Classifications

• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C5/00—Registering or indicating the working of vehicles
  • G07C5/08—Registering or indicating performance data other than driving, working, idle, or waiting time, with or without registering driving, working, idle or waiting time
  • G07C5/0808—Diagnosing performance data
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C2205/00—Indexing scheme relating to group G07C5/00
  • G07C2205/02—Indexing scheme relating to group G07C5/00 using a vehicle scan tool
• • G—PHYSICS
  • G07—CHECKING-DEVICES
  • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
  • G07C5/00—Registering or indicating the working of vehicles
  • G07C5/008—Registering or indicating the working of vehicles communicating information to a remotely located station

Definitions

• the invention relates to remote diagnostic assistance systems for motor vehicles, and more particularly the protection of such systems against accidental or malicious uses that can cause a loss of functional integrity on a vehicle.
• fault codes usually referred to as fault codes or DTC for Diagnostic Trouble Codes.
• DTC Diagnostic Trouble Codes
• the main defect generated by this type of functionality is precisely related to the fact that, when activating these different functions, the operator to The distance does not have the visual status of the vehicle and it can, without any malicious intent, activate a feature that it would never have activated if the vehicle had been in the shop. For example, it is very unlikely that an operator activates an injector control function (to check if they are defective and if the vehicle has a fuel leak). Indeed, the operator is not near the vehicle, it is not able to see this fuel leak. Other, more complex cases may occur, for example, triggering regeneration of the particulate filter while the vehicle is parked in tall grass, thus potentially triggering a fire.
• the invention therefore aims to overcome the aforementioned drawback and to provide a more secure diagnostic assistance system.
• the invention makes it possible to improve the security of a remote diagnosis by integrating, on the one hand, the steps of opening and closing a session dedicated to remote diagnostics from the embedded and, secondly, by implementing a verification step to control that a request is allowed to be executed during a remote diagnostic session. This limits access to certain functions of a vehicle for an operator located remote from a vehicle.
• the method according to the invention further comprises a filtering step, performed by the first calculator each time a request is received and consisting in rejecting the request if the request is a logon request.
• the second computer comprises a table comprising a list of requests and indicating for each request whether it is authorized during a remote diagnostic session, the table being used during the verification step.
• the method according to the invention furthermore comprises, in response to the transmission of a request to open a remote diagnostic session, the transmission of a message, from the second computer to the first computer. , indicating that the session is open.
• the method according to the invention furthermore comprises, in response to the transmission of a closing request of a remote diagnostic session, the transmission of a message, from the second computer to the first computer, indicating that the session is closed.
• the first computer and the second computer are connected by a data bus, the diagnostic requests and exchanged messages circulating on the data bus.
• the diagnostic requests each include an address for identifying the destination computer and an address for identifying the computer to which the response to the request is to be sent.
• the invention also relates to a system for assisting the remote diagnosis of a vehicle, the vehicle comprising a first computer, and at least one second computer connected to the first computer, said system being characterized in that: the first computer has a filtering module configured to reject a request if the request is a logon request, and in that the second computer has a remote diagnostic session, the diagnostic session defining a set of requests authorized to be executed.
• the second computer comprises a table comprising a list of requests and indicating for each request whether it is authorized during a remote diagnostic session.
• the vehicle further comprises a third computer, the second computer being connected to the first computer via the third computer, the second computer being connected to the third computer by a data bus, the messages or requests exchanged between the first computer and the destination computer passing through the third computer.
• FIG. 1 illustrates an exemplary embodiment of the system according to the invention
• FIG. 2 represents a logic diagram illustrating the progress of the steps of the method according to the invention
• FIG. 3 presents a logic diagram illustrating the steps implemented by a calculator receiving a request
• FIG. 4 illustrates an alternative embodiment of the system according to the invention.
• the system 1 10 facilitates the maintenance of a vehicle 100.
• the vehicle 100 comprises a first computer 102.
• the first computer 102 is able to exchange data remotely with a tool diagnosis 101 for example via a wireless telephone network (GSM or 3G).
• the vehicle comprises, for example, a second computer 103 dedicated for example to managing the engine of the vehicle 100.
• the vehicle 100 comprises for example a third computer 105 dedicated for example to the management of the cabin of the vehicle 100.
• the third computer 105 manages a number of electrical equipment of the vehicle 100 and in particular, airbags, interior lights, locking / unlocking the doors and the trunk, the operation of the windows and sunroof, the timing of the wipers.
• Each of the computers 102, 103, 105 comprises at least one processor and one memory.
• the vehicle 100 comprises at least one data bus 104 on which data exchanged by the various on-board computers 102, 103, 105 pass in the vehicle 100.
• the diagnostic tool 101 and the computers 102, 103, 105 communicate by means of a diagnostic protocol.
• This protocol is based on the following mechanism: each request of the tool 101 corresponds to a response from the recipient (one of the calculators 102, 103, 105). This response can be positive, it is then the response expected by the diagnostic tool 101, or negative, either because the request is incorrect, or because the destination computer 102, 103, 105 is in a state not not to transmit the expected response, for example because of processor overload or because of improper functional conditions (the parking brake may for example not be tight because the vehicle is rolling, which may prevent the performance of certain functions).
• a session defines a mode of access to a computer in which the execution of certain functions or queries is authorized or not.
• Each of the computers 103, 105 also includes a session dedicated to the connected diagnosis, ie to the diagnosis using a tool directly connected to the vehicle. Such a tool is used by an operator physically located near the vehicle.
• the creation of a specific remote diagnostic session thus makes it possible to dissociate the activatable functions by a professional connecting in a garage a tool on the centralized connector of a vehicle, a professional operating remotely.
• each of the computers 103, 105 embedded in the vehicle 100 capable of responding to requests for remote diagnosis, comprises a table comprising a list of requests and indicating for each request whether it is authorized during a particular request. a remote diagnostic session, the table being used during a verification step.
• the table comprises for example a series of lines corresponding to requests, a column associated with the remote diagnosis and another column associated with the connected diagnosis.
• a value indicates whether the request is allowed in the corresponding session as in the example if after:
• a number of features on a vehicle are accessible to a professional by means of a connected tool when it is in the development phase or when it is in the repair phase as part of a road course in a vehicle. which he will have control of the moment of the triggering of the operation.
• these same functionalities are forbidden in the use phase by a client who does not master the moment of triggering these features.
• the first computer 102 comprises a request filtering module.
• the filtering module filters all login or logoff requests from outside the vehicle.
• the first computer 102 alone has the ability to issue queries for opening and closing a remote diagnostic session for each of the onboard computers.
• This feature helps prevent a malicious person from taking control or exploiting this feature. Indeed, with this filtering, it is not possible to open a connected diagnostic session remotely. It is therefore not possible to "let believe" to the vehicle that a computer is in communication with a tool connected to the centralized take of the vehicle while access is achieved remotely via the first computer 102.
• the first computer 102 filters and refuses any external request for logon or logoff. In other words, when the first computer 102 receives a request corresponding to a diagnostic logon, it filters this request:
• the first computer 102 if this request is directly intended for it (the first computer 102 also has an internal diagnostic function with which it is possible to exchange elements remotely), then it does not enter the requested session, or
• the first computer 102 For any other request REQ1 received by the first computer 102 to another computer 103, 105, the first computer 102 transmits beforehand to the other computer 103, 105 a request to open a remote diagnostic session. Upon receipt of this request, the destination computer 103, 105 switches to the desired session after having activated an internal indicator (or flag) indicating that a session remote diagnosis is open. The destination computer 103, 105 sends a message indicating that it has now entered the requested session. Upon receipt of this message, the first computer 102 transmits the request REQ1.
• the latter On receipt of the frame or message REQ1 and according to the authorization table for the remote diagnosis session and the functional conditions of the vehicle (for example, stationary vehicle, handbrake tightened) available to the destination computer 103, 105, the latter is responsible for executing or not the functionality carried by the request and then transmits the response to the first computer 102.
• the vehicle for example, stationary vehicle, handbrake tightened
• the first computer 102 On receipt of the response, the first computer 102 then sends the response of the destination computer to the tool 101 from which it has received the request REQ1 and also transmits to the recipient computer a request for logoff remote diagnosis means.
• the destination calculator sets its internal diagnostic remote indicator to the invalid value indicating the closing of the remote diagnostic session, closes the remote diagnosis session and transmits a closure confirmation message to the first computer 102 to confirm that it has been abandoned. session in progress.
• the data bus is for example a bus type CAN (for Controller Area Network) that is to say a multiplexed system on which a plurality of computers communicate in turn by exchanging communications frames.
• CAN Controller Area Network
• Each frame is identified by a code, and contains a set of functional information.
• Each request includes a destination address ADR_REQ indicating an identifier of the calculator receiving the request on the data bus 104 and an ADR_REP response address indicating an identifier of the calculator transmitting the request on the data bus 104.
• FIG. 2 represents a logic diagram illustrating the progress of the steps of the method according to the invention in this example.
• the first step will of course for this operator to select, in a diagnostic tool 101, the request we will call REQ1 corresponding to this request.
• the method comprises a transmission step 201 of the diagnostic request REQ1 from the diagnostic tool 101 to the first computer 102 via a wireless connection.
• the request is thus transmitted without physical contact between the vehicle 100 and the diagnostic tool 101.
• the request further contains an ADR_REQ request address and an ADR_REP response address of the computer 103 which must functionally process this request: in this case, the engine control computer 103 in our example.
• the first computer 102 On receipt of this request, the first computer 102 stores in memory the addresses ADR_REQ, ADR_REP of the engine control computer 103 and the request REQ1.
• the method then comprises the transmission 202 of a request to open a remote diagnostic session (denoted DO_opening), from the first computer 102 to the second computer 103.
• the request for remote diagnostic logon 202 contains the address ADR_REQ stored in memory.
• the request is sent on the data bus 104.
• the second computer 103 recognizes its destination address ADR_REQ and receives the request 301.
• the second computer 103 checks 302 if the request is a telediagnostic logon request.
• the second computer 103 switches 303 in the remote diagnosis session, sets the internal indicator 304 to a valid state and sends the first computer 102 a message indicating that it is in the requested remote diagnostic session (noted TD_Ouvert), the message includes the response address ADR_REP of the second computer 103.
• the first computer 102 On receipt by the first computer 102 of the confirmation message, the first computer 102 compares the address of the message with the ADR_REP address that it has kept in memory so as to verify that the answer is that which corresponds to the request previously transmitted. The first computer 102 does not return this message to the diagnostic tool 101.
• the first computer 102 transmits the request REQ1 (in the example the request for reading the water temperature information) to the second computer 103 (the engine control computer) which he kept the address ADR_REQ in memory.
• the second computer 103 recognizes its destination ADR_REQ address, receives the request 301 and 103 checks 302 if the request is a remote diagnostic logon request.
• the second engine computer 103 verifies 306 that its remote diagnosis indicator is set to a valid state and that the REQ1 request is one of the allowed requests in the remote diagnosis session 306 (using the table). If this is the case, as in our example, the second computer 103 executes the request 307 and sends 205 a response message (denoted R1) containing the water temperature information to the first computer 102.
• the second computer 103 sends a negative response message 308, indicating that it can not answer the request.
• the first computer 102 transmits 206 this response R1 to the diagnostic tool 101 and sends 207 to the second computer 103 a request to close the remote diagnostic session (denoted Fermeture_TD).
• the second computer 103 On receipt of this request, the second computer 103 repositions its internal indicator remote diagnostic invalid and transmits 208 to the first computer 102 a response confirming the closure of the remote diagnostic session (denoted TD_closed). This last message is also not transmitted to the diagnostic tool 101.
• the first computer 102 upon power-up, starts from the beginning of the process at the log-on request step 202.
• the destination computer 103, 105 repositions the internal diagnostic remote indicator is disabled when the power is turned back on.
• the first computer 102 is not directly connected to the data bus 104 of the vehicle.
• the first computer 102 is connected to an intermediate computer, itself connected to the data bus 104 and serving as gateway or message switcher.
• Each of the messages or requests exchanged between the first computer 102 and the destination computer 103 then passes through the intermediate computer.
• the intermediate computer may for example be the third computer 105.
• FIG. 4 illustrates this variant embodiment of the system according to the invention in which the vehicle 410 comprises an intermediate computer 105.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Vehicle Cleaning, Maintenance, Repair, Refitting, And Outriggers (AREA)
• Selective Calling Equipment (AREA)

Applications Claiming Priority (2)

Publications (2)

Family

ID=47557324

Family Applications (1)

Country Status (4)

Families Citing this family (8)

Family Cites Families (8)

• 2012
  • 2012-11-16 FR FR1260919A patent/FR2998237B1/fr not_active Expired - Fee Related
• 2013
  • 2013-11-04 CN CN201380059992.9A patent/CN104956407B/zh active Active
  • 2013-11-04 EP EP13803102.6A patent/EP2920768B1/de active Active
  • 2013-11-04 WO PCT/FR2013/052623 patent/WO2014076386A1/fr not_active Ceased

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events