desired motion information provided by the sensor 5. To determine the motion information, the sensor 5 is electromagnetically coupled to a pulse wheel 3. In the present embodiment, the pulse wheel 3 is attached to the drive shaft 2. Of course, the pulse wheel 3 can also be attached to another vehicle component that simulates the movement of the vehicle 1. It is attached in such a way that the pulse wheel 3 moves along with the drive shaft 2.The movement of the impulse wheel 3, and thus indirectly also the movement of the vehicle 1 via the drive shaft 2, can be detected by the sensor 5 in the form of impulses. The sensor 5 outputs these impulses as an analog sensor signal S.

[0065] System 4 thus provides a pulse generator for producing a representative position and / or speed signal (sensor signal S), which operates on the basis of dynamically adaptive pulse detection. Sensor 5 can be installed or mounted at various locations in the vehicle, such as in a vehicle transmission, on the drive shaft, on the axles, or on the wheels. The sensor signal is representative because the detected position and / or speed information is only proportional to the vehicle's position or speed information, as in the present embodiment on the drive shaft.

[0066] The following is a brief summary of the operating principle of system 4. For example, in the gearbox, the impulse wheel 3 is attached to the drive shaft 2 to acquire the position and / or speed information. As shown in the exemplary embodiment in Fig. Figure 1 shows a disc-shaped device with teeth along its outer edge. As the vehicle 1 moves, the ferromagnetic pulse wheel 3 rotates in front of the sensor 5. The sensor contains, for example, a Hall-effect IC with a bias magnet. The sensor 5 thus operates without contact. In particular, the sensor reacts to changes in the magnetic field that occur when the pulse wheel 3, especially its teeth, move past the sensor 5. This is achieved by exploiting the fact that the magnetic field is stronger in front of a tooth than in front of a gap. The magnetic field is detected by the sensor 5 as the teeth slide past the sensor and converted into pulses in real time via dynamic adaptive pulse detection and output as a real-time signal.

[0067] This real-time signal is the sensor signal S, which is present, for example, as an electrical signal, such as an electrical voltage signal. Fig. Figure 2 shows a schematic voltage-time diagram illustrating an example of the sensor signal S's behavior. As in Fig. As shown in Figure 2, the sensor signal S is, for example, a sinusoidal voltage signal. Of course, other signal shapes are also conceivable. The signal shape depends in particular on the design of the pulse wheel 3. As shown in Figure 2, the sensor signal S is, for example, a sinusoidal voltage signal. Fig. As can be seen in Figure 2, the level or state of the sensor signal S continuously changes from a "high" state (h) to a "low" state (d). The signal enters the "high" state (h), for example, when a tooth of the pulse wheel 3 passes the sensor 5. The signal enters the "low" state (d), for example, when a gap in the teeth of the pulse wheel 3 passes the sensor 5.

[0068] The shape of the sensor signal S, i.e., the pulses generated by the movement of the pulse wheel 3, is representative of the vehicle's movement. For example, the distance traveled by the vehicle can be determined from the number of teeth that have passed the sensor. The pulses per unit of time contained in the sensor signal S provide, for example, a measure of the vehicle's speed. The desired motion information can thus be determined by evaluating the sensor signal S, for example, in the application control unit 6.

[0069] The evaluation is performed by the application control unit 6 digitizing the analog sensor signal S using a known signal analysis method. For this purpose, the sensor signal S is sampled and converted into a digital output signal A. Fig. Figure 3 shows a schematic voltage-time diagram illustrating an example of the output signal A. As in Fig. As shown in Figure 3, the output signal A is, for example, a square wave. Of course, other signal shapes are also conceivable. The signal shape depends in particular on the design of the pulse wheel 3. The level of the output signal A continuously alternates from a "high" state (h) to a "low" state (d), corresponding to the sensor signal S. Each square wave in the rectangular signal corresponds to a pulse of the output signal A. Since the shape of the output signal A follows the shape of the sensor signal S, the pulses of the output signal A are also representative of the vehicle movement.

[0070] To obtain the motion information, the number of pulses per time interval Δt of the output signal A is determined, for example. The desired motion information can be deduced from the number of pulses per time interval Δt, given the known dimensions of the pulse wheel 3. For this purpose, the system 4 includes a tachograph 8 or speed recorder.

[0071] Preferably, the tachograph 8 is designed as a digital tachograph. From the output signal A, the tachograph can record movement information such as driving and rest times, breaks in driving time, kilometers driven, or speed. This movement information is used, for example, to prosecute violations of occupational safety regulations. For this purpose, the data from the tachograph can be read digitally by an enforcement authority or a company.

[0072] Manipulation can occur when determining movement information using a tachograph. For example, the raw data (sensor signal S) recorded by sensor 5 or the output signal A may be manipulated, thus falsifying the signals or data. In such cases, the movement information no longer corresponds to the actual vehicle movement. To prevent such manipulation, system 4 includes, as shown in Fig. Figure 1 shows an additional safety control unit 7. The safety control unit 7 is used to validate the sensor signal S and, in particular, the output signal A. Validation here means checking whether manipulation has occurred, i.e., whether the integrity of the detected signals is compromised or intact.

[0073] Fig. Figure 4 shows an example of a schematic process flowchart for a procedure for operating a system, as exemplified in Fig. 1 is shown. Fig. Figure 4 shows a process flow diagram with individual constitution steps for a procedure to verify the plausibility of the analog sensor signal S.

[0074] In step S1, the sensor signal S is first detected or recorded by the sensor 5, as described previously. In step S2, the sensor signal S is evaluated by the application control unit 6. For this purpose, the sensor 5 sends the sensor signal S to the application control unit 6. The application control unit 6 evaluates the sensor signal using known signal analysis methods. As a result of the evaluation, the application control unit 6 provides the digital output signal A. The application control unit 6 also determines pulse data I, which contains the number of pulses of the digital output signal A for the specified time interval Δt. In the exemplary embodiment in Fig. For example, 5 such impulses I1 to I5 are contained in the time interval Δt.

[0075] In step S3 of the procedure, plausibility data P is determined. This determination is carried out using sensor 5. The sensor may include a control unit or data processing device. For the specified time interval Δt, the plausibility data P contains a state value R1 to R11 of the analog sensor signal S, corresponding to the number of pulses. This state value could, for example, indicate the number of state changes of the sensor signal S within the time interval Δt. That is, it represents the number of changes in direction that sensor 5 detects for the sensor signal S within the time interval Δt, specifically from the "high" state (h) to the "low" state (d) and vice versa.

[0076] To determine the number of state changes, one can, for example, proceed as in Fig. Figure 2 shows the analog sensor signal S being compared with a threshold interval G. The threshold interval G comprises an upper limit G1 and a lower limit G2. The upper limit G1 represents the "high" state h. The lower limit G2 represents the "low" state d. If the sensor signal S exceeds or falls below the threshold interval G, i.e., the upper or lower limit G1 or G2, this is detected as a change of state and thus a change of direction. In the embodiment according to Fig. Figure 2 shows, for example, 11 such state changes R1 to R11 in the time interval Δt. The state value contained in the plausibility data is therefore 11.

[0077] Preferably, the hysteresis of the analog sensor signal S is taken into account when determining the threshold interval G. That is, the magnitude of the limit values ​​G1, G2 is chosen such that it corresponds to a percentage of a relative maximum of the sensor signal S. In particular, the smallest amplitude that the sensor 5 can detect is considered.

[0078] The plausibility data P is then transmitted to the safety control unit 7 in a protected manner, specifically with a cryptographic checksum. Various well-known encryption methods can be used for this purpose, such as AES encryption. Transmission can occur directly from sensor 5 to the safety control unit 7, or the plausibility data P can be transmitted via the application control unit 6 and then to the safety control unit 7. Furthermore, the pulse data I is also transmitted to the safety control unit 7. The pulse data is preferably transmitted unprotected.

[0079] In step S4, the safety control unit 7 checks whether the pulse data I and the plausibility data P match according to a predefined plausibility criterion for verifying the plausibility of the analog sensor signal S. This means that the pulse data I and the plausibility data P are compared. To do this, it is checked whether the number of detected pulses in the pulse data I and the corresponding state value in the plausibility data P lie within a predefined approximation range. That is, the values ​​must not deviate from each other beyond this approximation range. The approximation range thus defines a tolerance for the comparison of the pulse data I and the plausibility data P. This approximation range is, for example, defined in the plausibility criterion.

[0080] According to the plausibility criterion, the sensor signal S is only validated, for example, if the number of pulses of the pulse data I used to determine the state value is greater than or equal to the number of pulses of the plausibility data P that can be derived from the state value. To convert the state value into pulses, a comparison or reference value is defined, specific to the application. This applies particularly to applications with a tachograph. For other applications, such as with ABS sensors, this rule may be omitted or a different plausibility validation rule may be chosen, depending on the application.

[0081] According to the pulse data I, 5 pulses are present in the defined time interval Δt. The number of direction changes R1 to R11 in the defined time interval is 11. The reference value can be set to, for example, 4. The safety control unit 7 can now check whether the number of pulses is greater than or equal to the number of direction changes divided by 4. In this case, this calculation yields, for example, 2, so the plausibility criterion is met.

[0082] If the plausibility criterion is met, the procedure continues in step S5. In step S5, the safety control unit 7 can transmit a release signal F to the tachograph 8. The release signal F indicates that the sensor signal S and, consequently, the output signal A are plausible and, in particular, have not been manipulated. The tachograph 8 can thus link the motion information assigned to the analyzed time interval Δt with the release signal F, thereby confirming the motion information as correct. The tachograph 8 can thus mark or highlight the motion information for the considered time interval Δt as unmanipulated. If the motion information is retrieved from the tachograph 8 by an enforcement authority, the authority can immediately recognize that the motion information is unmanipulated.

[0083] If, however, it turns out in step S4 that the plausibility criterion is not met, the procedure continues in step S6. In step S6, the safety control unit 7 can send a manipulation signal M to the tachograph 8. The manipulation signal M indicates that the sensor signal S or the output signal A has been manipulated. The tachograph 8 can store the manipulation signal M with the movement information for the considered time interval Δt. The tachograph 8 can thereby mark or highlight the movement information for the considered time interval Δt as manipulated. The enforcement authority that retrieves the movement information immediately recognizes that the movement information for this time interval has been manipulated and is therefore falsified.

[0084] Preferably, the release signal F and the manipulation signal M are also protected, in particular transmitted to the tachograph 8 in encrypted form.

[0085] The described procedure can therefore be summarized as follows: The Hall-effect IC (sensor 5) scans the pulse wheel 3 and generates sinusoidal raw data as measured values. For plausibility checks, changes in direction with hysteresis are counted for the sensor signal S over a defined period. The raw data is sent to the application controller (application control unit 6) for the defined period (time interval Δt). This generates a square wave signal and counts the pulses, which are sent as a result or reference value to the security controller (safety control unit 7). The number of direction changes in the Hall-effect IC is transmitted to the security controller in a protected manner. The security controller verifies both pieces of information. If the deviation is too large, an error is generated, thereby marking the data as manipulated.

[0086] Overall, the examples demonstrate how Hall-IC raw data and signal data derived by an application controller can be verified in a safety controller. Reference symbol list A Output signal The state “low” F Release signal h state “high” I Impulse data I1-I5 Impulses M Manipulation signal P Plausibility data R1-R11 Direction change S Sensor signal S1-S6 process steps t time Δt time interval U voltage 1 vehicle 2 Drive shaft 3 Impulse wheel 4 System 5 Sensor 6 Application control unit 7 Safety control unit 8 Tachograph

Claims

[1] Method for verifying the plausibility of an analog sensor signal (S) containing motion information for a vehicle (1), wherein the analog sensor signal (S) is detected by means of a sensor (5) as a function of a change in a magnetic field in response to a movement of an associated pulse wheel (3) coupled to a vehicle movement, wherein - a digital output signal (A) is determined from the analog sensor signal (S) by means of an application control unit (6), and pulse data (I) are determined which contain a number of pulses of the digital output signal (A) for a specified time interval (Δt), characterized by , that - plausibility data (P) are determined by means of the sensor (5), wherein the plausibility data (P) for the specified time interval (Δt) contain a state value of the analog sensor signal (S) assigned to the number of pulses, wherein - on the one hand, the plausibility data (P) is protected, and on the other hand, the impulse data (I) is transmitted to a safety control unit (7), and - by means of the safety control unit (7) the impulse data (I) and the plausibility data (P) are compared according to a predetermined plausibility criterion to verify the plausibility of the analog sensor signal (S), wherein the predetermined plausibility criterion contains a requirement which, if it is fulfilled, indicates that the analog sensor signal (S) is unmanipulated. [2] Method according to claim 1, wherein the analog sensor signal (S) is only evaluated as plausible according to the specified plausibility criterion when comparing if the number of detected pulses of the pulse data (I) and the state value of the plausibility data (P) associated with the number of pulses are within a specified range of approximation to each other. [3] Method according to claim 2, wherein the analog sensor signal (S) is only evaluated as plausible according to the specified plausibility criterion when comparing if the number of detected pulses of the pulse data (I) is greater than or equal to the number of pulses of the plausibility data (P) that can be determined from the state value. [4] Method according to one of the preceding claims, wherein the state value is determined by determining a number of state changes of the analog sensor signal (S) in the predetermined time interval (Δt). [5] Method according to claim 4, wherein to determine the number of state changes, the analog sensor signal (S) is compared with a predetermined threshold interval (G), and a state change is detected only when a respective signal value of the analog sensor signal (S) enters the threshold interval (G). [6] Method according to claim 5, wherein the threshold interval (G) is determined as a function of a hysteresis of the analog sensor signal (S). [7] Method according to one of the preceding claims, wherein the digital output signal (A) is transmitted to a tachograph (8) for determining the motion information, wherein the tachograph (8) confirms the motion information as plausible only if a protected release signal (F) is transmitted to the tachograph (8) according to which the analog sensor signal (S) is plausible according to the specified plausibility criterion. [8] Method according to any of the preceding claims, wherein a cryptographic method is used for protection. [9] System (4) for verifying the plausibility of an analog sensor signal (S) containing motion information for a vehicle (1), comprising: - a sensor (5) for detecting the analog sensor signal (S) as a function of a change in a magnetic field in response to a movement of an associated pulse wheel (3) coupled to a vehicle movement, and - an application control unit (6) for determining a digital output signal (A) from the analog sensor signal (S) and for determining pulse data (I) which contains a number of pulses of the digital output signal (A) for a specified time interval (Δt), characterized by , that - the sensor (5) is configured to determine plausibility data (P), wherein the plausibility data (P) for the specified time interval (Δt) contain a state value of the analog sensor signal (S) assigned to the number of pulses, and - the system (4) comprises a safety control unit (7), wherein the sensor (5) is configured to transmit the plausibility data (P) to the safety control unit (7) in a protected manner and the application control unit (6) is configured to transmit the pulse data (I) to the safety control unit (7), wherein - the safety control unit (7) is designed to compare the impulse data (I) and the plausibility data (P) according to a predetermined plausibility criterion to verify the plausibility of the analog sensor signal (S), wherein the predetermined plausibility criterion includes a requirement which, if fulfilled, indicates that the analog sensor signal (S) is unmanipulated. [10] System (4) according to claim 9, wherein the system (4) comprises a tachograph (8) for determining the motion information, wherein the application control unit (6) is configured to transmit the digital output signal (A) to the tachograph (8), and the tachograph (8) is configured to confirm the motion information as plausible only if a protected release signal (F) is transmitted from the security control unit (7) to the tachograph (8), according to which the analog sensor signal (S) is plausible according to the specified plausibility criterion.

Images