EP1966695A1

EP1966695A1 - Bus-guardian of a subscriber of a communication system, and subscriber for a communication system

Info

Publication number: EP1966695A1
Application number: EP06830568A
Authority: EP
Inventors: Thomas Fuehrer; Bernd Mueller
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2005-12-22
Filing date: 2006-12-12
Publication date: 2008-09-10
Also published as: CN101346698B; DE102005061392A1; WO2007074058A1; US20100229046A1; CN101346698A

Abstract

The invention relates to a monitoring unit (9) for monitoring and controlling access to a data bus (2) which is associated locally with a bus-controller (6) of a subscriber (3) of a communication system (1). Said bus-controller (6) accesses the data bus (2) via a bus-driver (8), and the monitoring unit (9) monitors and controls access authorisation of the bus-driver (8) to the data bus (2). The monitoring unit (9) comprises means (18, 19, 20, 21, 22) for producing a question-answer type communication with the bus controller in order to detect malfunctions which may be permanent, of the bus-controller (6) and thus resulting errors of the bus controller (6) when accessing the data bus (2) and the access of the bus-controller (6). The data bus (2) is only then released if the question-answer type communication produces an appropriate function of the bus-controller (6).

Description

Bus guardian of a subscriber of a communication system, as well as subscribers for a communication system

description

The present invention relates to a monitoring unit locally associated with a bus controller of a subscriber of a communication system for monitoring and controlling access to a data bus. The bus controller accesses the data bus via a bus driver, and the monitoring unit monitors and controls the access authorization of the bus driver.

The invention also relates to a subscriber of a communication system comprising a data bus. The subscriber has a bus controller and a bus driver, the bus controller being connected to the data bus via the bus driver. The subscriber has a monitoring unit assigned to the bus controller for monitoring and controlling the access authorization of the bus driver to the data bus.

State of the art

The networking of control devices, sensors and actuators using a communication system or data transmission system and a communication link, for example in the form of a bus system or a data bus, has in recent years in modern motor vehicles but also in other areas, such as in mechanical engineering, in particular Machine tools sector, and dramatically increased in automation. Synergy effects can be achieved by distributing functions over several subscribers, for example control devices, of the communication system. This is called distributed systems.

Communication between different subscribers of such a communication system takes place more and more via a bus system. The communication traffic on the bus system, access and reception mechanisms, as well as error handling are regulated by a protocol. Known protocols include CAN (Controller Area Network), TTCAN (Time Triggered CAN), TTP / C (Time Triggered Protocol Class C) and the FlexRay protocol, which is currently based on the FlexRay protocol specification v2.1. FlexRay is a fast, deterministic and fault-tolerant bus system, especially for use in motor vehicles. The FlexRay protocol operates on the principle of Time Division Multiple Access (TDMA), whereby the subscribers or the messages to be transmitted are assigned fixed time slots in which they have exclusive access to the communication connection. The time slots are repeated in a fixed cycle, so that the time at which a message is transmitted over the bus, can be accurately predicted and the bus access is deterministic.

In order to make the most of the bandwidth available for the transmission of messages on the bus system, FlexRay divides the communication cycle into a static and a dynamic part or into a static and a dynamic segment. The fixed time slots are located in the static part at the beginning of the bus cycle. In the dynamic part, the time slots are specified dynamically. Therein, the exclusive bus access is only possible for a short time, for the duration of at least one so-called mini slot. Only if a bus access occurs within a minislot, the time slot is extended to the time required for the access. Thus, bandwidth is only consumed when it is actually needed. FlexRay communicates via one or two physically separate lines with a maximum data rate of 10 Mb / s. Of course, FlexRay can also work with operated at lower data rates. The two channels correspond to the physical layer, in particular the so-called OSI (Open System Architecture) layer model. These are mainly used for the redundant and thus fault-tolerant transmission of messages, but can also transmit different messages, which could then double the data rate. It is also conceivable that the signal transmitted via the connecting lines results as a difference signal. The physical layer is designed such that it enables electrical or optical transmission of the signal or signals via the line (s) or a transmission by other means, for example by radio.

In order to realize synchronous functions and to optimize the bandwidth by small distances between two messages, the subscribers in the communication network need a common time base, the so-called global time. The global time is a system-wide time base to which the local times of the nodes (nodes or controllers) of the communication system are synchronized. Global time plays an important role in timing in communication and in the application (time-controlled operating systems such as (OSEKtime), but also in diagnostic functions and error detection or error handling, which means that each communication controller (host or participant) has one Such a communication system has its own clock (for example, a quartz oscillator), which is synchronized with all the other clocks in the system (so-called local time base) via the mechanism of global time synchronization messages in the static part of the synchronization Cycle, where using a special algorithm according to the FlexRay specification, the local time of a subscriber is corrected so that all local clocks run synchronously to a global clock.

For the various known communication systems, there are a number of ways to avoid or solve access conflicts. In CAN, for example, the so-called bitwise arbitration is used. This is very robust, but runtime phenomena limit the maximum transmission speed as a matter of principle. In time-controlled communication systems, the access problem is solved by approach and configuration, the conflicts are already avoided offline. Prerequisite, however, is a common understanding of the time, which has validity throughout the network (with FlexRay: global time). In these systems, however, there is usually no way to handle the access conflicts in the event of an error, since access can not be prevented in itself. Therefore, for safety-relevant or even safety-critical applications in the vehicle, for example, for X-by-wire systems, mechanisms for ensuring error-free data transmission via the communication system and to release the actuator of the sensor, such as electric motors or hydraulic pumps required. At different

Communication systems, such as TTP / C or FlexRay, it is known to introduce a so-called bus guardian (BG, bus guardian) as an additional monitoring unit that allows physical access to the data bus only in the pre-configured periods. Thus, the access conflict is solvable or avoidable even in the event of a fault.

In current concepts, the local bus guardian is supplied via the clock of the bus controller and its lap information is used for the monitoring function. The current FlexRay protocol specification v2.1 describes a concept that is limited in terms of the time monitoring of the communication protocol or the communication controller. In the known concept, a macrotick (MT) of the local FlexRay communication controller clocks its local bus guardian. The time slot with transmit activity is also indicated by the communication controller by an ARM signal. The timing (the temporal activities) of the monitored FlexRay communication controller is only by a

Coarse monitored RC oscillator or monitored by an additional quartz oscillator with higher resolution.

In principle, however, there remains the problem that smaller clock drifts of the local communication controller are transmitted to the bus guardian by the macrotick supply and the ARM signals. This means that if the clock correction of the FlexRay communication controller according to the protocol specification v2.1 erroneous or undetected setting of the clock register correcting registers, drifts the local communication controller relative to the rest of the communication network. The time slots for sending messages (transmit slots, transmit slots) will shift over time into the time slots of the other participants in the network without the local bus guardian being able to detect this situation and initiate appropriate countermeasures. This problem occurs especially with FlexRay and TTCAN.

Another problem case concerns the offset correction of the local times of the subscribers so that the local times are synchronous with the global time of the communication system. Offset correction is available, for example, with TTCAN, TTP / C, and FlexRay, whereby in FlexRay the offset correction phase takes place during the so-called Network Idle Time (NIT) of the local communication controller at the end of a communication cycle. The correction of the offset at the end of a communication round or a double round shortens or lengthens the local round within specified specified limits. The next round of communication begins sooner or later due to the correction of a few so-called microticks (μT). The local bus guardian must allow this offset correction. The timer monitor must accept this. However, there is no Bus Guardian knowledge regarding the effects of offset correction on the next communication round. Also in this case, the transmission timeslots of the different subscribers may overlap. The likelihood of overlap increases as the number of laps increases.

In both mentioned problem cases there is a permanent disturbance. On the other hand, spontaneous errors do not lead to this situation, since the communication protocol itself contains suitable corrective measures or provides error handling measures in order to recognize, correct and remedy spontaneous errors.

The Bus Guardian concept according to the FlexRay protocol specification v2.1 is based on the assumption that the described error cases due to permanent disturbances occur only with low probability or these disturbances or errors Additional measures can be detected in the participant host or by additional functionalities.

Furthermore, various methods for monitoring control devices (or process computers) are known from the state of the art. This can be done in the prior art by a so-called question-answer communication based on a 1 ¹ A computer concept. In DE 198 26 131 Al this monitoring concept for a wheel unit of a brake-by-wire system is shown. In this case, the actual control unit which is responsible for the actuation of the actuator (eg hydraulic wheel brakes) is monitored by a monitoring component and switched off in the event of an error. Control of the controller is based on a question-answer communication that follows a specified protocol. The release of the actuator is carried out exclusively on successful question-answer communication, ie the question asked by the monitoring component to the control unit is answered correctly by the controller on the one hand within a given time window and on the other hand and asked a question asked by the control unit of the Surveillance component correctly answered within a given time window. If the control unit and the monitoring component are asked questions that have the same correct answer, the release of the actuator is done only if the response of the controller with the response of the monitoring component (1 ¹ A computer concept). The principle of release is based on an electrical circuit, the so-called release circuit (in the known from DE 198 26 131 Al embodiment in the form of a UN D link), which is implemented between the control unit (the process computer) and the monitoring unit. This means that both components, ie the control unit and the monitoring component, have to apply a logical "1" to the enable circuit for a normal function of the actuator system. The shutdown of the Akuatorik takes place as soon as a process in the control unit gives the signal for shutdown. The monitoring component will only signal the switch-off if the monitored component, ie the control unit (the process computer), has been detected as faulty. Question-answer communication is a common method for monitoring ECUs in a motor vehicle. The independent monitoring unit (the so-called monitoring computer) has a list of questions that are preferably provided periodically to the actual process computer (control unit). These questions need

a) be answered within a given, specified time and b) the answer must be entered in a corresponding response table of the monitoring computer in response to the question previously asked.

The selection of questions from the list can be random or purely cyclic. An important part of the question-answer communication are the timers for preferably periodically starting the question-answer communication and setting the time window allowed for the answers. The time window describes the period between the earliest possible and the latest possible arrival of the answer.

Based on the described prior art, the present invention has the object to extend known Bus Guardian concepts for communication systems to the effect that even permanent disturbances in the participants or in the bus controllers of the participants are detected and corrected or corrected if necessary can.

To solve this problem is proposed starting from the local monitoring unit of the type mentioned that the monitoring unit has means for realizing a question-answer communication with the bus controller, and only releases the access of the bus controller to the data bus, if the question-answer communication results in the proper functioning of the bus controller. According to the invention, therefore, the monitoring concept known per se from the monitoring of control units is transmitted to the bus controller and the monitoring unit of the participants of a communication system for carrying out a question and answer communication. In a FlexRay communication system, the monitoring concept is therefore transferred to the FlexRay communication controller and the FlexRay bus guardian. Of course, the proposed monitoring concept is not limited to use in FlexRay communication systems, but can be used in any communication systems that have a monitoring unit (eg, a bus guardian) to monitor the function of a bus controller. The monitoring unit must use the question and answer concept to detect possible errors in the bus controller, in particular due to permanent disturbances in the bus controller, which lead to the problems described above.

The question-answer communication between the bus controller and the monitoring unit preferably takes into account the following possible errors:

a) check clock synchronization input set b) correct rate correction calculation c) correct application of rate correction d) correct calculation of offset correction e) correct application of offset correction

The monitoring unit takes over the task of a monitoring computer and provides, preferably periodically, questions to its associated bus controller, to then monitor the receipt of the correct answer within a specified time window. In the event that the time window is not respected or an incorrect answer to the question arrives, the monitoring unit takes over the shutdown of the bus controller or prevents the active transmission of messages by the bus controller. The response of the monitoring unit to failed question-answer communication may be either temporary (for one or more communication cycles), or permanent in nature (until the subscriber or the entire communication system shuts down).

The present invention eliminates the conceptual weaknesses of the hitherto known monitoring concept, in particular the known Bus Guardian concept in the FlexRay protocol specification v2.1. In this case, a cost-optimized implementation is possible because only necessary logic / functionality extends the monitoring unit, namely the monitoring functionality of the question-answer communication. The integration of the concept in so-called monitoring computers has particular advantages. This saves costs when introducing new ones

Communication system technologies, such as the FlexRay technology, with the requirement for a monitoring unit (bus guardian) are made possible. No separate monitoring unit (bus guardian) is necessary, but the present invention can be integrated into the existing monitoring computer concept.

The present invention has particular advantages for implementation in a FlexRay communication system, wherein the bus guardians and the communication controllers of the users of a FlexRay communication system are designed to perform the question-answer communication. To realize the concept, only the monitoring unit needs to be supplemented with a list of questions and corresponding answers. The monitoring unit is supplemented by a mechanism which allows for preferably periodic questions, setting according to the timers for the time window, monitoring this time window and checking the response. Finally, the monitoring unit has a pin for releasing the bus controller and for operating an optionally present in the participant release circuit. The proposed concept deliberately tests the logic of the bus controller responsible for calculating the clock synchronization values (for synchronization of the subscriber's local time base to the global time base of the communication system). Furthermore, a simple read-back mechanism can be performed on the relevant clock registers for clock synchronization. This is an advanced Interface between the monitoring unit and the bus controller provided. For example, the FlexRay protocol currently proposes the exchange of information via an SPI (Serial Peripheral Interface) interface. The SPI interface is a simple synchronous serial data bus. This interface would also be sufficient for the question-and-answer communication according to the present invention. The previous functionality of the monitoring unit, for example the functionality of the bus guardian according to FlexRay protocol specification v2.1, can be completely retained.

To check the input set for the clock synchronization of the subscriber, the invention proposes that the monitoring unit is extended by a logic that specifically checks the input set of the bus controller for the clock synchronization. The aim is to keep the quality of the clock synchronization high and to detect and, if necessary, prevent faults due to permanent faults. If this is not successful, the user or the bus controller or the bus driver should be set to a fail-silent mode in order to avoid the transmission of the bus controller or to block any available enable circuit for the bus controller , For this purpose, the monitoring unit is supplied via an interface to the bus controller with information regarding the synchronization messages (sync frames, data frame for synchronization of the local time base), which form the basis for the clock synchronization in the bus controller. The monitoring unit is thus provided with information which of the sync frames were received by the local bus controller, decoded and used for the calculation of correction values (for the local time base). For this purpose, in the bus controller, a list with information regarding the

Synchronization messages are created, as proposed for example in the FlexRay protocol specification v2.1. This list can now be subjected to the following checks as part of the question-answer communication:

a) A majority vote can be taken on the number of available sync frames. If a critical number of sync frames is undershot, there is a risk that the following calculations the correction values were based on an inaccurate local time base and therefore lead to incorrect results. The limit of the minimum permissible number of sync frames is preferably adapted to the settings of the bus controller. A corresponding check of the number of available sync frames can also be carried out in the bus controller. Through the redundant execution of the verification of the number of existing sync frames by the monitoring unit, a consistency check can be performed. If there are different results, the monitoring unit should avoid sending messages by the local bus controller or any existing ones

Lock enable circuit.

b) If information in the communication system is transmitted redundantly via two separate channels, the number and the identification of the synchronization messages (sync frames) of both channels can also be compared.

This information is also available in the bus controller (compare, for example, FlexRay protocol specification v2.1). If different results are obtained, the monitoring unit must avoid the transmission of messages by the local bus controller or block any existing enable circuit.

A fault rate correction for the global time base of the communication system calculated by a bus controller, which then results in the local time base of the subscriber or bus controller, can have various causes. The erroneous calculation may result from an incorrect input set or due to an error in a calculation logic of the bus controller. To verify the proper functioning of the calculation logic, several possibilities are suggested:

a) In the monitoring unit, the calculation of the rate correction is performed in the same way as in the bus controller, ie in the monitoring unit, there is an identical implementation of the mechanism of the bus controller for Calculation of rate correction. The values of the input set are present in the monitoring unit in the manner described above. The calculation results are also available in the bus controller and can be compared with the results of the monitoring unit. This is additional communication via an interface between the

Monitoring unit and the bus controller necessary. If different results are obtained, the monitoring unit must avoid the transmission of messages by the local bus controller or block any existing enable circuit.

b) The monitoring unit can also ask specific questions to the calculation logic of the bus controller, which is responsible for the calculation of the rate correction values. The calculation logic must return a response to the monitoring unit. The required response must be made within a specified time window. The monitoring unit compares this

Result with the corresponding locally stored answer to the question. Thus, the correct function of the calculation logic for the rate correction of the bus controller is preferably checked periodically. Permanent disturbances and the resulting errors can thus be determined. In this case, the monitoring unit must avoid the transmission of messages by the local bus controller or disable an enable circuit accordingly.

The reason for incorrect application of a correctly calculated value for the global time base rate correction by the bus controller may be due to several causes. On the one hand there can be errors in the logic for macrotick (MT) generation and on the other hand errors in a memory element, for example a memory register, for the correction value, so that an incorrect correction value is used in the macrotick generation. According to the invention, the following mechanisms are proposed: a) The monitoring unit receives a value for the rate correction communicated from the bus controller via the interface and compares the value with the corresponding memory value in a control register of the bus controller. If there are different results, the monitoring unit must avoid the transmission of messages by the local bus controller

Lock enable circuit.

b) The monitoring unit can ask specific questions to the logic of the bus controller, which is responsible for the macrotick generation. The logic must return a response to the monitoring unit. The required

Answer must be within a specified time window. The monitoring unit compares the result with a corresponding locally stored answer to this question. Thus, the correct function of the macrotick generation logic is preferably periodically checked. Permanent disturbances and the resulting errors can be detected. In this case, the monitoring unit must avoid the transmission of messages by the local bus controller or block any existing enable circuit.

c) At the end of a communication cycle, the monitoring unit receives the number of microticks (μT) per round or the number of microticks (μT) per macrotick (MT) from the bus controller. The information is exchanged via the interface between the bus controller and the monitoring unit. The information is exchanged and adjusted from round to round. For comparison by the monitoring unit are

Specify limits, ie a permissible drift in microtick per round or microtick per macrotick specified. If the comparison exceeds or falls below a fixed upper or lower limit, the monitoring unit can avoid the transmission of messages by the local bus controller or block any existing enable circuit. The bus controller may erroneous in the computation logic of the bus controller due to erroneous input sets or incorrect offset correction for the global time base of the communication system to which the local time base of the subscriber is synchronized. For the detection of a faulty input set, several suggestions have already been made above. The following mechanisms are proposed for detecting an error in the offset correction calculation logic:

a) In the monitoring unit, the offset correction from the bus controller is traced. For example, in the monitoring unit, a 1: 1

Implementation of the mechanism formed from the bus controller. The values of the input set are present in the monitoring unit as described above. The calculation results of the offset correction are also present in the bus controller and can be compared with the results of the monitoring unit. This requires additional communication via the interface between the monitoring unit and the bus controller. If different results are obtained, the monitoring unit must avoid the transmission of messages by the local bus controller or block any existing enable circuit.

b) The monitoring unit asks specific questions to the logic of the bus controller, which is responsible for calculating the offset correction values. The calculation logic must return a response to the monitoring unit. The required response must be made within specified time windows. The

Monitoring unit compares the result with their locally stored answers. In particular, it is checked whether the response of the bus controller is the correct answer to the question asked. Thus, the correct function of the calculation logic is preferably checked periodically. Permanent disturbances and the resulting errors are detected. In this case, the

Monitoring unit sending messages through the local bus Avoid controller or block any existing enable circuit.

The cause of the bus controller not correctly applying a correctly calculated global time base offset correction may be in the logic of the offset application or in a memory element, such as a memory register, for the correction value. In any case, this will cause an incorrect correction value to be used for the offset correction.

Various mechanisms are proposed for checking the correct application of the offset correction:

a) The monitoring unit receives the offset correction value from the bus controller via the interface and compares the correction value with the memory value in a control register of the bus controller. If different results are obtained, the monitoring unit must avoid the transmission of messages by the local bus controller or block any existing enable circuit.

b) The monitoring unit asks specific questions to the logic of the bus controller, which is responsible for the offset application, for FlexRay, for example, during network idle time (NIT). The logic must return a response to the monitoring unit. The required answer must be made within specified time windows. The monitoring unit compares the result with its locally stored answers, in particular it checks whether it is the correct answer to the question asked. Thus, the correct function of the offset application is preferably checked periodically. Permanent disturbances and the resulting errors are detected. In this case, the monitoring unit must avoid the transmission of messages by the local bus controller or any existing ones

Lock enable circuit. c) The monitoring unit compares a microtick counter (μT counter) of the bus controller before the offset correction with the microtick counter after the offset correction. These microtick counters are exchanged via the interface between the bus controller and the monitoring unit. The difference of the microtick counter before and after the offset correction must be within predefined ranges. If these ranges are exceeded and no values are supplied, the monitoring unit must avoid the transmission of messages by the local bus controller or block any enable circuits that may be present.

Preferred embodiments of the present invention can be taken from the subclaims. Preferred embodiments of the invention and further advantages of the invention will be explained in more detail with reference to the figures. Show it:

1 shows a communication system according to the invention according to a preferred embodiment;

FIG. 2 shows a subscriber of a communication system known from the prior art; and

FIG. 3 shows a subscriber according to the invention of the FlexRay

Communication system of Figure 1.

Description of the embodiments

The present invention will be explained below by way of example with reference to a FlexRay communication system. Of course, however, the present invention can also be used in other communication systems in which already other bus guardian concepts are already being used, or in which the inventive bus guardian concept would make sense and / or would bring benefits. In FIG. 1, a simplified topology of a FlexRay communication system is indicated in its entirety by the reference numeral 1. The communication system comprises a physical layer, which in the present case is designed as a data bus 2 with two electrically conductive lines. Of course, the physical layer can also be realized by optical waveguides or by radio links. Likewise, it is conceivable not to provide two separate transmission channels, but only one channel. Connected to the data bus 2 are a plurality of subscribers 3, which are also referred to as controllers or hosts. Strictly speaking, however, the host also comprises a microcontroller, which is denoted by reference numeral 4 in FIG. Thus, the subscriber 3 and the microcontroller 4 together form the actual host 5.

The subscribers 3 of the communication system each comprise a communication controller 6, which receives data 7 to be transmitted via the data bus 2 from the microcontroller 4 and according to the protocol specification used in the communication system 1, in the illustrated example according to the FlexRay protocol specification v2.1, into the correct data format for transmission over the data bus 2 brings. The information 7 in the correct data format is transmitted to the bus driver 8 of the subscriber 3, which places it in a form required for transmission over the data bus, also in accordance with the protocol specification used.

For example, in security-relevant applications of the communication system 1 a blocking data bus 2 by a defective, constantly sending

To prevent subscriber 3, 3 bus guards 9 (Bus Guardian) are provided in the participants, which monitor and control the access authorization of the bus driver 8. The bus drivers 8 can only apply information or data packets to the data bus 2 if they receive a corresponding enable signal 10 from the associated bus guardian 9. The FlexRay communication system 1 from FIG. 1 has a particularly simple topology. Of course, the topology of the data bus 2 may also be annular or star-shaped. Likewise, it is conceivable to arrange amplifier elements, for example an active star, in the data bus structure 2 for transmission of the data packets over relatively long distances.

FIG. 2 shows a FlexRay subscriber 3 known from the prior art with a known Bus Guardian concept. The concept described in the FlexRay Protocol Specification v2.1 is limited with regard to the time monitoring of the communication protocol or the communication controller 6. In the known monitoring concept, a macrotick (MT) 13 of the local communication controller 6 clocks its local bus guardian 9. The time slot with transmission activity is additionally indicated by an ARM signal 14 of the communication controller 6. The time sequences (the so-called timing) of the monitored FlexRay communication controller 6 is roughly monitored only by an RC oscillator 15 or monitored by an additional quartz oscillator (not shown) with a higher resolution.

In the subscriber 3 with the known monitoring concept, the bus guardian 9 thus derives its time base from the corrected macrotick signal 13, which it receives from the communication controller 6. The ARM signal 14 is used to synchronize the beginning of a communication cycle or the transmission slots of the communication cycle. The RC oscillator 15 allows a rough monitoring of the macrotick signal 13, so that deviations are recognized as such only above 20 to 30% of the signal.

Thus, the time base of the bus guardian 9 is not independent of the time base of the communication controller 6, but depending on the macrotick (MT) signal 13. By monitoring this signal 13 by means of the signals of the RC oscillator 15, a complete independence from the time base of the communication controller 6 can not be achieved. The communication controller 6 receives data to be distinguished from the host computer (microcontroller) 4. The controller 6 brings the data into the data format prescribed according to the FlexRay protocol specification. In particular, the data is introduced into a payload segment (so-called payload segment) of a data frame (FlexRay frame). The formatted data to be transmitted via the data bus 2 are designated by the reference numeral 16 in FIG. The data 16 is transmitted to the bus driver 8, which brings it into a format suitable for data transmission. The bus driver 8 then applies the data 16 to be transmitted to the data bus 2 at the time of transmission. The activity of the bus driver 8 is monitored and / or controlled so far by the bus guardian 9 that the bus driver 8 can only apply the data 16 to the data bus 2 if the bus guardian 9 has the access authorization of the bus Driver 8 and an enable signal 17 to the bus driver 8 applies.

The known monitoring concept has particular weaknesses in cases where there are permanent disturbances due to errors or inaccuracies in the communication controller 6 to a creeping shift of the transmission timeslots of the subscriber 3 in the other transmission time slots according to the communication schedule remaining participants 3 of the communication cycle. For example, there is a problem that the

Macrotick supply 13 and the ARM signals 14 minimum Uhrendrifts the local communication controller 6 can be transmitted to the bus guardian 9. Thus, if the clock correction of the FlexRay communication controller 6 is faulty according to the protocol specification v2.1 or the setting of setting registers for the clock correction of the communication controller 6 is faulty and undiscovered, the local communication controller 6 drifts and thus also the local Bus guardian 9 compared to the rest of the communication network 1. The transmission slots of the communication cycle for the subscriber 3, the communication controller 6 has errors or inaccuracies in the local time base, so over time in the transmission time slots of the other

Push subscriber 3 in the communication network 1, without the local bus guardian 9 could detect this situation and trigger appropriate responses. Another problem is the so-called offset correction phase during the so-called Network Idle Time (NIT) of the local communication controller 6 at the end of a communication cycle. The offset correction phase is used inter alia to synchronize the local time base of the subscriber 3 on the global time base of Communication System 1. In order to make such a correction, it may be corrected within specified limits. The subsequent communication round starts by a few microticks (μT) sooner or later. The local bus guardian 9 must allow this correction. The timer monitoring must accept this. However, there is no bus guardian knowledge regarding the effects of offset correction on the next round of communication. Also in this case, the transmission time slots may overlap. The likelihood of such overlap increases as the number of laps increases.

An inventive participant 3 is shown in detail in Figure 3. In the subscriber 3 according to the invention, the bus guardian 9 has been circuitically and functionally extended in comparison to a known FlexRay bus guardian (see FIG. 2) in such a way that even permanent disturbances of the FlexRay communication controller 6 when accessing the data bus 2 are secure and reliably detected and appropriate remedial and countermeasures can be taken. The proposed solution according to the invention is particularly simple and inexpensive to implement, but at the same time extremely effective.

Between the bus guardian 9 and the communication controller 6, an interface 18 is arranged, which is designed for example as an SPI (Serial Peripheral Interface) interface. The bus guardian 9 can selectively transmit questions to the communication controller 6 via this interface 18, and the communication controller 6 can transmit the answers calculated to the questions back to the bus guardian 9. Thus, a question and answer communication between the bus guardian 9 and the communication controller 6 can be realized via the interface 18. For this it is necessary that in the bus guardian 9 a list 19 with various questions and a list 20 with the corresponding correct answers to the questions from the list 19 are stored are. Of course, the lists 19 and 20 can also be combined into a common list. The lists 19 and 20 can also be stored on a memory outside the bus guardian 9, in which case questions and / or answers are transmitted to the bus guardian 9 as needed.

Furthermore, in the bus guardian 9 means 21 must be provided to initiate a question-answer communication at certain times, preferably periodically. For the temporal coordination of the question-answer communication, the macrotick (MT) signal 13 of the communication controller 6 and / or a clock signal of the RC oscillator can be used. Even if the MT signal 13 is drifting because, for example, the clock synchronization in the communication controller 6 is erroneous, and thus there is an error of the controller 6, this error can be detected with the present invention solely by the question-answer communication. Ideally, the communication controller 6 will provide a false result or result, but outside the allowable response window. The effectiveness of the procedure depends crucially on the nature of the questions asked. These must be matched to the component and / or function of the communication controller 6 to be monitored. All components / functions to be monitored must be covered by the questions. A defect of the component / function must actually lead to a faulty response.

At the beginning of a question-answer communication from the list 19 a suitable question is selected. The questions can be taken from the list 19 either randomly or in a predetermined order, for example in the order in which they are stored in the list 19. Certain question and answer combinations are suitable for detecting certain errors of the communication controller 6. Through the specific selection of specific questions, certain functions and / or properties of the communication controller 6 can therefore be checked for proper functioning. According to the invention, the lists 19 and 20 include such questions and answers which enable a recognition of the following errors: a) Error of the input set (the synchronization messages actually used, sync frames) for the clock synchronization, b) incorrect calculation of the rate correction, c) incorrect application of correctly calculated rate correction values, d) incorrect calculation of the offset Correction, and e) incorrect application of correctly calculated offset correction values.

After selecting a suitable question from the list 19, this is transmitted via the interface 18 to the communication controller 6. At the same time, the means 21 in other means 22 for checking the response start a timer for a time window within which the response must be received from a properly functioning communication controller 6. Compliance with this time window is monitored by the means 22. If a response from the communication controller 6 is received within the time window, this response is checked in the means 22 for correctness. For this purpose, the means 22 compare the received answer with the correct answer from the list 20. Only when the correct answer is received within the defined time window, the bus guardian 9 releases the access to the data bus 2 by the enable signal 17.

For example, the questions asked by the bus guardian 9 to the communication controller 6 may include one or more of the following questions:

Number of synchronization messages (sync frames) received by the communication controller 6, decoded and used to synchronize the local time base?

Are the number and identification of the synchronization messages redundantly transmitted via the two communication channels (lines) of the data bus 2 the same?

What is the result of the rate correction calculation in the communication controller 6? (The right answer provides additional logic for calculating the rate correction, which is an identical implementation of the mechanism from the communication controller 6, formed in the bus guardian 9.)

Is the value of the rate correction or the offset correction calculated by the mechanism of the communication controller 6 equal to the correction value stored in a memory element, in particular in a memory register, of the communication controller 6?

Is the number of microticks (μT) per macrotick (MT) or the number of microticks (μT) per communication round (so-called communication cycle) still below a predefinable limit at the end of a lap?

- Is the difference of a microtick counter (μT) before the offset correction and then within a predefinable range?

In order for the bus guardian 9 to be able to answer these questions, additional information must in some cases be transmitted from the communication controller 6 to the bus guardian 9 via the interface 18. These additional information to be transmitted include, for example:

The result of the calculation of the rate correction or the offset correction, the number of microticks (μT) per communication round or the number of microticks (μT) per macrotick (MT) at the end of a communication round, the level of a microtick (μT) Counter of the communication controller 6 before the offset correction and thereafter.

Claims

claims

1. A bus controller (6) of a subscriber (3) of a communication system (1) locally associated monitoring unit (9) for monitoring and controlling the access to a data bus (2), wherein the bus controller (6) via a NEN Bus driver (8) accesses the data bus (2) and the monitoring unit

(9) monitors and controls the access authorization of the bus driver (8), characterized in that the monitoring unit (9) comprises means (18, 19, 20, 21, 22) for realizing a question-answer communication with the bus controller (6) and only enables the access of the bus controller (6) to the data bus (2) if the question-answer communication results in the proper functioning of the bus controller (6).

Second monitoring unit (9) according to claim 9, characterized in that a local time base of the bus controller (6) is synchronized by means of synchronization messages to a global time base of the communication system (1) that the monitoring unit (9) via an interface (18). to the bus-

Controller (6) receives information about the in the bus controller (6) decoded and used for clock synchronization synchronization messages, and that the question-answer communication takes into account the synchronization information obtained.

3. Monitoring unit (9) according to claim 2, characterized in that in the bus controller (6) is a list of the bus controller (6) received, decoded and used for clock synchronization synchronization messages, wherein the monitoring unit (9) the Obtain synchronization information from the list and queries in the question-answer communication whether the synchronization information meets certain minimum requirements.

4. Monitoring unit (9) according to claim 3, characterized in that the monitoring unit (9) in the question-answer communication queries whether the number of received, decoded and used for clock synchronization synchronization messages is greater and / or equal to a minimum number.

5. Monitoring unit (9) according to one of claims 2 to 4, characterized in that, if the synchronization messages are transmitted via the data bus (2) in two redundant communication channels, the monitoring unit (9) queries in the context of question-answer communication, whether the received, decoded and / or used for clock synchronization

Synchronization information for both communication channels are the same.

6. Monitoring unit (9) according to claim 5, characterized in that the monitoring unit (9) in the question-answer communication queries whether the number and / or the identification of the synchronization messages of both communication channels are the same.

7. monitoring unit (9) according to one of claims 1 to 6, characterized in that a local time base of the bus controller (6) by means of synchronization messages to a global time base of the communication system (1) by means of rate correction and / or offset correction relative is synchronized to the global time base and that the monitoring unit (9) in the context of the question-answer communication queries the correct calculation of the rate correction and / or the offset correction for the local time base.

8. Monitoring unit (9) according to claim 7, characterized in that means of the bus controller (6) for calculating the rate correction and / or the offset correction are formed identically in the monitoring unit (9), the monitoring unit (9) Information about the synchronization messages received, decoded and used for the clock synchronization in the bus controller (6) is obtained, the computing means provided in the monitoring unit (9) calculate the rate correction and / or the offset correction depending on the synchronization information, and supervision monitoring unit (9) compares the result in the question-answer communication with the rate correction or offset correction calculated by the calculation means provided in the communication controller (6).

9. Monitoring unit (9) according to claim 7, characterized in that the monitoring unit (9) provided in the bus controller (6) means for

Calculation of rate correction and / or offset correction asks (21) and monitors the receipt of the correct response from the bus controller (6) within a given response window.

10. Monitoring unit (9) according to any one of claims 1 to 6, characterized in that a local time base of the bus controller (6) by means of synchronization messages on a global time base of the communication system (1) by means of rate correction and / or offset Correction is synchronized relative to the global time base and that the monitoring unit (9) in the context of the question-answer communication queries the correct application of the calculated values for the rate correction and / or the offset correction for the local time base.

11. Monitoring unit (9) according to claim 10, characterized in that the monitoring unit (9) comprises means of the bus controller (6) for generating a macrotick and / or storage means for the correction value calculated during the rate correction within the scope of the questionnaire. Response communication checks for error-free operation.

12. Monitoring unit (9) according to claim 10, characterized in that the monitoring means (9) comprise means of the bus controller (6) for applying the offset correction and / or storage means for the correction value calculated in the course of the offset correction in the context of Question-answer communication checks for error-free operation.

13. Monitoring unit (9) according to claim 11 or 12, characterized in that the monitoring unit (9) receives the calculated correction value from the bus controller (6) via an interface (18) and this correction value in Compares the frame of the question-answer communication with a stored in the memory means of the bus controller (6) correction value.

14. Monitoring unit (9) according to claim 11, characterized in that the monitoring unit (9) to the means provided in the bus controller (6) for generating the macrotick specific questions and the receipt of the correct response from the bus controller ( 6) monitored within a given time window.

15. Monitoring unit (9) according to claim 12, characterized in that the monitoring unit (9) provides targeted questions to the means provided in the bus controller (6) for applying the offset correction, and the input of the correct response from the bus controller. Controlled controller (6) within a predetermined time window.

16. Monitoring unit (9) according to claim 11, characterized in that the monitoring unit (9) at the end of a communication cycle from the bus controller (6) via an interface (18) the number of microticks per round and / or the number of microticks per As part of the question-and-answer communication, the monitoring unit (9) queries whether a drift in the number of microticks per round and / or the number of microticks per macrotick between a communication round and a subsequent round is greater in magnitude and / or equal a predetermined allowable

Drift is.

17. Monitoring unit (9) according to claim 12, characterized in that the monitoring unit (9) receives the state of a microtick counter of the bus controller (6) via an interface (18) before an offset correction and thereafter, and the monitoring unit (9) as part of the question and answer

Communication queries whether a difference between the state of the microtick counter before the offset correction and then in terms of amount is greater and / or equal to a predetermined limit.

18. Subscriber (3) of a data bus (2) comprehensive communication system (1), wherein the subscriber (3) comprises a bus controller (6) and a bus driver (8), wherein the bus controller (6) via the bus driver (8) is connected to the data bus (2), and wherein the subscriber (3) has a monitoring unit (9) assigned to the bus controller (6) for monitoring and

Control of the access authorization of the bus driver (8) on the data bus (2), characterized in that the monitoring unit (9) is designed according to one of claims 1 to 17.

19. Subscriber (3) according to claim 18, characterized in that the bus controller (6) comprises means for receiving a question from the monitoring unit

(9), means for processing a question received from the monitoring unit (9) and for generating a corresponding answer and means for transmitting the generated response to the monitoring unit (9).

20. Subscriber (3) according to claim 18 or 19, characterized in that the subscriber (3) as a FlexRay subscriber of a FlexRay

Communication system (1) for transmitting information according to the FlexRay protocol specification is formed.