Method for a certified refueling of a vehicle

Abstract

The invention relates to a method for a refueling process in a system comprising a vehicle (1) and an evaluation unit (9), wherein the vehicle (1) has a vehicle tank (2) and a refueling unit, and an actuatable blocking device (10) is also present in the refueling unit. The method has the following steps: - in the filling station (3), transmitting a request message to the evaluation unit (9), said request message comprising a characteristic value of a CO2 balance of the fuel or an identification of the origin of the fuel and an identification of the vehicle, - in the evaluation unit (9), receiving the request message and checking whether an authorization is present which permits the vehicle (1) to be refueled with said fuel, and - in the evaluation unit (9), transmitting a release message to the blocking device (10) if the vehicle (1) specified in the request message is permitted to be refueled with the fuel, said blocking device (10) being in a permanently closed state and only being openable after receiving the release message.

Description

[0001] Procedure for certified refueling of a vehicle

[0002] The invention relates to a method for refueling in a system comprising a vehicle and an evaluation unit.

[0003] It's well known from the state of the art to refuel vehicles with a wide variety of fuels. When the vehicle needs refueling, it's taken to a gas station and a fuel suitable for the vehicle's engine is selected.

[0004] Problems could arise if, for example, the vehicle's engine can only run on diesel, but the vehicle is accidentally refueled with gasoline, which could, for example, cause engine damage. To prevent this, the method disclosed in document DE 10 2006 044 780 A1 establishes communication between the gas station and the vehicle. The vehicle indicates to the gas station which fuel is suitable for the vehicle's engine (e.g., gasoline or diesel), whereupon the gas station authorizes refueling or issues a corresponding warning signal.

[0005] However, regardless of the problem of accidental misfueling discussed above, which can lead to engine damage, the filling station could also offer several different fuels, all suitable for the vehicle. Examples include fossil methane (i.e., methane of fossil origin) and biomethane (i.e., methane produced from biogenic materials and therefore essentially CO2-neutral). Regardless of whether the vehicle is fueled with fossil methane or biomethane, engine damage will not occur.

[0006] However, it is an aim of modern vehicle technology that vehicles are powered exclusively by CO2-neutral fuels. In the example of fossil methane and biomethane, it could be stipulated by law that filling stations may only offer biomethane, but this does not prevent the user of the vehicle from simply going to another filling station abroad which is not subject to such restrictions and can therefore offer fossil methane. Furthermore, the user could be subject to sanctions if they fill up their vehicle with fossil methane, but fossil methane and biomethane do not differ in their chemical composition, so subsequent checking of the fuel using chemical tests is not possible. The object of the invention is to provide a vehicle orto provide a refuelling system for vehicles that ensures that the vehicle is only refuelled with environmentally friendly fuel throughout its entire service life.

[0007] This object is achieved by a method for refueling in a system comprising a vehicle and an evaluation unit, wherein the vehicle has an energy storage device, in particular a vehicle tank for storing fluid fuel, and a feed unit connected to the energy storage device, wherein a controllable locking device is further present in the feed unit, and wherein the locking device enables refueling in an open state and prevents refueling in a closed state, wherein the method comprises the following steps:

[0008] Selecting a desired fuel and sending a request message to the evaluation unit, wherein the request message comprises a characteristic value of an environmental impact, in particular a CO2 balance, of the selected fuel or an identification of the origin of the selected fuel, wherein these steps preferably all take place at a filling station, in the evaluation unit, receiving the request message and checking whether there is authorization for the vehicle to be refueled with this fuel in accordance with the characteristic value of the environmental impact of the fuel or the identification of the origin of the fuel specified in the request message, in the evaluation unit, sending an approval message to the locking device to open the locking device if the check showed that the vehicle may be refueled with the fuel,The locking device is normally closed and can only be opened after receiving the release message for the duration of the refueling and, if necessary, via an emergency switch. In other words, the locking device is permanently closed and can only be opened after receiving the release message for the duration of the refueling and, if necessary, via an emergency switch.

[0009] This system has the advantage of ensuring that the vehicle is only refueled with environmentally friendly fuel throughout its entire service life. Since the locking device is permanently locked, this prevents the user from unauthorized refueling of the vehicle with environmentally harmful fuel. The vehicle can only be refueled once the release message to unlock the locking device has been received.

[0010] In contrast to the prior art, the generation of the release message is not, or not only, based on checking whether the fuel could be harmful to a vehicle's engine. According to the invention, the fuel is checked to see whether it is environmentally friendly. This is done by checking a characteristic value of an environmental impact, e.g., a CO2 balance, of the fuel or the fuel's origin.

[0011] A check to determine whether the vehicle is authorized to be refueled with a fuel with a specific environmental impact can, for example, be carried out using a threshold value comparison. To do this, the evaluation unit can initially use a threshold value for the characteristic value of the environmental impact of the fuel. This threshold value can be stored as the only threshold value in the evaluation unit (e.g. if the evaluation unit is present on the vehicle) or the threshold value could be stored in a database, with threshold values ​​for the characteristic value of the environmental impact being assigned to one or more vehicles. For example, a threshold value is assigned to a unique vehicle identification in the database, or a threshold value is assigned to a vehicle group (e.g. one group is passenger cars and another group is safety-critical vehicles).Preferably, the step of checking whether authorization exists therefore includes the step of checking whether the environmental impact characteristic specified in the request message is below a threshold value specified for the vehicle. However, a threshold comparison is not always necessary, e.g., if a database is stored in which the vehicle identifications are linked to all identifications permitted for the respective vehicle.

[0012] The said characteristic value of the environmental impact of a fuel can, for a fuel containing carbon, be defined, for example, as the CO2 released during combustion of the fuel less a biogenic portion of carbon bound in the fuel, whereby this can also be referred to as a CO2 balance. For a fuel such as hydrogen, which does not contain carbon, the CO2 balance can, for example, be used as the CO2 released during production of the fuel, provided the fuel was not produced using renewable energy. It is understood that many other and much more precise definitions for characteristic values ​​of the CO2 balance are known to those skilled in the art. In one example, the characteristic value of the CO2 balance of the fuel can be given as a relative value for the fuel being pumped, e.g. X kg CO2 per kg of fuel, or as an absolute value for the fuel being pumped, e.g. Y kg CO2.The relative value can also be used in conjunction with a quantity of fuel. Furthermore, CO2 equivalents from methane emissions (or other emissions) or health-related parameters can also be included in the environmental impact indicator.

[0013] A check to determine whether the vehicle is authorized to be fueled with a fuel of a specific origin can be carried out by the evaluation unit storing a database in which the origin of the fuel is linked to a characteristic value of the environmental impact, so that the threshold comparison explained above can again be carried out. However, this check can be shortened if all data relevant for the check is entered into a database which, for example, specifies that fuel of origin Y is permitted for vehicle X. As an example, this database could specify that methane of biogenic origin is permitted for passenger cars. It goes without saying that the origin can also be indicated by a unique identification number or similar.

[0014] The technicality of the method according to the invention is based on the fact that the environmental impact, in particular CO2 emissions, of vehicles can be set to a predetermined limit. It is not possible to refuel the vehicle in such a way that this limit could be exceeded. In other words, the environmental impact of the vehicle is limited by the technical means specified in the method.

[0015] In particular, three embodiments are available for implementing the evaluation unit according to the invention. First, the evaluation unit can be located on a remote server, second, on the vehicle, and third, at the gas station.

[0016] In the first preferred embodiment, the evaluation unit is located in a server, wherein a transceiver of a petrol station or petrol station system sends the request message to the server and wherein the vehicle has a transceiver which receives the release message from the server. This embodiment is particularly preferred because the safety-critical evaluation unit can thus be spatially removed from the vehicle and the petrol station, whereby unauthorized manipulation of the evaluation unit can be largely prevented. In the second preferred embodiment, it can be provided that the evaluation unit is located on the vehicle and a transceiver of a petrol station or petrol station system sends the request message to a transceiver on the vehicle connected to the evaluation unit.This has the advantage that the evaluation unit can be located as close as possible to the locking device, thus minimizing the transmission path of the release message and making it more difficult to forge. Furthermore, all communication can be conducted only between the gas station and the vehicle, preferably only via direct communication, e.g., short-range communication.

[0017] In the third preferred embodiment, it can be provided that the evaluation unit is located at a gas station, and the gas station has a transceiver connected to the evaluation unit, which transmits the release message to a transceiver on the vehicle connected to the blocking device. In this embodiment, in particular, the communication path for the request message can be minimized, making it more difficult to forge. Here, too, all communication can take place only between the gas station and the vehicle.

[0018] In a preferred embodiment of the invention, the method comprises the steps:

[0019] - Depositing a first certificate at the petrol station, whereby the first certificate is sent to the evaluation unit as part of the request message; and

[0020] - Verify the authenticity of the first certificate in the evaluation unit before verifying or sending the release message.

[0021] Alternatively or additionally, the procedure may include the following steps:

[0022] - depositing a second certificate in the evaluation unit, whereby the second certificate is sent to the blocking device as part of the release message; and

[0023] - Verifying the authenticity of the second certificate in the revocation device or an associated computing unit before opening the revocation device.

[0024] In the two variants above, with the first and second certificates, an additional level of security is introduced against fraudulent attempts to circumvent the system. Specifically, the certificate prevents a fraudster from "spoofing" the request message or the approval message, since the fraudster will not be in possession of an authentic certificate. Many options for implementing the certificate are known in the field of cryptography. In one example, the respective certificate can be issued by an independent authority, and the entity to be verified, after receiving the message bearing the certificate, can have the independent authority verify whether the certificate, and thus the message, is authentic.

[0025] According to the invention, the locking device is normally closed and is only opened upon receipt of the release message. If this were the only way to open the locking device, in some cases (for example, if communication between the vehicle, the gas station, and / or the server is disrupted due to technical problems), a vehicle with an empty tank could remain parked at a gas station permanently, unable to refuel. According to the invention, this is prevented if the locking device can be opened not only by the release message, but also by actuating an emergency switch. Therefore, there is either only one way to open the locking device (release message) or only two ways to open the locking device (release message and emergency switch). The emergency switch can also be designed as a service switch to open the locking device for maintenance purposes.

[0026] However, if the locking device can be opened using an emergency switch, it is preferred that actuating the emergency switch trigger the following step: opening the locking device and issuing an emergency signal. The emergency signal can, for example, indicate to an external unit that at least one attempt has been made to refuel the vehicle without an authorization message being present. In the simplest case, the presence of an emergency signal can be recorded in a readable memory on the vehicle, or the emergency signal can be sent to a control center such as a remote server via a transceiver.

[0027] In the aforementioned embodiment, the emergency signal can also be transmitted to an engine control unit, and upon receipt of the emergency signal, the engine control unit only allows vehicle operation with limited power. In this way, an immediate technical sanction can be applied to the vehicle, forcing the improperly fueled vehicle to be transported to a service station or similar location while still in emergency mode ("limp home" state).

[0028] In a preferred embodiment, the system further comprises a filling station that provides a first fuel and a second fuel, wherein the first fuel and the second fuel have a substantially identical chemical composition but a different characteristic of the environmental impact of the fuel or a different identification of the fuel's origin. In this variant, the step "selecting the first or second fuel" is carried out in the method according to the invention.

[0029] In a preferred embodiment, the gas station has a first nozzle, through which the first fuel can be refueled, and a second nozzle, through which the second fuel can be refueled. The refueling unit of said vehicle has a filling coupling into which the first nozzle can be inserted, but not the second nozzle. This design of the nozzles and the filling coupling as a "key system" also prevents the user from refueling with environmentally harmful fuel at the hardware level.

[0030] In a preferred embodiment, the system further comprises a legacy vehicle having a legacy filling coupling for refueling, wherein both the first nozzle and the second nozzle can be inserted into the legacy filling coupling. This also allows existing vehicles, i.e., legacy vehicles, to continue to be refueled with any fuel using the "key system" explained above.

[0031] Figure 1 shows a first embodiment of the method according to the invention.

[0032] Figure 2 shows a flow chart of the method according to the invention.

[0033] Figure 3 shows a second embodiment of the method according to the invention. Figure 4 shows a third embodiment of the method according to the invention.

[0034] Figure 1 shows a vehicle 1 with a vehicle tank 2, to which fuel can be supplied via a filling station 3. The vehicle tank 2 comprises a feed unit with a filling coupling 4 and a filling line 5, which leads from the filling coupling 4 to a connection point 51 in the vehicle tank 2. Fuel can be fed into the vehicle tank 2 via the feed unit. The vehicle 1 could, for example, have a supporting frame and two axles as shown, with a vehicle tank 2 being mounted on one or both sides of the supporting frame between the axles. The vehicle 1 is typically a road vehicle with at least four wheels, but could also be a train, an aircraft, a ship, a submarine, or the like.

[0035] The vehicle tank 2 is designed for storing fluid, e.g. gasoline, diesel or the like. In particularly relevant embodiments of the invention, the vehicle tank 2 is a cryogenic container for storing cryogenic fluid, in particular LNG (liquefied natural gas) or hydrogen. Depending on the cryogenic fluid, the cryogenic container 2 is thus designed to store cryogenic fluid at temperatures of, for example, below 150 Kelvin, in the case of hydrogen even below 50 Kelvin or below 30 Kelvin or essentially 20 Kelvin. Depending on the application, the cryogenic container 2 could, for example, be designed to store sLH2 (subcooled liquid hydrogen) or CcH2 (cryo-compressed hydrogen) and thus also be designed for correspondingly high pressures, e.g. for maximum pressures between 1 bar and 350 bar.

[0036] In other variants, however, the fuel could also be electricity. In this case, a battery is provided instead of a vehicle tank 2. In general, the battery and the vehicle tank 2 can be understood as energy storage devices. If the fuel is electricity, the feed-in unit is, for example, a charging port (which optionally enables inductive charging) of the battery and corresponding electrical lines between the charging port and the battery. The embodiments explained below are explained for the case where the fuel is a fluid, although these embodiments can also be implemented for electricity as the fuel. Furthermore, the terms “fueling”, “filling”, “loading” etc. are used below for both fluids and electricity.

[0037] As background for the embodiments explained below, it should be mentioned that the origin of the fuel that is to be fed into or loaded into the energy storage device plays a key role in maintaining a desired CO2 balance. This will be explained using biomethane and fossil methane as examples. Biomethane and fossil methane are indistinguishable in their chemical composition and can be described by the chemical formula CH4. When methane is burned, it is clear from the reaction equation CH4 + 2*O2 = CO2 + 2*H2O that both methane and biomethane release the same amount of CO2 during combustion. When calculating the CO2 balance, however, it must be taken into account that during the production and combustion of biomethane, only the CO2 that was previously absorbed by the plants during photosynthesis is released. Therefore, biomethane can be regarded as essentially CO2 neutral, whereas fossil methane cannot.

[0038] The principles explained above can also be applied to other fuels. In the case of hydrogen H2, no CO2 is produced in a fuel cell, so the fuel cell operates essentially emission-free. However, when calculating the carbon footprint, the origin of the H2 must be taken into account. In many cases, hydrogen is produced from fossil natural gas using steam reforming, in which case a large amount of CO2 is released, so that hydrogen can also have an environmentally harmful CO2 footprint. In other cases, however, hydrogen is produced using solar or wind power, in which case hydrogen is considered essentially CO2-neutral or at least less environmentally harmful than hydrogen produced using the aforementioned method.The same considerations apply to electricity, as it can come, for example, from wind power, in which case its environmental impact is low, or from the combustion of coal, in which case its environmental impact will be greater.

[0039] To summarize the above explanations, the present invention is based on the fact that the fuel type is not considered in isolation in terms of its chemical and / or physical composition, but rather its origin is also taken into account for a more comprehensive description of the fuel. Therefore, for example, a first database DB1 could be provided that links a fuel identification fuell, fuel2 (this could be a serial number of the fuel or simply a chosen name such as "biomethane") with a CO2 balance bill, bil2 of the fuel.Instead of the CO2 footprint, you can use an equivalent benchmark (e.g., a CO2 footprint plus CO2 equivalents from methane emissions) or simply a binary "yes" / "no" rating, where "yes" indicates a CO2 footprint below a predetermined threshold and thus an environmentally friendly fuel, and "no" indicates a CO2 footprint above a predetermined threshold and thus an environmentally harmful fuel. All of these ratings are considered "indicators of an environmental impact."

[0040] The embodiments described below are intended to ensure that the vehicle 1 is only refueled with an environmentally friendly fuel or with a fuel with an environmental impact below a predetermined threshold. To achieve this, the refueling unit of the vehicle 1 is permanently locked and is to be released only after a thorough inspection of the fuel to be refueled. Specifically, the refueling unit contains a locking device 10, which enables refueling when open and prevents refueling when closed. The locking device 10 is to be closed in a normal state and can only be opened by a release message.

[0041] In the example of Figure 1, the release of the locking device 10 is implemented by providing an external server 6, which communicates, on the one hand, with a transceiver 7 of the gas station 3 and, on the other hand, with a transceiver 8 of the vehicle 1. For ease of explanation, it is generally stated that the server 6 communicates with the gas station 3 or the vehicle 1, whereby this is understood to mean communication with the respective transceiver 7, 8.

[0042] In an initialization step that takes place at the beginning, it can be provided that the gas station 3 receives a unique identification ID1 of the vehicle 1 before refueling begins, e.g. by guiding a pump nozzle of the gas station 3 to the filling coupling 4 of the vehicle 1 in order to carry out short-range communication at this point, e.g. by means of RFID. For example, in a first step S1, shown in Figure 2, the gas station 3 can send a request to the vehicle 1 and the vehicle 1 can transmit its identification ID1 to the gas station 3 in a second step S2. Alternatively, the gas station 3 could also optically capture a license plate number of the vehicle 1. There are therefore many options possible as to how the gas station 3 can obtain the identification ID1 of the vehicle 1.

[0043] As shown in Figure 1, the filling station 3 could store several fuels fuell, fuel2, which in particular, as explained above, have the same chemical composition but a different CO2 balance (or generally a different environmental impact). The user of the vehicle 1 or the user of the filling station 3 can choose in a step S3 whether the vehicle 1 should be refueled with the first fuel fuell or with the second fuel fuel2. This selection could also take place automatically, e.g., the fuel with the lower environmental impact value could always be selected and the other fuel used only when the first fuel is no longer in stock.Of course, the filling station 3 could also have fuels with different chemical compositions, although this is irrelevant in the present invention and it is assumed that the vehicle 1 is supplied with a fuel with a composition suitable for it.

[0044] Before starting to refuel vehicle 1 with identification ID1 with the fuel fuel, gas station 3 sends a request message to server 6 in a step S4. The request message contains the identification ID1 of vehicle 1 and the information about the desired fuel fuel. In Figure 1, this request message is therefore referred to as msg(ID1, fuel). It would be possible for this request message to also contain further information, for example the quantity of fuel refueled and / or a timestamp of the refueling. As explained further below, the request message could also contain less or different information. After receiving the request message, server 6, or more precisely an evaluation unit 9 of server 6, can evaluate whether vehicle 1 may be refueled with the fuel fuel specified in the request message.For this purpose, the aforementioned first database DB1, in which the characteristic value of the environmental impact bill of the fuel fuel is shown, could be present, for example, in the server 6 or in the evaluation unit 9. In a step S5, the evaluation unit 9 can thus determine which characteristic value of the environmental impact of the fuel fuel fuel has.

[0045] Furthermore, a second database DB2 could be present in server 6, in which a maximum characteristic value of the environmental impact bil maxl, bil_max2 is assigned to the vehicles 1 identified with the identification ID1, ID2. The evaluation unit 9 can check in a step S6 whether authorization exists for the vehicle 1 to be refueled with the predetermined fuel fuel specified in the request message. In the example with the databases DB1, DB2, the check is carried out by checking whether the fuel fuel identified in the request message is assigned an characteristic value of the environmental impact bill (from database DB1) that is below the maximum characteristic value of the environmental impact bil maxl of the respective vehicle 1 with the identification ID1 (from database DB2). If this is the case, i.e., if bill < bil maxl, the server 6 sends an approval message to the vehicle 1 in a step S7.The release message is shown in Figure 1 as msg(ok) and is sent to an address assigned to the identifier ID1. The identifier ID1 could, for example, be an address (e.g., a GSM phone number, network address, etc.) or there could be another database with this link, possibly even outside of Server 6.

[0046] However, the first database DB1 and / or the second database DB2 are only optional, and the aforementioned check could also be performed in a different way. For example, the balance bill for the fuel fuell could be included directly in the request message, i.e., in addition to or alternatively to specifying the fuel fuell. In this case, the first database DB1 can be omitted. Furthermore, a global maximum characteristic value of the environmental impact bil max glob could be stored in the evaluation unit 9, i.e., it is checked whether the characteristic value of the environmental impact bill of the fuel fuell is below the global maximum characteristic value of the environmental impact bil max glob. In this case, the identification ID1 in the request message serves merely as an address for the release message.Furthermore, possibilities could be implemented whereby, for example, passenger cars would be subject to stricter or less stringent restrictions regarding the maximum environmental impact index than trucks or safety-critical vehicles such as police vehicles, fire engines, or ambulances. In other words, the identification ID1 could be assigned to a group of vehicles that should not exceed a corresponding maximum environmental impact index bil maxl. A further or alternative grouping could be based on the vehicle's weight, whereby heavier or older vehicles could be fueled with a more environmentally friendly maximum environmental impact index than correspondingly lighter or newer vehicles.

[0047] The maximum environmental impact value bil maxl used for the test does not have to be static. For example, it could be stipulated that an average environmental impact value should not be exceeded over a period of time or over a predetermined amount, i.e., the vehicle could first fill up twice with fuel with a more environmentally friendly environmental impact value and then once with a fuel with a more environmentally harmful environmental impact value. It is therefore clear that all these possibilities are encompassed by the essence of the invention.

[0048] It should also be noted that the request message does not necessarily have to contain the vehicle's identification ID1. For example, vehicle 1 could receive an identification of the gas station 3 from which the refueling process is to be started, and the identification of this gas station 3 is sent from vehicle 1 to server 6 together with the identification ID1 of vehicle 1. In this case, the request message sent from gas station 3 to server 6 can also contain the identification of this gas station 3, so that the evaluation unit 9 can link these two messages accordingly. It is therefore clear that the two initialization steps S1, S2 mentioned above are also not required.

[0049] After the release message has been sent from the server 6 to the vehicle 1, the vehicle is released for refueling. Specifically, the locking device 10 in the refueling unit mentioned above is opened by the release message in a step S8. In the simplest case, the transceiver 8 of the vehicle 1 can convert the release message addressed to this vehicle 1 into an unlocking signal for the locking device 10. The locking device 10 can, for example, remain open for a predetermined period of time or until the refueling process is completed, which can be indicated, for example, by the petrol station or detected by the withdrawal of a fuel nozzle from the filling coupling 4. In other words, the locking device 10 remains open for the duration of the refueling and can then be closed again automatically.

[0050] As shown in Figure 1, the blocking device 10 could be a controllable valve in the filling line 5, particularly when the energy storage device is to be filled with fluid. If the energy storage device is to be charged with electricity, the blocking device 10 is preferably a switch. Furthermore, the blocking device 10 could be a controllable closure of the filling coupling 4. Particularly if the blocking device 10 is designed as a controllable valve or switch, the blocking device 10 is preferably not manually openable to prevent tampering. Furthermore, the valve or switch is preferably arranged as close to the vehicle tank 2 as possible, preferably directly at a connection point 51 of the filling line 5 to the vehicle tank 2, in order to prevent any possibility of bypassing.

[0051] If the locking device 10 is designed such that it is closed in a normal state and only opens when the release message has been received from the vehicle 1, fraudulent refueling of the vehicle 1 can be prevented and it is ensured that the vehicle 1 is only refueled with a fuel with an environmentally friendly CO2 balance or another low environmental impact characteristic.

[0052] In some cases, it may nevertheless be desirable to refuel the vehicle 1 with an environmentally harmful fuel, e.g., if no environmentally friendly fuel is available at the filling station 3, or because the server 6 is not accessible. In this case, the locking device 10 could have a further control input connected to an emergency switch. By actuating the emergency switch, the locking device 10 is opened, and an emergency signal can also be sent. The emergency signal can, for example, be forwarded to the vehicle electronics, after which the vehicle can only be operated in a mode with restricted performance, e.g., at a reduced maximum speed, or the emergency signal is sent to a remote computer, e.g., the server 6 or another control center, in order to impose appropriate sanctions on the vehicle 1 or its user.

[0053] The procedure described above can be further protected against manipulation and fraud attempts by implementing a few additional measures, as explained below. For example, the request message and / or the approval message could be provided with a certificate (cert, cert2), which is only issued by a higher-level authority and is forgery-proof.

[0054] For example, to prevent a gas station 3 from feigning that it will refuel with a fuel fuell with an environmental impact characteristic value bill, even though the gas station will actually refuel with a fuel fuel2 with a higher environmental impact characteristic value bil2, the aforementioned certificate zertl can only be issued to certain gas stations 3. A request message sent by this gas station 3 can now include this certificate zertl. After receiving a request message, the server 6 or the evaluation unit 9 checks whether it includes the certificate zertl and only starts the verification or sending the release message if the request message includes the certificate zertl.

[0055] Furthermore, the release message could be prevented from being forged, e.g., by providing a certificate cert2 in the evaluation unit 9. A release message sent by this evaluation unit 9 can now include this certificate cert2. The locking device 10 (or another computing unit on the vehicle 1) now checks whether the release message includes the certificate cert2 and is only unlocked if this is the case. To make the locking device 10 particularly tamper-proof, the computing unit for checking the certificate cert2 can be an integral part of the locking device 10, so that the checking of the certificate cert2 cannot be circumvented. This computing unit could, for example, be designed as a secure element that is part of the locking device 10.

[0056] A secure element is defined as a tamper-proof physical component (usually a secure single-chip microcontroller) capable of securely hosting applications, for example, in accordance with rules and security requirements established by a trusted authority.

[0057] Figure 3 shows a further embodiment that is operated as an alternative to the embodiment of Figure 1 without an external server 6. Here, the evaluation unit 9 is located directly on the vehicle 1. Unless otherwise stated below, all aspects and variants of Figure 1 can also be applied to the embodiment of Figure 3.

[0058] In the method shown in Figure 3, an optional initialization process can also be performed first, including the steps S1 and S2 explained above. The initialization primarily serves to ensure that gas station 3 receives an address for vehicle 1, to which the request message can be sent.

[0059] Then, again as specified above, a fuel type can optionally be selected in step S3, after which the request message is sent in step S4 from the filling station 3 to the evaluation unit 9 on the vehicle 1 (this usually takes place via wireless communication), wherein the request message generally contains the information on the fuel type. In a step S5, the evaluation unit 9 can determine, using the first database DB1 available there, which characteristic value of the environmental impact of the fuel type has. Alternatively, the characteristic value of the environmental impact bill could already be contained in the request message, as explained above. In step S6, the evaluation unit 9 checks whether there is authorization for the vehicle to be refueled with the predetermined fuel specified in the request message.In the embodiment of Figure 3, this can primarily be implemented by storing a maximum characteristic value of the environmental influence bil maxl of the respective vehicle 1 in the evaluation unit 9, i.e., the second database DB2 will typically not be present in the evaluation unit 9 in this embodiment. Another possibility would be for the evaluation unit 9 to communicate with another server (not shown) in order to retrieve the maximum characteristic value of the environmental influence bil maxl for this vehicle 1.

[0060] If the check shows that there is authorization for the vehicle 1 to be refueled with the predetermined fuel specified in the request message, ie that bill < bil maxl, the evaluation unit 9 sends the release message to the locking device 10 in step S7, whereupon the latter opens in step S8.

[0061] It is clear that the embodiment of Figure 3 prevents refueling with an environmentally harmful fuel at a superficial security level, since the locking device prevents refueling without receiving an approval message. However, since all components are freely accessible and, in particular, the safety-critical evaluation unit is not located on the remote server 6, further precautions are usually taken to increase the security level.

[0062] On the one hand, in the embodiment of Figure 3, it can also be provided to provide the aforementioned first certificate zertl at the gas station 3. A request message sent by this gas station 3 can now include this certificate zertl. After receiving a request message, the evaluation unit 9 checks whether it includes the certificate zertl and only starts the verification or sending of the release message if the request message includes the certificate zertl.

[0063] In particular, the evaluation unit 9 can be present in a so-called secure element. Reference is made to the above definition of the secure element.

[0064] If the evaluation unit 9 is located in a secure element, the algorithm for authenticating the first certificate and / or the algorithm for verifying whether vehicle 1 is authorized to refuel with the predetermined fuel specified in the request message cannot be influenced from outside. In other words, the secure element provides no way to manipulate or circumvent these algorithms.

[0065] The secure element with the evaluation unit 9 is preferably an integral part of the locking device 10 and, for example, is permanently connected to it. This allows the release message to be sent directly to the locking device 10 via a wired connection (or via an integrated circuit). If necessary, the release message could also be transmitted wirelessly.

[0066] Figure 4 also shows a further embodiment, which is operated as an alternative to the embodiment of Figure 1 without an external server 6. Here, the evaluation unit 9 is located directly at the gas station 3. Unless otherwise stated below, all aspects and variants of Figure 1 or Figure 3 can also be transferred to the embodiment of Figure 4.

[0067] In the method of Figure 4, an optional initialization process with the steps S1 and S2 explained above can also take place first. This allows the gas station 3 to receive a unique identification ID1 of the vehicle 1 or at least its address so that the release message can be sent to this address.

[0068] Then, again as specified above, a fuel type can optionally be selected in step S3, after which the request message is sent in step S4 to the evaluation unit 9 at the petrol station 3, said request message containing information about the fuel type. In a step S5, the evaluation unit 9 can use the first database DB1 available there to determine which characteristic value of the environmental impact of the fuel type has. Alternatively, the characteristic value of the environmental impact bill could already be contained in the request message, as explained above. In step S6, the evaluation unit 9 checks whether there is authorization for the vehicle to be refueled with the predetermined fuel specified in the request message. Here, the second database DB2 can preferably be used again, as explained above.Here, too, another possibility would be for the evaluation unit 9 to communicate with another server (not shown) in order to retrieve the maximum characteristic value of the environmental influence bil maxl for this vehicle 1.

[0069] If the check shows that there is authorization for the vehicle 1 to be refueled with the predetermined fuel specified in the request message, ie that bill < bil maxl, the evaluation unit 9 sends the release message to the locking device 10 in step S7, ie from the filling station 3 to the vehicle 1 (this is usually done by wireless communication), whereupon the latter opens in step S8.

[0070] Additional security aspects can also be provided in the embodiment of Figure 4, whereby, for example, the aforementioned second certificate, cert2, can be provided at the gas station 3. A release message sent by this gas station 3 can now include this certificate, cert2. The locking device 10 (which is preferably equipped with a secure element for verifying the second certificate, cert2, see above) checks, after receiving a release message, whether it includes the certificate, cert2, and opens only if the release message includes the certificate, cert2.

[0071] The evaluation unit 9 can also be present in a so-called secure element. Reference is made to the above definition of the secure element. It is clear that in the variant of Figure 4, two secure elements can be used: a first secure element at the gas station 3, which contains the evaluation unit 9, and a second secure element at the vehicle 1, which contains the algorithm for verifying the second certificate, cert2.

[0072] At this point, we would like to discuss what happens if an error occurs in the process of steps S1-S8. For example, in step S5 of the check, the evaluation unit 9 could determine that there is no authorization for vehicle 1 to be refueled with the predetermined fuel fuel specified in the request message, e.g. because this vehicle has already used up its monthly quota of environmentally harmful fuel. In this case, the evaluation unit 9 could send a corresponding error message to the petrol station 3 and / or the vehicle 1 so that a different fuel can be selected in step S3. Furthermore, the evaluation unit 9 could determine that the request message does not contain a first certificate or does not contain a valid one, after which the evaluation unit 9 could report this to the petrol station 3, the vehicle 1 and / or a control center to report fraud.Likewise, the blocking device 10 or its computing unit could determine that the release message does not contain a valid second certificate, after which this unit could communicate this to the petrol station 3, the vehicle 1 and / or a central office to report fraud.

[0073] Furthermore, it should be noted at this point that communication between gas station 3 and vehicle 1 preferably takes place via short-range communication such as RFID, although this is not mandatory. Communication could also take place, for example, via a cellular mobile network or the Internet. Generally, this communication is preferably radio-based, i.e., wireless, although communication can also be wired via corresponding contacts on the fuel nozzle and the filling coupling 4. Communication between the server 6 and the gas station 3 or vehicle 1 preferably takes place via a cellular mobile network or the Internet.

[0074] It can also be seen from Figures 1, 3 and 4 that the filling station 3 can store the first fuel fuell and the second fuel fuel2 physically separately from one another, i.e. two separate pumps are provided at the filling station, one pump dispensing only the first fuel fuell and the other pump dispensing only the second fuel fuel2. The first reporting message is generated on the basis of a measurement signal from a mass flow meter which measures the dispensing of the respective fuel fuell, fuel2. In such a system, special safety precautions can be provided, e.g. the feed unit of the said vehicle 1, which is only intended to refuel in an environmentally friendly manner, can have a specially designed filling coupling 4 into which the first pump can be inserted, but not the second pump.For Legacy vehicles, which can also refuel in an environmentally harmful manner, a Legacy filling coupling 4 can be provided, whereby both the first nozzle and the second nozzle can be inserted into the Legacy filling coupling 4. However, these designs are by no means mandatory.

[0075] In practice, at some filling stations 3, they receive the aforementioned fuels fuell, fuel2 with the same chemical composition but different CO2 footprints and store them as a mixture in a single storage facility (or multiple storage facilities). In this case, filling station 3 can maintain internal accounting of certificates of origin (i.e., certificates other than the aforementioned certificates zertl, zert2 for verifying the authenticity of the reporting messages) to ensure that no more environmentally friendly fuel is delivered to vehicles 1 than is actually available to filling station 3. These certificates of origin can be attached to the first reporting message and stored in evaluation unit 9 or in vehicle 1 for later retrieval as evidence.However, from a global perspective, this does not affect the functioning of the system mentioned, since it is simply assumed that petrol station 3 only dispensed the desired fuel fuell, fuel2.

[0076] In yet other variants, filling stations 3 can be provided that only store predetermined fuels, preferably only a single fuel, e.g., an environmentally friendly fuel with a low CO2 footprint. If the second message includes a current position such as a GPS fix, the evaluation unit 9 can check whether it is plausible that the fuel fuell, fuel2 indicated in the first message was actually refueled at the refueling location. For this purpose, the evaluation unit 9 can, for example, access another database in which the fuel fuell, fuel2 available at a filling station location is assigned.

[0077] As additional safety levels, mass balances can be drawn for the gas station 3 and / or for the vehicle 1 in the described system. To draw a mass balance for the gas station 3, the following procedural steps can be performed:

[0078] - Determine the quantities of fuel supplied to the filling station 3 and compare, if necessary using the data entries DE stored in the evaluation unit 9, whether the quantity of fuel delivered to vehicles 1 corresponds to the quantity of fuel supplied to the filling station, whereby a distinction is made between fuels with the same chemical composition but different CO2 balance.

[0079] These procedural steps can be used to verify whether petrol station 3 actually only dispenses as much environmentally friendly fuel as it has received.

[0080] To draw a mass balance for vehicle 1, the following procedural steps can be carried out:

[0081] Estimating an amount of fuel consumed by vehicle 1, wherein the estimation is carried out based on a distance traveled by the vehicle, and comparing whether this estimated amount of fuel corresponds to an amount of fuel refueled that is shown in the data entries DE.

[0082] In this variant, the first report and / or the second report will include the amount of fuel refueled. The mass balance across the vehicle can be used to verify or validate whether all DE data entries are actually present to mathematically calculate the distance traveled by the vehicle. If this is not the case, it must be assumed that the vehicle failed to report 1 refueling process, and sensor unit 10 was thereby bypassed.

[0083] In all of the aforementioned embodiments, the request message was sent directly from the gas station 3 that is performing the refueling process. This also allows the gas station to precisely assign which fuel is dispensed to which vehicle 1.

[0084] In other embodiments, however, a filling station system could also be considered which can comprise a plurality of filling stations 3. For example, a first fuel fluid 1 and a second fuel fluid 2 can be introduced into this filling station system. As described above, these fuels fluid 1, fluid 2 can have different environmental impact characteristics. In such a filling station system, however, there is no strict separation of the fuels fluid 1, fluid 2, since, as described above, they can have the same chemical composition or are to be regarded as equivalent as a stream. A filling station 3 therefore does not need to know whether it has actually been supplied with fuel fluid 1 or fuel fluid 2. However, it is important to note that it is nevertheless well known how much fuel fluid 1 and how much fuel fluid 2 is in this filling station system.In other words, no more environmentally friendly fuel fluid 1 can be withdrawn from this filling station system than is introduced into it.

[0085] If a user now wishes to have their vehicle 1 refueled with environmentally friendly fuel, they can purchase it at a gas station 3 or from the gas station system (e.g., online via a platform) for a refueling process. For example, the user of vehicle 1 purchases 20 liters of fuel, so the online platform sends the request message to the evaluation unit 9. The remaining steps can take place as described above for Figures 1 to 3.

Claims

Claims:

1. A method for refueling in a system comprising a vehicle (1) and an evaluation unit (9), wherein the vehicle (1) has an energy storage device, in particular a vehicle tank (2) for storing fluid fuel, and a feed unit connected to the energy storage device, wherein the feed unit comprises a controllable locking device (10), and wherein the locking device (10) enables refueling in an open state and prevents refueling in a closed state, the method comprising the following steps: Selecting a desired fuel and sending a request message to the evaluation unit (9), wherein the request message comprises a characteristic value of an environmental impact, in particular a CO2 balance, of the selected fuel or an identification of the origin of the selected fuel, wherein the identification of the origin allows a conclusion to be drawn about the CO2 balance of the fuel with regard to its production, in the evaluation unit (9), receiving the request message and checking whether there is authorization for the vehicle (1) to be refueled with this fuel in accordance with the characteristic value of the environmental impact of the fuel specified in the request message or the identification of the origin of the fuel, in the evaluation unit (9), sending an approval message to the locking device (10) to open the locking device (10) if the check has shown that the vehicle (1) may be refueled with the fuel,wherein the locking device (10) is in a closed state in a normal state and can only be opened after receipt of the release message for the period of refueling and, if necessary, via an emergency switch.

2. The method according to claim 1, wherein the step of checking whether authorization exists comprises the following step: - Check whether the environmental impact characteristic value specified in the request message is below a threshold value provided for the vehicle (1).

3. Method according to claim 1 or 2, wherein the evaluation unit (9) is present in a server (6), wherein a transceiver (7) of a petrol station (3) or a petrol station system (3) sends the request message to the server (6) and wherein the Vehicle (1) has a transceiver (8) which receives the release message from the server (6).

4. Method according to claim 1 or 2, wherein the evaluation unit (9) is present on the vehicle (1) and a transceiver (7) of a petrol station (3) or a petrol station system (3) sends the request message to a transceiver (8) on the vehicle (1) connected to the evaluation unit (9).

5. The method according to claim 1 or 2, wherein the evaluation unit (9) is located at a petrol station (3) and the petrol station (3) has a transceiver (7) connected to the evaluation unit (9), which transmits the release message to a transceiver (8) on the vehicle (1) connected to the blocking device (10).

6. Method according to one of claims 1 to 5, comprising the steps: - depositing a first certificate (certl) at a petrol station (3), wherein the first certificate (certl) is sent to the evaluation unit (9) as part of the request message; and - Checking the authenticity of the first certificate (certl) in the evaluation unit (9) before checking or sending the release message.

7. Method according to one of claims 1 to 6, comprising the steps: - depositing a second certificate (cert2) in the evaluation unit (9), wherein the second certificate (cert2) is sent to the blocking device (10) as part of the release message; and - Checking the authenticity of the second certificate (cert2) in the blocking device (10) or a computing unit connected thereto before opening the blocking device (10).

8. Method according to one of claims 1 to 7, wherein the actuation of the emergency switch triggers the following steps: Opening the locking device (10) and issuing an emergency signal.

9. The method according to claim 8, wherein the emergency signal is output to an engine control unit and the engine control unit, upon receipt of the emergency signal, only allows vehicle operation with limited power.

10. The method of claim 8 or 9, wherein the emergency signal is sent to a remote server.

11. Method according to one of claims 1 to 10, wherein the evaluation unit (9) is present in a secure element in which the first certificate (certl) or the second certificate (cert2) is preferably also present.

12. The method according to any one of claims 1 to 11, wherein the system further comprises a filling station (3) which provides a first fuel (fuel) and a second fuel (fuel2), wherein the first fuel (fuel) and the second fuel (fuel2) have a substantially identical chemical composition but a different characteristic of the environmental impact of the fuel or a different identification of the origin of the fuel.

13. The method according to claim 12, wherein the filling station has a first nozzle via which the first fuel can be refueled and a second nozzle via which the second fuel can be refueled, wherein the refueling unit of said vehicle (1) has a filling coupling (4) into which the first nozzle can be inserted, but not the second nozzle.

14. The method according to claim 13, wherein the system further comprises a legacy vehicle having a legacy filling coupling (4) for refueling, wherein both the first nozzle and the second nozzle are insertable into the legacy filling coupling (4).

Images