METHOD FOR DETERMINING A PERIOD

Abstract

A method for determining a period in a vehicle using several time sources.

Claims

1. A method for determining a period in a vehicle, comprising: receiving a quantity of time information from, in each case, a time source external to the vehicle, wherein a respective time source confidence measure is assigned to each time source, establishing the period based on the time information, and establishing a total confidence measure assigned to the period based on the time source confidence measures.

2. The method according to claim 1, wherein the time information is received from time sources which are selected from the group consisting of: infrastructure facilities, roadside units, other vehicles, special operations vehicles, backend systems, intelligent transport systems, radio-controlled clocks, public key infrastructure systems, satellites, and a mobile network.

3. The method according to claim 1, wherein the time information is weighted during the establishment of the period.

4. The method according to claim 3, wherein the weighting given to a piece of time information is all the higher, the higher the respective time source confidence measure of the time source is from which the time information was received.

5. The method according to claim 1, wherein a respective time source confidence measure is indicative of the accuracy and/or the reliability of the respective time source.

6. The method according to claim 1, wherein a deviation between the time information is additionally determined.

7. The method according to claim 6, wherein the total confidence measure is additionally established based on the deviation.

8. The method according to claim 6, wherein an examination is activated in response to the deviation exceeding a prescribed threshold.

9. The method according to claim 1, wherein failure periods based on different time sources are compared with one another following a failure of a system implementing the method, wherein, if a deviation between the failure periods exceeds a threshold, it is ascertained that the period established is unreliable.

10. The method according to claim 1, in which a continual measure of time is additionally advanced by an oscillator, wherein the measure of time is updated by the established period.

11. The method according to claim 10, wherein the measure of time is only updated if the total confidence measure of the period exceeds a predetermined threshold.

12. The method according to claim 10, wherein the measure of time is updated at prescribed intervals and/or after prescribed events.

13. The method according to claim 10, wherein the measure of time is implemented such that it can exclusively be amended to later periods.

14. The method according to claim 10, wherein, in the event of a system administering the measure of time being switched off, the measure of time and/or a quantity of periods is/are stored.

15. The method according to claim 10, wherein the measure of time is not used for prescribed tasks until after an update or after a prescribed minimum number of updates.

16. The method according to claim 2, wherein the time information is weighted during the establishment of the period.

17. The method according to claim 7, wherein an examination is activated in response to the deviation exceeding a prescribed threshold.

18. The method according to claim 11, wherein the measure of time is updated at prescribed intervals and/or after prescribed events.

19. The method according to claim 10, wherein the measure of time is updated at prescribed intervals and/or after a power failure.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The person skilled in the art will infer further features and advantages from the embodiment example described below with respect to the appended drawing, wherein: The FIGURE shows a vehicle which is configured to execute a method according to an aspect of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0059] The FIGURE shows a vehicle 10 which is merely represented schematically here. The vehicle 10 has a control module 20 which is configured to perform one possible embodiment of a method according to an aspect of the invention. The control module 20 is also merely schematically represented here.

[0060] The vehicle 10 has an antenna 22 which can receive a variety of signals. The antenna 22 is connected to the control module 20 as shown.

[0061] In the present embodiment, vehicle-to-X messages are in particular received by means of the antenna 22, which vehicle-to-X messages can originate for example from a further vehicle 30 which is also merely represented schematically and by way of example. Furthermore, satellite navigation signals are received, which can originate for example from a satellite 40 which is merely represented schematically and by way of example.

[0062] Both vehicle-to-X messages and satellite navigation signals contain time information. The control module 20 uses this time information and determines a combined measure of time therewith, which is effected in the form of weighted averaging. The time sources, that is to say the further vehicle 30 and the satellite 40 here, are in this case weighted with regard to their reliability and accuracy. This means that an overall more reliable measure of time can be obtained overall than when only one time source is used.

[0063] Furthermore, a deviation between the periods supplied by the two time sources is constantly established. In the event that these exceed a specific value, an error search procedure is activated, which searches for errors in the system or with the time sources. In the event of a corresponding deviation, the use of the determined period can, for example, be temporarily suspended for critical applications.

[0064] A continual measure of time, which is advanced by an oscillator, is further implemented in the control module 20. The measure of time is implemented such that it can only be advanced towards later periods. In the event of a power failure, this measure of time remains at its last value prior to the power failure. Following the power failure, it is advanced further by the oscillator. If a sufficiently reliable period has been established, as has just been described, the measure of time is updated so that the period of the power failure is bridged therewith until such time as a current measure of time is available again. The described implementation prevents a rewinding of the measure of time so that attackers cannot lead the vehicle 10 to think that the period is earlier than it actually is by means of compromised messages. In this way, attacks involving vehicle-to-X messages being recorded and sent out, simulating an incorrect period, at later points in time and being identified as valid messages, are impeded.

[0065] It should be pointed out in general that vehicle-to-X communication means, in particular, a direct communication between vehicles and/or between vehicles and infrastructure facilities. For example, therefore, vehicle-to-vehicle communication or vehicle-to-infrastructure communication may be involved. Where communication between vehicles is referred to within the framework of this application, this can essentially, for example, take place within the framework of vehicle-to-vehicle communication, which typically takes place without the intermediary of a mobile network or a similar external infrastructure and which can therefore be distinguished from other solutions which, for example, are based on a mobile network. For example, vehicle-to-X communication can take place using the standards IEEE 802.11p or IEEE 1609.4. Vehicle-to-X communication can also be referred to as C2X communication. The sub-areas can be referred to as C2C (Car-to-Car) or C2I (Car-to-Infrastructure). Aspects of the invention expressly do not, however, exclude vehicle-to-X communication with the intermediary of, for example, a mobile network.

[0066] The indicated steps of the method according to an aspect of the invention can be executed in the indicated order. They can, however, also be executed in another order. The method according to an aspect of the invention can be executed in one of its embodiments, for example with a specific combination of steps, such that no further steps are executed. However, further steps can essentially also be executed, including those which are not indicated.

[0067] The claims which form part of the application do not constitute a waiver of the attainment of more extensive protection.

[0068] If in the course of the proceedings it transpires that a feature or a group of features is not absolutely necessary, then the applicant here and now seeks a wording of at least one independent claim, no longer comprising the feature or the group of features. This may, for example, involve a sub-combination of a claim existing as at the application date or a sub-combination of a claim existing as at the application date restricted by further features. Such claims or combinations of features, which are to be newly worded, are understood to also be covered by the disclosure of this application.

[0069] It is further pointed out that configurations, features and variants of aspects of the invention, which are described in the various embodiments or embodiment examples and/or shown in the FIGURES, can be combined with one another as desired. Individual or multiple features are interchangeable as desired. Resulting combinations of features are understood to also be covered by the disclosure of this application.

[0070] Back references in dependent claims should not be construed as a waiver of the right to independent, objective protection for the features of the subclaims referred back to. These features can also be used in any combination with other features.

[0071] Features which are only disclosed in the description or features which are disclosed in the description or a claim only in conjunction with other features can, in principle, be of independent inventive relevance. They can therefore also be included separately in claims to distinguish from the prior art.