Method for performing a control function by means of control software, and a vehicle with corresponding control software

Abstract

The invention relates to a method for performing control functions by means of control software (Soft), in particular software for controlling a vehicle, wherein the control software (Soft) is assigned code sections (AB1, AB2) with test code, in particular of a validator (GV, LV, SV, HV), for validating calculations, wherein defence level information is used to assign a defence level (DefL) to the test codes contained in the control software (Soft), in each case with respect to an attack from an attack list (Att), wherein the method comprises the following steps: a) calculating at least one total defence level (TDef) in a computer-aided manner using at least a selection of the defence level information (Def); b) using the total defence level (TDef) to improve the security of the control software (Soft).

Description

[0001] Method for performing a control function by means of control software and a vehicle with corresponding control software

[0002] DESCRIPTION

[0003] The present invention relates to a method for performing a control function by means of control software and a vehicle with corresponding control software.

[0004] In order to be able to control a motor vehicle autonomously, it is necessary to develop highly reliable software, especially control software.

[0005] For example, various information sources can be evaluated to determine the position, whereby each information source can be assigned to a sensor. The different information sources can be statistically independent of one another. For example, a first piece of position information can be determined based on signals from an acceleration sensor, a second piece of position information can be determined based on wheel speeds of the motor vehicle, and a third piece of position information can be determined based on an object in the vicinity of the motor vehicle that is detected by a camera. Position information usually relates to a geographical position and can additionally include an orientation of the motor vehicle as a pose. The information determined in each case can be compared with geographical information recorded in map data.

[0006] In this context, it is known to first independently check the plausibility of the position information from each information source by determining whether the position information from one information source matches that of the other sufficiently well. This usually assumes temporally correlated or simultaneous observation by the individual information sources, and the matching position information can be summarized in a single set. The geographic position can then be determined based only on the position information that is deemed sufficiently plausible.The plausibility check can be carried out by means of a validator, which preferably determines whether the position information provided by an information source does not deviate, with a predetermined minimum probability, by more than a predetermined amount from a position determined on the basis of position information from all information sources.

[0007] Such validators can be trained using machine learning, for example.

[0008] It is therefore known to use validators to detect and respond to problems with individual sensors (see DE 10 2021 123 714 A1). However, with the increasing digitalization and equipment of vehicles, a new field of potential sources of danger is opening up. For example, there are attacks on the software to gain control over a specific vehicle. Much more destructive approaches involve deliberately attacking the software to provoke malfunctions. This can sometimes lead to personal injury. For example, there are GPS jammers that can significantly impair the functionality of control software in vehicles. Alternatively, signs can be covered up, provoking software malfunctions.

[0009] Such attacks are new, and there are currently very few approaches to counter them.

[0010] Based on this situation, the object of the present invention is to provide an improved method for performing a control function. In particular, the aim is to create software, especially control software, that functions robustly under all conditions and detects malfunctions or attacks.

[0011] The object is achieved by the method according to claim 1. In particular, the object is achieved by a method for performing control functions using control software, wherein the control software is assigned code sections with check code, in particular a validator, for validating calculations, wherein, by means of defense level information, a defense level is assigned to the check codes contained in the control software with respect to an attack from an attack list. The method according to the invention comprises the following steps: a) computer-assisted calculation of at least one overall defense level using at least a selection of the defense level information; b) using the overall defense level to improve the security of the control software.

[0012] The control software can therefore be assigned test codes. This means that it can include these, or separate modules can be provided that contain the test codes. Such test codes can be validators that indicate whether a specific code section, the program as a whole, a measurement, a calculation, etc., is functioning correctly. In one embodiment, the control software performs a calculation, for example based on a measurement. The validator or test code indicates whether the measurement or the measurement source is reliable. According to the present invention, the term measurement or measurement result is understood very broadly. A measurement result can be any information based on the determination of a fact in reality. Sensors, for example position sensors, optical and / or acoustic sensors, are preferably used for this purpose.

[0013] The attack list can contain a list of attacks that are potentially dangerous for the control software. For example, a specific code section might use a GPS device to determine a position. A potential attack associated with this positioning could be jamming the GPS signal.

[0014] The defense level information assigns a defense level to a specific verification code, such as a validator. Preferably, the assignment is made with reference to a specific attack. In the above example, this could be jamming the GPS signal.

[0015] Different information about defense levels can preferably be stored in external data sources. In one embodiment, these assignments can be made via references. It is also possible to list the specific defense level as part of the validator.

[0016] The method according to the invention uses the information about the different defense levels assigned to the different attacks on a validator-specific basis to calculate an overall defense level. This overall defense level can be used to improve the security of the control software. The overall defense level does not necessarily have to take all defense levels into account. According to the invention, an overall defense level is already considered to be achieved when at least two defense levels are combined to form a new value.

[0017] In one embodiment, the overall defense level can be determined iteratively, whereby an abort (=consideration of additional defense levels) can occur if a threshold is exceeded or undershot. Abort can occur, for example, if a minimum value is not reached for a specific attack, taking all available check codes into account.

[0018] In one embodiment, for each attack from the attack list, the individual validators are considered and a corresponding defense level is determined.

[0019] This method can be used to improve software that is still under development. For example, it can be determined that a certain security level is not met, making it possible to provide additional security mechanisms. In one embodiment, the method according to the invention is part of the control software or runs in parallel with it and results in at least one function of the control software being deactivated in step b) if certain criteria are met. In this respect, the invention can be used to always keep the system on which the control software is running in a secure state. For example, functions that no longer meet a predetermined security defense level can be deactivated. Using autonomous driving as an example, the driver can be requested to take control of the vehicle if a certain defense level can no longer be maintained.This leads to more robust behavior of the entire system.

[0020] In one embodiment, step b) comprises comparing the overall defense level with a threshold and taking a measure, for example, the previously described deactivation of a function of the control software. The threshold can be a maximum or a minimum value, whereby the described measure can be taken when this threshold is exceeded or fallen below, respectively.

[0021] In one embodiment, a first verification code comprises a code for validating a position using a satellite-based system, for example a GPS device and / or a GNUS device.

[0022] In one embodiment, a second check code comprises a code for validating a position using a video system, for example an optical lane detection system.

[0023] In one embodiment, a third check code comprises a code for validating a position using a lidar and / or radar system. The individual embodiments with the three different check codes can be combined with each other as desired. It is possible to provide additional check codes; for example, a check code can comprise a code for validating a position and / or a rule, such as a traffic rule, using a video system, for example, traffic signs being optically detected.

[0024] In one embodiment, each check code is checked to see whether it is active or inactive. This means that it is determined whether the respective check code contributes to security. When running through the attacks, in one embodiment only those check codes that are active for the respective attack can be taken into account. The respective defense level is then combined with the additional defense levels offered by the check codes that are active with respect to the respective attack. A combination of the defense levels with respect to a specific attack can include adding the defense level determined for the respective (active) check code. Thus, in one embodiment, each active check code increases the defense level as long as it has a value greater than zero (= is effective) with respect to the attack.

[0025] In one embodiment, in step b), the (combined) defense levels determined for a specific attack are combined using a minimum operator. Thus, in this embodiment, the most dangerous attack (a low defense level is poor) determines the overall defense level. Alternatively, a combination can be performed using a maximum operator if the defense level is set such that a low value symbolizes particularly good protection.

[0026] The object mentioned at the outset is further achieved by a computer-readable memory with instructions for implementing one of the embodiments already described, wherein the instructions are preferably selected such that they lead to the implementation of the method when executed on at least one processor.

[0027] The object is further achieved by a vehicle, in particular an autonomously driving vehicle, which comprises a corresponding memory and / or is designed such that it implements at least one of the methods already described.

[0028] The task is still solved by a vehicle that includes:

[0029] - one or more computer-readable storage media a) for storing control software, wherein the control software is assigned code sections with test code, in particular a validator, for validating calculations, in particular calculations based on measurement results; b) for storing at least one attack list; c) for storing defense level information, which assigns a defense level to the test codes contained in the control software in relation to an attack from the attack list

[0030] - at least one processor executing control software configured to calculate at least one overall defense level using at least a selection of the defense level information; and to deactivate at least one function of the control software if the overall defense level falls below or exceeds a threshold value.

[0031] Similar advantages arise with regard to the computer-readable memory and the respective vehicle as those already described in connection with the method.

[0032] In one embodiment, the memory comprises: - a first check code for validating a position using a satellite-based system, for example a GPS and / or a GNUS and / or

[0033] - a second check code for validating a position using a video system, for example an optical lane recognition system, and / or

[0034] - a third verification code to validate a position using a lidar and / or radar system.

[0035] In one embodiment, the control software is configured to prompt a vehicle occupant to assume a task, such as driving the vehicle, before deactivating the at least one function. As already explained, the control software can be part of the control software or executed separately from it. The request to assume the at least one function by the control software can be made using various actuators, for example, optical signals (flashing light, display on an LCD screen), vibration signals, or acoustic signals.

[0036] The invention will now be described with regard to further features and advantages using exemplary embodiments which will be explained in more detail by means of illustrations.

[0037] Here we show:

[0038] Fig. 1 shows an autonomously driving vehicle that implements the method according to the invention;

[0039] Fig. 2 shows a schematic processing of the available data by a processor which is part of the vehicle according to Fig. 1;

[0040] Fig. 3 is a schematic representation of a control software which is validated or monitored according to the invention;

[0041] Fig. 4 a table with potential attacks; and

[0042] Fig. 5 shows a table that assigns attack-specific defense levels to validators. In the following description, the same reference numerals are used for identical and equivalent parts.

[0043] Fig. 1 shows a vehicle 200 equipped with a vehicle bus 210.

[0044] The vehicle bus 210 connects several components of the vehicle 200. These include a camera system 240, a lidar system 250, a GPS device 220, and a control module 280. The control module 280 is connected to a database 350 for storing data, particularly data such as those shown by way of example in Figs. 4 and 5. In another embodiment, data is simply stored in a file, so that the database 350 can be omitted.

[0045] The control module 280 has a processor that implements a control function using control software. In one embodiment, the control software can be a software component that implements the autonomous movement of the vehicle 200 in road traffic. For the exemplary embodiment, it is assumed that this is a highly automated (Level 4) or fully automated (Level 5) journey.

[0046] To improve safety, vehicle 200 is equipped with a control software called Check (see Fig. 2). This software performs a continuous control function and ensures that the vehicle navigates reliably in traffic. Validators are assigned to the control software for this purpose. These can be:

[0047] - a GPS validator GV,

[0048] - a lane boundary validator (LV),

[0049] - a sign validator SV and / or

[0050] - a GPS history validator HV (“GPS history validator”).

[0051] The control software Check recognizes different attacks, which are listed in an attack table Att (see Fig. 4). It has access to a defense table Def, which assigns a defense level DefL to each of the validators GV, LV, SV, HV with respect to a specific attack. A corresponding defense table Def is shown in Fig. 5. In one embodiment, the respective validator provides a Boolean value that indicates whether the respective validator is active. The defense table Def can be configured such that it specifies that a certain defense level ("DefL") is present for the respective validator GV, LV, SV, HV if its output value is TRUE. Otherwise (output value = FALSE), it can be assumed in this embodiment that no or a low defense level is present with respect to the respective validator and the respective attack.

[0052] Using the defense table Def, the control software Check can determine a defense level DefL for each attack from the attack table Att or indicate whether a given defense level TDefMin is met.

[0053] In one embodiment, the control software Check implements the following pseudocode:

[0054] MinDefenseLevel = infinite for A in attacks

[0055] DefenseLevel = 0 for V in validators if (Active(V)) then

[0056] DefenseLevel = DefenseLevel + D(V,A) end if end for

[0057] MinDefenseLevel = min(MinDefenseLevel, DefenseLevel) end for if MinDefenseLevel > DefenseThreshold then return True else return False end if

[0058] This calculates a defense level (see variable "DefenseLevel") for all attacks (see variable "A") and summarizes all attacks (see variable "MinDefenseLeve"). If the total defense level TDef calculated in this way (see variable "MinDefenseLevel") exceeds a threshold TDefMin (see variable "DefenseThreshold"), TRUE is returned ("return True"). In this case, it can be assumed that the control software is in a safe state. Otherwise ("return False"), it must be assumed that the control software is in an unsafe state and appropriate countermeasures must be initiated. Appropriate countermeasures could, for example, consist of shutting down the vehicle 200 or asking the driver to assume various control functions independently.

[0059] The pseudocode contains another loop that checks all validators for each attack, e.g., validators GV, LV, SV, HV. Each validator is checked to see if it is active (see function "Active(V)"). If so, a defense level is determined for the respective validator and attack based on the defense table Def (see

[0060] Application of the function "D(V,A)"). The defense level DefL determined in this way is then combined with a defense level previously determined for the attack (see plus operation "DefenseLevel + D(V,A)").

[0061] In another embodiment, simulations can be performed in which sensors fail randomly, so that the respective validators indicate that the respective sensor is not active (see the "Active(V)" function in the pseudocode shown above). Under these conditions, the control software Check can then output different defense levels for different attacks and / or an overall defense level TDef to assess the security level of the control software Soft, if necessary, with respect to different attacks. It is also possible to assign failure probabilities to sensors and to consider these failure probabilities in the aforementioned simulation.

[0062] Fig. 4 shows an example of an attack table. This table lists all attacks relevant to the control software. In the example shown, the table contains two columns. One column ("Attack") lists the individual attacks, for example, "GPS Attack." The other assigns an identification number ("AttackID") to each attack.

[0063] The defense table Def shown in Fig. 5 uses this identification number (see the middle column there) to assign a defense level DefL to some validators (see the first column with the heading "Validator"). For example, the first entry in the second row of the table in Fig. 5 indicates that the validator GV is assigned a defense level DefL of 0 for a GPS attack (AttackID = 1). The following row indicates that the same validator GV is assigned a defense level DefL of 3 for a shield overlay (AttackID = 2).

[0064] In the described embodiment, it is stated that the driver is requested to take over the steering function independently. It is not necessarily necessary for the driver to take over the steering function in every situation in which the desired defense level TDefMin is not maintained. There may be situations in which the driver or another occupant of the vehicle simply needs to be made aware of a problem. Such a warning can be given by means of a signal. The signal can indicate to the driver or the occupant in general that additional precautionary measures are required, e.g. that the driver puts their hands on the steering wheel and is ready to brake. The signal can indicate that additional attention is required by a reduction in speed, a vibrating steering wheel and / or a steering drift towards the edge of the road.To generate the signal, the vehicle can confirm 200 corresponding actuators.

[0065] In one embodiment, the vehicle may have sensors that determine whether the driver is paying attention, e.g., a sensor that indicates that the driver's hands are on the steering wheel. The vehicle 200 may enter a safe mode, e.g., by a controlled stop of the vehicle, e.g., at the side of the road, if the sensor indicates that the driver is not controlling the vehicle 200 satisfactorily or is not providing the desired level of attention. According to the invention, safe modes can be defined for each code section AB1, AB2, which the vehicle 200 enters if the control software Check determines that a sufficiently high defense level TDefMin is not present. To enter the respective safe mode, the vehicle 200, for example, can actuate suitable actuators, e.g., brakes, engine, any light signals, including a turn signal, etc., by the control software Check.

[0066] At this point, it should be noted that all parts described above, viewed individually and in any combination, particularly the details shown in the drawings, are claimed as essential to the invention. List of reference symbols:

[0067] 200 vehicles

[0068] 210 vehicle bus

[0069] 220 GPS setup

[0070] 240 camera system

[0071] 250 Lidar system

[0072] 280 control module

[0073] 350 database

[0074] AB1 , AB2 code section

[0075] Att attack table

[0076] Check control software

[0077] Def Defense Table

[0078] DefL defense level

[0079] GV, LV, SV, HV validator or testing software

[0080] Soft tax software

[0081] TDef Total Defense Level

[0082] TDefMin minimum defense level

Claims

CLAIMS 1. A method for carrying out control functions by means of control software (soft), in particular software for controlling a vehicle, wherein the control software (soft) is assigned code sections (AB1, AB2) with check code, in particular a validator (GV, LV, SV, HV), for validating calculations, wherein a defense level (DefL) is assigned to the check codes contained in the control software (soft) with respect to an attack from an attack list (Att) by means of defense level information, the method comprising the following steps: c) computer-assisted calculation of at least one overall defense level (TDef) using at least a selection of the defense level information (Def); d) using the overall defense level (TDef) to improve the security of the control software (soft).

2. Method according to claim 1, characterized in that step b) comprises deactivating at least one function of the control software (soft).

3. Method according to claim 1 or 2, characterized in that step b) comprises comparing the overall defense level with a threshold value (DefMin) and taking a measure, for example deactivating a function of the control software (Soft).

4. Method according to one of the preceding claims, characterized in that a first check code is a code for validating a position using a satellite-based system, for example a GPS and / or a GNUS and / or a second check code is a code for validating a position using a video system, for example a system for optical lane detection, and / or a third check code comprises a code for validating a position using a lidar and / or radar system.

5. Method according to one of the preceding claims, characterized in that it is determined for each check code whether it is active.

6. Method according to one of the preceding claims, in particular according to claim 5, characterized in that in step b) for an attack from the attack list (Att) the defense levels of the active check codes are combined, in particular by means of addition or multiplication, for the respective attack in order to determine an attack-specific defense level, and optionally the attack-specific defense levels are combined, in particular by means of a minimum operator, in order to determine the overall defense level (TDef).

7. Computer-readable memory with instructions for implementing the method according to one of the preceding claims, when the instructions are executed on at least one processor.

8. Vehicle, in particular an autonomously driving vehicle, comprising a computer-readable storage medium according to claim 7 and a processor for executing the instructions.

9. Vehicle, in particular an autonomous vehicle, comprising: - one or more computer-readable storage media a) for storing control software (soft), wherein the control software (soft) is assigned code sections with test code, in particular a validator (GV, LV, SV, HV), for validating calculations, in particular calculations based on measurement results; b) for storing at least one attack list; c) for storing defense level information that assigns a defense level (DefL) to the check codes contained in the control software (Soft) in relation to an attack from the attack list (Att) - at least one processor (208) executing control software (Check) configured to calculate at least one overall defense level (TDef) using at least one selection of the defense level information (Def); and to deactivate at least one function of the control software (Soft) if the overall defense level (TDef) falls below or exceeds a limit value (TDefMin).

10. The vehicle of claim 9, wherein the control software comprises: a first check code for validating a position using a satellite-based system, for example a GPS and / or a GNUS and / or a second check code for validating a position using a video system, for example an optical lane detection system, and / or a third check code for validating a position using a lidar and / or radar system.

11. Vehicle according to claim 9 or 10, the control software is designed to request an occupant of the vehicle to take over a task, for example steering the vehicle, before deactivating the at least one function.

Images