Computing unit, method for running a test mode of a computing unit and method for starting a computing unit

Abstract

The invention relates to a computing unit (2), comprising a CAN transceiver (4), which has a CAN bus connection (20) that can be connected or is connected to CAN bus lines (8) of a CAN bus and which has a state connection (10), wherein a wake-up operating state is implemented by the CAN transceiver (4) if the state connection (10) has a first voltage level, and, if the state connection (10) has a second voltage level, a standby operating state is implemented by the CAN transceiver; and comprising a computing module (6) which is connected to the state connection (10) and which is also connected to the CAN transceiver (20) via at least one data interface (16, 18, 20). The CAN transceiver (4) is designed to set the state connection (10) to the first voltage level in response to a specified message pattern, which is received on the CAN bus lines (8), when the CAN transceiver is in the standby operating state, and the computing module (6) is designed to check, during a starting process, whether the state connection (10) has the first voltage level and, if it is determined that the state connection has the first voltage level, to determine whether a test mode should be executed and, if the test mode should be executed, to execute the starting process in the test mode.

Description

[0001] Description

[0002] title

[0003] Computing unit, method for calling a test mode of a computing unit and method for starting a computing unit

[0004] The present invention relates to a computing unit, a method for calling a test mode of a computing unit and a method for starting a computing unit.

[0005] Background of the invention

[0006] To start a control unit in a specific test mode during factory production or during return analysis, an entry condition can be provided. This can be generated in various ways. For example, a dedicated interface (interface or individual signal) can be provided for this purpose, or an existing interface can be loaded with special signal forms that the device recognizes as an entry condition.

[0007] Disclosure of the invention

[0008] According to the invention, a computing unit, a method for calling a test mode of a computing unit, a method for starting a computing unit, and a computer program for implementing the method are proposed, each having the features of the independent patent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0009] A computing unit with a CAN transceiver and a computing module (e.g. microprocessor or microcontroller) is proposed, wherein the CAN transceiver is configured, when in a standby operating state, to set the status connection to a first voltage level in response to a predetermined message pattern received on CAN bus lines, and wherein the computing module is configured, during a startup process, to check whether the status connection has the first voltage level and, if the status connection has the first voltage level, to determine whether a test mode should be executed and, if the test mode should be executed, to execute the startup process in the test mode. By using a status connection, an entry condition can be set before the computing module is booted up, namely the first voltage level, whereby the boot-up or shutdown process can be controlled.the start process and the query as to whether an entry condition exists can be greatly simplified and accelerated.

[0010] CAN stands for "Controller Area Network" and is a fieldbus familiar to those in the field. CAN is standardized in ISO 11898, specifically ISO 11898-1, ISO 11898-2, and ISO 11898-3, or SAE J2284.

[0011] The computing unit is, for example, a control unit of a machine, such as a vehicle. The computing module, for example a microcontroller, implements functionalities of the computing unit, such as control functions or similar, by executing computer programs. The computing module includes, for example, a processor with one or more computing cores, a volatile memory (e.g.

[0012] RAM or main memory), a non-volatile memory (or has access to such), interfaces for data communication and, e.g. in the case of a control unit, in particular interfaces for generating control signals.

[0013] The term "start-up process" refers to starting or booting the computing module from a switched-off state (off state) or a standby mode of the computing module. The CAN transceiver is still supplied with voltage while the computing module is in the off state or standby mode. The standby operating state is, for example, an operating state of the CAN transceiver in which it has low energy consumption, whereby certain modules or components of the CAN transceiver are switched off or are in a sleep mode in which they consume as little energy as possible. For example, the CAN interface between the CAN transceiver and the computing module can be switched off or in sleep mode. In the standby operating state, the CAN transceiver is designed to receive signals or messages via the CAN bus connection and, in particular, to transmit certain messages (i.e., specified signal patterns orpredefined message patterns) that correspond to configured messages or configured signal patterns. These messages can be predefined, i.e., preconfigured, and / or configurable. For the latter, a configuration interface can be provided, for example, via which the computing module, in particular, can configure or set the configured messages that are recognized by the CAN transceiver in the standby operating state. The CAN transceiver can be configured to perform a specific action, for example, "wake up," in response to the recognition of a predefined message pattern.

[0014] Normal mode is, in particular, a mode of the computing module in which, during the startup process, computer programs are launched that implement a specific range of functions of the computing unit. In an engine control unit, this could include, for example, computer programs that implement a control algorithm for an engine.

[0015] The test mode is in particular a mode of the computing module in which, during the boot process, only some (or none) of the computer programs are started that are started during a boot process in normal mode and / or in which, during the boot process, one or more special computer programs (e.g. referred to as test computer programs) are started that are not started in normal mode during the boot mode.

[0016] The computing module is connected to the status terminal (via a corresponding connection) so that the computing module can detect the voltage level present at the status terminal. The status terminal is designed, in particular, as a so-called INH ("Inhibit") pin of the CAN transceiver. The computing module further has at least one data interface via which the computing module is connected to the CAN transceiver for data communication.

[0017] According to one embodiment, in order to determine whether the test mode should be executed, the computing module is configured to receive a call message via the at least one data interface and to determine that the test mode should be executed if the call message indicates that the test mode should be executed. The call message confirms that the test mode should actually be executed. If no call message is received or no message is received indicating that the test mode should be executed, the startup process continues, in particular, in normal mode.

[0018] According to one embodiment, in order to determine whether the test mode should be executed, the computing module is configured to receive a call message via the at least one data interface if the call message indicates that the test mode should be executed, to carry out an authorization check to determine whether a sender of the call message is authorized to call the test mode, and to determine that the test mode should be executed if the authorization check confirms that the sender of the call message is authorized to call the test mode. In particular, the computing module is further configured to exchange one or more check messages with the sender during the authorization check in order to implement a cryptographic method with which the sender's authorization to call the test mode can be checked. By means of an authorization check, the test mode can be prevented from being accessed by attackers who have already used the test mode, for example.B. want to use to manipulate the computing unit, is called. If no call message is received or no message is received which indicates that the test mode should be executed, and / or if the authorization check does not confirm that the sender of the call message is authorized to call the test mode (i.e. if the authorization check fails or is not successful), the start process is continued in particular in normal mode. Here it can be checked, for example, whether the sender knows a cryptographic key. According to one embodiment, the at least one data interface comprises a CAN interface and a UART interface, wherein the call message is received via the UART interface, wherein in particular, if necessary, the authorization check is carried out using the UART interface.The use of a UART interface is practical because it is simple and robust to implement, and thus, for example, is not affected by malfunctions that are to be detected in test mode. UART (Universal Asynchronous Receiver Transmitter) is well known to those skilled in the art and implements serial interfaces in which data is transmitted in frames, with each frame consisting of a start bit, five to eight or nine data bits, an optional parity bit, and one or two stop bits.

[0019] According to one embodiment, in order to determine whether the test mode should be executed, the computing module is configured to determine that the test mode should be executed immediately after determining that the status connection has the first voltage level and / or to determine that the test mode should be executed immediately after determining that the status connection has the first voltage level if no condition exists that prevents the execution of the test mode. The presence of the first voltage level at the status connection of the CAN transceiver is therefore considered sufficient by the computing module (if optionally no condition exists that prevents the execution of the test mode) to determine that the test mode should be executed. Accordingly, the test mode can be called without waiting for a call message. A condition that prevents this could, for example,set by an attack detection system that has detected a possible attack on the computing unit and prevents the test mode from being called, since an attacker could possibly gain further rights in this mode.

[0020] According to one embodiment, the message pattern is a wake-up pattern, wherein the CAN transceiver is configured, in particular, to assume the wake-up operating state in response to the wake-up pattern. The wake-up pattern can, in particular, be a "wake-up pattern" according to the ISO 11898 standard.

[0021] According to one embodiment, the at least one data interface comprises a configuration interface, which is in particular a serial interface, wherein the computing module is configured to configure the message pattern in the CAN transceiver via the configuration interface. The message pattern can, in particular, be configured as a specific message (set message). This embodiment is expedient because not all messages that correspond to a wake-up pattern lead to the test mode being called.

[0022] According to one embodiment, the computing module is configured to execute the startup process in a normal mode if the status connection does not have the first voltage level. This can occur immediately after determining that the first voltage level is not present, in particular without any waiting times.

[0023] According to one embodiment, the checking of whether the status terminal has the first voltage level is carried out by the computing module during the start-up process, before computer programs are executed and / or initializations are carried out that are not intended for the test mode.

[0024] A method according to the invention for calling a test mode of a computing unit according to the invention comprises sending the message pattern via CAN bus lines that are connected to the CAN transceiver of the computing unit.

[0025] According to embodiments, the method comprises connecting an external computing unit to the CAN bus, which is connected to the CAN transceiver, and / or connecting the CAN bus to the CAN transceiver.

[0026] According to embodiments, the method comprises sending a call message indicating that the test mode is to be executed to the CAN transceiver and via the at least one data interface to the computing module, and / or exchanging one or more check messages for authorization checking with the computing module of the computing unit using the at least one data interface.

[0027] According to embodiments, the method comprises calling at least one test function and / or initialization function after the start-up process in the test mode.

[0028] A method according to the invention for starting a computing unit that has a CAN transceiver and a computing module, wherein the CAN transceiver has a CAN bus connection that is connectable or connected to CAN bus lines of a CAN bus, and has a status connection, and which is configured, when the CAN transceiver is in a standby operating state, to set the status connection to a first voltage level in response to a predetermined message pattern received on the CAN bus lines, and wherein the computing module is connected to the status connection and is further connected to the CAN transceiver via at least one data interface, comprises, by the computing module: checking, during a start-up process, whether the status connection has the first voltage level; determining, if it is determined that the status connection has the first voltage level, whether a test mode should be executed;and, if test mode is to be executed, executing the boot process in test mode.;

[0029] The implementation of a method according to the invention, the steps of which are carried out in a computing unit by a computing module, in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous, as this entails particularly low costs, in particular if an executing control unit is also used for further tasks and is therefore already present. Finally, a machine-readable storage medium is provided with a computer program stored thereon as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical memories, such as, for example,

[0030] Hard drives, flash memory, EEPROMs, DVDs, and more. Downloading a program via computer networks (internet, intranet, etc.) is also possible. Such a download can be done wired or wirelessly (e.g., via a Wi-Fi network, a 3G, 4G, 5G, or 6G connection, etc.).

[0031] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0032] The invention is illustrated schematically in the drawing using exemplary embodiments and is described below with reference to the drawing.

[0033] Short description of the drawings

[0034] Figure 1 shows a computing unit according to an embodiment of the invention.

[0035] Figure 2 shows a computing unit according to a further embodiment of the invention.

[0036] Figure 3 shows a flowchart of a method for calling a test mode of a computing unit according to an embodiment of the invention.

[0037] Figure 4 shows a flowchart of a start-up method that is carried out in a computing unit according to an embodiment of the invention.

[0038] Embodiment(s) of the invention

[0039] Figure 1 shows a computing unit 2 according to an embodiment of the invention.

[0040] The computing unit 2 comprises a computing module 6, such as a microcontroller, and a CAN transceiver 4. The computing module 6 and the CAN transceiver 4 are connected internally in the computing unit via a CAN data interface, wherein the CAN transceiver 4 has a CAN interface 14 (or a CAN interface connection) and the computing module 6 has a CAN interface 16, which are connected to one another via lines. The CAN transceiver 4 is connected to CAN bus lines 8, so that the computing module 6 can exchange data via the CAN data interface and the CAN transceiver 4 with bus participants connected to the CAN bus lines 8. The CAN bus lines 8 are connected, for example, to a CAN bus connection 20 of the CAN transceiver 4.

[0041] In addition to the CAN transceiver 4, the processing unit can generally have additional interfaces (not shown) for sending and / or receiving to or from other devices. For example, in addition to the CAN transceiver 4 shown, additional CAN transceivers or other data communication interfaces, such as one or more Ethernet interfaces for connecting to an Ethernet-based fieldbus, can be provided for data communication. Sensors, for example, can also be connected via such data communication interfaces. Interfaces can also be provided via which control signals for one or more components controlled by the processing unit are output.

[0042] The CAN transceiver 4 can be further configured to implement a UART interface via the CAN interface 14. The computing module 6 has a UART interface 18 connected to the lines between the CAN interfaces 14, 16, so that the CAN transceiver 4 can send UART frames via the CAN interface 14, and the computing module 6 can send UART frames via the UART interface 18 to communicate data.

[0043] The CAN transceiver 4 has a status terminal 10, which can have specific voltage levels; in particular, the voltage levels can be set by the CAN transceiver. Different voltage levels indicate corresponding operating modes of the CAN transceiver 4. A first voltage level, e.g., a higher voltage level, is provided, which corresponds to a wake-up operating mode, and a second voltage level, e.g., a lower voltage level or reference voltage level, is provided, which corresponds to a standby operating mode. The status terminal 10 of the CAN transceiver 4 is connected to a corresponding terminal 12 of the computing module 6, so that the computing module 6 can detect the voltage level at the status terminal 10.

[0044] Furthermore, the CAN transceiver 4 is configured, when it is in standby mode and a voltage signal (or a message) is received on the CAN bus lines 8, which has a predetermined message pattern, to set the first voltage level at the status terminal 10 in response to this message pattern. The CAN transceiver 4 can also be placed in the wake-up mode, so that one or more functionalities beyond the standby mode are available. At least the CAN data interface 14 of the CAN transceiver 4 is placed in an operational state (if it is not already in an operational state).

[0045] The computing module 6 is configured to check, during a startup process, whether the first voltage level is present at the status terminal 10. This check is performed relatively early during the startup process, i.e., before the execution of computer programs and / or computer program modules, the initialization of components, or the like, that are not provided for in the test mode and / or that are specific to one of the modes (normal mode, test mode) of the computing module begins.

[0046] When the first voltage level is present at status terminal 10, computing module 6 can, if not already done, initialize UART interface 18 or load or execute a driver for it, enabling data communication via the UART interface with CAN transceiver 4 and, via the latter, with devices connected to bus lines 8. Computing module 6 can then receive a call message via UART interface 18 indicating that test mode is to be executed or called, and execute or start test mode in response to the call message. If no call message is received, test mode is not executed and, for example, normal mode is continued and / or an error message is stored.Optionally, it can be provided that after receipt of the call message, an authorization check is first carried out (before starting test mode), in which, for example, messages are exchanged via the UART interface 18 with a sender of the call message in order to check whether the sender is authorized to execute test mode. For this purpose, a suitable cryptographic method is used. If the authorization check is successful (i.e., if it is determined that the sender is authorized to execute test mode), test mode is executed. If the authorization check is not successful, test mode is not executed and, for example, execution continues with normal mode and / or an error message is stored.

[0047] If the first voltage level is not present at status terminal 10 and, for example, the second voltage level is present, the computing module starts normal mode. This occurs immediately after determining that the first voltage level is not present at status terminal 10, i.e., without waiting for a message requesting test mode to be received at the UART interface. In particular, in addition to the waiting time, initialization of the UART interface and / or loading of a driver for it can be omitted.

[0048] Overall, the startup process can be accelerated because the computing module 6 can start directly, without waiting time, in test mode or normal mode, depending on the voltage level at the status connection 10 of the CAN transceiver.

[0049] Figure 2 shows a computing unit according to a further embodiment of the invention. This is largely identical to the computing unit shown in Figure 1. In addition, a further data interface, referred to as a configuration interface 22, is provided. The configuration interface 22 is, in particular, a serial interface, e.g., an SPI interface (SPI: Serial Peripheral Interface). The computing module 6 is, in particular, configured to configure the message pattern in the CAN transceiver 4 via the configuration interface 22. The computing module 6 can therefore set the message pattern in response to which the CAN transceiver 4 generates the first voltage level at the status terminal 10.

[0050] Figure 3 shows a flowchart of a method for calling a test mode of a computing unit according to one embodiment. The steps are performed by an external device (external computing unit) that wishes to call the test mode, or are implemented by such a device. The method is based on a computing unit according to the invention, such as described above.

[0051] In optional step 110, the external device is connected to the CAN bus connected to the CAN transceiver and / or the CAN bus is connected to the CAN transceiver. If such a connection already exists, this step can be omitted.

[0052] In step 120, the message pattern is sent over the CAN bus lines connected to the computing unit's CAN transceiver. The message pattern is the one that, as described, causes the CAN transceiver to generate the first voltage level at the status terminal.

[0053] In optional step 130, a call message indicating that test mode is to be executed is sent to the CAN transceiver and, via the at least one data interface, to the computing module. If the computing module starts test mode immediately after determining that the first voltage level is present at the status terminal, step 130 and, if applicable, step 140 are omitted.

[0054] In optional step 140, if an authorization check is provided, one or more check messages for the authorization check are exchanged with the computing module of the computing unit using the at least one data interface.

[0055] Depending on the implementation, the calculation module is started in test mode after step 120, step 130, or step 140 (if the authorization check is successful). In the optional step 150, at least one test function and / or initialization function can then be called in the calculation module.

[0056] Figure 4 shows a flowchart of a startup method performed in a computing unit according to one embodiment. The starting point is a computing unit according to the invention, such as described above. The steps are performed by the computing module of the computing unit.

[0057] In step 210, a check is carried out (by the computing module) during a start-up process as to whether the status connection has the first voltage level.

[0058] In step 220, if it is determined that the status terminal has the first voltage level, it is determined (by the computing module) whether a test mode should be executed.

[0059] In optional step 222, a call message is received via the at least one data interface. In optional step 224, if the call message indicates that the test mode should be executed, an authorization check is performed to determine whether a sender of the call message is authorized to call the test mode. In optional step 226, it is determined that the test mode should be executed if the authorization check confirms that the sender of the call message is authorized to call the test mode. Steps 222 to 226 represent a possible embodiment of step 220. Alternatively, step 230 can occur immediately after step 220, i.e. the presence of the first voltage level at the status terminal is already regarded as a determination or establishment that the test mode should be executed.

[0060] In step 230, if it is determined that the test mode should be executed, the boot process is executed in the test mode (by the computing module).

Claims

Claims 1. A computing unit (2) comprising a CAN transceiver (4) having a CAN bus connection (20) that is connectable or connected to CAN bus lines (8) of a CAN bus, and having a status connection (10), wherein, when the status connection (10) has a first voltage level, a wake-up operating state is implemented by the CAN transceiver (4), and, when the status connection (10) has a second voltage level, a standby operating state is implemented by the CAN transceiver; and a computing module (6) connected to the status connection (10) and further connected to the CAN transceiver (20) via at least one data interface (16, 18, 20);wherein the CAN transceiver (4) is configured, when the CAN transceiver is in the standby operating state, to set the status terminal (10) to the first voltage level in response to a predetermined message pattern received on the CAN bus lines (8); and wherein the computing module (6) is configured, during a startup process, to check whether the status terminal (10) has the first voltage level and, if it is determined that the status terminal has the first voltage level, to determine whether a test mode should be executed, and if the test mode should be executed, to execute the startup process in the test mode.

2. A computing unit according to claim 1, wherein the computing module (6) is configured to determine whether the test mode should be executed: to receive a call message via the at least one data interface (16, 18), and to specify that test mode should be executed if the invocation message indicates that test mode should be executed.

3. Computing unit according to claim 1 or 2, wherein the computing module (6) is configured to determine whether the test mode should be executed: to receive a call message via the at least one data interface (16, 18) if the call message indicates that the test mode should be executed, to perform an authorization check to determine whether a sender of the call message is authorized to call the test mode, and to determine that the test mode should be executed if the authorization check confirms that the sender of the call message is authorized to call the test mode; wherein in particular the computing module (6) is configured to exchange one or more check messages with the sender during the authorization check in order to implement a cryptographic method with which the sender's authorization to call the test mode can be checked.

4. A computing unit according to claim 2 or 3, wherein the at least one data interface comprises a CAN interface (16) and a UART interface (18); wherein the request message is received via the UART interface; wherein, in particular, if dependent on claim 3, the authorization check is performed using the UART interface.

5. A computing unit according to any one of the preceding claims, wherein the computing module (2) is configured to determine whether the test mode should be executed: to determine that the test mode should be executed immediately after determining that the status terminal (10) has the first voltage level; and / or to determine that the test mode should be executed immediately after determining that the status terminal (10) has the first voltage level, should be executed if there is no condition that prevents the test mode from running.

6. A computing unit according to one of the preceding claims, wherein the message pattern is a wake-up pattern; wherein the CAN transceiver (4) is particularly configured to assume the wake-up operating state in response to the wake-up pattern.

7. Computing unit according to one of the preceding claims, wherein the at least one data interface comprises a configuration interface (22), which is in particular a serial interface; and wherein the computing module (6) is configured to configure the message pattern in the CAN transceiver (4) via the configuration interface.

8. Computing unit according to one of the preceding claims, wherein the computing module (6) is configured to carry out the starting process in a normal mode if the status terminal (10) does not have the first voltage level.

9. A computing unit according to any one of the preceding claims, wherein the checking of whether the status terminal (10) has the first voltage level is carried out by the computing module (6) during the start-up process before computer programs are executed and / or initializations are carried out which are not provided for the test mode.

10. A method for calling a test mode of a computing unit (2) according to one of the preceding claims, comprising: Sending (120) the message pattern via CAN bus lines (8) connected to the CAN transceiver (4) of the computing unit.

11. The method of claim 10, further comprising: Sending (130) a call message indicating that the test mode is to be executed to the CAN transceiver (4) and via the at least one data interface to the computing module (6); and / or Exchanging (140) one or more verification messages for authorization verification with the computing module (6) of the computing unit using the at least one data interface; and / or Calling (150) at least one test function and / or initialization function after the start-up process in the test mode.

12. A method for starting a computing unit (2) comprising a CAN transceiver (4) and a computing module (6), wherein the CAN transceiver has a CAN bus connection (20) which is connectable or connected to CAN bus lines (8) of a CAN bus, and has a status connection (10) and is configured, when the CAN transceiver is in a standby operating state, to set the status connection (10) to a first voltage level in response to a predetermined message pattern received on the CAN bus lines, and wherein the computing module is connected to the status connection and is further connected to the CAN transceiver via at least one data interface, comprising, by the computing module (6), Checking (210), during a start-up process, whether the status terminal (10) has the first voltage level; Determining (220) if it is determined that the status terminal has the first voltage level whether a test mode should be executed; and if the test mode should be executed, executing (230) the boot process in the test mode.

13. The method according to claim 12, further comprising, by the computing module (6), receiving (222) a call message via the at least one data interface; and Determining that the test mode should be executed if the call message indicates that the test mode should be executed; and / or further comprising, by the computing module (6), Receiving (222) a call message via the at least one data interface; if the call message indicates that the test mode is to be executed, performing (224) an authorization check as to whether a sender of the call message is authorized to call the test mode; and Determining (226) that the test mode should be executed if the authorization check confirms that the sender of the call message is authorized to call the test mode.

14. Computer program which causes a computing module (6) of a computing unit (2) to carry out all method steps of a method according to one of claims 12 or 13 when it is executed on the computing module.

Images