DE102016202527A1 - Computing unit for a motor vehicle - Google Patents

Abstract

The invention relates to a method for operating a computation unit (110) for a motor vehicle (100), wherein the arithmetic unit has interfaces (131, 141) for accessing resources (130, 140) of the motor vehicle (100) for a non-vehicle software application ( 210), an authentication of the non-vehicle software application (210) is carried out (311) and / or a functional scope of the non-vehicle software application (210) is determined (313) in the course of a verification phase (310), depending on the The result of the performed verification phase (310) it is determined whether and to what extent the non-vehicle software application (210) is permitted to access the resources (130, 140) of the motor vehicle (100) via the interfaces (131, 141) (320), and security functions which can be called by the non-vehicle software application (210) in order to secure the execution of the non-vehicle software application (210) (340).

Description

The present invention relates to a method for operating a computing unit for a motor vehicle and a computing unit and a computer program for its implementation.

State of the art

Software applications, so-called "apps", which are executed on hand-held devices from the class of smart devices, such as smartphones or tablet PCs, are known. Such apps can also be used in the automotive sector. For example, a handset, such as a smartphone, on which the app is running, be connected to a data transfer control device, whereby the app can communicate with the controller. It is also conceivable to load such apps directly into a control unit of the motor vehicle, for example via the Internet or a so-called cloud, and to execute the app from the control unit. Such software applications or apps for motor vehicles are for example in the US 2014/0106726 A1 described.

In the US 7 197 637 B2 For example, a method of ensuring data integrity of software for a control device of a motor vehicle is described. The US 7 748 043 B2 describes, for example, a method for authenticating a software package provided by a software provider which contains a software component that can be loaded into a terminal.

Disclosure of the invention

According to the invention, a method for operating a computing unit for a motor vehicle and a computing unit and a computer program for carrying it out with the features of the independent patent claims are proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

The invention makes it easier to implement a vehicle-external software application in the motor vehicle. A non-vehicle software application in this context is a software application to understand, which was not implemented in the course of a manufacturing process in the motor vehicle. The off-board software application was thus not originally present in the motor vehicle and could not be executed by the motor vehicle, as this has left a corresponding production plant and was put into operation. The off-board software application is introduced into the vehicle if it is already in the field.

The non-vehicle software application may in particular be a so-called "app". In particular, rechargeable motor vehicle functions can be realized by means of the vehicle-external software application, which can be introduced into the motor vehicle if this is already in the field. In order to realize such rechargeable motor vehicle functions, the vehicle software application can in particular influence vehicle functions or execute them completely.

In particular, the invention provides a platform for safely implementing such rechargeable software applications in the motor vehicle. The vehicle external software application is introduced, for example via the Internet or an appropriate network to a computing unit (control unit) of the motor vehicle. The arithmetic unit decides in particular whether and to what extent the vehicle external software application is to be executed and expediently serves for coordination between the software application and resources or components of the motor vehicle.

Interfaces are provided for accessing resources or components of the motor vehicle for the off-board software application. The interfaces are software interfaces. The resources may preferably be sensors, actuators, control devices and / or storage units.

The computing unit assesses during a verification phase whether the software application poses a security risk or can be executed without negatively affecting the safety of the motor vehicle. In particular, the software application can according to aspects of given security policies, such as Standard ISO 26262 to be examined.

In the course of the checking phase, the arithmetic unit can perform an authentication of the non-vehicle software application. It is expedient to check the origin of the software application and whether it comes from secure, trustworthy sources and not from potential attackers. Furthermore, it can be checked whether the software application is suitable and authorized to influence vehicle functions of the motor vehicle.

Alternatively or additionally, the arithmetic unit in the course of the verification phase to determine a range of functions of the vehicle external software application. In particular, it checks for which resources or vehicle functions would like to access the non-vehicle software application and in which framework it would like to influence these vehicle functions.

Furthermore, it is determined whether and to what extent the non-vehicle software application is allowed to access the resources of the motor vehicle via the interfaces, depending on the result of the checking phase carried out. In particular, the arithmetic unit determines to what extent the software application is allowed to control components of the motor vehicle, preferably actuators, and how far it may thus intervene in the driving behavior of the motor vehicle. Again, this definition may be in accordance with given security policies such as ISO 26262 so that the software application can only influence resources as required by the security policies.

If the software application is not authenticated, for example, if it comes from insecure sources or its source can not be traced with certainty, the arithmetic unit restricts its scope in particular or expediently hinders its execution. In this case, the software application in particular no interfaces or resources assigned and they must not control an actuator of the motor vehicle.

If authentication is successful, the software application may run to the specified extent. Callable security functions are provided by the non-vehicle software application in order to ensure the execution of the non-vehicle software application. In particular, when the software application is executed, it may request that its operation and its executed functionalities be monitored and controlled by the computing unit. In particular, the arithmetic unit can ensure, by means of the security functions, that the software application complies with prescribed security guidelines such as ISO 26262 is performed. In particular, if security-relevant and / or real-time-critical actions are performed by the software application, the arithmetic unit can provide protection according to the so-called Automotive Safety Integrity Level (ASIL), one of the ISO 26262 specified safety requirement level for safety-relevant systems in motor vehicles.

Thus, it is not necessary to implement or program special functions into the software application itself, which control or safeguard the operation of the software application. The fact that such security functions are already implemented in the arithmetic unit, the software application can call them during their execution in a simple manner.

The software application can thus be easily programmed and its source code can be kept simple and clear. Furthermore, an efficient and safe operation of the software application can be ensured and it can be checked and ensured by the security functions of the computing unit, for example, that the software application uses the resources of the motor vehicle as efficiently as possible. Since the security functions are provided centrally, especially by the manufacturer, they can easily be certified, so that safety-critical external software applications no longer have to be laboriously certified.

The arithmetic unit is caused by the corresponding running on her computer program to perform the functions described above. The arithmetic unit is preferably designed as a control unit of the motor vehicle, for example as an engine control unit. The arithmetic unit can also be introduced into the motor vehicle in addition to other control devices. Suitable data carriers for providing the computer program are in particular magnetic, optical and electrical memories, such as e.g. Hard drives, flash memory, EEPROMs, DVDs, etc. It is also possible to download a program via computer networks (Internet, intranet, etc.).

In particular, a platform can be offered by the invention, which enables developers to develop software applications for motor vehicles according to established standards or standardized standardized security guidelines. Developers can use this platform and program their software application so that it can use the special functions of the processing unit or of the computer program running on it. Furthermore, the platform makes it possible, in particular, for the rechargeable software application to be carried out safely, while ensuring the functional safety of the motor vehicle. In particular, it can be achieved that both in the course of development and during the execution of vehicle-external application software safety requirements or safety-critical requirements according to eg ISO standard 26262 fulfilled or respected.

Developers will be offered the freedom to develop new software applications for automobiles. In particular, it is not necessary to program special functions into the software application in order to implement the same in the motor vehicle, and then to have them possibly costly to be certified. For the Implementation and validation, the software application can rely on the provided in the arithmetic unit (and appropriately already certified) functions that are offered uniformly in the course of the platform for different software application. In particular, users or drivers of vehicles can be informed that recharged software applications pose no security risk and can be executed safely. Overall, thus, a wider acceptance of rechargeable software application can be achieved, and their sales are increased.

In particular, a security of resources of the motor vehicle according to the ISO 26262 such as libraries (eg for security-relevant operations or for checking messages, for example by means of checksums), memory areas (eg RAM, ROM), program sequences, diagnostics, analog-to-digital converters, error responses, etc.

The vehicle external software application can be conveniently carried out by the arithmetic unit itself. For example, the software application can also be executed by a control unit or an on-board computer of the motor vehicle. The off-board software application may, for example, be transmitted over the Internet or e.g. be loaded via a so-called "cloud" in the control unit or the on-board computer. A cloud, or so-called cloud computing, is a remote, distributed computing unit system in communication with the motor vehicle over a network (e.g., over cellular networks (e.g., 3G, 4G, etc.), WLAN, or Bluetooth, etc.). Particularly preferably, the non-vehicle software application is executed by the computing unit designed as a control unit of the motor vehicle.

Alternatively or additionally, the vehicle-external software application can preferably also be executed by a vehicle-external or vehicle-external computing unit. Advantageously, the vehicle-external computing unit is designed as a hand-held device from the class of smart devices, preferably as a smartphone or as a tablet PC. The handset is in particular a mobile handset, which is in the possession of the driver and is also carried by this outside the vehicle. The off-board computing unit may preferably be in wired communication (e.g., USB, etc.) or wireless (e.g., WLAN, Bluetooth, GSM, 3G, 4G, etc.) or over the Internet to the motor vehicle or control devices of the motor vehicle in data transmitting communication. For example, the vehicle-external computing unit can also be designed as a PC, as a server, for example in a data center, or as a cloud.

Advantageously, by means of the safety functions, an activation by the vehicle software application of resources of the motor vehicle, in particular of actuators, is checked via the interface. For this purpose, particular setpoint values, according to which the resources or actuators are to be controlled via the interfaces, can be checked or recalculated for plausibility by the arithmetic unit for this purpose. Thus, it can be checked whether the software application also works correctly and controls the actuators sensibly. The non-vehicle software application does not need to check itself, but can rely on the security features offered by the platform.

By means of the security functions, the arithmetic unit can preferably estimate whether a computing capacity is sufficient for executing the software application external to the vehicle or for achieving the corresponding functionality. If not, further resources may be conveniently reserved for the software application.

Alternatively or additionally, by means of the safety functions preferably input signals or the integrity of the input signals can be monitored. The input signals are expediently transmitted from sensors to the software application and can be checked for plausibility / timeliness.

Alternatively or additionally, vehicle-external data or its availability can preferably be monitored by means of the safety functions. In particular, such external vehicle data is data that is transmitted to the motor vehicle by a computing unit, such as a server or a cloud, that is external to the vehicle and that is required for the execution of the software application. This off-board data can also conveniently be checked for plausibility / timeliness. In particular, a real-time availability of cloud data is thus checked and real-time control of actuators via the cloud can be ensured.

By means of the security functions, alternatively or additionally, a communication channel (eg WLAN, Bluetooth, GSM, 3G, 4G, etc.) is preferably checked for an off-board computing unit, such as a server or a cloud, or its availability. If the software application communicates with such a vehicle-external computing unit during its execution, it can ensure that the corresponding communication connection works correctly.

Advantageously, a prioritization of accesses to the resources is performed via the interfaces. For example, the case may arise that both the software application and other components of the motor vehicle, in particular control devices, want to access the same resource in parallel. It is also conceivable that several different software applications want to access the same resource in parallel. The arithmetic unit can prevent such collisions. For example, the arithmetic unit can evaluate the different accesses to the resource and create an order according to which these accesses are to be performed.

According to a preferred embodiment, an identification number (ID), a key and / or a security certificate are checked in the course of the checking phase for authentication of the software application external to the vehicle. Appropriately, it can thus be recognized in a simple and secure manner, whether the software application comes from a secure source or represents a potential attacker.

In the course of the checking phase, it is preferably checked to authenticate the non-vehicle software application as to whether the non-vehicle software application was developed according to given security guidelines, in particular according to the Standard ISO 26262 , For example, special information can be stored in the source code of the software application for this purpose.

In the course of the checking phase for determining the functional scope of the software application external to the vehicle, it is preferably determined which resources of the motor vehicle the vehicle external software application would like to access, for example if the software application wants to influence steering, braking, acceleration, etc.

Preferably, a driver assistance function is performed by the vehicle external software application. Such a driver assistance function serves, in particular, to assist the driver and can warn him, for example, of dangerous situations or to defuse or counteract a dangerous situation. Driver assistance functions can perceive the environment, in particular via sensors, and actuate actuators based on corresponding sensor data. Examples of such driver assistance functions are adaptive cruise control (ACC), curve assistant, parking assistant, lane departure warning, autonomous longitudinal guidance, attention and fatigue detection, electronic stability program (ESP), engine drag torque control (MSR), traction control (ASR), Anti-lock braking system (ABS) as well as functions in the course of automated driving.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

The invention is illustrated schematically by means of embodiments in the drawing and will be described below with reference to the drawing.

Brief description of the drawings

1 schematically shows a motor vehicle with a preferred embodiment of a computing unit according to the invention.

2 schematically shows functions that are performed by a preferred embodiment of a computing unit according to the invention, as a block diagram.

Embodiment (s) of the invention

In 1 is a motor vehicle 100 with a preferred embodiment of a computing unit according to the invention 110 shown. Identical reference numerals in the 1a and 1b designate identical or structurally identical elements.

The arithmetic unit is as a control unit 110 of the motor vehicle 100 designed, for example, as an engine control unit. The control unit 110 is via a communication channel 120 , In particular a bus, such as a CAN bus, with a sensor 130 and an actor 140 connected. The control unit 110 has a first interface for this purpose 131 on, over which the sensor 130 is connected and corresponding sensor values can be read, and a second interface 141 over which the actor 140 is connected and can be controlled.

The sensor 130 For example, may be a distance sensor, which is a distance of the motor vehicle 100 to a preceding vehicle. For example, the actuator 140 for speed control of the motor vehicle 100 be used.

By means of a vehicle-external software application 210 , a so-called "App", is subsequently a driver assistance system in the motor vehicle 100 reloaded if this is already in the field. For example, Adaptive Cruise Control (ACC) may be used as Such reloaded driver assistance system of the App 210 be executed.

In 1a is a first example shown how such an app 210 in the motor vehicle 100 can be recharged. In the motor vehicle 100 In this example, there is an off-board computing unit 200 in the form of a smartphone 220 , For example, the smartphone 220 carried by a driver of the motor vehicle.

The app 210 is in the smartphone 220 stored and is executed by this. The smartphone 220 stands with the control unit 110 in data-transmitting connection 230 , for example via WLAN or Bluetooth.

A second example to an app 210 in the motor vehicle 100 to reload is in 1b shown. The control unit 110 in this example is a mobile network 250 with a non-vehicle computing unit 200 in the form of a remote distributed computing unit system 240 in the sense of cloud computing in connection. The app 210 is in the arithmetic unit system 240 deposited and can via the so-called cloud via the mobile network 250 in the control unit 110 be transmitted. The app 210 is then in the controller 110 stored and can be executed by this.

After the app 210 in the motor vehicle 100 was introduced, either via the smartphone 220 in case of 1a or in the control unit 110 in the example of 1b , it is from the controller 110 checked and the controller 110 Arithmetic unit decides whether and to what extent the app 210 to be executed.

The individual functions, that of the control unit 110 to be executed for this purpose are in 2 schematically illustrated as a block diagram.

In the course of a review phase 310 checks the control unit 110 first of origin and functionality of the app 210 , In one step 311 leads the controller 110 an authentication of the app 210 by. For this purpose, an identification number, a key and a security certificate are checked.

The developer has in the course of this identification number, the key and the security certificate according to predetermined security guidelines and predetermined standards in the app 210 implemented. Thus, it can be verified that the app 210 from a trusted, secure developer, not from a potential attacker.

If identification number, key, and security certificate could be successfully verified, the controller will 110 continues to check if the app 210 was developed according to given security guidelines, in particular according to the guidelines according to the Standard ISO 26262 , This may be done by the developer at a dedicated location in the source code of the app 210 be deposited.

If this has been successfully verified, the app is 210 authenticated. If at least one of these reviews is unsuccessful, it may indicate that the app is being reviewed 210 is a malicious software. In this case, the controller prevents 110 the app 210 according to step 312 on the execution.

If the authentication is successful, the step 313 from the controller 110 a range of functions of the app 210 certainly. For this purpose, it is determined on which components of the motor vehicle 100 the app 210 want to access. In this example, the app wants 210 for realizing a pitch control on the distance sensor 130 and on the actor 140 to access the speed control. The app 210 can its corresponding functional scope, for example, the control unit 110 announce or the controller 110 This can also be done, for example, by examining the source code of the app 210 get yourself in touch.

If the app 210 in step 311 was successfully authenticated and the functionality of the app 210 in step 313 has been determined by the controller 110 in step 320 depending on the result of the verification phase 310 set to what extent the app 210 on resources of the motor vehicle 100 allowed to access and components of the motor vehicle 100 may drive.

For example, it can be specified that the app 210 on the actor 140 and the sensor 130 as resources may access. The control unit 110 To this end, states that the app 210 on the interfaces 131 and 141 may access. The app 131 can thus sensor values of the sensor 130 over the interface 131 read in and the actor 140 over the interface 141 to control the speed control. For example, it can thus be specified that the app 210 may be carried out in full.

If the app 210 as in the example of 1b from the controller 110 itself is executed, for example, a computing capacity and storage units of the controller 110 the app 210 be assigned as appropriate resources. Even if the app 210 according to the example of 1a on the smartphone 220 running, computing capacity and memory units of the controller 110 for the app 210 be provided so that calculations and arithmetic operations of the smartphone 220 in the control unit 110 can be outsourced.

The app 210 will be in step 330 executed in the correspondingly defined full extent. In the course of reading the app 210 Sensor data of the sensor 130 over the interface 131 one. The app 210 can from this sensor data a distance of the motor vehicle 100 determine to a preceding vehicle. Depending on this distance, the app determines 210 a target speed of the motor vehicle 100 , by means of which a predetermined minimum distance to the preceding vehicle can be maintained. The app 210 controls the actuator 140 over the interface 141 accordingly.

In step 340 call the app 210 Security features of the controller 110 on, by means of which the execution of the app 210 is secured. For this purpose, the controller estimates 110 For example, by means of the security functions, whether the allocated computing capacity for the execution of the app 210 is sufficient. If this is not the case, for example, further computing capacity for the app 210 reserved. Furthermore, expediently, the integrity of the sensor data of the sensor 130 be monitored by means of the safety functions. The sensor data can thus be checked for plausibility and timeliness. Furthermore, for example, also target values, by the App 210 be determined and according to which the actuator 140 is controlled by the safety functions of the controller 110 checked for plausibility to monitor whether the app 210 works correctly and sensibly.

Such security functions can be realized by means of a 3-level concept. The basis for such a concept are, for example, security mechanisms that are used in the Standard ISO 26262 Part 5, Annex D to be discribed.

A first level or functional level includes engine control functions, in particular for the implementation of requested engine torques, component monitoring, diagnosis of input and output variables as well as control of system reactions in the detected error case.

In a second level or functional monitoring level, a function to be monitored is calculated independently of the functional level, monitored and established in the event of a fault, a manageable state. The function monitoring level detects the erroneous course of monitoring-relevant scopes of the functional software in level 1 inter alia by monitoring the calculated moments or the vehicle acceleration. In the case of an error, the triggering of system reactions takes place.

A third level or computer monitoring level comprises, in particular, a monitoring module (for example an ASIC or computer) which is independent of the function computer and which tests the proper execution of the program instructions of the function computer by means of a question-and-answer procedure. In the event of an error, the triggering of system reactions takes place independently of the function computer.

The security features of the controller 110 For example, they may be implemented in the second level. In particular, the safety functions can be called cyclically here. These calls are automatic and will not be triggered by the app. The calls can be checked, eg by an (external) watchdog, which is implemented in particular in the third level. The sensor data can be secured and deployed by default by the security features or only after the app 210 their hedging according to step 340 requests. A use of the sensor data in App 210 without protection, for example, can be prevented, for example, to prevent sensor data without requesting a hedge of the app 210 to be provided.

By doing that, the review phase 310 and the determination according to step 320 be performed according to predetermined criteria and security policies, and by the provision of the app 210 Callable security features can be offered a platform that allows developers to develop apps or software applications for automobiles according to established standards and consistent security policies.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• US 2014/0106726 A1 [0002]
• US 7197637 B2 [0003]
• US 7748043 B2 [0003]

Cited non-patent literature

• Standard ISO 26262 [0009]
• ISO 26262 [0012]
• ISO 26262 [0014]
• ISO 26262 [0014]
• ISO standard 26262 [0018]
• ISO 26262 [0020]
• Standard ISO 26262 [0030]
• Standard ISO 26262 [0048]
• Standard ISO 26262 Part 5, Annex D [0056]

Claims (11)

Method for operating a computing unit ( 110 ) for a motor vehicle ( 100 ), whereby by the computing unit interfaces ( 131 . 141 ) to access resources ( 130 . 140 ) of the motor vehicle ( 100 ) for a non-vehicle software application ( 210 ) during a review phase ( 310 ) an authentication of the non-vehicle software application ( 210 ) is carried out ( 311 ) and / or a range of functions of the non-vehicle software application ( 210 ) is determined ( 313 ), depending on the outcome of the review ( 310 ) determines whether and to what extent the non-vehicle software application ( 210 ) via the interfaces ( 131 . 141 ) on resources ( 130 . 140 ) of the motor vehicle ( 100 ) ( 320 ), and the non-vehicle software application ( 210 ) are provided to call the execution of the non-vehicle software application ( 210 ) ( 340 ). Method according to claim 1, wherein an activation of resources ( 130 . 140 ) of the motor vehicle ( 100 ) via the interfaces ( 131 . 141 ) by the non-vehicle software application ( 210 ) is checked ( 340 ). Method according to claim 1 or 2, wherein by means of the security functions - it is estimated whether a computing capacity for the execution of the non-vehicle software application ( 210 ) is sufficient, and / or - vehicle-internal input signals are monitored and / or - vehicle-external data is monitored and / or - a communication channel is checked to a vehicle-external computing unit. Method according to one of the preceding claims, wherein a prioritization of accesses to the resources of the motor vehicle ( 100 ) via the interfaces ( 131 . 141 ) is carried out. Method according to one of the preceding claims, wherein in the course of the checking phase ( 310 ) for authentication of the non-vehicle software application ( 210 ) an identification number, a key and / or a safety certificate are checked ( 311 ). Method according to one of the preceding claims, wherein in the course of the checking phase ( 310 ) for authentication of the non-vehicle software application ( 210 ) checks whether the non-vehicle software application ( 210 ) was developed according to given security guidelines ( 311 ). Method according to one of the preceding claims, wherein in the course of the checking phase ( 310 ) for determining the functional scope of the non-vehicle software application ( 210 ) determines which resources ( 130 . 140 ) of the motor vehicle wants to access the non-vehicle software application ( 313 ). Method according to one of the preceding claims, wherein interfaces ( 131 . 141 ) to access sensors ( 130 ) and / or actuators ( 140 ) and / or control devices and / or storage units as resources of the motor vehicle ( 100 ) for the non-vehicle software application ( 210 ) to be provided. Arithmetic unit ( 110 ), which is adapted to perform a method according to any one of the preceding claims. Computer program comprising a computing unit ( 110 ) to perform a method according to any one of claims 1 to 8 when executed on the computing unit. A machine-readable storage medium having a computer program stored thereon according to claim 10.

Images