Vehicle ECU Malfunction Handling via Backup Controller
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-connected vehicles are vulnerable to malicious activity that can cause ECU malfunction, posing safety risks due to insufficient protection against remote access and tampering.
Innovation Solution
A system with backup ECUs operating in a disconnected mode, using read-only firmware, and a monitoring component that switches the vehicle to a backup driving mode upon detecting ECU malfunction, ensuring basic driving features remain operational and uncompromised by external malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the vehicle uses network-connected standard ECUs for advanced features, then the vehicle functionality and adaptability are improved, but the vulnerability to malicious activity and data tampering increases
Solution Approach 1:
The vehicle ECU system is divided into two separate segments: standard ECUs connected to communication networks for advanced features, and isolated backup ECUs disconnected from networks for basic driving functions. This segmentation allows the vehicle to utilize network-connected features while protecting critical functions from remote malicious activity.
Solution Approach 2:
A monitoring component acts as an intermediary between the standard ECUs and backup ECUs. It continuously monitors the standard ECUs for malicious activity and data tampering, and automatically triggers switching to backup ECUs when threats are detected, serving as a protective mediator.
2Reliability
If the vehicle disconnects backup ECUs from communication networks, then protection against remote malicious activity is improved, but the ability to receive updates and remote assistance is reduced
Solution Approach 1:
The ECU system is segmented into network-connected standard ECUs and network-disconnected backup ECUs. The backup ECUs are intentionally isolated from communication networks to provide air-gapped protection against remote malicious activity, while standard ECUs maintain network connectivity for updates and assistance.
Solution Approach 2:
Backup ECUs with read-only firmware are prepared in advance and isolated from networks before any malicious activity can occur. This pre-established isolated environment provides a safety cushion that ensures basic vehicle functions can operate securely even if network-connected ECUs are compromised.
3Reliability
If the vehicle implements monitoring and automatic switching capability, then the safety and reliability are improved, but the device complexity increases
Solution Approach 1:
A monitoring component serves as an intermediary that automatically detects malicious activity in standard ECUs and triggers switching to backup ECUs. This mediator handles the complexity of monitoring and decision-making, keeping the overall system manageable while improving safety.
Solution Approach 2:
The monitoring component automatically monitors standard ECUs for malicious activity and autonomously triggers the switching mechanism without requiring manual intervention. This self-service capability reduces operational complexity while maintaining high safety through automated response to threats.
4Reliability
If the backup ECUs use read-only firmware, then protection against code injection and tampering is improved, but the ability to update and adapt is limited
Solution Approach 1:
Different firmware characteristics are applied to different ECU types: standard ECUs use writable, updatable firmware for adaptability, while backup ECUs use read-only firmware for tamper-proof operation. This local quality differentiation allows each ECU type to optimize for its specific function.
Solution Approach 2:
The backup ECU firmware is finalized and written to read-only memory in advance during manufacturing, before deployment. This preliminary action ensures the firmware cannot be modified or injected with malicious code during vehicle operation, providing inherent protection against tampering.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an aspect of some embodiments of the present invention there is provided a vehicle mechanism for handling vehicle electronic control unit (ECU) malfunction, comprising: a first set of vehicle backup ECUs for operating in a backup vehicle driving mode comprising read-only firmware and disconnected from an interface with communication networks outside the vehicle, the vehicle backup ECUs providing at least basic driving related features of the vehicle including transmission and engine controllers to provide control of the vehicle; and a controller that switches from a standard vehicle driving mode operating according to a second set of standard vehicle ECUs to backup vehicle driving mode in response to a trigger indicative of malfunction of at least one ECU of the first set of vehicle ECUs.