FR3085145A1 - METHOD AND DEVICE FOR CONTROLLING THE OPERATION OF A DIRECT COMMUNICATION MODULE BY VEHICLE WAVEWAYS, BY TRIGGERING A REACTION - Google Patents

Abstract

A method controls the operation of a communication module of a vehicle exchanging messages by direct and short-range waves. This method comprises: - a first step (10) in which a computer installed in the vehicle generates and then transmits to the communication module at least one test frame intended to trigger, in the absence of malfunction, a reaction known to the latter having in the form of a known result, - a second step (20-30) in which the communication module reacts to each test frame received by producing a result which it transmits to the computer, and - a third step (40 -60) in which the computer compares the result transmitted to the known result, and generates an alarm signal in the event of a difference determined at least once between these results transmitted and known.

Description

METHOD AND DEVICE FOR CONTROLLING THE OPERATION OF A DIRECT COMMUNICATION MODULE BY VEHICLE WAVEWAYS BY TRIGGERING A REACTION

The invention relates to vehicles which include a communication module arranged so as to exchange messages by direct and short-range waves, and more precisely the control of the operation of such communication modules.

Certain vehicles defined above, generally of the automobile type, include a communication module by wave which allows them to exchange directly and at short range (typically up to 3 km) messages, periodicals or events, with other vehicles or stations belonging to the road infrastructure which they use temporarily. For example, these messages can be of the Car2X or V2X type.

For example, these messages are intended to exchange information relating to the operation of the vehicle (speed, cruise control activated, braking system used, technical problem, for example), or to the environment of the vehicle (detection of a danger, signaling an accident or an obstacle or a slowdown or an intervention, road condition, weather conditions, signaling of another approaching vehicle, for example), or to the road infrastructure (eg closed exit, problem at a motorway toll, closed tunnel, gas station not supplied, intervention in progress, for example).

A main drawback of these direct wave communications is their vulnerability to attack. A malicious person can indeed corrupt a communication module, in particular a vehicle, by waves, and thus cause it to malfunction. However, the malfunction of a communication module can cause the transmission of erroneous values of parameters or information, which can have significant consequences and in particular cause accidents. The problem is all the more important when the messages are transmitted gradually and therefore the erroneous values propagate quickly.

It was proposed in patent document EP 3197730 a method intended to detect a cyber attack by comparing metadata emitted or received by a communication module equipping a vehicle with metadata emitted or received by a communication module equipping a communicating station '' a road infrastructure located near this vehicle or fitted to another vehicle. A correlation calculation between the different metadata compared makes it possible to determine the probability of the presence of a cyber attack, and when this probability is high, communications from vehicle to vehicle are blocked.

However, there is currently no solution for controlling the operation of the communication modules described above, in order to at least report their malfunction as quickly as possible, and thus avoid the propagation of erroneous information.

The invention therefore aims in particular to improve the situation.

It proposes in particular for this purpose a control method intended to control the operation of a communication module of a vehicle exchanging messages by direct and short-range waves.

This control process is characterized by the fact that it includes:

a first step in which a computer installed in the vehicle generates and then transmits to the communication module at least one test frame intended to trigger, in the absence of malfunction, a known reaction of the latter in the form of a known result,

- a second step in which the communication module reacts to each test frame received by producing a result which it transmits to the computer, and

- a third step in which the computer compares the result transmitted to the known result, and generates an alarm signal in the event of a difference determined at least once between the results transmitted and known.

It is thus possible to diagnose the operating state of the communication module, and in the event of a malfunction report the detection of the latter.

The control method according to the invention may include other characteristics which can be taken separately or in combination, and in particular:

- in its first step, a test frame can include a request to transmit a current value of at least one parameter or at least one piece of information accessible in the vehicle;

> in its third step, the computer can generate an alarm signal ordering the ban on the use of the communication module in transmission and / or in reception, depending on whether the difference relates to a reaction dysfunction in transmission and / or in reception, a transmission reaction malfunction resulting in the transmission of an erroneous value of a required parameter or of required information or correct values of at least two required parameters or of at least two required information according to an erroneous scheduling, and a reception reaction malfunction resulting in the transmission of a value of a parameter different from a required parameter or of a value of information different from a required information or correct values of at least two parameters required or at least two pieces of information required according to an incorrect scheduling;

- in its third step, in the event of a difference determined for the first time between the results transmitted and known, the computer may not generate an alarm but may repeat the first step, and during the next third step may generate the signal alarm in the event of a new determined difference between the results transmitted and known;

- in the first step, each test frame can, for example, be of a Car2X type;

- it can be implemented periodically.

The invention also provides a computer program product comprising a set of instructions which, when executed by processing means, is capable of implementing the control method described above for controlling the operation of a communication module of a vehicle exchanging messages by direct and short-range waves.

The invention also provides a control device intended to equip a vehicle comprising a communication module exchanging messages by direct and short-range waves.

This control device is characterized by the fact that it includes a computer intended to be permanently coupled to the communication module and:

- generating and then transmitting to the latter at least one test frame intended to trigger, in the absence of a malfunction, a known reaction of the communication module in the form of a known result, and

- comparing to this known result a result transmitted by the communication module in reaction to this (each) test frame, and

- generating an alarm signal in the event of a difference determined at least once between the results transmitted and known.

The invention also provides a vehicle, possibly of the automobile type, and comprising, on the one hand, a communication module exchanging messages by direct and short-range waves, and, on the other hand, a control device. of the type presented above and coupled to the communication module.

Other characteristics and advantages of the invention will appear on examining the detailed description below, and the attached drawings, in which:

FIG. 1 diagrammatically and functionally illustrates a vehicle located on one of the two lanes of traffic on a road and equipped with a communication module to which an exemplary embodiment of a control device according to the invention is coupled, and

FIG. 2 schematically illustrates an example of an algorithm implementing a control method according to the invention.

The object of the invention is in particular to propose a control method, and an associated DC control device, intended to allow the control of the operation of a communication module MC of a vehicle V exchanging messages by means of waves directly. and short range.

In what follows, it is considered, by way of nonlimiting example, that vehicle V is of the automobile type. This is for example a car. However, the invention is not limited to this type of vehicle. It relates in fact to any type of land vehicle comprising a communication module exchanging messages by direct and short-range waves.

There is schematically and functionally shown in FIG. 1 a vehicle V traveling on one of the two traffic lanes VCk (k = 1 or 2) of a road.

This vehicle V notably includes a communication module MC and an exemplary embodiment of a DC control device according to the invention.

It will be noted that the vehicle V can possibly be driven at least partially autonomous (or automated). It is recalled that a fully automated driving vehicle is a vehicle which is driven by a driving assistance device, possibly of the ADAS (“Advanced Driver Assistance System”) type, without the intervention of a driver, while a partially automated driving vehicle is a vehicle which is driven at least partially by a driving assistance device during an autonomous driving phase and by a driver during a manual driving phase.

The communication module MC is arranged so as to exchange messages by direct and short-range waves (typically between 300 m and 3 km) with other communication modules fitted to other vehicles and stations belonging to the road infrastructure that includes VCk traffic lanes. For example, these messages can be of type Car2X.

As mentioned above, the invention proposes in particular a control method intended to allow the control of the operation of the communication module MC of the vehicle V.

This control method can be at least partially implemented by the DC control device which includes for this purpose at least one CD computer intended to be permanently coupled to the communication module MC. Such a CD computer can comprise at least one processor, for example of digital signal (or DSP ("Digital Signal Processor")), possibly associated with at least one memory. In general, the DC control device can be produced in the form of a combination of electrical or electronic circuits or components (or "hardware") and software modules (or computer or even "software").

In the example illustrated without limitation in FIG. 1, the CD computer is coupled "directly" to the communication module MC via a computer cable. But it is not compulsory. Indeed, the computer CD could be coupled "indirectly" to the communication module MC via a communication network of the vehicle V, possibly multiplexed.

Note that the implementation of the control process may require the implementation of a specific program (or routine) in the communication module MC.

As illustrated in FIG. 2, the detection method according to the invention comprises first 10, second 20-30, and third 40-60 steps.

In the first step 10, one (the CD computer) generates and then transmits to the communication module MC at least one test frame which is intended to trigger, in the absence of malfunction, a known reaction of the latter (MC) which present as a known result.

In other words, the result that the communication module MC must produce in reaction to the test frame (s) coming from the CD computer is, in the absence of a malfunction, known in advance. of the latter (CD). It will be noted that the test frames can be transmitted periodically and their sequences can be random in order to prevent the communication module MC from decoying the control device DC.

By way of example, in the first step 10, a test frame can comprise a request for transmitting a current value of at least one parameter or at least one piece of information accessible in the vehicle V. Each value (of parameter or information) that the CD computer expects to receive from the communication module MC is known in advance from the CD computer because it has just determined it within vehicle V, for example via its communication network to which it is coupled.

The notion of "value" must be taken here in the broad sense. It can indeed be alphanumeric data defining at least a number and / or at least one word (possibly an expression). An expression can, for example, be of the type "warning danger at 100 meters".

The information and values are preferably objective and describe a state. For example, input information can be emergency braking, a position (x1, y1), a speed equal to v1, a deceleration equal to dec1, or a direction equal to d1. Also for example, if the response (or reaction) of the MC communication module is "attention danger at 500 m" or "attention cork tail at 100 m" when it should be "attention danger at 100 m", it is that there is a problem with the MC communication module.

In the second step 20-30, of the control method, the communication module MC reacts to each test frame it receives from the CD computer by producing a result which it then transmits to the CD computer within a response frame.

For example, if a test frame requires the transmission of a current value of at least one parameter or at least one piece of information accessible in vehicle V, then the communication module MC must fetch in vehicle V, for example via its communication network to which it is linked, each current value concerned (and therefore required). It will be understood that in the event of a malfunction in reception of the communication module MC, there is a risk of fetching in vehicle V the current value of a parameter not required or of information not required, or even of not fetching anything , for example. Likewise, in the event of a malfunction in transmission of the communication module MC, it risks transmitting to the computer CD a value which is different from the current value that it went to fetch or from correct current values but according to an erroneous scheduling.

In the third step 40-60, of the control method, one (the CD computer) compares the (each) result transmitted by the communication module MC with (each) known result. Then, we (the CD computer) generate an alarm signal in the event of a difference determined at least once between the results transmitted and known.

Thanks to this control performed by the CD computer, the latter can diagnose the operating state of the communication module MC, and thus detect its malfunction and alert of the detection of the latter.

In order to avoid unnecessary alarms (or alerts), resulting from a single malfunction, in the third step 40-60, in the event of a difference determined a first time between the results transmitted and known, the CD computer may not generate d 'alarm. In this case, it (CD) repeats the first step 10, and it is only during the following third step 40-60 that it will generate the alarm signal if it determines a new difference between the transmitted result. by the communication module MC and the known result.

It will be noted that the control method can, for example, be implemented periodically. For example, the CD computer can be programmed to implement its first step 10 every five or ten minutes. The lower the periodicity, the more the propagation of erroneous information (possibly due to a failure of the MC communication module) and attacks will be limited. As a variant or in addition, the control method can, for example, be punctually implemented when the vehicle V is not in a critical driving environment (for example in the absence of traffic when it is all alone on the road) or when the driving environment of vehicle V does not present a major danger (for example when there are very few vehicles on the road it takes).

It will also be noted that when a test frame requires the transmission of a current value of at least one parameter or at least one piece of information accessible in the vehicle V, then in the third step 40-60 the computer CD can generate an alarm signal ordering the ban on the use of the communication module MC in transmission and / or in reception, depending on whether the difference relates to a reaction malfunction in transmission and / or in reception. In this case, the alarm signal (or message) can possibly be representative of the origin of the malfunction (in transmission, in reception, or in transmission and in reception). As mentioned above, a transmission reaction malfunction can result in the transmission of an incorrect value of a required parameter or of required information, or in the transmission of correct values of at least two required parameters or d '' at least two pieces of information required according to an incorrect schedule. Furthermore, a reception reaction malfunction can result in the transmission of a value of a parameter which is different from a required parameter or a value of information which is different from required information, or by the transmission of the correct values of at least two required parameters or at least two required information according to an erroneous scheduling.

It will also be noted that the alarm signal (or message) may possibly be transmitted to at least one server, for example from the road infrastructure or from the manufacturer of the vehicle V, via another communication module on board the vehicle V so as to permanent or temporarily (such as a smart phone (or "smartphone") or an electronic tablet), and can connect to a communication network, because you can not use the MC communication module. This alarm reporting is intended to alert as quickly as possible so that backup and / or recall measures for vehicle (s) can be taken. Each alarm signal (or message) can also possibly be transmitted to at least one display screen on board the vehicle V permanently or temporarily (such as for example a smartphone or an electronic tablet) in order to inform the driver CV. For example, an alarm message can be displayed on the screen of the CC central handset which is installed in or on the dashboard of vehicle V, and / or on the screen of the dashboard of vehicle V. A such an alarm message can, for example, ask the driver CV to have the communication module MC of his vehicle V checked as quickly as possible in an after-sales service.

It is the CD computer which can trigger, itself, the prohibition of operation of the MC communication module in transmission and / or in reception. Alternatively, this ban can be triggered remotely by a server of the road infrastructure or of the vehicle manufacturer V.

It will also be noted that in the foregoing, a detailed description has been given of the control (or diagnosis) of malfunctions of the Car2X communication type performed by the DC control device (and in particular its CD computer). However, this check (or diagnosis) also concerns "system" type malfunctions, in order to ensure that the Car2X type functionalities which are provided by the MC communication module have not changed over time. In other words, the objective is to ensure that the MC communication module performs only the functionality strictly requested initially, no more and no less.

As an illustrative example, if the communication module MC must only process messages of the CAM or DENM type, the DC control device will, for example, check whether, as initially configured, it always inhibits the IP functions (" Internet Protocol "), so that it does not allow access to the Internet.

This control (or diagnosis) of system malfunctions is done in the same way as the control (or diagnosis) of Car2X communication malfunctions, that is to say by means of test frames transmitted to the MC communication module and an analysis of the result of the reaction of this communication module MC following the reception of these test frames.

FIG. 2 schematically illustrates an example of an algorithm implementing the control method described above.

In a first sub-step 10 of the first step on (the CD computer) generates and then transmits to the communication module MC at least one test frame intended to trigger, in the absence of malfunction, a reaction known to the latter (MC ) in the form of a known result.

In a second substep 20 of the second step, the communication module MC reacts to each test frame it receives from the computer CD, for example by going to seek in the vehicle V the current value of at least one required parameter or at least one piece of required information, which produces a result.

In a third sub-step 30 of the second step, the communication module MC transmits each result to the computer CD within a response frame.

In a fourth sub-step 40 of the third step, (the CD computer) compares the (each) result transmitted by the communication module MC to the (to each) corresponding known result.

If there is a difference determined at least once between the results transmitted and known, one (the CD computer) generates an alarm signal in a fifth substep 50 of the third step. Then, one (the computer CD) ends the control process in a sixth sub-step 60 of the third step.

On the other hand, in the absence of a difference between the results transmitted and known, one (the CD computer) terminates the control process in the sixth sub-step 60 of the third step.

It will also be noted that the invention also provides a computer program product comprising at least one set of instructions which, when executed by processing means of electronic circuits (or hardware) type, such as for example, and in particular , the computer CD and possibly the communication module MC, is suitable for implementing the control method described above to control the operation of the communication module MC of the vehicle V.

It will also be noted that in FIG. 1 the DC control device is very schematically illustrated with only its CD computer. This DC control device can take the form of a box comprising integrated (or printed) circuits, or else of several integrated (or printed) circuits connected by wired or non-wired connections. The term integrated circuit (or printed circuit) means any type of device capable of performing at least one electrical or electronic operation. As mentioned above, this DC control device comprises at least one CD computer comprising for example a digital signal processor (or DSP (Digital Signal Processor)), a random access memory for storing instructions for the implementation by this processor of part of the control method as described above, and a mass memory for storing data intended to be kept after the implementation of the control method. The digital signal processor receives at least the results of the reactions from the communication module MC, to analyze them and make comparisons, possibly after having shaped them and / or demodulated and / or amplified them, in a manner known per se. The DC control device can also include an input interface for receiving messages 5 (or frames) transmitted by the communication module MC and containing the results of the reactions, and an output interface for transmitting the frames for the MC communication module and the transmission of alarm signals (or messages).

One or more steps or sub-steps of the control method 10 can be carried out by different components. Thus, the control method can be implemented by a plurality of processors, random access memory, mass memory, input interface, output interface and / or digital signal processor.

Claims (10)

1. Method for controlling the operation of a communication module (MC) of a vehicle (V) exchanging messages by direct and short-range waves, characterized in that it comprises i) a first step ( 10) in which a computer (CD) installed in said vehicle (V) generates and then transmits to said communication module (MC) at least one test frame intended to trigger, in the absence of malfunction, a reaction known to the latter ( MC) being in the form of a known result, ii) a second step (20-30) in which said communication module (MC) reacts to each test frame received by producing a result which it transmits to said computer ( CD), and iii) a third step (40-60) in which said computer (CD) compares said result transmitted to said known result, and generates an alarm signal in the event of a difference determined at least once between said results transmitted and co nnu. 2. Method according to claim 1, characterized in that in said first step (10) a test frame comprises a request for transmission of a current value of at least one parameter or at least information accessible in said vehicle (V). 3. Method according to claim 2, characterized in that in said third step (40-60) said computer (CD) generates an alarm signal ordering the prohibition of the use of said communication module (MC) in transmission and / or in reception depending on whether said difference relates to a transmission reaction malfunction and / or in reception, a transmission reaction dysfunction resulting in the transmission of an incorrect value of a required parameter or of required information or values correct of at least two required parameters or at least two information required according to an erroneous scheduling, and a reception reaction malfunction resulting in the transmission of a value of a parameter different from a required parameter or a value of information different from required information or correct values of at least two required parameters or at least two information re quises according to an erroneous scheduling. 4. Method according to one of claims 1 to 3, characterized in that in said third step (40-60), in the event of a difference determined a first time between said results transmitted and known, said computer (CD) does not generate alarm but repeats said first step (10), and during the next third step (40-60) generates said alarm signal in the event of a new determined difference between said transmitted and known results. 5. Method according to one of claims 1 to 4, characterized in that in said first step (10-20) each test frame is of a Car2X type. 6. Method according to one of claims 1 to 5, characterized in that it is implemented periodically. 7. Computer program product comprising a set of instructions which, when executed by processing means, is capable of implementing the control method according to one of the preceding claims for controlling the operation of a communication module (MC) of a vehicle (V) exchanging messages by direct and short-range waves. 8. Control device (DC) for a vehicle (V) comprising a communication module (MC) exchanging messages by direct and short-range waves, characterized in that it comprises a computer (CD) intended for be permanently coupled to said communication module (MC) and generate and then transmit to the latter (MC) at least one test frame intended to trigger, in the absence of malfunction, a known reaction of said communication module (MC) presenting in the form of a known result, and comparing to said known result a result transmitted by said communication module (MC) in response to said test frame, and generating an alarm signal in the event of a difference determined at least once between said results transmitted and known. 9. Vehicle (V) comprising a communication module (MC) exchanging messages by direct and short-range waves, characterized in that it further comprises a control device (DC) according to claim 8, coupled audit communication module (MC). 10. Vehicle according to claim 9, characterized in that it is of the type