DE102019108504A1 - System for data transmission for a commercial vehicle and method for this - Google Patents

Abstract

The present invention relates to a system (10) for data transmission for a commercial vehicle, with at least one first communication path (12) and with at least one second communication path (14), the first communication path (12) having a first protection module (16) and the The second communication path (14) has a second protection module (18), the first protection module (16) being designed and set up in a first way to protect data to be sent via the first communication path (12), and the second protection module (18) is designed and set up in a second way, different from the first way, to secure data to be sent via the second communication path (14).

Description

The present invention relates to a system for data transmission for a commercial vehicle and a method for this.

Systems for data transmission in commercial vehicles and the corresponding methods are used for secure data transmission on the on-board communication means of vehicles, in particular commercial vehicles. In particular, the question of securing the communication channels of electronic systems and components for such vehicles arises.

The requirement to provide adequate protection is made, for example, by safety standards in the automotive industry, such as ISO 26262 and other standards.

In relation to the protection of data communication, there are a number of basic methods that are widely used as individual methods and are referenced by common technical standards.

About calls the safety standard ISO 26262 a number of such methods for protection, such as "information redundancy", "frame counter" etc. ( ISO 26262-5 Table D6).

However, the concrete application and design of the methods is not specified and the achievement of an appropriate level of security is left to the developer himself.

The strength of a protection of the communication by means of a protocol depends on the exact design of the protocol or the protection measures.

It is therefore limited / influenced, for example by the technical possibilities of the protocol (configuration), the transmission unit or the requirements for a maximum transmission time (per measured value) etc.

It would be desirable to improve the overall security of the communication channels in order to be able to rule out remote access and manipulation.

According to the invention, this object is achieved by a system for data transmission for a commercial vehicle having the features of claim 1.

It is then provided that a system for data transmission for a commercial vehicle is provided, with at least one first communication path and with at least one second communication path, the first communication path having a first protection module and the second communication path having a second protection module, the first protection module such is designed and set up to secure data to be sent via the first communication path in a first way, and wherein the second protection module is set up and set up in a second way that differs from the first way and / or in an at least partially identical way and Way to secure data to be sent via the second communication path.

The invention is based on the basic idea that the fundamental technological possibilities of transmission protocols in the context of redundant versions of the communication paths are used in an advantageous manner. Redundancy is achieved by providing at least two communication paths. Then there should be diversity with regard to the communication content with regard to data and measurement data on the redundant communication channels. The diversity also affects the design of the security measures for the individual redundant communication channels. This enables increased security of communication. The advantages are, in particular, a higher level of protection and a lower residual risk for the population and users of the devices. In model calculations based on ISO 26262, it was possible to show that the invention can markedly increase the ability to detect communication errors (so-called diagnostic coverage). This increase can be around 30% (relative) or much higher, depending on the application context.

The further advantage that goes beyond the purely numerically calculated increase in diagnostic coverage is that (increased) protection against communication errors with regard to various causes can be created.

Further advantages are, for example, that it is possible to achieve the requirements of higher automotive safety integrity levels. In addition, it is possible to use newer and further technologies in the product as well as further components or protocols accordingly. A larger scope of required integrity levels with the same technology or the same components is also made possible. This allows economies of scale in purchasing, such as cost reduction, streamlining in the procurement effort, generally better cost management. Another advantage is that implementation with so-called "off the shelf" components improves the overall provision and design of the systems. It is not Change to a custom protocol is necessary, ie no self-produced solution is necessary, since existing solutions can be used in new combinations. Overall, the development effort and the change effort can be reduced and at the same time the availability ensured.

It is also possible to achieve savings in components, for example in internal vehicle communication, such as CAN communication (Can transmitters or external microcontrollers, which should be mentioned in this context).

A faster data / measured value transmission in the sense of a refresh rate of the protocols, the updater rate, a higher number of message packets or useful data per time is also made possible. This is also due to a shorter "telegram length" when maintaining or increasing the protection.

In particular, it can be provided that the first protection module and the second protection module are designed and set up in such a way that the protection level of the first protection module differs from the protection level of the second protection module or vice versa. In particular, the aim is to ensure that a higher degree of protection can be achieved through a diversity of the protection than is the case with conventional methods.

In particular, it can be provided that the first protection module and the second protection module implement asymmetrical protection of the data to be sent. The asymmetry improves the protection and thus a higher degree of protection. At the same time, the overall effort of the security measures is lower than is the case with symmetrical security, which at the same time strives for a very high degree of protection.

The strengths of the protection can be different in each case, so that in the later offsetting, i.e. in the comparison, an overall stronger protection, and with inverted data values, a higher resolution can be achieved.

The data can in particular be and / or comprise sensor data. Sensor data are to be used particularly advantageously here or the system presented works with sensor data particularly advantageously because these are often provided with partially safety-critical runtime and timing requirements for which other security methods, such as integrating or comparing several data values sent one after the other, are problematic and time-consuming are disadvantageous.

In addition, it can be provided that the first protection module is designed and set up in such a way that a message counter functionality takes place or can take place on the first communication path.

In particular, protection can be provided against inserted and / or lost and / or repeatedly sent message packets. It is conceivable, for example, that the message counters are so-called rolling counters, which enable protection against, among other things, inserted, lost or repeatedly sent message packets. Based on ISO 26262, for example, an average security level of 8 bits should be mentioned as the security level.

Furthermore, it can be provided that the first protection module is additionally designed and set up in such a way that an information redundancy functionality takes place or can take place on the first communication path, in which a protection of at least part of the user data by repeated and / or inverted storage in sent message packets. This can be, for example, a so-called information redundancy using redundant bits, i.e. a protection of a small part of the user data by repeated (possibly inverted) storage in the message packet. The strength here is a low strength of 4 bits.

It is also conceivable that the first protection module is additionally designed and set up in such a way that a CRC information redundancy functionality takes place or can take place on the first communication path, in which at least part of the useful data is secured by forming a checksum. With information redundancy ("CRC"), the user data is secured by forming a checksum, the strength of which, however, clearly depends on the length of the bits. A low strength of 4bit should be mentioned as strength.

It is conceivable, for example, that the first communication path is identical to the second communication path.

In particular, it can be provided that the second protection module is designed and set up such that a message counter functionality takes place or can take place on the second communication path, in particular with protection against inserted and / or lost and / or repeatedly sent message packets.

It is also conceivable that the second protection module is designed and set up in such a way that information redundancy functionality takes place or can take place on the second communication path in which at least part of the user data is protected by repeated and / or inverted storage in sent message packets .

It is also conceivable that the second protection module is additionally designed and set up in such a way that a CRC information redundancy functionality takes place or can take place on the second communication path in which at least part of the user data is secured by forming a checksum.

It is also conceivable that the information redundancy functionality of the second protection module is designed and created in such a way that the entire part of the useful data is protected by repeated and / or inverted storage in sent message packets.

In addition, provision can be made for a comparison module to be provided that is designed and set up in such a way that the data secured by means of the first and second security module are at least partially compared with one another after these data have been sent or received.

Further details and advantages of the invention will now be explained on the basis of an exemplary embodiment shown in more detail in the drawings.

• 1 ein erstes Ausführungsbeispiel eines Systems zur Datenübertragung für ein Nutzfahrzeug;
• 2 ein zweites Ausführungsbeispiel eines Systems zur Datenübertragung für ein Nutzfahrzeug; und
• 3 ein weiteres, drittes Ausführungsbeispiel eines Systems zur Datenübertragung für ein Nutzfahrzeug gemäß der vorliegenden Erfindung.

Show it:

• 1 a first embodiment of a system for data transmission for a commercial vehicle;
• 2 a second embodiment of a system for data transmission for a commercial vehicle; and
• 3 a further, third exemplary embodiment of a system for data transmission for a utility vehicle according to the present invention.

1 shows a first embodiment of a system 10 for data transmission for a commercial vehicle (the commercial vehicle is not shown in detail).

The system 10 has a first communication path 12 and at least one second communication path 14th on.

The first communication path 12 has a first protection module 16 on.

The second communication path 14th furthermore has a second protection module 18th on.

The first protection module 16 is created and set up in such a way that it is in a first way via the first communication path 12 can secure data to be sent.

The second protection module 18th is designed and set up in such a way that this can be done in a second way that differs from the first way via the second communication path 14th can secure data to be sent.

The system 10 can be used, for example, in connection with the communication of data from position sensors to a control unit of a commercial vehicle (electronic control unit (ECU)) or a microcontroller (µC).

An application for the communication of data between sensors / highly integrated hardware elements is also conceivable.

It is also possible that the system is used to communicate data within the ECU or between control units.

• Der erste Kommunikationspfad 12 mit dem ersten Absicherungsmodul 16 ist dabei derart beschaffen und ausgestaltet, dass die folgenden Maßnahmen umgesetzt werden:

The system 10 can be designed as follows (with a focus on increased coverage) with non-diversified redundancy in the coverage measures:

• The first communication path 12 with the first protection module 16 is created and designed in such a way that the following measures are implemented:

As a first measure M1 the communication protection in the first communication path 12 MessageCounters ("Rolling Counters") are used, which provide protection against, among other things, inserted, lost or repeatedly sent message packets (strength, based on ISO26262: medium, 8 bit).

As an additional second measure M2 in the first communication path 12 information redundancy ("Redundant Bits") takes place, which provides protection of a (small) part of the user data by repeated (possibly inverted) storage in the message package (strength: low, 4 bits).

As a further, additional third measure M3 in the first communication path 12 there is a further information redundancy ("CRC"), which safeguards the user data by creating a Checksum implemented, the strength of which, however, clearly depends on the length of the bits (strength: low, 4 bits).

The second communication path 14th with the second protection module 18th is created and designed in such a way that it is identical to the first communication path 12 with the first protection module 16 is formed and secured, ie the second communication path 14th with the second protection module 18th also implements the measures M1 , M2 and M3 , in 1 denoted by the reference symbols M1 ', M2' and M3 '.

The second communication path (with the same measures) can, assuming a downstream comparison logic, increase the overall security of the useful signal, but the basic weaknesses of the measures remain. For example, depending on the requirements of the application, the "redundant bits" measure does not provide any protection at all for large parts of the (possibly safety-critical) user data area.

2 shows a second embodiment of a system 110 for data transmission for a commercial vehicle (the commercial vehicle is not shown in detail).

The system 110 is identical to the system in terms of its structural and functional features 10 according to 1 and formed as described above. Identical or comparable characteristics are of value 100 marked with increased reference numbers.

• Das System 110 kann wie folgt (mit Fokus auf Absicherungserhöhung) mit diversitärer Redundanz in den Absicherungsmaßnahmen ausgestaltet sein:

There are the following differences:

• The system 110 can be designed as follows (with a focus on increased coverage) with diverse redundancy in the coverage measures:

As a first measure M1 the communication protection in the first communication path 112 MessageCounters ("Rolling Counters") are used, which provide protection against, among other things, inserted, lost or repeated message packets (strength, based on ISO26262: medium, 8 bit).

As an additional second measure M2 in the first communication path 112 information redundancy ("Redundant Bits") takes place, which provides protection of a (small) part of the user data by repeated (possibly inverted) storage in the message package (strength: low, 4 bits).

As a further, additional third measure M3 in the first communication path 112 there is another information redundancy (“CRC”), which secures the user data by forming a checksum, the strength of which, however, clearly depends on the length of the bits (strength: low, 4 bits).

• Als erste Maßnahme M4 im zweiten Kommunikationspfad 114 erfolgt eine Information Redundancy („Redundant Bits“), die eine Absicherung des gesamten Teils der Nutzdaten durch wiederholtes (ggf. invertiertes) Ablegen im Nachrichtenpakte (Stärke: hoch, 12bit) bietet.

Notwithstanding the above-described first embodiment according to 1 is the second communication path 114 designed differently as follows:

• As a first measure M4 in the second communication path 114 information redundancy ("redundant bits") takes place, which offers protection of the entire part of the user data by repeated (possibly inverted) storage in the message package (strength: high, 12 bit).

As a further, additional second measure M5 in the second communication path 114 there is another information redundancy (“CRC”), which secures the user data by forming a checksum, the strength of which, however, clearly depends on the length of the bits (strength: low, 4 bits).

The diverse safeguarding of the communication path enables a downstream comparison logic to combine the strengths of the safeguarding measures profitably. With a suitable design, in practice there will be no message counter in the second communication path 114 highly negligible / no influence on the overall protection that can be achieved, while the increase in information redundancy can bring about a great gain in protection (e.g. through redundancy of all or all of the 'safety significant bits').

One advantage of this architecture is that in this so-called diverse design, the (measurement) data transmission is more secure.

In addition, other diverse configurations are advantageous and can be implemented (for example, strong “CRC” when “redundant bit” or “rolling counter” is not used in a communication path). These options for diversified hedging are also included here, even if they are not given as an example down to the last detail.

Furthermore, the above example of the comparison logic enables not only the improved detection of communication errors but also the evaluation and methods of compensation. For example through a 2oo3 voting with optimal / high resolution / accuracy of the user data area (12bit x 3 (+ 4bit x 1)). Advantage in terms of robustness of communication and in terms of fail-operational properties.

3 shows a second embodiment of a system 210 for data transmission for a commercial vehicle (the commercial vehicle is not shown in detail).

The system 210 is identical to the system in terms of its structural and functional features 10 according to 1 and formed as described above. Identical or comparable characteristics are of value 200 marked with increased reference numbers.

• Das System 210 kann wie folgt (mit Fokus auf schnelle Datenverfügbarkeit, bei dennoch hoher Gesamtabsicherung) mit diversitärer Redundanz in den Absicherungsmaßnahmen ausgestaltet sein:
  • Der Kommunikationspfad 212 kann als „Maßnahme“ M6 auf kurze „Telegrammlänge“ und hohe Senderate/Updaterate getrimmt sein, z.B. durch Einsprung von Bits bei den Absicherungsmaßnahmen. Denkbar ist hier, nur (4bit) Rolling Counter, etc. einzusetzen.

There are the following differences:

• The system 210 can be designed as follows (with a focus on fast data availability, but with a high level of overall protection) with diverse redundancy in the protection measures:
  • The communication path 212 As a “measure” M6, it can be trimmed to a short “telegram length” and a high transmission rate / update rate, eg by inserting bits during the security measures. It is conceivable to only use (4-bit) rolling counters, etc. here.

The communication path 214 can be equipped as a "measure" M7 with a longer "telegram length" and strong security measures, eg with rolling counter, many redundant bits, strong CRC, or comparable security measures.

It is also conceivable to coordinate the times so that, for example, the communication path 212 in an integer multiple of the communication path 214 sends.

This is particularly advantageous when realizing several (system) functions with different requirements with regard to protection and timing as well as when realizing a (system) function that has different requirements with regard to “performance timing” and “protection timing”. An application example in this context is given, for example, in connection with pressure sensors.

List of reference symbols

10

system

12

first communication path

14th

second communication path

16

first protection module

18th

second protection module

110

system

112

first communication path

114

second communication path

116

first protection module

118

second protection module

210

system

212

first communication path

214

second communication path

216

first protection module

218

second protection module

M1

measure

M2

measure

M3

measure

M4

measure

M5

measure

M6

measure

M7

measure

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Non-patent literature cited

• ISO 26262 [0005]
• ISO 26262-5 [0005]

Claims (12)

System (10; 110; 210) for data transmission for a commercial vehicle, with at least one first communication path (12; 112; 212) and with at least one second communication path (14; 114; 214), the first communication path (12; 112; 212 ) has a first protection module (16; 116; 216) and wherein the second communication path (14; 114; 214) has a second protection module (18; 118; 218), the first protection module (16; 116; 216) being designed and is set up to secure data to be sent via the first communication path (12; 112; 212) in a first way, and wherein the second protection module (18; 118; 218) is designed and set up in a second way, from the first way differentiating manner and / or in an at least partially identical manner to secure data to be sent via the second communication path (14; 114; 214). System according to Claim 1 , characterized in that the first protection module and the second protection module are designed and set up such that the protection level of the first protection module differs from the protection level of the second protection module or vice versa. System according to Claim 1 or Claim 2 , characterized in that an asymmetrical protection of the data to be sent is realized by the first protection module and the second protection module. System according to one of the preceding claims, characterized in that the data are at least partially or include sensor data. System according to one of the preceding claims, characterized in that the first protection module (16; 116) is designed and set up such that a message counter functionality takes place or can take place on the first communication path (12; 112), in particular with protection against inserted and / or lost and / or repeatedly sent message packets. System (10; 110) according to any one of the preceding claims, characterized in that the first protection module (16; 116) is designed and set up in such a way that information redundancy functionality takes place or can take place on the first communication path (12; 112) , in which at least part of the user data is protected by repeated and / or inverted storage in sent message packets. System (10; 110) according to any one of the preceding claims, characterized in that the first protection module (16; 116) is designed and set up in such a way that a CRC information redundancy functionality takes place on the first communication path (12; 112) or can take place in which at least a part of the user data is secured by forming a checksum. System (10) according to one of the preceding claims, characterized in that the second security module (18) is designed and set up in such a way that a message counter functionality takes place or can take place on the second communication path (14), in particular with protection against inserted and / or lost and / or repeatedly sent message packets takes place. System (10; 110) according to any one of the preceding claims, characterized in that the second protection module (18; 118) is designed and set up in such a way that information redundancy functionality takes place or can take place on the second communication path (14; 114) , in which at least part of the user data is protected by repeated and / or inverted storage in sent message packets. System (10; 110; 210) according to one of the preceding claims, characterized in that the second protection module (18; 118; 218) is additionally designed and set up in such a way that a CRC information redundancy functionality is provided on the second communication path (14 ; 114; 214) takes place or can take place in which at least part of the user data is secured by forming a checksum. System (10; 110) Claim 9 or Claim 10 , characterized in that the information redundancy functionality of the second protection module (18; 118) is designed and created in such a way that the entire part of the user data is protected by repeated and / or inverted storage in sent message packets. System (10; 110; 210) according to any one of the preceding claims, characterized in that there is also provided an alignment module that is designed and set up in such a way that the security modules (16; 18; 116; 118; 216; 218) secured data are at least partially compared with each other after these data have been sent or received.

Images