EP3174015A1 - Detecting faults in an on board vehicle unit of a toll system - Google Patents

Abstract

In order to detect faulty state variables of a vehicle toll device that is used for toll collection, it is proposed to store input data from which the in-vehicle device output data in the form of a value of the state variables in an event log and the output data in a status protocol, then using a set of rules based on input data to be tested to search in the status log for expected and / or prohibited output data or to search for output data to be checked by means of a set of rules in the event log for expected and / or prohibited input data, an error message being output if one or the other searches for expected data is unsuccessful and / or one or the other search for prohibited data is successful.

Description

The invention relates to a toll system, a vehicle device and a method for detecting errors in a vehicle-carried vehicle device of a toll system according to the preambles of the independent claims.

In-vehicle equipment used for toll collection and carried in a vehicle; are accordingly adapted to detect position data of positions of the vehicle and to process the position data and / or data derived from the position data for the purpose of collecting a vehicle-related toll fee in accordance with a plurality of state variables of the vehicle device Vehicle is to be raised, which is identifiable on the basis of the detected position data.
In this case, either the vehicle device itself depending on a plurality of state variables of the vehicle device by collecting at least one used by the vehicle toll road surface based on the position data and / or from the position data derived data levy a vehicle related toll for the use of the identified traffic area by the vehicle or a central data processing device of the toll system which has received from the vehicle device the position data and / or data derived from the position data as a result of processing the position data and / or data derived from the position data based on the detected position data and / or data derived from the position data levy a vehicle-related toll for the use of the identified traffic area by the vehicle.

The state variables of the vehicle device are such that they influence the processing of the position data or the data derived from the position data-for example, enable or prevent it-in the sense that the result of the processing depends on the state variables. For example, a state variable may be a registered identifier of the vehicle device or the vehicle needed to obtain an allocation of a toll to the vehicle using the toll road surface. Another state variable may be a registered operational readiness state of the vehicle device for which, in the event of a lack of operational readiness, a dedicated processing of the position data or data derived from the position data is prevented.
In-vehicle toll collection systems typically have a variety of state variables that affect toll collection. The values of these state variables are stored in a memory of the vehicle device in the form of output data generated in response to received or generated input data. For example, input data of the vehicle device can be supplied via an interface or generated by the vehicle device itself.
When commissioning the vehicle device output data are generated on this by the receipt of input data that allow operation of the vehicle device in terms of their purpose. Also during operation of the vehicle device, the vehicle device can receive input data whose processing then results in a change of the output data, with the result that a changed value of the affected state variables is stored in the vehicle device. In addition, the vehicle device in operation itself Generate input data, the processing then also has a change of the output data with the result that a changed value of the state variables concerned is stored in the vehicle device.

For example, a particular value of a state variable may result in a toll being no longer levied or being levied incorrectly or being allocated to the correct vehicle. Such a certain value can be correct. Due to the complex processing of input data, under unforeseen circumstances that can not be remedied, such a particular value may not be correct. Thus, changing a value of a state variable without the prerequisites necessary for it - as well as maintaining a value of a state variable which has become invalid due to changed boundary conditions or input data - has an unjustified influence on the toll collection - in other words an error. In the interest of both the toll operator and the user, it must be determined in such a case that there is a mistake and, if so, in whose area of responsibility he falls. Thus, an error may be due to the vehicle equipment of the toll operator or the lack of cooperation of the user.

The present invention has set itself the task of detecting such erroneous values of a state variable of a vehicle device of a toll system.

This object is solved by the independent claims. Advantageous developments are the subject of the dependent claims. Features of further development of independently claimed products and processes shall be considered interchangeable with each other and interchangeable as far as technically possible.

In summary, the invention provides for the detection of erroneous state variables of a tolling vehicle device, input data from which the vehicle device output data in the form of a value of the state variables are generated in an event log and store the output data in a status protocol to then starting from to be tested To search input data by means of a set of rules in the status log for expected and / or prohibited output data, or to search for expected and / or prohibited input data by means of a set of rules in the event log by means of a set of rules, wherein an error message is output if the one or the other search for expected data is unsuccessful and / or one or the other search for forbidden data is successful.

According to one aspect of the invention, a toll collection system is provided, which comprises at least one vehicle device carried by a vehicle, which is configured to (a) detect position data of positions of the vehicle, (b) position data and / or in dependence on a plurality of state variables of the vehicle device to derive data derived from the position data for the purpose of collecting a toll related to the vehicle to be levied for the use of a traffic area by the vehicle identifiable from the acquired position data; (c) receiving or generating input data; d) generating output data, each representing a value of a state variable of the vehicle device, in dependence on the received or generated input data, and characterized in that the vehicle device is configured, (e) status information generated respectively associated with a status time value Output data includes entering in a status log stored in the vehicle device (f) event messages that include received or generated input data associated with an event time value respectively, in an event log stored in the vehicle instrument, and the toll system is configured to (g) determine from at least one rule stored in the toll system whether i) at least one event log of the event log to be tested in the status protocol in accordance with at least one set of rules stored in the toll system and / or prohibited output data are contained in at least one status information whose status time value within at least a predetermined time range is the event time value of the event message to be checked, and / or ii) at least one verzustenden status information of the status protocol in the event log according to at least one stored in the toll system rules are expected and / or prohibited input data contained in at least one event message whose event (h) in the determination of a lack of expected according to the at least one set of output data and / or expected input data and / or upon detection of a presence of in accordance with the at least one predetermined time range to the status time value of the status information to be checked at least one set of prohibited output data and / or prohibited input data to generate an error message.

The feature (g) i) corresponds to a protocol check according to the invention with the search for one or more results in the form of output data in the status protocol to be expected (ie expected) by one or more triggers in the form of the input data to be checked in the event log according to the rules. and / or not expected (ie prohibited), and is referred to as "forward search".
The feature (g) ii) corresponds to a protocol check according to the invention for one or more triggers in the form of input data in the event log, which condition one or more results to be tested according to the set of rules in the form of the output data to be checked in the status protocol according to the control scheme expected to be present in the initial data to be tested) or not (and thus prohibited if the initial data to be checked are available), and is referred to as "backward search".
Expected input or output data can be both required input or output data of a single event message or status information that is required by the policy, as well as allowed input or output data of multiple event messages or status information, of which input or output data is at least one event message or status message required input or output data. The feature (d) describes the desired state of the vehicle device according to the invention.
The feature (h) describes with the result that can result from the forward and / or reverse search, the reportable incorrect actual state of the vehicle device according to the invention.

The formulation of a given time range (in short: time range) around the respective time value of the event message or status information to be checked does not necessarily mean that the respective time value of the event message or status information to be checked must be contained in the predetermined time range (this condition applies only to the Time value of the status information (s) or event message (s) to be searched for in the exam). It may be the respective time value of the event message or status information to be checked outside the predetermined time range, then in the definition of the predetermined time range, the limits of the time range with two relative time intervals are defined with negative sign, if the predetermined time range entirely before each Time value of the event message or status information to be checked, and with two relative time intervals each with a positive sign, if the predetermined time range entirely after the respective time value of the event message or status information to be checked. In the event that the respective time value of the event message or status information to be checked forms a limit, so that a relative distance is equal to zero, it is sufficient to specify a single time interval for the respective time value of the event message to be checked or status information for defining the time range.
In particular, the time ranges for the search for prohibited input or output data may be different from the time ranges for the searches for expected input or output data. For example, the time range for the search for prohibited input or output data may be arranged temporally according to the respective time value of the status information or event message to be checked, because on the basis of event messages or status information to be checked, certain subsequent event messages or status information should not occur, and the time range for the Search for expected input or output data to be arranged in time before the respective time value of the status information or event message to be checked, because the existence of the status information or event messages to be checked presupposes the presence of specific input or output data of preceding event messages or status information. Conversely, however, the time range for the search for prohibited input or output data can also be arranged before the respective time value of the status information or event message to be checked, because on the basis of event messages or status information to be checked, certain preceding event messages or status information must not occur, their forbidden input data being different Output data than the status information to be checked or their prohibited output data would have generated input data other than that of the event message to be checked. Likewise, the time range for the search nach.zu expected input or output data can be arranged in time to the respective time value of the status information or event message to be checked, because on the basis of checking event messages or status information specific subsequent event messages or status information should occur.
The temporal readjustment or preposition of the time range does not rule out that the respective time value of the status information or event message to be checked forms a lower or upper limit of the relevant time range.

In particular, the toll system may be configured to determine (i) at least one event message of the event log to be tested in the status log in accordance with at least one set of rules stored and / or prohibited in the toll system at least one status information is included whose status time value is within a predetermined time interval according to the event time value of the event message to be tested and / or ii) expected at least one to be tested status information of the status log in the event log according to at least one stored in the toll system rules and / or forbidden input data are contained in at least one event message whose event time value lies within a predetermined time interval before the status time value of the status information to be checked, and (h) in the determination of a In the absence of output data to be expected in accordance with the at least one set of rules and / or expected input data and / or upon detection of the presence of output data and / or prohibited input data prohibited according to the at least one set of rules.

This makes it possible, as part of a backward search, to check whether the value of a specific state variable represented by output data was generated correctly from expected input data, was generated incorrectly from unexpected input data or no input data, or not at all due to prohibited input data should have been generated. It also becomes possible to check in a forward search whether input data has been processed correctly or not to expected output data representing the value of a certain state variable.
With the rules of the invention, a monitoring tool is provided, which verifies the intended execution of the vehicle device. Deviations from the intended design, which depend on unforeseen influences, can thus be identified as faults in the toll system, in particular the vehicle equipment. In this case, it is proven that the user is not to blame when identifying combinations of input and output data that conflict with each other because, for example, they are not in any context with each other.

The set of rules preferably comprises a database in which input data of one or more event messages are linked to output data of one or more status information, the output data to be expected being the output data associated with the input data of one or more event messages to be checked and the output data to be searched for input data to be tested for one or more status information associated input data are expected input data.
Such a database provides the combinations of compatible input and output data.
Preferably, in the same or another database of the set of rules, input data of one or more event messages are linked to output data of one or more status information, with the output data associated with the input data of one or more event messages being prohibited being output data for a forward search and the output data for a backward search examining output data of one or more status information associated input data is prohibited input data.
Such a database provides the combinations of incompatible input and output data.

Preferably, the duration of said time range or said time interval is one hour or less than one hour. More preferably, the duration of said time range or said time interval is less than one minute. The duration of the said time range or the said time interval may depend on the status information to be checked or the event message (s) to be checked. The duration of the said time range or said time interval may also depend on a status time value of status information other than that of the status information to be checked or, in addition to the status time value of the status information to be checked, also on the status time value of status information other than that of the status information to be checked.

The toll system can be configured to select a first status information from the status protocol and a second status information entered immediately below into the status protocol with regard to one and the same status variable, first output data of the first status information and second output data of the second To check status information for a change in the value of the state variables, to determine whether in the event log according to at least one rule stored in the toll system expected input data of at least one event message are included, the processing according to the processing instructions would trigger a corresponding change in the value of the state variables and their Event time value between the first status time value of the first status information and the second status time value of the second status information is and to generate the error message when determining that no expected according to the rule input data in the event log.
In this form of the backward search, it is determined whether the input data relevant for a specific change of the value of a state variable from a first value to a second value are present.

The vehicle device can be designed to generate output data from input data at predetermined time intervals or upon receipt of a corresponding instruction and to write these and / or output data already generated previously into a status protocol. This status protocol may already have been stored in the in-vehicle device before the write clock, so that status information written in the status protocol may be added to the state information already existing in the status protocol or replace it with respect to the same state variable. In the latter case, previous values of state variables are lost in the status log. Nevertheless, a comparison in the sense of the previously described backward search remains possible if first a first status protocol written with a first status information for each state variable by the vehicle device by means of a mobile communications device included in the vehicle device to an outside - in particular off Vehicle arranged central data processing device is sent and later transmitted a second time written second status protocol with each second status information to one state variable by the vehicle device by means of the covered by the vehicle device mobile communication device to the central data processing device, which is a possible override of the first status protocol prevented by the second. Alternatively, the vehicle device may be configured to simultaneously store a plurality of status logs generated at different times with respect to the same state variables.
In both cases, the toll system may be configured to select a first status information from a first status protocol written at a first time and a second status information regarding a same status variable as the first status information from a second status protocol written at a second time, first output data of the first Status information and second output data of the second status information on a change in the value of the state variables to determine whether to include in the event log according to at least one rule stored in the toll system expected input data of at least one event message, the processing according to the processing instructions a corresponding change of the value would trigger the state variable and its event time value between the first status time value of the first status information and the second status time value of the second status information is on and on the determination that no expected according to the rules input data in the event log to generate the error message.

The toll system may also be configured to select from the event log input data of a first event message and input data of a second event message, to determine whether in the status protocol according to at least an output data to be expected in the toll system of at least one status information that would result from the consecutive processing of the input data of the first event message and the input data of the second event message by the vehicle device and whose status time value lies within a predetermined time interval after the event time value of the second event message , and in the determination that no according to the rule-expected output data are included in the event log to generate the error message.
In this form of the forward search, it is determined whether, for a particular event pair, the output data expected from the processing of its input data is in status information of the status protocol.
A corresponding backward search for the input data of two event messages is possible analogously starting from a status information item to be checked.

The toll system can also be configured to select input data of an event message to be checked from the event log, to determine whether the output data of at least one first status information and expected output data of at least one second status information are to be expected in the status protocol according to at least one rule stored in the toll system would result from the consecutive processing of the input data of the event message to be checked by the vehicle device and whose status time value is within a given time interval after the event time value of the second event message to be checked, and on the determination that no expected according to the rules output data in the event log are included to generate the error message.
In this form of forward search, it is determined whether expected output data of a plurality of status information resulting from the processing of its input data is present in the status protocol for a specific event.
A corresponding backward search for the input data of an event message is possible analogously on the basis of several status information to be checked.

In particular, the toll system is designed to raise a vehicle-related toll for the use of the identified traffic area by the vehicle based on the plurality of state variables of the vehicle device by identifying at least one toll road used by the vehicle on the basis of the detected position data.
The toll system preferably comprises a central data processing device arranged outside the vehicle, and the vehicle device comprises a wireless communication device at least for sending data to the central data processing device.
In particular, the central data processing device is arranged away from the vehicle.
Thus, the vehicle device can send position data to the central data processing device, which can be configured to receive the position data and identify at least one used by the vehicle toll road surface based on the detected position data on the vehicle related toll for the use of the identified traffic area by the vehicle to raise.
Alternatively or optionally, the vehicle device may derive data derived from the position data, for example that of an identifier of a traffic area identified by the vehicle device or of a vehicle toll that the vehicle device detects by identifying at least one toll road used by the vehicle Position data has determined - to the central Send data processing device. In the case of a transmission of an identifier of an identified traffic areas, the central data processing device determines a toll charge from the identifier of the identified traffic area. The toll charge received by the central data processing device or alternatively / optionally determined is allocated by the central data processing to a user account, with respect to which the central data processing sends a request for debiting the toll fee and booking to an account of the toll operator to an account management data processing device.

The vehicle device preferably sends an identifier of the vehicle device, of the vehicle or of the user together with the position data and / or the data derived from the position data to the central data processing device. The identifier of the vehicle device or of the vehicle is used by the central data processing device to refer the raised toll charge to the vehicle from which the position data originate, in order to charge the user with a toll that actually traveled the identified traffic area. For this purpose, the identifier of the vehicle device, of the vehicle or of the user in association with the account data of the user is stored in the central data processing device. On the basis of the received from the vehicle device identifier of the vehicle device, the vehicle or the user the Fahrzeugzeugrichtseitig with the position data, the identifier of the identified traffic area and / or the toll fee was sent, the central data processing device, the position data, the identifier of the identified traffic area and / or allocate the toll fee to the user account.
The identifier of the vehicle device, of the vehicle or of the user is a possible state variable of the vehicle device. In the context of the invention, in this case, the position data processing process with which the vehicle device processes the position data and / or data derived from the position data for the purpose of collecting a toll related to the vehicle, which is to be levied for the use of a traffic area by the vehicle, which is identifiable on the basis of the detected position data, insofar as a function of the identifier of the vehicle device, the vehicle or the user, as the position data processing, the linkage of the position data and / or derived from the position data with the identification of the vehicle device, the vehicle or the User includes.

Preferably, the vehicle device is designed, only for a given operational readiness of the vehicle device, the position data and / or derived from the position data for the purpose of collecting a related to the vehicle toll, which is to be raised for the use of a traffic area by the vehicle, based on the detected Position data is identifiable to process a position data processing process.
For this purpose, a value of an operational readiness state-which, incidentally, forms a state variable of the vehicle device-is stored in the vehicle direction, which may correspond to one of at least two values of a given and a lack of operational readiness. The vehicle device is designed to monitor its operational readiness state and, as a result of a change in the value of the operational readiness state from "given" to "insufficient," to set the position data processing process, ie no longer to perform any further detection of position data. Consequently, the vehicle device can be configured alternatively or optionally, only to detect the position data of positions of the vehicle given the operational readiness of the vehicle device, which implies that in the case of a lack of operational readiness then the position data processing process also fails.

Preferably, the toll system according to the invention is characterized in that a first state variable of the vehicle device is a registered identifier of the vehicle device, the vehicle or a user of the vehicle and a second state variable of the vehicle device is a registered operational readiness state of the vehicle device.
In this case, the vehicle device is preferably designed to process the position data and / or data derived from the position data for the purpose of collecting a toll related to the vehicle, depending on at least the identifier of the vehicle device, the vehicle or the user and the registered operational readiness state to be collected by the vehicle for the use of a traffic area identifiable on the basis of the recorded position data,
In this case, the toll system preferably comprises a central data processing device arranged outside the vehicle and the vehicle device comprises a wireless communication device in the form of a mobile radio communication device at least for sending position data and / or data derived from the position data together with the identification of the vehicle device of the vehicle or the user to the central data processing device. In this case, the vehicle device is designed, as part of the position data processing process of processing the position data and / or the data derived from the position data for the purpose of collecting a toll related to the vehicle, the position data and / or the data derived from the position data together with the identifier of the vehicle device , the vehicle or the user to send by means of the mobile communication device to the central data processing device.
In this case, the central data processing device is preferably designed to link the received data derived from the position data and / or data derived from the received position data, for example a toll, to an account of a user that is linked to the identifier of the vehicle device of the vehicle or the user is stored in the central data processing device.

An example of an identifier of the vehicle device is a serial number of the vehicle device. Another example of an identification of the in-vehicle device is the mobile radio (call) number (eg MSISDN, "Mobile Subscriber Integrated Services Digital Network Number") of the mobile radio communication device of the vehicle device An example of an identification of the vehicle is the vehicle license plate front and reverse side of the vehicle attached license plate (colloquially "number plate"). Another example of an identification of the vehicle is the vehicle identification number (colloquially: "VIN") of the vehicle's registration certificate. An example of an identifier of the user is a user identifier assigned by the toll operator or selected by the user himself, which can consist of a user name and a password.

Further state variables of the vehicle device may be: a registered vehicle class of the vehicle, a registered determination of the use or non-use of a tollable traffic area by the vehicle, a registered toll or toll collection allowance of the vehicle, a registered availability state of a particular service of the vehicle device.

Examples of the vehicle class are a weight class, a length class, an axle class and a pollutant class. The amount of the toll fee as data derived from the position data in this case depends on the vehicle class or possibly on several different types of vehicle classes. In this respect, the vehicle class is also a state variable of the vehicle device according to the invention, because the position data processing process, regardless of whether the vehicle device determines the toll amount (first case) or the central data processing device, the amount of the toll from the transmitted from the vehicle device position data or derived from the position data determined (second case), is dependent on the value of the vehicle class, which is sent in the second case together with the position data or derived from the position data from the vehicle device in the position data processing to the central data processing device.

The registered determination of the use or disuse of a toll road surface by the vehicle may affect the way the position data and / or data derived from the position data are processed by the vehicle device, so that the result of the position data processing is dependent on whether the vehicle is on a toll road or not.

It depends on the registered toll or toll-exempt status, whether the vehicle equipment must perform the position data processing at all. Because if the vehicle has been declared toll-free in the vehicle equipment, toll collection by the vehicle equipment must be ruled out.

From a registered availability state of a particular service of the vehicle device may depend, for example, if and when, when the vehicle device sends position data or data derived from position data to a central data processing device and / or optionally to which of several central data processing devices. Thus, for example, when the service "Anonymous position data provision" is available, the vehicle device can be designed to send the acquired position data to a central data processing device of an anonymization service instead of to a central data processing device of the toll operator, which forwards the position data with its own identifier to the central data processing device of the toll operator which, from the point of view of the central data processing device, does not allow any conclusions to be drawn about the vehicle device from which they originate. After determining the toll fee from the position data, the central data processing device of the toll operator receives the identifier of the vehicle device, the vehicle or the user from the central data processing of the anonymization service. If the service "Anonymous position data provision" is not available, then the vehicle device sends the position data directly to the central data processing device of the toll operator.

Another possible state variable is the identifier of the toll road surface, the use of which was determined by the vehicle based on the position data by the vehicle device. The position data or data derived from the position data in an intermediate step in the process for determining the toll area used for tolling forms the input data according to the invention in this case.

The toll system according to the invention preferably has at least one central data processing device arranged outside the vehicle, and the vehicle device comprises at least one mobile radio communication device for sending and / or receiving data to and / or from the central data processing device, at least one position determining device being configured. Receive, process and generate position data from a global navigation satellite system, at least one travel sensor for detecting traveled distances, at least one acceleration or yaw rate sensor for detecting changes of direction of the vehicle, at least one data memory in which software of the vehicle device is stored , at least one main memory in which software is loaded for use by the vehicle device, at least one data memory in which at least one time value d the validity of software to be used by the vehicle device is stored, at least one data memory in which at least temporary position data, data of identified traffic areas and / or data from toll collection is stored, at least one data memory in which a vehicle registration number of the vehicle is stored, at least one data memory in which a vehicle class of the vehicle is stored, at least one processor configured to generate the output data by the processing of the input data, at least one timer and at least one charge storage element for at least temporary power supply of at least one processor of the vehicle device the input data represents one or more of the following events: (i) failure to receive signals from a global navigation satellite system at the position determining device; (ii) the absence of the generation of position data from signals of a global navigation satellite system by the position-determining device; (iii) the undershooting of a minimum quality of quality of at least one signal of a global navigation satellite system and / or at least one position determined by the position-determining device; (iv) failure to receive signals at the interface for receiving signals from a transmitter; (v) the mismatch of travel angles determined from global navigation satellite system signals and travel direction angles detected by the accelerometer / yaw rate sensor; (vi) loading software for processing position data and / or data derived from the position data from the data memory to the working memory fails; (vii) exceeding the time value of the expiry of the validity of the software; (viii) the absence of a timing signal from the timer; (ix) the charge state of the charge storage element falls below a predetermined limit, (x) the failure to receive signals from base stations of a mobile network at the mobile communication device; (xi) exceeding a certain amount of toll collection that could not be communicated by the cellular communication device to a central data processing device of the toll collection system; (xii) receiving an instruction to disable a service of the vehicle device via the cellular communication device; (xiii) receiving an instruction to change the vehicle registration of the vehicle; (xiv) receiving an instruction to change the vehicle class of the vehicle; (xv) performing a self-test of the vehicle device; (xvi) receiving an activation or deactivation of a service of the vehicle device; (xvii) to receive an instruction to change the facts regarding a toll or a toll-free vehicle.
Each of these events, individually or in conjunction with other events, may cause a change in a value of a state variable due to the execution of instructions for processing stored therein in the in-vehicle device.

Thus, each individual one of the events (i) to (v) or a certain combination of these events can trigger a change in the operational readiness of the vehicle device from "ready for operation" to "not ready" after a period of occurrence of one or more of these events.
The same applies to the events (vi) to (xi).
However, there are also other differentiations in terms of the operational readiness state of the vehicle device possible. Thus, in the case of a first occurrence or a lack of generating position data from signals of a global navigation satellite system by the position determination device lasting for a short period of time, for example 10 seconds, the value of the operational readiness can change from "ready for operation" to "restricted ready for operation". Only when the provision of position data from signals of a global navigation satellite system by the position determining device for a longer period of, for example, 1 minute fails, the value of the operational readiness of "restricted ready" to "not ready". If position data from signals of a global navigation satellite system are provided by the position determination device again before the expiration of the longer time period of 1 minute, then the value of the operational readiness can change from restricted ready for operation "back to" ready for operation ".
The consequences of the occurrence of events (xii) to (xvii) are self-explanatory in view of the preceding explanations. In events (xii) to (xvii), it should be noted that these events each form only one of several consecutive events that combine to produce the results that are intended by them. Thus, the event of receiving an instruction to change the vehicle registration number can trigger a chain of several successive events (password query, password input, authentication, sending a request to the central data processing device, the encryption of this request, etc.), which finally leads to the entry of the changed vehicle license plate into the status log.
With regard to exceeding a certain amount of toll collection that could not be communicated by the first communication device to a central data processing device of the toll system, examples of the amount of toll collection (for example, the number of recognized traffic areas used) or a toll amount are used calculated for traffic areas used consecutively.
Suffice a single data store to store said data; However, it is preferably a plurality of data memories: a first data memory for storing the software for processing position data and / or data derived from the position data, a second data memory for temporary storage of the position data and at least a third data memory for storing the time value of the sequence of Validity of the software used to process position data and / or position data, data of identified traffic areas and / or toll collection, vehicle registration data, and vehicle class data.

In one embodiment of the decentralized error check, the toll system is preferably characterized by performing at least steps g) and h) based on at least one set of rules stored in the vehicle device and storing the possibly generated error message in the vehicle device and / or by means of a mobile radio device included in the vehicle device. To send communication device to a arranged outside the vehicle central data processing device of the toll system.

Preferably, the vehicle device of such a toll system according to the invention is further developed with decentralized error checking, event-dependent, time-dependent, location-dependent and / or random to carry out a self-test, in which the vehicle device for at least one to be examined event message of the event log steps g) i) and h) performed the event of execution of the self-test is stored as input data together with the time value of the execution of the self-test as an event message in the event log and wherein the at least one event message to be tested is defined as having an event time value delayed from the time value of the most recent self-test.
So that we can create a toll system in which a vehicle device, for example, every time you turn the vehicle device; at each re-powering of the vehicle device, at each completed hour of operation of the vehicle device, each time a contiguous road network of toll sections is re-entered, each time a 100-kilometer path is covered, and / or at random during operation of the vehicle device for a selection .an or all event messages newly registered in the event log since the last self-test have been performed, to check whether they have associated expected status information in the status log.

Preferably, the vehicle device of such a toll system according to the invention with decentralized error checking a mobile communication device for wireless transmission of the status protocol via at least one mobile network to at least one arranged outside the vehicle central data processing device of the toll system and is configured, the status protocol by means of the mobile communication device to the central Data processing device to send, from the central data processing device by means of the mobile communication device to receive an instruction to perform step g) ii) with respect to at least one defined by the central data processing device to be checked status information, the step g) ii) with respect to the defined by the central data processing device perform at least one status information to be checked and h) upon detection of a defect in accordance with the w At least one set of rules to be expected input data and / or in the determination of the presence of prohibited according to the at least one set of input data to generate at least one error message and to send this error message by means of the mobile communication device to the central data processing device.
In this case, in particular, the central data processing device is designed to receive the status protocol, to determine the status information to be checked on the basis of predetermined criteria, and to send a test request with respect to the status information to be checked to the vehicle device.

In one embodiment of the central error check, the toll system is preferably characterized in that the toll system comprises at least one central data processing device arranged outside the vehicle, the vehicle device has at least one vehicle-side communication device for wireless transmission of the event log to the central data processing device and at least one vehicle-side communication device for wireless transmission at least one status information of the status protocol to the central data processing device and is configured to send the event log and at least one status information of the status protocol to the central data processing device, wherein the central data processing device is formed, the event log sent by the vehicle device and the the vehicle device sent at least receive status information and perform at least steps g) and h) based on at least one stored in the central data processing device rules. Sends the vehicle device - because it is designed accordingly - only one status information, so this status information is to be tested according to the invention status information. Sends the vehicle device because it is designed accordingly - an extract of the status protocol, which includes a plurality of status information, or the entire, several status information comprehensive, status protocol, so.ist the central data processing system is formed to determine the status information from the status information of the several status information or the extract thereof which is the status information to be checked according to the invention.

Such a toll system with central error checking preferably comprises at least one DSRC communication device coupled to the central data processing device for receiving the at least one status information of the status protocol from the vehicle device, while the vehicle device is a first vehicle-side communication device in the form of a wireless communication device for wireless Sending the event log to the central data processing device via at least one mobile radio network and a second vehicle-side communication device in the form of a vehicle-side DSRC communication device for wireless transmission of at least one status information of the status protocol to the DSRC roadside communication device and is adapted to the event protocol by means of the mobile communication device via at least one mobile network to the central Datenver to send processing device and to send at least one status information of the status protocol by means of the vehicle-side DSRC communication device to the roadside DSRC communication device of the toll system.
In this case, the roadside DSRC communication device or a roadside control device comprising the DSRC roadside communication device may be configured to send the status information received from the vehicle device to the central data processing device - either on its own initiative or on the basis of a request from the central data processing device for status information that have been received by the DSRC communication device since the last shipment.
When the vehicle device sends an extract of the status protocol that includes a plurality of status information or the entire status protocol including multiple status information, the DSRC roadside device or a roadside controller including the DSRC roadside communication device may be formed of the plurality of status information the status protocol or the statement thereof to determine that status information which is the status information to be checked according to the invention, and to send the specific status information to be checked to the central data processing device. Alternatively, the DSRC roadside communications device or a roadside controller including the DSRC roadside communications device may be configured to send the complete received state log digest or complete status log to the central data processing device.

The toll system according to the invention provides a particular advantage in the case of a check in which reference data is compared with output data of a status information received from the vehicle device for conformity by means of a roadside control device. Depending on the outcome of this comparison then there is one Causing a control-based protocol check, in which the central data processing device in a central audit or by the vehicle device in a decentralized check the status information is checked by the event log to determine whether unexpected output data on a fault of the vehicle device (ie the toll system ) or due to a mistake of the user.

For example, in the case of a centralized check, the toll inspection system according to the invention for this purpose comprises at least one central data processing device arranged outside the vehicle and at least one roadside control device with at least one DSRC roadside communication device for receiving at least one status information of the status protocol from the vehicle device, wherein the vehicle device has a first communication device in the form of a mobile radio communication device for wireless transmission of the event log to the central data processing device via at least one mobile network and a second communication device in the form of a vehicle-side DSRC communication device for wireless transmission of at least one status information of the status protocol to the roadside DSRC communication device and trained is the event log by means of d he mobile communication device to send at least one mobile network to the central data processing device and to send at least one status information of the status protocol by means of the vehicle-side DSRC communication device to the roadside DSRC communication device of the toll system, the roadside control device is adapted to at least one status information of the status of the protocol Receive vehicle device by means of the DSRC roadside communication device to compare output data of the at least one status information of status protocol with reference data to match, and depending on the result of the comparison, a problem message about the lack or given match of the output data with the reference data to the central data processing device to send, and the central data processing device is formed, the problem message about the lack of de or given match of the relevant output data with the reference data together with the relevant status information from the roadside control device and send an event log request message via at least one mobile network to the vehicle device for requesting the event log, the vehicle device is further configured, the event log request message receive in response to the event log request message the event log by means of the cellular communication device via the mobile network to the central data processing device, and the central data processing device is further configured to determine on the basis of the rules, whether in the event log an event message with expected input data is included, their processing by the vehicle device according to the rules it should generate the relevant status information with the relevant output data, and / or an event message with prohibited input data, the processing of which by the vehicle device according to the rules should not generate the relevant status information with the relevant output data, in the determination of a deficiency according to the To generate at least one toll system error message in the event log and / or detecting the presence of prohibited input data according to the rules in the event log, and / or detecting an occurrence of input data expected under the rules in the event log and / or detection a lack of input data prohibited according to the rules in the event log to generate a user error message.
When the in-vehicle device sends out the status protocol comprising a plurality of status information or an extract of the status protocol comprising a plurality of status information, the DSRC roadside communications device may be configured to receive the status protocol or the status report extract with a plurality of status information Control device is formed in this case, from the status protocol to gain the status information with the output data, with which the reference data are to be compared.

In the case of a decentralized test, the control-based toll inspection system according to the invention comprises, for example, at least one central data processing device located outside the vehicle and at least one roadside controller with at least one DSRC roadside communication device for receiving at least one status information of the status protocol, the vehicle device having a first communication device a mobile radio communication device for wireless transmission of the event log to the central data processing device via at least one mobile network and a second communication device in the form of a vehicle-side DSRC communication device for wireless transmission of at least one status information of the status protocol to the DSRC roadside communication device and is configured, the event log by means of the Mobilfunk-Kommunikationsvorr sending at least one status information of the status protocol to the road-side DSRC communication device of the toll system by means of the DSRC on-board communication device, wherein the roadside control device is configured to generate at least status information of the status protocol from the in-vehicle DSRC system. Communications device to receive, compare output data of the at least one status information of the status protocol with reference data to match, and depending on the result of the comparison to send a problem message about the lack or given match of the output data with the reference data to the central data processing device, and the central Data processing device is formed, the problem message about the lack or given match of the respective Ausgangsd aten with the reference data together with the relevant status information from the roadside control device to receive and send an audit instruction message via at least one mobile network to the vehicle device for checking the event log regarding the status information in question, the vehicle device is also configured to the Prüfungsanweisungsnachricht means of the mobile communication device receive, in response to the Prüfungsanweisungsnachricht based on the rules to determine whether the event log an event message with expected input data is included, the processing by the vehicle device according to the rules should generate the relevant status information with the relevant output data, and / or an event message with contains prohibited input data, the processing of which by the vehicle device according to the rules does not the status information in question should generate at least a Tautsystemfehlermeldung message by means of the mobile communication device to the central data processing device in the determination of a lack of expected according to the rules in the event log input data and / or the presence of banned according to the rules in the event log input data send and in the determination of a Existence of input data expected according to the rules in the event log and / or detection of a lack of input data prohibited according to the rules in the event log, to send a user error message to the central data processing device via the cellular communication device. When the in-vehicle device, as appropriately configured, sends the status log comprising a plurality of status information or an extract of the status log comprising a plurality of status information, the DSRC roadside communications device may be configured to receive the status log or the status report digest with a plurality of status information Roadside control device is formed in this case to obtain from the status protocol, the status information with the output data, with which the reference data are to be compared.

With the control-related protocol check according to the invention, if the output data provided by the vehicle device deviates or matches the reference data detected or provided at the control device, it can advantageously be determined whether this deviation or coincidence is due to an error of the toll system or an error of the user - for example an operator error , a behavioral error (neglect of the obligation to cooperate) or an irregular act (manipulation, falsification or impairment of data or signals) - are due.

The following embodiments of such control-related protocol checks clarify the significance of the invention for the control practice in toll systems:

Thus, in a toll-based toll control system, the output data may represent a registered standby state of the vehicle device, the reference data may represent a state of inoperability of the vehicle device, and the roadside control device may be configured in the case that the standby state is the inoperative state to send a problem message about the lack of operational readiness to the central data processing device.
Specifically, the DSRC roadside communication device may be configured to receive the status protocol or an extract of the status report having a plurality of status information, in which case the roadside controller is configured to obtain from the status protocol the status information including the output data in the form of the registered number of the vehicle ,
Input data may be represented by data regarding the following events: (i) failure to receive signals from a Global Navigation Satellite System at the position-determining device; (ii) the absence of the generation of position data from signals of a global navigation satellite system by the position-determining device; (iii) the undershooting of a minimum quality of quality of at least one signal of a global navigation satellite system and / or at least one position determined by the position-determining device; (iv) failure to receive signals at the interface for receiving signals from a transmitter; (v) the mismatch of travel angles determined from global navigation satellite system signals and travel direction angles detected by the accelerometer / yaw rate sensor; (vi) the failure of loading the operating system from the data store to the working memory; (vii) exceeding the time value of the expiration of the validity period Processing instructions; (viii) the absence of a timing signal from the timer; (ix) the charge state of the charge storage element falls below a predetermined limit, (x) the failure to receive signals from base stations of a mobile network at the mobile communication device; (xi) the exceeding of a certain amount of toll collection, which could not be transmitted by the mobile communication device to a central data processing device of the toll system.

Furthermore, in a toll system with a control-related decentralized or central protocol check, the output data may represent an identifier of a toll road section identified last by the vehicle device as reference, the reference data representing an identifier of a toll section to be checked on which the control device is located, corresponding to the position of the control device and the road-side control device is configured, in the event that the identifier of the toll road section last identified by the vehicle device does not coincide with the identifier of the route section to be checked, a problem message about the inconsistency of the identifier of the vehicle device last Tolling section of the route identified as having traveled with the identification of the section of track to be checked to the central data to send processing device. In particular, the DSRC roadside communication device may be configured to receive the status log or an extract of the status log having a plurality of status information, wherein the roadside control device is configured to retrieve from the status log the status information with the output data in the form of the identifier of the vehicle device last to win as a traffic-identified section of the route. Input data may be represented by recorded position data from one or more of the identification of the most recent tolling section identified as having traveled. If the recorded position data does not correspond to the identified route section during the protocol check, a recognition error of the software for processing the position data and / or data derived from the position data must be assumed, and a toll system error message is generated. If the recorded position data correspond to the identified route section during the protocol check, an operator error is to be assumed and a user error message is generated.

Alternatively or optionally, in a toll system with a control-based decentralized or central protocol check, the output data may represent a position last registered by the vehicle device, representing reference data of a position assigned to the control device, and the roadside control device may be configured, in the event that last of the vehicle device Registered position does not match within a permissible deviation (of, for example, 100 meters) with the control device associated position to send a problem message about the mismatch of the last registered by the vehicle device position with the control device associated position to the central data processing device. In particular, the DSRC roadside communication device may be configured to receive the status log or an extract of the status log having a plurality of status information, wherein the roadside controller is configured to obtain status information with the output data in the form of the position last registered by the vehicle device from the status log to win.

In addition, a toll system with control-dependent decentralized or central protocol check may be characterized in that the road-side control device at least one image pickup device (for example, a camera) for generating at least one image capture of a license plate of the vehicle and at least one image processing device for obtaining a mark from the image recording of the license plate of the vehicle includes and is adapted to generate by means of the camera at least one image recording of a license plate of the vehicle and to win by means of the image data processing means a recorded characteristic from the image capture of the license plate of the vehicle, the output data representing a registered license plate of the vehicle and the reference data the recorded license plate of the vehicle and in the case where the r and the recorded tag are different to send a problem message about the diversity of the registered and recorded tags to the central data processing device. Specifically, the DSRC roadside communication device may be configured to receive the status protocol or an extract of the status report with a plurality of status information, in which case the roadside controller is configured to retrieve from the status protocol the status information including the output data in the form of the registered vehicle number ,

Furthermore, a toll system with control-dependent decentralized or central protocol check may be characterized in that the roadside control device comprises at least one detection device for detecting an image and / or a contour of the vehicle and at least one classification device for determining a vehicle class of the vehicle from the acquired image and / or the has detected contour of the vehicle and is adapted to receive at least the status information with the output data in the form of the registered vehicle and / or axle class of the vehicle from the vehicle device by means of the roadside DSRC device, by means of the detection device at least one image and / or at least one To capture contour of the vehicle and to determine a detected vehicle class of the vehicle from the captured image and / or the detected contour of the vehicle by means of the classification device, the output data is a registered Fah representing the vehicle class of the vehicle, the reference data representing the detected vehicle class of the vehicle, and the roadside controller being further configured, in the case where the registered vehicle class and the detected vehicle class are different, a problem message about the diversity of the registered and the detected vehicle class to send to the central data processing device.
In particular, the DSRC roadside communication device may be configured to receive a status protocol having a plurality of status information, in which case the roadside controller is configured to obtain from the status protocol the status information with the output data in the form of the registered vehicle class of the vehicle,

In each case, it is also possible that the vehicle device is designed to send only the output data to the control device from the status information, since the output data satisfy the control device for comparison with the reference data. In the case of the central check by the central data processing device, the central data processing device is designed to request from the vehicle device in addition to the event log also the status time value of the status information of the output data, and the Vehicle device is designed to send the status time value of the status information of the output data together with the event log to the central data processing device.

It is also possible that the vehicle device is designed to send only an extract of the event log with several event messages. In this sense, the said extract is also to be understood as an event log.
Thus, the volume of data in the context of the dispatch of the event log can be limited, or at least reduced.

It is possible, in each case, that the vehicle device is designed to delete event messages from the event log that relate to status information that is no longer up-to-date or no longer available in that out-of-date values of its state variables have been updated by current values of state variables , This can limit the scope of the event log.

In the cases where the vehicle device has a vehicle-side DSRC communication device for wirelessly sending at least status information of the status protocol to the DSRC roadside communication device, the vehicle device is preferably a first device part and at least one of the first device part objected to and communication technology The second device part coupled to the first device part, wherein the first device part has a first processor, which is at least formed, depending on a plurality of state variables of the vehicle device, the position data and / or derived from the position data for the purpose of collecting a toll related to the vehicle to process, which is to be raised for the use of a traffic area by the vehicle, which is identifiable based on the detected position data, and at least a first data memory, wherein d the second device part comprises the on-vehicle DSRC communication device having a second processor configured to control DSRC communication of the on-vehicle DSRC communication device with the DSRC roadside communication and having at least one second data memory, and wherein the vehicle device is configured Save event log in the first datastore and save the status log in the second datastore. With this embodiment, the status protocol or at least status information of the status protocol may be provided in the course of passing the vehicle on a DSRC roadside communication device by the vehicle device promptly for dispatch from the on-vehicle DSRC communication device to the DSRC roadside communication device.

According to a second aspect of the invention, a vehicle device for detecting positions of a vehicle carrying them is provided, wherein the vehicle device is configured to (a) detect position data of positions of the vehicle (b) in dependence on a plurality of state variables of the vehicle device To process position data and / or data derived from the position data for the purpose of collecting a vehicle toll related to the use of a traffic area by the vehicle identifiable from the detected position data; and (d) generate output data depending on the received or generated input data, each representing a value of a state variable of the vehicle device, characterized in that the vehicle device further configured to (e) register status information, each comprising generated output data associated with a status time value, in a status log stored in the vehicle device, (f) event messages each including received or generated input data associated with an event time value in one of the in-vehicle device (g) using at least one stored in the vehicle set rules to determine whether i) are included in at least one to be tested event message of the event log in the status protocol according to the at least one set of expected and / or prohibited output data in at least one status information whose status time value lies within a predetermined time range around the event time value of the event message to be checked, and / or ii) at least one status information of the status protocol to be checked in the event log according to the at least one set of rules expected and / or prohibited input data are included in at least one event message whose event time value is within a predetermined time range to the status time value of the status information to be checked, and (h) in the determination of a deficiency according to the at least one rule expected output data and / or expected input data and / or upon detection of the presence of prohibited according to the at least one rule output data and / or prohibited input data to generate an error message.
In particular, the invented vehicle device may be configured to determine (g) based on at least one event message of the event log to be tested in the status protocol according to the at least one set of rules expected and / or prohibited output data in at least one status information is contained whose status time value lies within a predetermined time interval after the event time value of the event message to be checked, and / or (ii) at least one status information of the status protocol to be tested in the event log according to the at least one set of rules expected and / or prohibited Input data are contained in at least one event message whose event time value lies within a predetermined time interval before the status time value of the status information to be checked, and (h) when a deficiency is detected rtenden output data and / or according to the at least one set of rules to be expected input data to generate an error message. Preferably, the in-vehicle device according to the invention has a vehicle-side DSRC communication device for the wireless transmission of at least one status information of the status protocol to the DSRC roadside communication device and is in a first device part and at least one second objected by the first device part and communicatively coupled to the first device part Subdivided part of the device, wherein the first device part has a first processor which is at least configured to process the position data and / or derived from the position data for the purpose of collecting a vehicle related toll fee depending on a plurality of state variables of the vehicle device Use of a traffic area is to be raised by the vehicle, which is identifiable based on the detected position data, and at least one first data memory, wherein the second device part the f A vehicle-side DSRC communication device having a second processor configured to control the DSRC communication of the on-vehicle DSRC communication device with the DSRC roadside communication, and having at least a second data memory, and wherein the vehicle device is configured to store the event log in the first data memory store and save the status log in the second data store. With this embodiment, the status protocol or at least one status information of the status protocol in the course of passing the vehicle on a roadside DSRC communication device by the Vehicle equipment according to the invention can be provided quickly for dispatch from the vehicle-side DSRC communication device to the road-side DSRC communication device.

According to a third aspect of the invention, there is provided a method for detecting faults in a vehicle-mounted vehicle device of a toll system comprising the steps of: (a) acquiring position data of positions of the vehicle by the in-vehicle device, (b) processing the position data, and / or data derived from the position data by the vehicle device in dependence on a plurality of state variables of the vehicle device for the purpose of charging a vehicle-related toll fee, which is to be levied for the use of a traffic area by the vehicle, which is identifiable from the acquired position data, (c) Receiving or generating input data by the vehicle device; and (d) generating output data, each representing a value of a state variable of the vehicle device, in response to the received or generated input data by the vehicle device, gek characterized by the further steps of (e) registering status information, each comprising generated output data associated with a status time value, in a status log stored in the vehicle device by the vehicle device, (f) registering event messages, each received or generated associated with an event time value Input data comprise, in an event log stored in the vehicle device by the vehicle device, (g) determination by the vehicle device and / or by a central data processing device of the toll system arranged outside the vehicle on the basis of at least one set of rules stored in the vehicle device and / or in the central data processing device, whether (i) sin to at least one to be tested event message of the event log in the status log according to the rules expected output data in at least one status information sin d, whose status time value lies within a predetermined time range around the event time value of the event message to be tested and / or (ii) for at least one status information of the status protocol to be checked in the event log according to the rules are expected input data contained in at least one event message whose event time value within and (h) generating an error message upon detection of a lack of output data to be expected according to the set of rules and / or expected input data and / or upon detection of presence of at least one of a predetermined time range Rules forbidden output data and / or prohibited input data by the vehicle device and / or the central data processing device.
In particular, the method may provide for the following steps: (g) determination by the vehicle device and / or by a central data processing device of the toll system, based on at least one of the rules stored in the vehicle device and / or in the central data processing device, whether (i) at least one to be tested event message of the event log in the status protocol according to the rules expected and / or prohibited output data are included in at least one status information whose status time value within a predetermined time interval after the event time value of the event message to be checked is and / or (ii) at least a status information of the status protocol to be checked in the event log according to the set of rules expected and / or prohibited input data are contained in at least one event message whose event time value within a v predetermined time interval before the status time value of the status information to be checked, by the decentralized processor and / or a central processor of a central data processing device of the toll system, the event log and and (h) generating an error message upon detection of a lack of expected output data according to the set of rules and / or expected input data and / or upon the presence of output data prohibited according to the at least one set of rules and / or or prohibited input data by the vehicle device and / or the central data processing device.
Preferably, the registration of event messages, each comprising received or generated input data associated with an event time value, in an event log stored in a first data memory of a first device portion of the in-vehicle device, and the registration of status information comprising generated output data associated with a status time value, respectively a first processor of the first device part processing the position data and / or data derived from the position data as a function of a plurality of state variables of the first device part objected and communicatively coupled with the first device part second device part of the vehicle device Vehicle device for the purpose of collecting a vehicle-related toll, which is to be levied for the use of a traffic area by the vehicle, based on the recorded Po sitiondaten is identifiable, performs and controls a second processor of the second part of a device in the context of a DSRC communication by the second part of the device taking place sending status information.

Fig. 1

schematisch eine erfindungsgemäße Fahrzeugeinrichtung

Fig. 2

schematisch ein erfindungsgemäßes Mautsystem

The invention will be explained below with reference to exemplary embodiments.
Show this

Fig. 1

schematically a vehicle device according to the invention

Fig. 2

schematically a toll system according to the invention

A vehicle device 20 according to the invention comprises - as shown schematically in FIG Fig. 1 illustrated - a vehicle device 10 with a decentralized processor 11 and a DSRC communication module 22 and a displacement sensor 21 (for example, an odometer or odometer), which are coupled to the vehicle device 10 in terms of data technology. Datentechnical couplings between data coupled with each other components are in Fig. 1 illustrated by continuous connecting lines between the coupled components. They can be realized by interfaces, connecting lines or wireless communication means (eg bluetooth). The distributed processor 11 is adapted to control and receive data from the DSRC communication module processor 22d by the execution of a computer program loaded into the random access memory 17b for execution from the data RAM. A GNSS position determination device 12 receives signals from satellites of a Global Navigation Satellite System (GNSS), for example GPS, by means of its GNSS reception antenna 12b and determines its provisional position from the received satellite signals by means of its GNSS receiver 12a - and thus the provisional position of a vehicle 30 (FIG. please refer Fig. 2 ), from which the vehicle device 20 is carried. The determined provisional position is further advanced by the processor 11 based on heading change values provided by a gyroscope 16 of the vehicle apparatus and relative path length values of a distance traveled in a certain time provided by the travel sensor 21 Position more precise final position (hereinafter referred to only as "position") processed in the course of a known as a coupling location method.

In an alternative embodiment, instead of the processor 11, the signals of the gyroscope 16 and the displacement sensor 21 may be directed to the GNSS position determination device 12, the GNSS position determination device 12 performing the coupling location.
The position determination by the processor 11 and the GNSS position determining device 12 is carried out repeatedly, for example, every second - in the course of the movement of the vehicle 30 by the vehicle device 20.

The remote processor 11 is coupled to a security module 18, which is formed as a stand-alone data processing unit (eg, a smart card) having at least one autonomous control module 18a and a memory area 18b, the autonomous control module 18a being configured to request data output from the memory area 18b and / or the modification or recording of data in the memory area 18b only to perform an authentication. The authentication procedure can be carried out by analyzing a digital signature by means of a public key stored by the signer in the memory area 18b of the security module 18.
Instead of the security module 18, a cryptographic data memory (not shown) may be provided, in which the processor 11 can store data encrypted only with appropriate authentication and can read out in a decrypting manner.
A vehicle identifier of the vehicle 30 is stored in the memory area 18b of the security module 18 or cryptographic data memory in the form of the vehicle license plate, which is encompassed by at least one vehicle license plate of the vehicle 30. Alternatively or optionally, the vehicle identifier may be stored in the data RAM 17a.
Furthermore, an axle class and a pollutant class, the combination of which forms a vehicle class, are stored in the memory area 18b of the security module 18.
An initial registration or modification of the vehicle identification, the axle class and / or the pollutant class can be effected by the user by sending corresponding data and instructions to the processor via an unillustrated user interface (Bluetooth interface, USB interface, keyboard or touch-sensitive display device) 11 of the vehicle device transmitted.
It can also be accessed by the central data processing device 50 (see Fig. 2 ), to which the user has previously transmitted the data of the initial registration or change by the central data processing device 50, a corresponding instruction for initial registration or modification of the vehicle identification, the Achsklasse and / or the vehicle class via the mobile network 40 (see Fig. 2 ) is sent to the vehicle device 20, which receives this instruction together with the new data by means of a mobile radio transceiver 13 and processed by the decentralized processor 11.
Such incoming instructions form first input data according to the invention, which are stored by the decentralized processor 11 in an event log provided for this purpose in the data read / write memory 17a together with a first event time value of the input of the respective instruction as the first event message.
The encrypted storage of the vehicle identifier, the axle class and / or the pollutant class in the memory area 18b of the security module 18 or in the cryptographic data memory can be initiated by means of appropriate instructions by the decentralized processor 11. These vehicle-internal instructions form second input data according to the invention, which are stored together with a second event time value in the event log as a second event message. After the storage in the memory area 18b of the Security module 18 is successful, the autonomous control module 18a of the security module 18 from a corresponding confirmation signal from the decentralized processor 11, which is stored as inventive third input data with a third event time value in the event log by the decentralized processor 11 as a third event message.
Only after the memory confirmation of the security module 18 has been carried out, the decentralized processor 11 causes the received vehicle identification, the received axle class and / or the received pollutant class as output data according to the invention together with a status time value in the status protocol. This status time value may correspond to the first event time value, the third and last event time value, or a time value later than the third and last event time value and the time value corresponding to the entry of the output data in the status protocol. This is only a question of definition; However, this has an influence on the definition of the predetermined time range, in which a status information of the status log is to be searched for relevant event messages of the event log in the course of the protocol check according to the invention.
In the case of this embodiment, the status time value is the time value of the entry of the output data in the status protocol and is thus temporally after the first, second and third event time value. The predetermined time interval within which the event time values of event messages, which precede the entry of the status information, must be, for example, 10 seconds for vehicle data (vehicle identification, vehicle class). This size would also apply to a time range within which the event time values of event messages that condition the registration of status information must be if the status time value did not fall after the third event time value but would, for example, fall to the first event time value; it would only be necessary to adjust the temporal position of the temporal range of the same time width as the distance accordingly.
The status protocol is stored in the DSRC communication module data read / write memory 22d of a vehicle-side DSRC communication module, which is mounted at a distance from the vehicle device 10 on the inside of the windshield of the vehicle 30 so that the DSRC transceiver 22a by means of its DSRC antenna 22b with an off-vehicle DSRC communication device 63a of a roadside controller 60 (see FIG Fig. 2 ) can communicate. The DSRC communication carrier is microwave in the 5.8 GHz frequency range. Alternatively or optionally, infrared light (850 nm) is possible as DSRC communication carrier, for which purpose photodiodes would have to be used as receiving elements and IR light emitting diodes as transmitting elements.
For storing status information in the DSRC communication module data read / write memory 22d, the distributed processor 11 communicates wirelessly or line-wise with the DSRC communication module processor 22c of the DSRC communication module 22 via a communication link.

As already mentioned, the processor 11 detects a position of the vehicle 30 every second and processes the detected position data of these positions for the purpose of collecting a vehicle-related toll charge to be levied for the use of a route section by the vehicle 30 Identifiable on the basis of the detected position data.
In the course of a decentralized toll calculation, the decentralized processor 11 compares thereto position data of one or more detected positions with geographical elements of a digital map, each of which has an identifier of a route section, by means of a toll-fee determination program executed in the main memory 17b assigned. If there is sufficient geographical agreement of the acquired position data with a specific geographical element, the route section whose identifier is associated with the particular geographic element is recognized as being traveled. Subsequently, the decentralized processor 11 determines a toll charge based on the identifier of the section of road identified as traveled, which depends on the axle class and the pollutant class of the vehicle 30.
In this respect, axle class and pollutant class are state variables of the vehicle device according to the invention because they determine the amount of the toll charge and insofar influence the processing of the position data on a toll related to the vehicle.
Subsequently, the central processor 11 to the mobile radio transceiver 13, the determined toll charge together with the vehicle identification via the mobile network 40 to the central data processing device 50 of a toll center 58 (see Fig. 2 ) to send. The central data processing device 50 of the toll center 58 assigns the toll fee on the basis of the vehicle identifier to a user account from which the toll fee is deducted by a data processing device of a bank (not shown) credited to the account of the toll operator.
In this respect, the vehicle identifier is also a state variable of the vehicle device according to the invention because it determines the allocation of the toll fee to a user and insofar influences the processing of the position data on a toll related to the vehicle.

In the course of an alternative or optional central toll calculation, the central processor 11 by means of a running in memory 17b position data processing program the mobile radio transceiver 13, detected position data - in particular position data of several immediately detected positions - together with the vehicle identification, axle class and emission class of the vehicle 30th to send to the central data processing device 50.
In the course of a central toll calculation, the central processor 51 of the central data processing device 50 compares the received position data of one or more detected positions with geographical elements of a digital map, to each of which an identifier of a route section is assigned. If there is sufficient geographical agreement of the acquired position data with a specific geographical element, the route section whose identifier is associated with the particular geographic element is recognized as being traveled. Subsequently, the central processor 51 determines a toll charge based on the identifier of the section of road identified as traveled, which depends on the axle class and the pollutant class of the vehicle 30. Vehicle identifier, axle class and pollutant class are also state variables of the vehicle device according to the invention in this case, because they determine the amount of the toll and the allocation of the toll to a user and insofar influence the processing of the position data for a toll related to the vehicle.

In the case of decentralized toll calculation, the section of the route recognized as being traveled also represents a state variable of the vehicle device whose identifier is output data of status information in the status protocol as currently traveled section on the initiative of the decentralized processor 11 in the DSRC communication module data read / write memory 22d are stored.

In particular, the decentralized processor 11 is designed, upon the occurrence of a power supply of the vehicle device 10 via the power supply terminal 19 or as a result of switching on the vehicle device 10, to check the operational readiness of the vehicle device 20 and, if possible, to put the vehicle device into operation. For this purpose, the decentralized processor 11 first undertakes at least an attempt to load the toll fee determination program from the data read / write memory 17a into the main memory 17b. If the loading of the toll fee determination program into the main memory 17b fails, it writes an event message about the attempt of loading and an event message about the failure of the loading into the event log stored in the data RAM 17a. Further, it is caused by the failure of the loading to set a standby state to "deficient" to present it to the user via the display device 15 and to write the storage of status information about the lack of operational readiness of the vehicle device in the status protocol, which in the DSRC communication module Data read-write memory 22d is stored.
If loading of the toll fee determination program succeeds in the main memory 17b, a corresponding event message is entered in the event log.
The remote processor 11 then checks whether the software comprising the toll collection program and the digital card is still valid by reading out a time value of the validity of the software from the storage area 18b of the security module 18 and a current time value of the timer 14 , for example a radio clock, compares. If the software is invalid because the current time value of the timer is greater than the time of expiration of the software, the remote processor 11 writes an event message about the validity check and an event message about the negative result of the validation into the event log is stored in the data RAM 17a.
Further, it is caused by the invalidation of the software to set a standby state vehicle device to "deficient", to present it to the user via the display device 15, and to write the storage of status information about the inoperability of the vehicle device into the status protocol, which is described in US Pat DSRC communication module data read-write memory 22d is stored.
The attempt to load the toll collection program into the main memory 17b and check the validity of the software may also be in the reverse order.
The status protocol may alternatively or optionally also be stored in the data read / write memory 17a of the vehicle device for storage in the DSRC communication module data read / write memory 22d.

After the decentralized processor 11 has commissioned the vehicle device 20 in such a way, under the condition of the successful loading and the validity of the software, it performs an internal protocol check relating to event messages and status information from a preceding operating cycle of the vehicle device as part of a self-test. These are all event messages stored in the event log, their event time values between the penultimate event of turning on or setting up a power supply of the vehicle device 20 or the vehicle device 10 via the power supply terminal 19 and the last event of turning off or removing the power of the vehicle device 20 or the vehicle device 10 are above the power supply terminal 19.

For this purpose, the decentralized processor 11 checks on the basis of at least one stored in the data read-write memory 17a rule, whether each event message of the event log in the status log - if determined in the rules - according to the rules expected output data are included in at least one status information whose Status time value within a predetermined time interval of, for example, 10 seconds after the event time value of the event message to be tested, and generates in the detection of a lack of expected according to the at least one rule output data an error message for their display on the display device 15 of the distributed processor no instruction to the display device 15 but to send them to the central data processing device 50 (see Fig. 2 ) the mobile radio transceiver 13 is instructed by the remote processor.
The set of rules comprises a database in which input data of one or more event messages are linked to output data of one or more status information, wherein the forward data to be expected with the input data to be tested of one or more event messages are expected output data.
For example, in the database, the input data of the three event messages "Attempting to load the toll charging program into the working memory 17b", "Failure to load the toll charging program into the working memory 17b" and "Registration to be inoperative" are linked to the output data of status information "Lack of operational readiness". , This corresponds to the rule that the input data of the three mentioned event messages must be stored in the event log, if the status information "lack of operational readiness" is entered in the status log, or if the status information "lack of operational readiness" in the status log from the input data of the three event messages mentioned in the event log result and only two of the three named event messages in the event log must not be sufficient for the status information "lack of operational readiness" to be entered in the status log. It is true that due to the input data of other event messages, the status information "lack of operational readiness" can also be entered in the status log (for the first time or again). However, the protocol check according to the invention provides - and this is one of its essential advantages - that the event messages and the status information are correlated with each other over the predetermined time range. Event messages which lie outside of this predetermined time range with regard to status information are not the subject of the protocol check and can therefore not lead to an error message.
The decentralized processor 11 is adapted to make an attempt to load the toll collection program into the main memory 17b again after a lapse of a predetermined period of time from the detection of the lack of operability due to the futile attempt to load the toll collection program into the working memory 17b. The decentralized processor 11 is designed to change the value of the status information of the operational readiness state from "inoperative readiness" to "given operational readiness" in the event of successful loading of the toll fee determination program into the main memory 17b.

After performing this self-test, the vehicle device 20 is ready for use (if it is not in the state of lack of operational readiness) and displays this given operational readiness on the display device 15.

In the event that the vehicle device 20 is operated without connection to an external power supply (eg vehicle battery), the vehicle device receives the operating current from a rechargeable battery (accumulator as an example of a charge storage element) 19 a, which is included in the vehicle device 10 , In this case, the decentralized processor 11 is designed to receive measured values of the charge state of the battery 19a at predetermined time intervals (of, for example, 10 minutes) and to write these together with the measurement time as event time value as an event message in the event log. The decentralized processor 11 is designed to compare the measured value of the charge state at each measurement with a limit value of the charge state and to store the undershooting of the limit value as input data of an event message in the event log. The decentralized processor 11 is further configured to count the entries of those immediately consecutive measurements of the state of charge whose measured values fall below the limit, set the counter to zero if, in a measurement of the state of charge, the measured value does not fall below the limit, and a lack of operability the vehicle device 20 to determine when the counter is set to three. The counter readings are also entered by the decentralized processor 11 as input data of meter reading events in the event log such as the determination of the lack of operability, which is also subsequently written together with the time of detection as status information in the status log.
The decentralized processor 11 is configured, after a predetermined period of time has elapsed since the determination of the lack of operability due to the insufficient charge state again to detect measured values and to check whether the measured value of the charge state of the battery 19a is still below the limit. The decentralized processor 11 is configured to change the value of the status information of the stand-by state from "lack of operational readiness" to "given operational readiness" in the event that the three immediately consecutively detected measured values of the state of charge do not fall below the limit value.

During operation of the vehicle device 20, the decentralized processor 11 of the vehicle device 10 - and thus vehicle device 20 - is designed to detect preliminary position data by means of the GNSS position determination device 12 and from this provisional position data based on path length data of the encoder 21 and travel angle change data of the gyroscope 16 final position data (hereinafter referred to as "position data") and to process these position data as described above in response to a plurality of state variables of the vehicle device for the purpose of collecting a vehicle-related toll fee to be levied for the use of a toll route section by the vehicle, which is identifiable on the basis of the detected position data.
The processor 11 is adapted to the events, (i) the absence of the reception of signals of a global navigation satellite system at the position determining device 12, (ii) the absence of generating position data from signals of a global navigation satellite system by the position determining device 12, (iii) falling below a Minimum quality of at least one signal of a global navigation satellite system and / or at least one position determined by the position-determining device 12, (iv) absence of reception of signals at the interface for receiving signals from a travel sensor 21 and / or (v) the mismatch from driving direction angles determined from signals of a global navigation satellite system and from driving direction changes detected by the gyroscope 16, driving direction angles determine these events with corresponding input data in the event log ei nzutragen and at the one or more times - especially directly consecutive - determination of such events to set the value of the operational readiness state of the vehicle device to "lack" and enter a corresponding status information in the status log.
The decentralized processor 11 is configured, after a predetermined period of time has elapsed since the determination of the lack of operability due to the insufficient charge state again to detect measured values and to check whether the measured value of the charge state of the battery 19a is still below the limit. The decentralized processor 11 is configured to change the value of the standby state status information from "lack of operational readiness" to "given operational readiness" in the case where three immediately-consecutively detected charge state measurements do not fall below the limit value.

The further description of the operation of the vehicle device 20 according to the invention in a toll system according to the invention is based on Fig. 2 described.

During operation of the vehicle device 20 (FIG. Fig. 1 ) is the decentralized processor 11 ( Fig. 1 ) of the vehicle device 10 - and thus the vehicle device 20 - formed in time with two hours of operation the mobile radio transceiver 13 ( Fig. 1 ) to send the status protocol via a mobile network 40 to the central data processing device 50 arranged outside and outside the vehicle. The central data processing device 50 is comprised by a center 58 of the toll system and has a central communication device 53, a central processor 51, a first central data memory 56 and a second central data memory 57. For example, the central communication device 53 is a network interface card (network adapter) which is the interface between the PSTN, mobile network 40 and / or the Internet and the central processor 51 included in the central data processing device 50.
The first central data memory 56 includes user data associated with an identifier of the vehicle 30 (vehicle license plate), with a user account and tolls associated with identifiers of toll sections, which of the vehicle device 20 together with the vehicle license plate after recognizing the pursuit of at least one toll road section were sent to the central data processing device.
The second central data memory 57 is provided for storing status information of status records and event reports of event logs associated with the vehicle registration numbers of vehicles, such as the vehicle 30, which the central data processing device 50 receives from vehicle devices, such as the vehicle device 20.

Regardless, the vehicle device 20 may be configured to receive an instruction for the transmission of the status protocol via the mobile radio network 40 by means of the mobile radio transceiver 13 and to comply with this instruction by the decentralized processor 11 of the vehicle device 10 and thus the vehicle device 20-the mobile radio device. Transmitter 13 instructs to send the status protocol via a mobile network 40 to the arranged outside and outside the vehicle central data processing device 50.

The central processor 51 is configured to store the status protocol received via the mobile radio network 40 by means of the central communication device 53 in the second central data memory 57 and to check for the presence of exceptional status information or unusual combinations of status information. An exceptional status information can be, for example, those whose output data represent a lack of operability of the vehicle device. An exceptional combination of status information can be formed, for example, by two status information, in this regard a registered section of the route has been registered immediately one after the other, and its output data represents the same identifier of the section of route traveled.
If the central processor 51 identifies exceptional status information or an exceptional combination of status information, it instructs the central communication device 53 to send an instruction for transmitting the event log to the vehicle device 20.
The exceptional status information and / or the status information of the extraordinary combination of status information form status information to be checked according to the invention.

The vehicle device 20 is configured to receive via the mobile radio network 40 by means of the mobile radio transceiver 13 an instruction to transmit the event log and comply with this instruction by the decentralized processor 11 of the vehicle unit 10 - and thus the vehicle device 20 - the mobile radio transceiver 13 instructs to send the event log via a cellular network 40 to the central data processing device 50 located outside and outside the vehicle.

The central data processing device 50 is designed to receive the event log sent by the vehicle device 20 and to store it in the second central data memory 57. In addition, the central data processing device 50 is configured to determine whether input status data to be evaluated for the status protocol to be checked in the event log according to at least one set of rules stored in the first data memory 56 is contained in at least one event message whose event time value is within a predetermined time range is the status time value of the status information to be checked, and to generate an error message upon detection of a lack of expected according to the at least one set of output data and / or expected input data error message and this error message stored in the first central data memory 56 to that record that the Vehicle license plate of the vehicle 30 has.

In the course of his journey on toll sections the vehicle 30 reaches a control device 60 of the toll system, which passes without stopping. The control device 60 has a control bridge 61, which spans the toll section section transverse to the direction of travel, so that the vehicle 30 can drive under it. Above the toll section, a control device 63 having a roadside DSRC communication device 63a, an image pickup device 62 and a vehicle contour detection device 64 are attached to the control bridge 61.
The image pickup device 62 captures at least one image from the approaching vehicle 30 and determines, by means of an image data processing device (not shown) from image data of the approaching vehicle image 30, the vehicle registration number of the vehicle 30 printed on the vehicle license plate 31 of the vehicle 30. The vehicle contour detection device 64 detects the contour of the vehicle 30 and determines, by means of a classification device (not illustrated) from the detected contour, a vehicle class of the vehicle 30 - in this case an axle class of the vehicle 30, based on the number of axles of the vehicle 30.
Examples of vehicle contour detection means known to those skilled in the art, which are included in the vehicle contour detector 64, are: a radar, a LIDAR, a time-of-flight camera (TOF camera), a stereo camera assembly, a light-section sensor with structured lighting / shading of the vehicle.

In the course of the passage of the vehicle 30 to the controller 60, the on-vehicle DSRC communication module 22 of the in-vehicle DSRC communication device 63a receives a request to send a control relevant extract of the status protocol to the roadside controller. The control-relevant extract of the status log contains status information with output data, each of which is the value of a state variable of the vehicle device 20 in the form of a registered vehicle license plate 30, a registered axle class of the vehicle 30, a registered emission class of the vehicle 30, a registered operational readiness state of the vehicle device 20 Registered identifier of a last recognized as driving recognized toll section and a registered identifier of a last but last recognized as a traffic toll section, along with the associated status time values.
The DSRC communication module processor 22c provides the requested extract of the status protocol by accessing the DSRC communication module data RAM 22d for shipment to the onboard DSRC transceiver 22a, which sends the digest to the DSRC antenna 22b roadside DSRC communication device 63a.
The recording apparatus 63 is configured to receive the extract of the status record by means of the DSRC roadside communication device 63a as well as the recorded vehicle number of the vehicle 30 detected by the image pickup device 62 and the detected axle class of the vehicle 30 detected by the vehicle contour detection device 64, and each Register reception with a reception time.
About the reception times of the extract of the status report of the vehicle device 20 and the image recording and vehicle contour detection of the vehicle 30 of the information, the control device 63 assigns the recorded vehicle registration number to the registered vehicle registration number and the detected axle class of the registered axle class.
The control device 63 is initially configured to obtain from the received extract of the status protocol the status information with the output data to be compared with reference data of the control device 60.
Then, the controller 63 is configured to check the vehicle standby state of the vehicle device 20 received by the vehicle device 20 to see whether it corresponds to the lack of operational readiness, and if so, a problem message about the inoperability of the vehicle device 20 together with the time of extracting the status protocol via the mobile network 40 to the central data processing device 50 send.
Further, the controller 63 is configured to check the link detection received from the vehicle device 20 to see whether it corresponds to the link ID of the link covered by the controller, and if there is a mismatch, a message of inconsistency of the ID of the vehicle device 20 last recognized as driving toll road section with the identifier of the controlled section to the central data processing device to send.
Moreover, the control device 63 is configured to check the registered vehicle registration number sent from the vehicle device 20 for compliance with the vehicle registration number recorded by the image acquisition device 62, and if inconclusive, a trouble message about the inconsistency of the received registration number with the vehicle registration number 20 to send the central data processing device.
Finally, the controller 63 is configured to check the registered axle class sent from the vehicle device 20 for compliance with the axle class detected by the vehicle contour detector 64, and in case of mismatch, a problem message about the detected registration with the registered axle class of the vehicle 20 to send to the central data processing device.

The central data processing device 50 is designed to receive each of the problem messages, wherein the reception of a single problem message, the problematic status information of which in this case forms the status information to be checked, is sufficient for the central data processing device to communicate via the central communication device 53 Mobile network 40 sends a request to the vehicle device 20 to transmit the event log.

The vehicle device 20 is configured to receive via the mobile radio network 40 by means of the mobile radio transceiver 13 an instruction to transmit the event log and comply with this instruction by the decentralized processor 11 of the vehicle unit 10 - and thus the vehicle device 20 - the mobile radio transceiver 13 instructs to send the event log via a cellular network 40 to the central data processing device 50 located outside and outside the vehicle.

The central data processing device 50 is designed to receive the event log from the vehicle device 20 by means of the central communication device 53 and to store it in the second central data memory 57 in association with the status information (s) to be checked. The central processor 51 is designed to determine for each of the status information to be checked whether input data to be expected in at least one set of rules stored in the first data memory 56 is contained in at least one event message, the event time value thereof within a predetermined time range around the status time value the status information to be checked is located.

In the event that the status information to be checked has output data in the form of the inoperative state value of the vehicle device 20, the central processor 51 is designed to check, according to the rules, whether one or more event messages in the transmitted event log are from one lack of operational readiness triggering input data (examples are given above), the event time value is not earlier than 10 seconds before and not later than the status time value of the registered lack of operational readiness. The central processor 51 is configured to generate a toll system error message when none or all of the event messages whose input data cause inoperability are within the first 10 second time period in the event log and generate a user error message if all event messages whose input data trigger a non-operational readiness are present in the event log in the said first time range.
For example, it may be a user fault to drive a toll road section with a non-operational vehicle device 20 if it has not previously decommissioned this inoperative vehicle device (eg, turned off) and an alternative toll collection device to the vehicle device 20 - and / or -entrichtung draws.
In addition, the central processor 51 is configured to check according to the rules whether in the transmitted event log one or more event messages from an ineligible input data (examples are mentioned above), their event time value in a second time range of later than the Status time value of the registered lack of operational readiness and earlier than the reception time of the check-relevant extract of the status protocol by the control unit 63 is located. The central processor 51 is configured to generate a toll system error message if there are one or more event messages in the second time range whose input data trigger the release of a malfunction, and to generate a user error message if there is no event message in the second time range whose input data is a cancellation the lack of operational readiness triggers or contributes to.
The processor 51 is designed, in particular, to generate a user error message only if all event messages which are necessary to trigger a lack of operational readiness are present in the first time range and not all event messages which are necessary to suspend a lack of operational readiness are present in the second time range.

In the event that the status information to be checked has output data in the form of the identifier of the toll road section recognized last by the vehicle device 20, the central processor 51 is designed to check, according to the rules, whether one or more event messages from the latter occur in the transmitted event log If the event time value is not earlier than the status time value of the registered identifier of the toll-liable route section last identified as traffic and not later than the status time value of the registered identifier of the toll-liable route section last identified as being traveled. The central processor 51 is configured to generate a toll system error message if none or all of the event messages whose input data are a prerequisite for recognition of the last traveled route section are present in the time range between two directly registered route section identifiers in the event log, and to generate a user error message if all event messages whose input data are prerequisites for a recognition of the last traveled section of the route are present in the named time interval between two directly registered route section identifiers in the event log.
A user error in this case may be that a user of the GNSS position determining means 12 is playing false navigation satellite signals which the GNSS position determining means 12 uses to determine their position in place of the correct navigation satellite signals coming from the navigation satellites of the GNSS. This so-called spoofing leads the vehicle device to process position data of another, for example, toll-free, route with the result of not recognizing any of the toll road sections actually to be recognized. A similar effect can be caused by the jamming which causes the GNSS position determiner 12 not to be able to determine its position.

In this case, input data may be: a spatial and / or temporal average of positions that have been subjected to the comparison with the geographical elements of the digital map, a spatial and / or temporal mean of directions, whose positions are compared with the geographical elements have been subjected to the digital map, the geographical element identified in the comparison, a measure of the quality of the GNSS positioning of the positions subjected to the comparison with the geographical elements of the digital map.

In the event that the status information to be checked has output data in the form of the registered vehicle registration number, the central processor 51 is designed to check according to the set of rules whether one or more event messages with input data leading to the registration of the registered vehicle registration number exist in the transmitted event log whose event time value is not earlier than 10 seconds before and not later than the status time value of the registered vehicle registration number. The central processor 51 is configured to generate a toll system error message when none or all of the event messages whose input data are indicative of registration of the registered tag are present in the said 10 second time range in the event log and generate a user error message if all Event messages whose input data are authoritative for registering the registered vehicle license plate are present in the said 10-second time range in the event log.
For example, it may be a user error to have his license plate 31 changed without having inputted or communicated to the central data processing device a corresponding change in the vehicle license plate.
Input data that are relevant for registration of the registered vehicle registration number have been given by way of example in the description text.

In the event that the status information to be checked has output data in the form of the registered axle class, the central processor 51 is designed to check according to the set of rules whether one or more event messages with input data leading to the registration of the registered axle class are present in the transmitted event log and whose event time value is not earlier than 10 seconds before and not later than the status time value of the registered axis class. The central processor 51 is configured to generate a toll system error message when none or all of the event messages whose input data is authoritative for registration of the registered axle class are present in the said 10 second time range in the event log and generate a user error message if all Event messages whose input data are relevant for registering the registered axle class are present in the said 10-second time range in the event log.
For example, it may be a mistake of the user to have his triaxial tractor provided with a biaxial semitrailer without having inputted or transmitted to the central data processing device a corresponding change in the axle class from three axles to five axles in the vehicle device.
Examples of input data that are relevant for registering the registered axle class have been given earlier in the description text.

LIST OF REFERENCE NUMBERS

10

Board unit

11

distributed processor

12

GNSS positioning device

12a

GNSS receiver

12b

GNSS receiver antenna

13

Mobile transceiver (vehicle side)

13b

Mobile antenna (vehicle side)

14

Radio Clock

15

display

16

gyroscope

17a

Data read-write memory

17b

random access memory

18

security module

18a

autonomous control module of the security module 18

18b

Memory area of the security module 18

19

Power connector

19a

Battery, supercapacitor

20

vehicle equipment

21

encoder

22

DSRC communication module (vehicle side)

22a

DSRC transceiver (vehicle side)

22b

DSRC antenna

22c

DSRC communication module processor

22d

DSRC communication module data read-write memory

30

vehicle

31

Vehicle license plate

40

mobile network

50

central data processing device

51

central processor

53

central communication device

56

first central data memory

57

second central data memory

58

toll center

60

control device

61

control bridge

62

Image recording device

63

recording equipment

63a

DSRC communication device (roadside)

64

Vehicle contour detecting means

Claims (15)

Tolling system, comprising
at least one vehicle device (20) carried by a vehicle (30), which is designed a) detecting position data of positions of the vehicle (30), b) in response to a plurality of state variables of the vehicle device (20) to process the position data and / or data derived from the position data for the purpose of collecting a toll related to the vehicle (30) that is required for the use of a traffic area by the vehicle (30). which is identifiable on the basis of the recorded position data, c) receive or generate input data and d) generating output data depending on the received or generated input data, each representing a value of a state variable of the vehicle device (20),
characterized in that
the vehicle device (20) is formed, e) entering status information, each of which includes generated output data associated with a status time value, in at least one status protocol stored in the vehicle device (20), f) register event messages, each comprising received or generated input data associated with an event time value, in at least one event log stored in the vehicle device (20), and the toll system is configured; g) determine whether at least one set of rules stored in the toll system i) for at least one event message of the event log to be checked in the status protocol according to at least one stored in the toll system rules expected and / or prohibited output data contained in at least one status information whose status time value is within at least a predetermined time range to the event time value of the event message to be checked .
and or ii) at least one to be tested status information of the status log in the event log according to at least one stored in the toll system rules expected and / or prohibited input data contained in at least one event message whose event time value is within at least a predetermined time range to the status time value of the status information to be checked . and h) in the determination of a lack of expected according to the at least one rule output data and / or expected input data
and or
upon detection of existence of output data prohibited according to the at least one policy and / or prohibited input data
to generate an error message. Tolling system according to claim 1, characterized in that
a first state variable of the vehicle device (20) a registered identifier of the vehicle device (20), the vehicle (30) or a user of the vehicle (30) and
a second state variable of the vehicle device (20) - Is a registered operational readiness state of the vehicle device (20). Tolling system according to claim 1 or 2, characterized in that
the toll system. - At least one outside of the vehicle (30) arranged central data processing device (50) and the the vehicle device (20) at least one mobile radio communication device (13) for sending and / or receiving data to and / or from the central data processing device (50), at least one position determining device (12), which is designed to receive signals of a global navigation satellite system, to process and to generate position data by their processing, at least one displacement sensor (21) for detecting traveled distances, at least one acceleration or yaw rate sensor (16) for detecting direction changes of the vehicle (30), at least one data memory (17a) in which software of the vehicle device is stored, at least one main memory (17b) into which software is loaded for use by the vehicle device (20), at least one data memory (17a, 18b) in which at least one time value of the expiry of the validity of software to be used by the vehicle device is stored, at least one data memory (17b, 18b) in which position data, data of identified traffic areas and / or data from toll collection are stored at least at times, at least one data memory (17a, 18b) in which a vehicle registration number of the vehicle is stored, at least one data memory (17a, 18b) in which a vehicle class of the vehicle is stored, at least one processor (11) configured to generate the output data by the processing of the input data, at least one timer (14) and at least one charge storage element (19a) for the at least temporary power supply of at least one processor (11) of the vehicle device (20). includes and
the input data represents one or more of the following events: i) failure to receive signals from a global navigation satellite system at the position determining means (12); ii) the absence of the generation of position data from signals of a global navigation satellite system by the position determining device (12); iii) falling below a minimum quality level of at least one signal of a global navigation satellite system and / or at least one position determined by the position-determining device (12); iv) failure to receive signals at the interface for receiving signals from a transmitter (21); (v) the mismatch of heading angles determined from Global Navigation Satellite System signals and heading angles determined by the accelerometer / yaw rate sensor (16); vi) the loading of the software from the data memory (17a) into the main memory (17b) fails; vii) exceeding the time value of the expiry of the validity of the software; viii) the absence of a timing signal of the timer (14); ix) the charge state of the charge storage element (19a) falls below a predetermined limit value, x) the failure to receive signals from base stations of a mobile network (40) at the mobile communication device (13); xi) the exceeding of a certain amount of toll collection that could not be transmitted by the mobile communication device (13) to a central data processing device of the toll system; xii) receiving an instruction to disable a service of the vehicle device (20) via the cellular communication device (13); xiii) receiving an instruction to change the vehicle registration number of the vehicle (30); xiv) receiving an instruction to change the vehicle class of the vehicle (30); xv) performing a self-test of the vehicle device (20); xvi) receiving an activation or blocking of a service of the vehicle device (20); xvii) the receipt of an instruction to change the facts regarding a toll or toll collection of the vehicle (30). Tolling system according to one of the preceding claims, characterized in that the vehicle device (20) is designed to carry out at least steps g) and h) based on at least one stored in the vehicle device (20) rules and store the possibly generated error message in the vehicle device (20) and / or by means of one of the vehicle device (20) comprised mobile communication device (13) to a outside the vehicle (30) arranged central data processing device (50) to send the toll system. Tolling system according to claim 4, characterized in that
the vehicle device (20) is designed to carry out a self-test on an event-dependent, time-dependent, location-dependent and / or random basis, in which the vehicle device (20) carries out the steps g) i) and h) for at least one event report of the event log to be tested,
in which
the event of execution of the self-test is stored as input data together with the time value of the execution of the self-test as an event message in the event log, and
in which
the at least one event message to be checked is defined by having an event time value delayed from the time value of the last preceding self-test. Tolling system according to claim 4 or 5, characterized in that
the vehicle device (20) - A mobile communication device (13) for wireless transmission of the status protocol via at least one mobile network (40) to at least one outside the vehicle (30) arranged central data processing device (50) of the toll system has and is designed to send the status protocol by means of the mobile radio communication device (13) to the central data processing device (50), receive from the central data processing device (50) by means of the mobile radio communication device (13) an instruction for carrying out step g) ii) with regard to at least one status information to be checked defined by the central data processing device (50), to carry out step g) ii) with respect to at least one status information to be checked, defined by the central data processing device (50), and to generate at least one error message upon detection of a lack of input data to be expected according to the at least one set of rules and / or upon detection of the presence of input data prohibited according to the at least one set of rules and send this error message to the central one by means of the mobile communication device (13) Data processing device (50) to send. Tolling system according to one of claims 1 to 3, characterized in that
the tolling system comprises at least one central data processing device (50) arranged outside the vehicle (30), the vehicle device (20) - At least one vehicle-side communication device (13, 22) for wireless transmission of the event log to the central data processing device and - At least one vehicle-side communication device (13, 22) for wireless transmission of at least one status information of the status protocol to the central data processing device has and is designed
to send the event log and at least one status information of the status protocol to the central data processing device (50),
wherein the central data processing device (50) is designed to receive the event log sent by the vehicle device (20) and the at least one status information sent by the vehicle device (20) and - Perform at least the steps g) and h) based on at least one in the central data processing device (50) stored rules. Tolling system according to claim 7, characterized in that
the toll system comprises at least one DSRC communication device (63a) coupled to the central data processing device (50) for receiving the at least one status information of the status protocol from the vehicle device (20) and
the vehicle device (20) - A first vehicle-side communication device in the form of a mobile communication device (13) for wireless transmission of the event log to the central data processing device (50) via at least one mobile network (40) and a second vehicle-side communication device in the form of a vehicle-side DSRC communication device (22) for the wireless transmission of the at least one status information of the status protocol to the DSRC roadside communication device (63a) has and is designed - To send the event log by means of the mobile communication device (13) via at least one mobile network (40) to the central data processing device (50) and - Send the at least one status information of the status protocol by means of the vehicle-side DSRC communication device (22) to the roadside DSRC communication device (63 a) of the toll system. Tolling system according to one of claims 1 to 3, characterized in that
the toll system - At least one outside of the vehicle (30) arranged central data processing device (50) and at least one roadside control device (60) having at least one roadside DSRC communication device (63a) for receiving at least one status information of the status protocol from the vehicle device (20) includes,
and the vehicle device (20) - A first communication device in the form of a mobile communication device (13) for wireless transmission of the event log to the central data processing device (50) via at least one mobile network and a second communication device in the form of a vehicle-side DSRC communication device (22) for the wireless transmission of at least one status information of the status protocol to the DSRC roadside communication device (63a) has and is designed - Send the event log by means of the mobile communication device (13) at least one mobile network (40) to the central data processing device (50) and to send at least one status information of the status protocol to the road-side DSRC communication device (63a) of the toll system by means of the vehicle-side DSRC communication device (22), in which
the roadside control device (60) is formed, to receive at least one status information of the status protocol from the vehicle device by means of the DSRC roadside communication device (63a), Comparing output data of the at least one status information of the status protocol with reference data for matching, and, depending on the result of the comparison, send a problem message about the lack of or given match of the output data with the reference data to the central data processing device (50), and the central data processing device (50) is designed, - Receive the problem message about the lack or given match of the relevant output data with the reference data together with the status information from the roadside control device (60) and to send an event log request message via at least one mobile radio network (40) to the vehicle device (20) for requesting the event log, the vehicle device (20) is further designed to receive the event log request message by means of the mobile radio communication device (13) and, in response to the event log request message, to send the event log via the mobile radio network (40) to the central data processing device (50) via the mobile communication device (13); the central data processing device (50) is further designed - Determine on the basis of the rules whether an event message with expected input data is included in the event log, their processing by the vehicle device (20) according to the rules should generate the relevant status information with the relevant output data, and / or contain an event message with prohibited input data is whose processing by the vehicle device (20) according to the set of rules should not generate the relevant status information with the relevant output data, to generate at least one toll system error message upon detection of a lack of input data to be expected according to the rules in the event log and / or determination of the presence of input data prohibited under the rules in the event log; - to establish a user error message upon detection of any input data expected to occur in the Event Log in accordance with the Regulations and / or in the event of detection of a lack of input data prohibited under the Event Log Rules. Tolling system according to one of claims 1 to 3, characterized in that
the toll system - At least one outside of the vehicle (30) arranged central data processing device (50) and - at least one roadside control device (60) with at least one roadside DSRC communication device (63a) for receiving at least one status information of the status protocol, and the vehicle device (20) - A first communication device in the form of a mobile communication device (13) for wireless transmission of the event log to the central data processing device (50) via at least one mobile network (40) and a second communication device in the form of a vehicle-side DSRC communication device (22) for the wireless transmission of at least one status information of the status protocol to the DSRC roadside communication device (63a) has and is designed - To send the event log by means of the mobile communication device (13) to the central data processing device (50) and to send at least one status information of the status protocol to the road-side DSRC communication device (63a) of the toll system by means of the vehicle-side DSRC communication device (22), in which
the roadside control device (60) is formed, to receive at least one status information of the status protocol from the vehicle device (20) by means of the DSRC roadside communication device (63a), Comparing output data of the at least one status information of the status protocol with reference data for matching, and, depending on the result of the comparison, send a problem message about the lack of or given match of the output data with the reference data to the central data processing device (50), and the central data processing device (50) is designed, - Receive the problem message about the lack or given match of the relevant output data with the reference data together with the status information from the roadside control device (60) and to send an examination instruction message via at least one mobile radio network (40) to the vehicle device (20) for checking the event log with regard to the relevant status information, the vehicle device (20) is further designed to receive the test instruction message by means of the mobile radio communication device (13), - to determine in response to the Prüfungsanweisungsnachricht based on the rules, whether in the event log an event message with expected input data is included, the processing of the vehicle device (20) according to the rules should generate the relevant status information with the relevant output data, and / or a Event message with prohibited input data is included, whose processing by the vehicle device (20) according to the rules should not generate the relevant status information with the relevant output data, - to send at least one toll system error message to the central data processing device (50) by the mobile communication device (13) upon detection of a lack of input data expected according to the rules in the event log and / or the presence of prohibited input data prohibited by the rules in the event log and upon the detection of a presence of input data to be expected according to the rules in the event log and / or detection of a lack of input data prohibited by the rules in the event log, send a user error message to the central data processing device (50) via the cellular communication device (13). Tolling system according to claim 9 or 10, characterized in that
the output data represents a registered operational readiness state of the vehicle device (20),
the reference data represents a state of inoperability of the vehicle device (20), and the roadside control device (60) is formed,
in the case that the stand-by state is the lack of operational readiness to send a problem message about the lack of operational readiness to the central data processing device (50). Tolling system according to claim 9 or 10, characterized in that
the roadside control device (60) - At least one camera (62) for generating at least one image recording of a license plate of the vehicle (30) and at least one image data processing device for obtaining a characteristic from the image recording of the license plate of the vehicle (30) includes and is trained - Produce by means of the camera (62) at least one image recording of a license plate of the vehicle (30) and to obtain a recorded characteristic from the image recording of the license plate of the vehicle (30) by means of the image data processing device, the output data represent a registered license plate of the vehicle (30) and
the reference data represents the recorded license plate of the vehicle (30), and
the roadside control device (60) is further configured in the case where the registered license plate and the recorded license plate are different, to send a problem message about the diversity of the registered and the recorded license plate to the central data processing device (50). Tolling system according to claim 9 or 10, characterized in that
the roadside control device (60) - At least one detection device (64) for detecting an image and / or a contour of the vehicle (30) and at least one classification device for determining a vehicle class of the vehicle (30) from the captured image and / or the detected contour of the vehicle (30) has and is designed to receive at least the status information with the output data in the form of the registered vehicle and / or axle class of the vehicle (30) from the vehicle device (20) by means of the roadside DSRC device (63), - To capture by means of the detection device (64) at least one image and / or at least one contour of the vehicle (20) and to determine a detected vehicle class of the vehicle (30) from the captured image and / or the detected contour of the vehicle (30) by means of the classification device, the output data represent a registered vehicle class of the vehicle (30),
the reference data represent the detected vehicle class of the vehicle (30) and
the roadside control device (60) is further configured in the case where the registered vehicle class and the detected vehicle class are different, sending a problem message about the diversity of the registered and the detected vehicle class to the central data processing device (50). Vehicle device (20) for detecting positions of a vehicle (30), of which it is carried, wherein the vehicle device (20) is formed a) to capture position data of positions of the vehicle (30) b) in response to a plurality of state variables of the vehicle device (20) to process the position data and / or data derived from the position data for the purpose of collecting a toll related to the vehicle (30) that is required for the use of a traffic area by the vehicle (30). which is identifiable on the basis of the recorded position data, c) receive or generate input data and d) generating output data depending on the received or generated input data, each representing a value of a state variable of the vehicle device (20),
characterized in that
the vehicle device (20) is further designed e) entering status information, each of which includes generated output data associated with a status time value, in a status log stored in the vehicle device (20), f) registering event messages, each containing received or generated input data associated with an event time value, in an event log stored in the vehicle device (20), g) using at least one in the vehicle device (20) stored rules to determine whether i) for at least one event report of the event log to be checked in the status log according to the at least one set of rules expected and / or prohibited output data are included in at least one status information whose status time value within a predetermined time range is the event time value of the event message to be checked, and / or ii) for at least one status information of the status protocol to be checked in the event log according to the at least one set of rules expected and / or prohibited input data are included in at least one event message whose event time value is within a predetermined time range to the status time value of the status information to be checked, and h) in the determination of a lack of expected according to the at least one rule output data and / or expected input data
and or
upon detection of existence of output data prohibited according to the at least one policy and / or prohibited input data
to generate an error message. A method of detecting faults in a vehicle device (20) of a toll system carried by a vehicle (30), comprising the following steps: a) detection of position data of positions of the vehicle (30) by the vehicle device (20), b) processing of the position data and / or data derived from the position data by the) vehicle device (20) depending on a plurality of state variables of the vehicle device (20) for the purpose of collecting a vehicle toll (30) related toll charge for the use of a Traffic surface is to be raised by the vehicle (30), which is identifiable on the basis of the detected position data, c) receiving or generating input data by the vehicle device (20) and d) generation of output data, each representing a value of a state variable of the vehicle device (20), as a function of the received or generated input data by the vehicle device (20),
characterized by the further steps of e) entry of status information, which in each case includes generated output data associated with a status time value, in a status protocol stored in the vehicle device (20) by the vehicle device (20), f) registration of event messages, each comprising received or generated input data associated with an event time value, in an event log stored in the vehicle device (20) by the vehicle device (20), g) determination by the vehicle device (20) and / or by a central data processing device (50) of the toll system arranged outside the vehicle (30) using at least one rule stored in the vehicle device (20) and / or in the central data processing device (50), if i) for at least one event message to be checked of the event log in the status protocol according to the rules and expected output data contained in at least one status information whose status time value is within a predetermined time range to the event time value of the event message to be checked and / or ii) for at least one status information of the status protocol to be checked in the event log according to the set of rules expected and / or prohibited input data are contained in at least one event message whose event time value is within a predetermined time range to the status time value of the status information to be checked, and h) Generation of an error message
upon detection of a lack of expected according to the rules output data and / or expected input data and / or
upon detection of existence of output data prohibited according to the at least one policy and / or prohibited input data
by the vehicle device (20) and / or the central data processing device (50).

Images