DE102019109353B3 - Dynamic anomaly detection and treatment - Google Patents

Abstract

Method (100) for controlling and / or regulating usage objects of a vehicle (10), wherein - in a first step at least one acquisition module (1) for acquiring and / or processing diagnostic data (1A) of at least one usage object is put into operation, wherein the acquisition module (1) at least partially records and / or processes this diagnostic data, and - in a further step, these diagnostic data (1A) are forwarded to a control unit (2), which from the diagnostic data (1A) control signals (1B) for control and / or disconnection of the usage object derives and / or generates characterized in that by means of these control signals (1B), in the case of an anomaly in the diagnostic and / or control data determined by the detection module (1) and / or the control unit (2), that memory location the control unit (2), which would actually be or is reserved for the storage and / or processing of faulty control data is released so that this then released memory space of the control unit (2) is occupied with correction control signals (10A) from a memory element (3) of the vehicle (10) and / or an external memory element (4), so that the control data stored in the control unit is at least partially is free of anomalous control data, these then partially corrected control data of the correction unit (2) being used to control the usage object, whereby these incorrect control data, however, are not stored in the storage space actually intended for them in the replacement unit or deleted from this storage space, rather, these are at least partially replaced by corrected control data or diagnostic data generated by the generating unit.

Description

The present invention relates to a method for controlling and / or regulating usage objects of a vehicle and a device for controlling and / or regulating usage objects of a vehicle according to the respective preambles of claims 1 and 10 and 11.

The inventive method proposed here also deals, among other things, with recognizing one or more anomalies with regard to the operation, i.e. with regard to the control and / or regulation of usage objects, and at the same time such an anomaly in operation, in particular the control and / or regulation of the objects of use, at least partially to be eliminated.

An anomaly can be understood to mean a deviation of the operation, in particular the control and / or regulation, of usage objects from a target control and / or target regulation of the usage objects. In particular, the anomaly can also be, among other things, a systematic or accidental malfunction of the usage object, as well as deliberate manipulation.

In this respect, an anomaly can be divided into various anomaly categories. These include network anomalies, protocol anomalies, performance anomalies and hardware anomalies in relation to the operation of the respective usage object.

When considering, structuring and delimiting the anomalies to be considered in the vehicle for the purposes of the invention, a distinction must be made between various categories. Depending on the level of their localization in the network, on the protocol, software or hardware level, the following subdivisions are provided as examples:

NETWORK ANOMALIES:

• Failure of switches, routers and / or links,
• Bandwidth implausibility
• inconsistent number of network data flows,
• implausible names of devices or network participants,
• lack of authentication,
• unauthorized use of services
• Disturbance of authentic time

LOG ANOMALIES:

• wrong sources or destinations,
• incorrect lengths of packages or
• wrong version or wrong message type
• wrong content
• Replay of messages

PERFORMANCE ANOMALIES:

• implausible execution time,
• Invalid timer interrupts

HARDWARE ANOMALIES:

• Incorrect initialization, configuration,
• Interruption of power supply,
• Sensor failure,
• invalid I / O access

SOFTWARE ANOMALIES:

• Buffer overflow,
• Memory violation,
• floating point error,
• invalid operating system call,
• Vulnerability patterns (known attacks),
• Flooding / brute force attacks (automated attacks)

The following, not exhaustively listed, technical options are provided for the detection and treatment of anomalies:

Network monitoring

1. a) Ethernet Switches stellen Knotenpunkte in Ethernet Netzwerken dar, durch die alle Kommunikation durchgeleitet wird. Sie bieten sowohl viele standardisierte als auch proprietäre Mechanismen, die zur Analyse des Datenverkehrs verwendet werden können.
2. b) Anomalieerkennung durch spezialisierte Messkomponenten (Beobachter). Spezialisierte Messkomponenten erlauben eine weitergehende Analyse von Daten, die zum Einsatz kommt, sobald die Analysemöglichkeiten im Switch an die Grenzen stoßen.

Due to its connection function, the network represents both the target of attack vectors (triggering of anomalies) and a point for the detection of anomalies. In contrast to bus technologies, the point-to-point communication in Ethernet networks enables the communication to be analyzed in more detail. There are two starting points for measurements to detect anomalies:

1. a) Ethernet switches represent nodes in Ethernet networks through which all communication is passed. They offer many standardized as well as proprietary mechanisms that can be used to analyze data traffic.
2. b) Anomaly detection by specialized measuring components (observers). Specialized Measurement components allow a more extensive analysis of data, which is used as soon as the analysis options in the switch reach their limits.

Health monitoring

There are so-called health monitors in vehicle control units, which periodically monitor the correct functionality of applications, hardware and software and, if necessary, trigger error handling or warning routines. Exemplary monitoring functions are lock-step calculation, watch dogs and memory protection units, which, as processor and process monitoring, make a statement about the trustworthiness of the computational resources and the physical communication channels by performing checks on the supply, memory and program execution integrity.

Physical plausibility check

In the physical plausibility check, anomalies, especially of sensor signals, are also identified by evaluating the content of the plausibility in comparison with redundancies ( 2 Sensors evaluate the same physical quantity in parallel) or with models ( 1 The plausibility of the sensor is checked against an online modeled signal).

The physical plausibility check can support the aforementioned types of computational anomaly detections, but often not replace them, since if implausibility is detected it must be decided whether it is a sensor error or a targeted signal corruption.

The physical plausibility check is often preferred to the computational check, particularly in the case of a quick reaction to an anomaly with the aim of reaching a safe state.

Methods and devices known from the prior art for identifying and treating anomalies of an object of use within a vehicle have, inter alia, a control unit which contains diagnostic data which have an anomaly or which indicate an anomaly.

The control unit therefore checks the deviation, i.e. the anomaly from a target operating value, in particular target diagnostic data, for example, and prevents the diagnostic data from being forwarded and / or control signals generated therefrom by the control unit or another unit for the control and / or or regulation of the usage object, so that in the event of an anomaly the usage object can be switched off by means of such a control unit or a malfunction of the usage object in the vehicle can be indicated by acoustic, optical or other signals.

Incidentally, the document "HUDAIB, A. u.a .: An automated approach to the detection and correction of software errors. Communications and Network, 8, 2016, pp. 158-169 “that autonomous software recovery enables software to automatically detect and restore software errors. This function ensures that the software runs more efficiently and actively and reduces maintenance time and costs. This document proposes an automated approach to software defect detection and recovery (SFDR). The SFDR recognizes the cases in which an error occurs in software components, such as delete, replace, or change any component, and restore the component so that the software can continue to operate as intended. The SFDR is analyzed and implemented in parallel as stand-alone software in the design phase of the target software. The practicality of the proposed approach was tested by implementing an application that demonstrates the performance and effectiveness of the SFDR. The experimental results and the comparisons with other work show the effectiveness of the proposed approach.

However, such methods and devices known from the prior art for controlling and / or regulating usage objects of a vehicle have the disadvantage that restarting the control and / or regulation of the usage object, that is to say, inter alia, use of the usage object of a vehicle, for example by switching off the device and reconfiguration and / or by replacing the usage object with a functioning usage object.

However, such a method for controlling and / or regulating objects of use of a vehicle is not only very complex, but also costly for the user to implement.

The present invention therefore offers a possibility of avoiding the above-mentioned reset and / or replacement of the usage object of a vehicle, so that it is an object of the present invention to carry out both an anomaly detection and such an anomaly in a particularly simple and cost-effective manner at least partially to be eliminated in a simple manner.

This object is achieved by the subject matter of claim 1.

In this respect, the method described here for controlling and / or regulating usage objects of a vehicle has a first step, within which at least one acquisition module for acquiring and / or processing diagnostic data of at least one usage object is put into operation, the acquisition module at least partially acquiring this diagnostic data and / or processed, wherein in a further step these diagnostic data are forwarded to a control unit which derives and / or generates control signals for activating and / or deactivating the usage object from the diagnostic data.

According to the invention, in the event of an anomaly in the diagnostic data and / or control data generated therefrom by the detection module and / or the control unit, that memory space of the control unit which would actually be reserved for the storage and / or processing of the (faulty) control data is or is, and / or released within the (memory space) area not required in the operating state limited by the error, so that this then released memory space of the control unit is occupied with correction control signals from a memory element of the vehicle and / or an external memory element so that the in The control data stored in the control unit is at least partially free of anomalous control data, these then partially corrected control data from the correction unit for controlling the usage object and for more detailed treatment and disposal the anomalies can be used.

By feeding in correction control signals and / or correction diagnostic data and by replacing the partially faulty control data for controlling the usage object, the diagnostic data is therefore repaired, in particular using software technology. In other words, the correction control signals and / or the diagnosis data and / or the correction diagnosis data are doctor signals and / or doctor data which carries out an at least partially performed healing of the faulty control signals and / or faulty diagnosis data.

According to at least one embodiment, the method for controlling and / or regulating usage objects of a vehicle comprises a first step, within which at least one acquisition module for acquiring and / or processing diagnostic data of at least one usage object is put into operation, the acquisition module at least partially acquiring this diagnostic data and / or processed and, in a further step, these diagnostic data are forwarded to a control unit, which derives and / or generates control signals for activating and / or switching off the reference object from the diagnostic data, whereby according to the invention, control signals in the case of one of the detection module and / or or the anomaly detected by the control unit in the diagnosis and / or control data, that memory space of the control unit which would actually be reserved for storage and / or processing of the (then faulty) control data is released is, so that this then released memory space of the control unit is occupied with correction control signals from a memory element of the vehicle and / or an external memory element, so that the control data stored in the control unit is at least partially free of abnormal control data, these at least partially corrected control data then being used by the correction unit Control of the usage object can be used.

According to at least one embodiment, the correction unit has a generation unit for generating the control signals on the basis of the diagnostic data and a replacement unit for replacing the anomalous control signals (faulty control signals) with at least partially faultless control signals, both units being in data communication with each other.

In this embodiment, the correction unit is therefore divided into two different, preferably also haptically and structurally separate units, so that in these two separate units a distinction can be made between the generation and at least partial replacement of the control signals.

According to at least one embodiment, the replacement unit is arranged downstream of the generation unit in the data flow direction.

In this respect, in the data flow direction, the various control data are first generated on the basis of the diagnostic data already determined and only then are these control data at least partially replaced by the replacement unit. For example, the control data include corresponding control signals. Incidentally, the present invention can be applied not only to control signals but also to control data.

According to the invention, however, these faulty control data are then v not stored in the storage space actually provided for them in the replacement unit or from this Storage space deleted, but these are at least partially replaced by corrected control data or diagnostic data generated by the generating unit.

According to at least one embodiment, the at least partially corrected control data and / or control signals are fed to a decision module based on the replacement unit.

The replacement unit therefore forwards these at least partially corrected control signals and / or control data to the decision module, the decision module deciding on the basis of a deviation determination of the corrected control data and / or control signals from target control data and / or target control signals whether the corrected control data and / or or control signals are subjected again to a correction by the correction unit, so that at least one data recursion, for example in the form of a data recursion loop, is or can be performed as a result. As an alternative or in addition, not only corrected control data with regard to the reduction of a deviation, but also control data for a changed anomaly detection and treatment can be used.

In the event of an excessive deviation of the corrected control signals from the target control signals determined by the decision module, the decision module therefore forwards the at least partially corrected control signals back to the generation unit, which feeds newly generated correction control signals from a memory element of the vehicle and / or an external memory element into the replacement unit , so that a repeated data replacement described above is replaced by incorrect control signals still contained in these corrected control signals. This process can be carried out until the deviation is minimal or nonexistent and the decision module therefore feeds these control signals to a control unit of the usage object, so that the usage object can then be put back into operation. As an alternative or in addition, not only corrected control data with regard to the reduction of a deviation, but also control data for a changed anomaly detection and treatment can be used.

According to at least one embodiment, the at least partially corrected control data is fed to the replacement unit to carry out the data recursion and / or the at least partially corrected control data is first fed back to the generating unit in the data flow direction.

In this respect, the data recursion (also referred to as dynamic reconfiguration) from the decision module can optionally be fed either to the generation unit and / or to the replacement unit.

However, it is also possible for the generation unit itself to carry out the above-mentioned data recursion, so that the incorrect control data is corrected within the generation unit by means of various layer communications within the generation unit, until the control data can withstand a deviation determination by the replacement unit.

According to at least one embodiment, the target control data correspond to at least one target control value, the at least partially corrected control data corresponding to at least one actual control value, a deviation value being represented by an arithmetic difference and / or an arithmetic fraction or by another arithmetic calculation by the decision module can be calculated. In this respect, the respective control data can be transformed or mapped in at least one respective control value.

According to at least one embodiment, if the deviation value is exceeded or not reached, at least one of the data recursions shown above is carried out.

According to at least one embodiment, the at least partially corrected control data are combined by the correction unit into so-called data blobs or data clusters, which are then classified by the correction unit in terms of their shape and / or extension.

According to at least one embodiment, the usage object is a temperature and / or brightness and / or pressure sensor of the vehicle.

Furthermore, a device for controlling and / or regulating usage objects of a vehicle is presented in the present application. In particular, the device can carry out the method described above and is also set up and provided for this.

Thus, all of the features disclosed for the method are also disclosed for the device described, and vice versa.

According to at least one embodiment, the device for controlling and / or regulating usage objects of a vehicle comprises at least one acquisition module for acquiring and / or processing diagnostic data of at least one usage object, the acquisition module at least partially acquiring and / or processing this diagnostic data.

In addition, the described device comprises a correction unit to which these diagnostic data are sent, the correction unit being set up and provided to derive and / or generate control signals for activation and / or deactivation from the diagnostic data, with the invention using these control signals in the case of a the anomaly detected by the detection module and / or the correction unit in the diagnostic and / or control data is that memory space of the control unit which would actually be reserved for the storage and / or processing of the erroneous control signals or is released so that this then released memory space of the control unit with Correction control signals from a memory element of the vehicle and / or an external memory element is assigned, so that the control data stored in the control unit is at least partially free of abnormal control data, w whether these then use the partially corrected control data of the correction unit for controlling the usage object.

Furthermore, the present application relates to a method for controlling and / or regulating usage objects of a vehicle, wherein in a first step at least one acquisition module for acquiring and / or processing diagnostic data of at least one usage object is put into operation, the acquisition module at least partially of this diagnostic data detected and / or processed, and in a further step these diagnostic data are forwarded to a control unit, which derives control signals for activating and / or deactivating the usage object from the diagnostic data and / or generates control signals by means of these, in the case of one from the detection module and / or the control unit detected anomaly in the diagnostic and / or control data, that memory space of the control unit which would actually be reserved for the storage and / or processing of faulty control data or is released so that it is then available for input memory space of the control unit is occupied with correction control signals from a memory element of the vehicle and / or an external memory element, so that the control data stored in the control unit is at least partially free of abnormal control data, these then partially corrected control data of the correction unit being used to control the usage object The at least partially corrected control data is first fed to a decision module which, based on a deviation determination of the corrected control data from the target control data, decides whether the corrected control data are subjected to another correction by the correction unit, so that a data recursion is carried out.

The invention described here is explained in more detail below with reference to a figure.

The 1 shows an embodiment of a method described here and an embodiment of a device described here on the basis of double data recursion and in particular double dynamic reconfiguration.

From the 1 is therefore a device 1000 for controlling and / or regulating usage objects of a vehicle 10 shown.

The device described here detects a detection module 1 for the acquisition and / or processing of diagnostic data 1A at least one usage object, this acquisition module 1 this diagnostic data is at least partially recorded and / or processed. In addition, the device 1000 detects a correction unit 2 to which this diagnostic data 1A be sent, the correction unit 2 those from the diagnostic data 1A Control signals 1B for activating and / or switching off the usage object.

According to the invention, these control signals 1B , in the case of one from the acquisition module 1 and / or the control unit 2 detected anomaly in the diagnostic and / or control data, that memory location of the control unit 2 which would actually be reserved for the storage and / or processing of faulty control data or is released, so that this memory space of the control unit is then released 2 with correction control signals 10A from a storage element 3 of the vehicle 10 and / or an external storage element 4th is occupied so that the control data stored in the control unit is at least partially free of abnormal control data, these then partially corrected control data of the correction unit 2 can be used to control the usage object. To this extent, a corresponding method 100 is also in FIG 1A shown.

In detail includes the control unit 2 a generating unit 21st which generates corresponding control signals on the basis of the diagnostic data, in particular on the basis of at least partially error-prone diagnostic data, which then a replacement unit 22nd the control unit 2 are fed. The control signals then generated 1B are therefore used by the replacement unit 22nd and initially taken to a control signal execution management center 22A fed in. These control data then fed in are processed via a first data recursion D1 and / or a data link to a control signal management center 22B fed in, which releases the memory space that would be reserved for the faulty parts of the control signals, in a further step then in a feed component unit 22C from an external storage element 3 then correction control signals 10A into the unit 22B be fed in. The location (ROM or RAM) of the replacement unit 22nd is therefore at least partially free of faulty control signals. As a result of the above-mentioned control signal replacement, the memory is therefore only occupied by error-free control signals. This process can be done within the replacement unit 22nd through the first data recursion D1 be carried out until the memory space is actually only occupied by completely error-free control signals.

As soon as the insertion unit 22nd detects a no longer relevant or no deviation from target control values, these are then entered in a decision module 5 fed in. Here you can check the contents of the replacement unit again 22nd performed first data recursions D1 be carried out, in the case of a still existing deviation, which corresponds to a further or narrower setpoint value, can be carried out again, so that a second data recursion D2 arises. Alternatively or additionally, a different type of and / or extended anomaly detection can also be carried out in the recursion.

The invention is not restricted on the basis of the exemplary embodiments, but rather the invention encompasses every feature, every combination of features.

List of reference symbols

1

Acquisition module

2

Control unit

3

Storage element

4th

External storage element

5

Decision module

10

vehicle

21st

Generating unit

22nd

Replacement unit

100

Procedure

1A

Diagnostic data

1B

Control signals

10A

Correction control signals

1000

contraption

D1

First data recursion

D2

Second data recursion

22A

Control signal execution management center

22B

Control signal management center

22C

Infeed component unit

Claims (11)

Method (100) for controlling and / or regulating usage objects of a vehicle (10), wherein - in a first step, at least one acquisition module (1) for acquiring and / or processing diagnostic data (1A) of at least one usage object is put into operation, wherein the acquisition module (1) at least partially records and / or processes these diagnostic data, and - in a further step, these diagnostic data (1A) are forwarded to a control unit (2), which from the diagnostic data (1A) control signals (1B) for control and / or disconnection of the usage object is derived and / or generated, characterized in that by means of these control signals (1B), in the case of an anomaly in the diagnostic and / or control data determined by the detection module (1) and / or the control unit (2), that memory location the control unit (2), which would actually be reserved for the storage and / or processing of faulty control data, or i st is released so that this then released memory space of the control unit (2) is occupied with correction control signals (10A) from a memory element (3) of the vehicle (10) and / or an external memory element (4) so that the control data stored in the control unit at least is partially free of abnormal control data, these then partially corrected control data of the correction unit (2) being used to control the usage object, whereby this incorrect control data is not stored in the storage space actually intended for it in the replacement unit or deleted from this storage space but these are at least partially replaced by corrected control data or diagnostic data generated by the generating unit. Method (100) according to Claim 1 , characterized in that the correction unit (2) has a generating unit (21) for generating the control signals (1B) on the basis of the diagnostic data (1A) and a replacement unit (22) for replacing the control signals with anomalies (faulty control signals) with at least partially faultless ones Has control signals, the two units (21, 22) being in data communication with one another. Method (100) according to Claim 1 or 2 , characterized in that the replacement unit (22) is arranged downstream of the generating unit (21) in the data flow direction. The method (100) according to at least one of the preceding claims, characterized in that the at least partially corrected control data is first fed to a decision module (5) which, based on a deviation determination of the corrected control data from target control data, decides whether the corrected control data should be corrected again by the correction unit (2), so that a data recursion is carried out as a result. The method (100) according to at least one of the preceding claims, characterized in that to carry out the data recursion, the at least partially corrected control data is first fed to the replacement unit (22) and / or the at least partially corrected control data in the data flow direction is first fed back to the generating unit (21) become. The method (100) according to the preceding claim, characterized in that the target control data correspond to at least one target control value and the at least partially corrected control data correspond to at least one actual control value, a deviation value being represented by an arithmetic difference and / or by an arithmetic fraction is calculated by the decision module (5). Method (100) according to the preceding claim, characterized in that the data recursion is carried out if this deviation value is exceeded or not reached. The method (100) according to at least one of the preceding claims, characterized in that the control unit (2) combines the at least partially corrected control data into so-called data blocks or data clusters, which are then classified by the control unit (2) in terms of their shape and / or extent become. Method (100) according to at least one of the preceding claims, characterized in that the usage object is a temperature and / or brightness and / or pressure sensor. Device (1000) for controlling and / or regulating objects in use of a vehicle (10) for carrying out the method according to Claim 1 , comprising at least one acquisition module (1) for acquiring and / or processing diagnostic data (1A) of at least one usage object, the acquisition module (1) at least partially acquiring and / or processing these diagnostic data, and a control unit (2) to which these diagnostic data (1A), the correction unit (2) being set up and provided for deriving and / or generating control signals (1B) for activating and / or switching off the usage object from the diagnostic data (1A), characterized in that by means of these control signals (1B), in the case of an anomaly in the diagnostic and / or control data detected by the detection module (1) and / or the control unit (2), that memory location of the control unit (2) which is actually used for the storage and / or processing of the error-prone control data would be reserved or is released so that this then released storage space of the control unit it (2) is filled with correction control signals (10A) from a memory element (3) of the vehicle (10) and / or an external memory element (4), so that the control data stored in the control unit is at least partially free of abnormal control data, whereby this then partially corrected control data of the control unit (2) are used to control the usage object. Method (100) for controlling and / or regulating usage objects of a vehicle (10), wherein - in a first step, at least one acquisition module (1) for acquiring and / or processing diagnostic data (1A) of at least one usage object is put into operation, wherein the acquisition module (1) at least partially records and / or processes these diagnostic data, and - in a further step, these diagnostic data (1A) are forwarded to a control unit (2), which from the diagnostic data (1A) control signals (1B) for control and / or disconnection of the usage object is derived and / or generated, characterized in that by means of these control signals (1B), in the case of an anomaly in the diagnostic and / or control data determined by the detection module (1) and / or the control unit (2), that memory location the control unit (2), which is actually for the storage and / or Processing error-prone control data would be reserved or is released so that this then released memory space of the control unit (2) is occupied with correction control signals (10A) from a memory element (3) of the vehicle (10) and / or an external memory element (4) so that the The control data stored in the control unit is at least partially free from control data afflicted with anomalies, these then partially corrected control data of the correction unit (2) being used to control the usage object, the at least partially corrected control data being first fed to a decision module (5) which is based on a deviation determination of the corrected control data from target control data decides whether the corrected control data are subjected to another correction by the correction unit (2), so that a data recursion is carried out as a result.

Images