DE102021203531A1 - Method and device for preparing a refueling - Google Patents

Abstract

Method (10) for preparing a refueling, characterized by the following features: - a first participant and a second participant in the refueling transmit an ultra wideband radio signal and - the signal is used at least by the second participant to prepare for the refueling.

Description

The present invention relates to a method for preparing a refueling. The present invention also relates to a corresponding device, a corresponding computer program and a corresponding storage medium.

State of the art

US2013139897A1 provides a system and method for safely filling hydrogen using real-time hydrogen tank expansion data. The system includes an expansion measurement unit, an on-vehicle control unit, a service station-side control unit, and a wireless communication unit. The expansion measuring unit is arranged on a hydrogen tank of the vehicle and measures the degree of expansion of the hydrogen tank and generates an output signal accordingly. The on-board control unit converts the output signal into a wireless output signal. The forecourt control unit stops hydrogen refilling by a hydrogen filling device when the wireless output signal indicates an unsafe level of tank expansion. The wireless communication unit is provided to carry out wireless data communication between the vehicle-side control unit and the gas station-side control unit.

US2020276909A1 , US10800281B2 and US2020346554A1 describe further communication systems and methods for hydrogen refueling and charging of electric vehicles.

In the US20130091042A1 Proposed method and the security system based on it provide security based on geographic location with different levels of access and allow the user to choose units to protect, configure geographic locations, geographic boundaries, permissions and access levels for specific geographic locations and geographic boundaries, security alerts. They make decisions to grant, deny, or assign a specific level of access based on the user's current geographic location and their own configuration for that geographic location or boundary, and send out security alerts.

US2018213376A1 discloses a method for configuring so-called V2X communication.

DE69219579T2 describes a method for automatic transmission power control in a transceiver adapted to a CDMA environment using direct sequence spread spectrum (DSSS).

Disclosure of Invention

The invention provides a method for preparing a refueling, a corresponding device, a corresponding computer program and a corresponding machine-readable storage medium according to the independent claims.

The approach according to the invention is based on the knowledge that the accelerated refueling of hydrogen gas, for example, should take into account the thermodynamics of the refueling process and should therefore regulate the process in a closed manner. For reasons of (functional and general) safety, the maximum temperature and maximum pressure specified for the tank container must not be exceeded at any time.

Known methods for transmitting data from the vehicle to the fuel pump have various disadvantages in this regard. A conventional unidirectional infrared connection from the vehicle to the fuel pump is severely impaired by scratches on the transmitting or receiving optics and by ice formation around the fuel nozzle or nozzle and is therefore affected by failures in practice, which makes accelerated refueling impossible. In addition, such a unidirectional connection does not provide for a return channel from the fuel pump to the vehicle, so that the supported fueling processes cannot be called up and therefore no agreement can be reached on a process that is optimal for the present combination of vehicle and fuel pump.

The proposed method also takes into account the fact that metallic contacts, which are essential for wired communication, should be avoided when refueling with hydrogen, especially in the vicinity of the tank coupling, because any sparks here could ignite the hydrogen gas explosively. Wireless (radio-based) communication is therefore preferable to wired communication to protect the filling station from explosions.

However, due to the unimpeded propagation of the radio waves, the use of radio involves special challenges that are overcome according to the invention. A triggering event is required to activate the overall process. In addition, the radio link must transmit data reliably enough to guarantee the functional and general safety of refueling can be. In particular, third parties who are within radio range of the vehicle or fuel pump should not be able to interfere with or manipulate the process, for example through jamming or overload attacks (denial of service, DoS). Finally, it should be borne in mind that all vehicles and petrol pumps within the radio range, which usually covers an entire petrol station, receive each other's radio signals. The participants that interact during a single refueling operation, i.e. vehicle and fuel pump, must therefore find and identify each other independently.

In summary, the radio connection must be information and operationally secure before refueling. The method described below achieves this goal regardless of the radio technology, filling station infrastructure and hardware used. It is also independent of the technology used for location determination and can be used for refueling any fuel (gaseous or liquid) as well as charging electric vehicles.

A basic idea of the proposed solution is that at least one antenna on the vehicle or fuel pump emits various ultra-broadband radio signals in a targeted manner so that data can be transmitted digitally between the vehicle and fuel pump or the vehicle and associated fuel pump can be mutually located. In the present context, ultra-wideband (UWB) is any intentionally generated radio signal that has a bandwidth of at least 500 MHz or 20% of the arithmetic mean of the lower and upper limit frequencies of the frequency band used.

In principle, communication can take place in both directions, with the respective radio transmitter having a UWB signal generator with one or more (transmitting) antennas and the receiver tuned to it having one or more (receiving) antennas with which it can locate the transmitter. A main advantage of this UWB application lies in the limited range and the possibility of exact localization of the radio signal, which allows it to be clearly assigned to a vehicle and increases protection against interference and eavesdropping.

In this way, IT security and functional security can be increased cost-effectively, since the required components are available on the market in large variety and are already provided in gas stations or vehicles - for example as part of keyless vehicle access systems - so that they can be used in the process without appreciable constructive additional effort can be reused.

Advantageous further developments and improvements of the basic idea specified in the independent claim are possible as a result of the measures listed in the dependent claims. Provision can thus be made for a vehicle to be able to find the gas station or charging station supplying it and identify it unambiguously as well as reliably in terms of operation and information, and vice versa. The ambiguity resulting from a large number of vehicles and fuel pumps present can be resolved in this way and increased functional safety requirements can be met.

Provision can also be made for the participants to use UWB technology for frequency spreading (spread spectrum), as is also used militarily as an electronic protective measure (electronic counter-countermeasure, ECCM). Examples include frequency hopping spread spectrum (FHSS), time hopping spread spectrum (THSS), direct sequence spread (DSSS) or chirp spread spectrum (CSS) of a narrowband output signal.

According to further aspects, it can be provided that the vehicle and the fuel pump mutually authenticate and authorize each other for the fueling process. This in turn enables automated refueling processes and billing. In this way, it can also be ensured that the vehicle and fuel pump are compatible with each other because they meet the functional safety requirements set by both parties and verified by communication.

Finally, it can be provided that the vehicle and fuel pump secure their radio communication - for example by exchanging a cryptographic key - with regard to possible eavesdropping or manipulation attempts and other attacks by third parties, despite a jamming or denial of service attack, continue to communicate with each other in a rudimentary manner and can maintain makeshift system operation or transmit a signal to meet functional safety requirements, e.g. B. a dead man or so-called keepalive signal.

character list

• 1 die Vorbereitung und Initialisierungsphase einer Betankung gemäß einer ersten Ausführungsform.
• 2 schematisch ein Steuergerät gemäß einer zweiten Ausführungsform.

Embodiments of the invention are shown in the drawings and explained in more detail in the following description. It shows:

• 1 the preparation and initialization phase of a refueling according to a first embodiment.
• 2 schematically a control unit according to a second embodiment.

Embodiments of the invention

A refueling scenario at a gas station, where a fuel cell vehicle is to be refueled with gaseous hydrogen, for example, is considered as an example. However, the method is applicable to all types of fuels (gaseous, liquid, cryogenic, etc.) and to charging electric vehicles. In addition, it is irrelevant whether refueling is manual or automatic, whether it is billed or whether it involves a conventional, (partially) automated or autonomous vehicle. It is also possible that a conventional, partially automated or autonomous refueling vehicle drives to the vehicle to be refueled and refuels it. Finally, the method can be combined with any other method of IT security or functional safety.

According to the invention, characteristics of security features, for example the values for pressure and temperature in the tank container, are transmitted via radio technology before, during or after the refueling process. It is conceivable that at least part of this data transmission will have to meet increased requirements for IT security and functional safety.

1 shows the inventive method (10) for preparing such a refueling. In this phase, the start of communication is triggered on both sides--at the gas station and at the vehicle--by coincident or different events (11, 12). On the part of the fuel pump, for example, the removal (11) of the fuel nozzle from its holder, the vehicle driving over a contact or the triggering of a light barrier, on the part of the vehicle, for example, a command input or the opening (12) of the fuel filler cap come into consideration.

In response to this triggering event (11, 12), the fuel pump and the vehicle—the latter preferably after activating an immobilizer (13)—perform a leak test (14) of their own system independently of one another. If the test (14) is passed, the method (10) is continued by releasing (15) a tank valve for refueling. Both systems are then coupled (16) to one another in order to establish an information-secure (17) and operationally reliable (18) connection.

Via the connection set up in this way, the participants exchange information about the services (19) offered in each case and make a suitable selection. This information can include querying a database, which is managed locally by one of the partners or by a remote server via an Internet connection via mobile communications, Ethernet or similar.

Now that they are aware of the refueling service to be provided, the fuel pump and vehicle negotiate a relevant data transmission protocol for the user data of the refueling process (20) and determine which - possibly standardized - thermodynamic refueling protocol and method are to be used. The refueling parameters (21) are then exchanged, in the course of which, for example, the tank container types are checked for compatibility with regard to their material, shape, etc. Finally, according to the refueling parameters, a plan for refueling is drawn up, about which the participants inform each other using the established connection (22).

Steps (11-22) of method (10) are preferably checked for successful execution by self-tests and plausibility checks. If the check is successful, the method (10) is continued with the next step in each case; Otherwise, those involved - the driver, for example, through a display in the vehicle or at the fuel pump, the gas station staff through a monitor display in the gas station monitoring system - are informed about the error so that they can rectify it.

In the course of this method (10), the proposed measures can be used in various steps for out-of-band signaling. For this purpose, a defined signal, onto which the useful signal is modulated, is emitted via a UWB transmitter with an antenna or a plurality of preferably separately controllable antennas or transmission units. A tuned receiver with the appropriate properties picks up the signal on the opposite side, extracts the transmitted information and interprets it.

The modulation can take place, for example, in amplitude, frequency, time and phase shift or a combination thereof on at least one sinusoidal carrier signal. As an alternative or in addition to this, (periodic) signal pulses can be modulated individually in terms of amplitude, period, pulse duration and width, pulse position within a period or a combination thereof. In principle, analog modulation methods can be used; digital modulation methods are nevertheless more expedient.

The localization can e.g. This can be done, for example, by sending special radio signals (Trai ning consequences) emits. The receiver detects the transit time from the transmitter to the receiver, or the difference in transit times between multiple matching pairs, and uses multilateration or angulation to locate the transmitter relative to the receiver. Alternatively, the angles of incidence of the radio wave in the receiver can be determined using the above methods. Knowing the transmission range and the fact that the gas station floor or another solid body that cannot be used as a transmitter is located at a certain distance at a recognized angle, such a localization is practicable.

Both the fuel pump or filling station and the vehicle can act as transmitters or receivers. It is particularly expedient to set up a bidirectional connection, which requires that the vehicle and fuel pump or station each have a transmitting and receiving device.

1. 1) Die Tanksäule kann, solange sie frei ist, periodisch ein Signal senden, dessen Empfang durch das Fahrzeug als auslösendes Ereignis (11, 12) dient. Das Verfahren lässt sich auch mit vertauschten Rollen durchführen.
2. 2) Fahrzeug und Tanksäule tauschen über die UWB-Signale eine gegenseitige Identifikationsnummer (ID) aus, mittels derer sie sich miteinander koppeln (16) und Funksignale an das jeweilige Gegenüber eindeutig identifizieren können. Diese Identifikation kann als sicher betrachtet werden, wenn der Empfänger den Sender lokalisiert und die Kombination aus Einfallswinkel und Entfernung oder absolute Position des Senders für zulässig befindet. Als zulässig ist hierbei zweckmäßigerweise der zur Tanksäule gehörende Tankplatz bzw. der Standort der Tanksäule des vom Fahrzeug belegten Tankplatzes anzusehen. Diese Art der Authentifizierung durch Lokalisierung kann auch in nachfolgenden Schritten verwendet werden.
3. 3) Ist die ID universell eindeutig und vorzugsweise durch die oben beschriebene Authentifizierung bestätigt, so können - z. B. durch eine Datenbankabfrage - weitere Informationen über Fähigkeiten und andere Merkmale von Fahrzeug bzw. Tanksäule abgerufen werden.
4. 4) Wenn bei der UWB-Übertragung ein kryptographisches Merkmal übermittelt wird, z. B. ein öffentlicher Schlüssel eines asymmetrischen Verschlüsselungsverfahrens, so können die Parteien sich anschließend per Funk gegenseitig authentifizieren und zu bestimmten Aktionen autorisieren.
5. 5) Insbesondere kann für den Aufbau einer informationssicheren Funkverbindung (17) ein Sitzungsschlüssel (session key) für ein symmetrisches Kryptosystem vereinbart werden.
6. 6) Zum selben Zweck kann ein Anfangsschlüssel oder ein skalarer Initialisierungswert (seed) oder entsprechender Vektor übertragen werden, aus welchem unter Heranziehung eines weiteren, beiden Seiten bekannten Geheimnisses ein Schlüssel für ein symmetrisches Kryptosystem abgeleitet werden kann.
7. 7) Unter Verwendung eines sogenannten Zero-Knowledge-Protokolls können die Partner sich z. B. durch Abfrage einer weiteren vertrauenswürdigen zentralen Datenbank gegenseitig beweisen, dass sie bestimmte für den Betankungsvorgang notwendige Kenntnisse besitzen, ohne letztere selbst preiszugeben.
8. 8) Unter Verwendung von Zertifikaten, mithilfe derer Information erzeugt und auf dem UWB-Kanal übertragen wird, kann das Gegenüber den Nachweis erbringen, dass es bzw. sein System standardisierte Anforderungen an die Funktionssicherheit erfüllt.
9. 9) Es kann ein herkömmliches Challenge-Response-Verfahren eingeleitet werden, wobei z. B. die Aufforderung (challenge) über den UWB-Übertragungskanal und die Antwort (response) über den herkömmlichen Kanal übertragen wird oder umgekehrt.
10. 10) Es kann ein Keepalive-Mechanismus realisiert werden, indem mindestens eine Seite periodisch Funksignale mit gleicher oder variierender Periodendauer aussendet und die Gegenseite diese Signale jeweils überprüft und bei ihrem Ausbleiben oder Abweichung von einem gegebenen Referenzsignal in einen sicheren Zustand übergeht.
11. 11) Sollte die schmalbandigere konventionelle Funkkommunikation z. B. durch vorsätzliche oder unbeabsichtigte Störsendungen oder Überlastungsangriffe beeinträchtigt sein, so kann mittels der UWB-Signale weiterhin rudimentär kommuniziert werden. Z. B. können das Gegenüber über die Situation informiert und ein Ausweich-Funkkanal abgestimmt oder elementare Angaben zum Betankungsfortschritt übertragen werden, sodass immer noch ein schnelleres Betanken möglich ist als ohne jedwede Kommunikation.
12. 12) Die Identifikation oder weitere Statusinformation über den Ablauf können auf einem Display im Fahrzeug oder auf einer Anzeige an der Tanksäule angezeigt werden.

This method allows the vehicle and gas station to exchange information independently of the primary radio communication. Because of the greater bandwidth, the UWB radio link is less susceptible to interference than the main radio transmission, or is susceptible to other types of interference. However, the channel capacity is usually lower, so it is expedient to limit its use to one or a combination of the following use cases:

1. 1) As long as it is free, the fuel pump can periodically send a signal, the receipt of which by the vehicle serves as the triggering event (11, 12). The method can also be carried out with reversed roles.
2. 2) The vehicle and fuel pump exchange a mutual identification number (ID) via the UWB signals, by means of which they can connect to each other (16) and radio signals can clearly identify the respective counterpart. This identification can be considered reliable if the receiver locates the transmitter and determines that the combination of angle of arrival and distance or absolute position of the transmitter is valid. The fuel station belonging to the fuel pump or the location of the fuel pump at the fuel station occupied by the vehicle is to be regarded as admissible. This type of localization authentication can also be used in subsequent steps.
3. 3) If the ID is universally unique and preferably confirmed by the authentication described above, then - e.g. B. by a database query - more information about capabilities and other characteristics of the vehicle or fuel pump can be retrieved.
4. 4) If a cryptographic feature is transmitted in the UWB transmission, e.g. B. a public key of an asymmetric encryption method, the parties can then authenticate each other by radio and authorize specific actions.
5. 5) In particular, a session key can be agreed for a symmetrical cryptosystem for setting up an information-secure radio connection (17).
6. 6) For the same purpose, an initial key or a scalar initialization value (seed) or a corresponding vector can be transmitted, from which a key for a symmetric cryptosystem can be derived using another secret known to both sides.
7. 7) Using a so-called zero-knowledge protocol, the partners can e.g. B. mutually prove by querying another trustworthy central database that they have certain knowledge necessary for the refueling process, without revealing the latter themselves.
8. 8) By using certificates, with the help of which information is generated and transmitted on the UWB channel, the other party can provide evidence that it or its system meets standardized functional safety requirements.
9. 9) A conventional challenge-response procedure can be initiated, e.g. B. the request (challenge) via the UWB transmission channel and the answer (response) is transmitted via the conventional channel or vice versa.
10. 10) A keepalive mechanism can be implemented in which at least one side periodically transmits radio signals with the same or varying period duration and the other side checks these signals and switches to a safe state if they fail to appear or deviate from a given reference signal.
11. 11) If the more narrow-band conventional radio communication, e.g. B. be affected by intentional or unintentional jamming or overload attacks, can be communicated using the UWB signals continue rudimentary. For example, the person opposite can be informed about the situation and an alternative radio channel can be coordinated or elementary information on the progress of refueling can be transmitted, so that refueling is still faster than without any communication.
12. 12) The identification or other status information about the process can be shown on a display in the vehicle or on a display on the fuel pump.

Additional measures can be implemented in the context of the basic procedure described (10). Because of the short range of a bundled UWB signal, identification and coupling (16) can take place in that each fuel pump directs a corresponding radio beam to the associated fuel station and thereby clearly identifies the vehicle to be fueled at the pump. In addition, the receiver can be equipped with directional or group antennas (antenna arrays) which, in combination with a suitable beamforming (beamforming), only detect the incoming signals under a narrowly limited angle of incidence. A MIMO system is preferably used for this purpose.

Furthermore, vehicles of different types or manufacturers, individual vehicles or antennas can be distinguished on the basis of certain high-frequency characteristics. These features can be stored and used to recognize vehicles when they are refueled and thus speed up the coupling (16). As a so-called physically unclonable function (PUF) of their carrier, they can also be used to identify the communication partner or to derive cryptographic keys.

This method (10) can be implemented, for example, in software or hardware or in a mixed form of software and hardware, for example in a control unit (30), as is shown schematically in FIG 2 clarified.

QUOTES INCLUDED IN DESCRIPTION

This list of documents cited by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent Literature Cited

• US2013139897A1[0002]
• US2020276909A1 [0003]
• US10800281B2 [0003]
• US2020346554A1 [0003]
• US20130091042A1 [0004]
• US2018213376A1[0005]
• DE 69219579 T2 [0006]

Claims (10)

Method (10) for preparing a refueling, characterized by the following features: - a first participant and a second participant of the refueling transmit an ultra wideband radio signal and - the signal is used at least by the second participant to prepare the refueling. Method (10) according to claim 1 , characterized by the following features: - the second participant uses the radio signal to locate the first participant and - after locating, the preparation is initiated. Method (10) according to claim 1 or 2 , characterized in that the participants take one of the following electronic protective measures to transmit the radio signal: - a frequency hopping method, - a time hopping method, - direct sequence spreading or - chirping frequency spreading. Method (10) according to any one of Claims 1 until 3 , characterized by the following features: - the second participant responds to the radio signal with a further radio signal and - the participants couple (16) to one another by means of the radio signals. Method (10) according to claim 4 , characterized by the following features: - in response to an event (11, 12) that triggers the preparation, in particular when a fuel nozzle is removed (11) or a tank flap is opened (12), the participants, preferably after activating an immobilizer (13), subjected to a leakage test (14) and - if the participants pass the test (14), the method (10) is continued, preferably by enabling a tank valve for refueling (15). Method (10) according to claim 4 or 5 , characterized by the following features: - after coupling (16), the participants use the radio signals to set up an information-secure (17) and operationally reliable (18) radio connection and - the participants act, preferably using a database, via the radio connection to provide a refueling service ( 19), a fueling protocol to follow (20) and fueling parameters to consider (21). Method (10) according to claim 6 , characterized by the following features: - according to the refueling parameters, a plan (22) for refueling is taken and - the participants inform each other about the plan (22) by means of the radio link. Computer program which is set up, the method (10) according to one of Claims 1 until 7 to execute. Machine-readable storage medium on which the computer program claim 8 is saved. Device (30) which is set up, the method (10) according to one of Claims 1 until 7 to execute.

Images