WO2022171409A1 - Method and device for preparing refueling - Google Patents

Abstract

The invention relates to a method (1-7) for preparing refueling, characterized by the following features: - a location is determined (3) by the first subscriber, - on the basis of the location, the first subscriber checks a general acceptance of a security feature (4) that assumes a known form at the second subscriber's end, and - if there is acceptance, the first subscriber uses the known form of the security feature to prepare refueling (5).

Description

description

title

Method and device for preparing a refueling

The present invention relates to a method for preparing a refueling. The present invention also relates to a corresponding device, a corresponding computer program and a corresponding storage medium.

State of the art

US2013139897A1 provides a system and method for safely filling hydrogen using real-time hydrogen tank expansion data. The system includes an expansion measurement unit, an on-vehicle control unit, a service station-side control unit, and a wireless communication unit. The expansion measuring unit is arranged on a hydrogen tank of the vehicle and measures the degree of expansion of the hydrogen tank and generates an output signal accordingly. The on-board control unit converts the output signal into a wireless output signal. The forecourt control unit stops hydrogen refilling by a hydrogen filling device when the wireless output signal indicates an unsafe level of tank expansion. The wireless communication unit is provided to carry out wireless data communication between the vehicle-side control unit and the gas station-side control unit.

US2020276909A1, US10800281B2 and US2020346554A1 describe further communication systems and methods for hydrogen refueling and charging of electric vehicles. The method proposed in US20130091042A1 and the security system based on it provides security based on geographic location with different levels of access and allows the user to select entities to be protected, geographic locations, geographic boundaries, permissions and access levels for specific geographic locations and geographic boundaries, and security alerts to configure. They make decisions to grant, deny, or assign a specific level of access based on the user's current geographic location and their own configuration for that geographic location or boundary, and send out security alerts.

US2018213376A1 discloses a method for configuring so-called V2X communication.

Disclosure of Invention

The invention provides a method for preparing a refueling, a corresponding device, a corresponding computer program and a corresponding machine-readable storage medium according to the independent claims.

The approach according to the invention is based on the knowledge that the accelerated refueling of hydrogen gas, for example, should take into account the thermodynamics of the refueling process and should therefore regulate the process in a closed manner. For reasons of (functional and general) safety, the maximum temperature and maximum pressure specified for the tank container must not be exceeded at any time.

Known methods for transmitting data from the vehicle to the fuel pump have various disadvantages in this regard. A conventional unidirectional infrared connection between the vehicle and the fuel pump is severely impaired by scratches on the transmitting or receiving optics and by ice formation around the fuel nozzle or nozzle and is therefore affected by failures in practice, which makes accelerated refueling impossible. Such a unidirectional In addition, the connection does not provide for a return channel from the fuel pump to the vehicle, so that the supported fueling process cannot be called up and therefore no agreement can be reached on a process that is optimal for the given combination of vehicle and fuel pump.

The proposed method also takes into account the fact that metallic contacts, which are essential for wired communication, should be avoided when refueling with hydrogen, especially in the vicinity of the tank coupling, because any sparks here could ignite the hydrogen gas explosively. Wireless (radio-based) communication is therefore preferable to wired communication to protect the filling station from explosions.

However, due to the unimpeded propagation of the radio waves, the use of radio involves special challenges that are overcome according to the invention. A triggering event is required to activate the overall process. In addition, the radio link must transmit data so reliably that the functional and general safety of the refueling can be guaranteed. In particular, third parties who are within radio range of the vehicle or fuel pump should not be able to interfere with or manipulate the process, for example through jamming or overload attacks (denial of service, DoS). Finally, it should be borne in mind that all vehicles and petrol pumps within the radio range, which usually covers an entire petrol station, receive each other's radio signals.

The participants that interact during a single refueling operation, i.e. vehicle and fuel pump, must therefore find and identify each other independently.

In summary, the radio connection must be information and operationally secure before refueling. The procedure described below achieves this goal regardless of the radio technology, tank station infrastructure and hardware used. It is also independent of the technology used for location determination and can be used for refueling any fuel (gaseous or liquid) as well as charging electric vehicles. A basic idea of the proposed solution is that the participants determine their own or each other's position and possibly other parameters. If this is within certain predefined ranges, then defined actions are permitted. Conversely, exclusion zones can be defined in which defined actions are never permitted, i.e. are forbidden, so to speak. In this way, IT security and functional security can be increased cost-effectively, since radar, lidar, ultrasonic parking sensors and video cameras for detecting the surroundings are available on the market in large variety and are usually already provided in petrol stations and vehicles, especially semi-automated ones are, so that they can be reused within the scope of a method according to the invention without any appreciable additional design effort.

Advantageous further developments and improvements of the basic idea specified in the independent claim are possible as a result of the measures listed in the dependent claims. Provision can thus be made for a vehicle to be able to find the gas station or charging station supplying it and identify it unambiguously as well as reliably in terms of operation and information, and vice versa. The ambiguity resulting from a large number of vehicles and fuel pumps present can be resolved in this way and increased functional safety requirements can be met.

According to further aspects, it can be provided that the vehicle and the fuel pump mutually authenticate and authorize each other for the fueling process. This in turn enables automated refueling processes and billing. In this way, it can also be ensured that the vehicle and fuel pump are compatible with each other because they meet the functional safety requirements set by both parties and verified by communication.

Finally, it can be provided that the vehicle and fuel pump secure their radio communication - for example by exchanging a cryptographic key - with regard to possible tapping or manipulation attempts and other attacks by third parties, despite a jamming or denial of service attack can continue to communicate with each other in a rudimentary manner and maintain makeshift system operation or transmit a signal to meet functional security requirements, e.g. B. a dead man or so-called keepalive signal.

Brief description of the drawings

Embodiments of the invention are shown in the drawings and explained in more detail in the following description. It shows:

Figure 1 the preparation and initialization phase of a refueling.

FIG. 2 shows the flow chart of a method according to a first embodiment.

FIG. 3 schematically shows a control device according to a second embodiment. Embodiments of the invention

A refueling scenario at a gas station, where a fuel cell vehicle is to be refueled with gaseous hydrogen, for example, is considered as an example. However, the method is applicable to all types of fuels (gaseous, liquid, cryogenic, etc.) and to charging electric vehicles. In addition, it is irrelevant whether the refueling is done manually or automatically or is billed or whether it concerns a conventional, (partially) automated or autonomous vehicle. It is also possible that a conventional, partially automated or autonomous refueling vehicle drives to the vehicle to be refueled and refuels it. Finally, the method can be combined with any other method of IT security or functional safety.

According to the invention, characteristics of security features, for example the values for pressure and temperature in the tank container, are transmitted via radio technology before, during or after the refueling process. Conceivable is that at least part of this data transmission must meet increased requirements for IT security and functional safety.

FIG. 1 shows the preparation (10) according to the invention for operating such a radio connection. In the course of this preparation (10), the proposed method can be used in various steps, particularly when secrets are to be transmitted via radio.

For this purpose, the own position (e.g. of the vehicle within the gas station) or the position of the partner is determined with any technology. Individual requirements can be logically linked to more complex requirements, e.g. B. with regard to the simultaneous stay of the vehicle in a first area and the fuel pump in a second area. If the position is within the previously defined area - for example based on an area projected onto the floor or a room volume - then security features (see below) transmitted by radio in plain text are accepted and used. However, if the subscriber in question is outside of this area, the transmitted data or security features are discarded or ignored because they are considered insecure.

The procedure can be carried out in two variants. According to the first variant, the position is determined first and the security feature is only sent at all if the position matches. According to the second variant, the security feature - expediently in a variable form - can be sent at any point in time and only accepted if the position allows it.

In this way, the window of vulnerability to cyber attacks is reduced, thereby increasing the IT security of the process. Only a little additional logic is required for this, which can also be implemented with little effort and reuse of the localization method. The definition of the relevant areas can e.g. B. done centrally and stored in a trustworthy database, so that the fuel pump and vehicle can call up this information. The areas stored in this way can relate to your own position or that of the other person. The vehicle may only accept the security feature "fuel pump identification number" if it is actually at a fuel station. Conversely, it is conceivable that the fuel pump only accepts a cryptographic key as a security feature when the vehicle is at the fuel station.

The method (1-7) used for this is shown in FIG. 2 and is as follows in one embodiment:

In an optional first step (process 1), a partner or a central control unit sends configuration information to at least one of the participants, e.g. B. regarding the backup procedure to be used.

In a second step (process 2), at least one of the partners receives this information.

In a third step (process 3), at least one partner determines his or her current position or that of the other party within a reference system. On the one hand, this can be done actively by own sensors such as GPS receivers, other radio methods, ultrasonic sensors, radar or detection of optical markers in a camera image. On the other hand, it is conceivable that the device is localized by external components and the position determined in this way is transmitted to the mobile device. The transmission should be encrypted and only take place after the external source has been authenticated in order to largely rule out manipulation of the position.

In a fourth step (process 4), the partner in question compares their own position with a digital map, possibly represented by a table or database, which shows whether at least one transmitted security feature is generically accepted at the determined location. In the simplest case, said location can be represented by reference values of the sensors used (internal or external, see above). In the event that one of the transmitted security features is accepted in principle, this partner evaluates the received data and uses the known expression of the security feature to prepare (10-FIG. 1) for refueling (process 5). Otherwise, it discards or caches them until the position meets a given requirement for acceptance (process 6).

Finally (process 7), the partner reports back to any central control unit or counterpart that the security feature was successfully received and used or the reason why this failed.

This method (1-7) makes it possible for the vehicle and the filling station to exchange information openly by radio communication while still guaranteeing a certain level of IT security. In particular, the following use cases come into consideration:

1) The fuel pump can use the location (process 3) of a vehicle at its fuel station as a triggering event (11, 12 - Figure 1). The method can also be carried out with reversed roles.

2) The vehicle and fuel pump exchange a mutual identification number (ID) on the radio channel, by means of which they can couple to one another (16 - FIG. 1) and clearly identify radio signals to the respective counterpart. Because a vehicle can only send a new ID to the filling station if it has just driven to a filling station (all vehicles already filling up have already exchanged an ID), the ID can optionally be linked to the time of location (process 3).

3) If the ID is universally unique, then - e.g. B. by a database query - more information about capabilities and other characteristics of the vehicle or fuel pump can be retrieved.

4) If a cryptographic feature is transmitted during radio transmission, e.g. B. a public key of an asymmetric Encryption process, the parties can then authenticate each other wirelessly and authorize specific actions.

5) In particular, a session key can be agreed for a symmetrical cryptosystem for setting up an information-secure radio link (17--FIG. 1).

6) For the same purpose, an initial key or an initialization value (seecO) can be transmitted by radio, from which a key for a symmetric cryptosystem can be derived using another secret known to both sides.

7) Using a so-called zero-knowledge protocol, the partners can e.g. B. mutually prove by querying another trustworthy central database that they have certain knowledge necessary for the refueling process, without revealing the latter themselves.

8) By using certificates, with the help of which information is generated and transmitted over the radio channel, the other party can provide evidence that it or its system meets standardized functional safety requirements.

9) A conventional challenge-response procedure can be initiated, after z. B. a vehicle is told which position it should go to, and the latter is checked by location.

10) A keepalive mechanism can be implemented by repeated location determination (process 3), in that at least one side periodically transmits location signals with the same or varying period duration and the other side transmits these signals in each case - e.g. e.g. using a simple technology-specific energy detector - and in the event of their absence or deviation from a given reference signal, transitions to a safe state. 11) The identification or other status information about the process can be shown on a display in the vehicle or on a display on the fuel pump.

Further measures can be implemented in the context of the basic procedure described (1-7). For example, the characteristics of certain security features can be protected against changes after they have been successfully transmitted for the first time. She is then z. B. unchangeable until the end of the refueling process, even if the corresponding position is within the permissible range and the security feature in question assumes a new form.

Furthermore, the comparison of positions with other zones can be used to meet functional safety requirements, e.g. B. by checking that the vehicle does not move during the fueling process. As soon as this requirement is no longer met, the system goes into a safe state.

In addition, other parameters of other types of sensors can also be included in the safety conditions, e.g. B. the orientation in a compass direction defined by the earth's magnetic field. For example, it is conceivable that certain security features would only be accepted by a vehicle facing south at the correct refueling point, but not by a vehicle facing north at the same refueling point. Correspondingly, other sensors, measured variables and physical phenomena such as light, humidity, acoustics, air pressure, vibration, linear acceleration, rotation, moving or still images, ultrasonic, radar or lidar signatures or their time profile can be used as parameters.

This method (1-7) can be implemented, for example, in software or hardware or in a mixed form of software and hardware, for example in a control unit (30), as the schematic illustration in FIG. 3 illustrates.

Claims

Expectations 1. Method (1-7) for preparing (10) a refueling with a first participant and a second participant, characterized by the following features: - a location is determined by the first participant (3), - On the basis of the location, the first participant checks the basic acceptance of a security feature (4), which takes on a known form for the second participant, and - If acceptance is given, the first participant uses the known form of the security feature to prepare (10) for refueling (5). 2. Method (1-7) according to claim 1, characterized by one of the following features: - If acceptance is refused (6), the first participant rejects the expression of the security feature or - If acceptance is denied (6), the first participant stores the expression of the security feature and repeats the determination (3) of the location until it meets a given requirement for acceptance. 3. Method (1-7) according to claim 1 or 2, characterized by at least one of the following features: - The first participant reports (7) the acceptance to a central controller or - The first participant reports (7) the acceptance to the second participant. 4. Method (1-7) according to claim 3, characterized by the following features: - the second participant or the controller transmits (1) advance configuration data relating to the refueling, - The first participant receives (2) the configuration data and - Determining (3) the location and checking (4) the acceptance take place depending on the configuration data. 5. The method (1-7) according to any one of claims 1 to 4, characterized by the following features: - In response to an event (3, 11, 12) triggering the preparation (10), in particular when a fuel nozzle is removed (11) or a tank flap is opened (12), the participants, preferably after activating an immobilizer (13), become one Leakage test (14) subjected and - If the participants pass the test (14), the protocol is continued, preferably by releasing a tank valve for refueling (15). 6. The method (1-7) according to any one of claims 1 to 5, characterized by the following features: - After a coupling (16) of the participants, they build up an information-secure (17) and operationally reliable (18) radio link and - the participants negotiate, preferably by means of a database, via the radio connection, a refueling service (19) to be provided, a refueling protocol (20) to be followed and refueling parameters (21) to be taken into account. 7. Method (1-7) according to claim 6, characterized by the following features: - According to the refueling parameters, a plan (22) for refueling is taken and - by means of the radio link, the participants inform each other about the plan (22). 8. Computer program which is set up to carry out the method (1-7) according to any one of claims 1 to 7. 9. Machine-readable storage medium on which the computer program according to claim 8 is stored. 10. Device (30), which is set up, the method (1-7) according to one of Claims 1 to 7 to execute.