DE102015012123A1 - Method for message transmission on a bus system of a vehicle, bus system for a vehicle, bus subscriber for a bus system, vehicle control unit - Google Patents

Abstract

The invention relates to a method for transmitting messages on a bus system of a vehicle, wherein bus subscribers connected to the bus system, in particular sensors, actuators and control units, can exchange messages (12, 13, 15) via the bus system, in particular send and receive. The method is characterized in that in order to prevent overloading of the bus system and / or the bus subscribers, a minimum time interval (14) between two messages (12; 13; 15) of the same type is maintained during transmission and / or reception and / or transmission. Furthermore, bus systems, bus subscribers and vehicle control devices for implementing the method are described.

Description

The invention relates to a method for message transmission on a bus system of a vehicle with the preamble of claim 1. Furthermore, the invention relates to a bus system for a vehicle, in particular motor vehicle, according to the preamble of claim 14. Furthermore, the invention relates to a bus subscriber for a bus system According to the preamble of claim 22. Finally, the invention relates to a vehicle control device according to the preamble of claim 23.

For a wide variety of control tasks in vehicles or motor vehicles, such as trucks and the like, they have corresponding communication systems. As a rule, these are so-called bus systems on which the corresponding data are transmitted in the vehicle.

Connected to the bus system are typically several bus subscribers, which may be, for example, sensors, actuators, control devices and the like. These bus participants exchange messages, usually in digital form, via the bus system with one another. For example, a brake request of a driver can be received by the corresponding brake control unit as a further bus subscriber by means of a brake pedal acting as a bus subscriber. This should also be implemented in a corresponding braking operation.

When communicating on the bus system, in particular for safety-critical components, such as the brake system, it must be ensured that corresponding safety-relevant messages can be forwarded unhindered at any time. For this purpose, on the one hand, a prioritization of messages take place so that safety-critical messages with higher priority are forwarded on the bus system. Thus, it can be ensured in most cases that, for example, a brake request is forwarded immediately, while less security-relevant messages may be forwarded only late.

Despite a corresponding prioritization of messages, it may still happen that at least temporarily a full utilization of the transmission capacity or bandwidth of the bus system takes place. This can then mean that the bus system temporarily has no free transmission capacity and security-related messages or messages of the highest priority can not be transmitted immediately. Such a situation may arise, for example, when a bus subscriber has a defect or software error. Also, a bus subscriber may even have been specifically provided with defective software to overload the bus system by a variety of messages. Typically, such "denial-of-service" attacks are driven by quickly repeating individual messages or at least one message type.

Basically, all messages are transmitted within the transmission capacity on a bus system. Thus, the bus system but can be utilized by a fast message repetition to a standstill and thus paralyzed.

A disadvantage of the known bus system in vehicles is therefore that neither effective safeguards against defective bus users are still provided against targeted attacks, if they are based on a full load of the bus system.

The object of the present invention is therefore to specify a method for message transmission on a bus system of a vehicle that prevents a corresponding overloading of the bus system or the bus subscriber.

The method for message transmission on a bus system of a vehicle with the measures of claim 1 solves this problem. Accordingly, a minimum time interval between two messages is maintained to prevent overloading the bus system and / or the bus users. In particular, the minimum time interval between two messages of the same type is complied with. The method is characterized in particular by the fact that the minimum time interval during the transmission and / or reception and / or transmission of messages is ensured. By ensuring a minimum time interval or a time interval between two messages, further messages can be transmitted in this intermediate time. In particular, these may be safety-critical messages. In a further embodiment of the invention, since no message transmission takes place in the meantime, at least the bus users can be protected against overloading by a large number of disturbing messages. Also, by rapid or frequent repetition of messages apart from the bus system and individual bus users, such as vehicle control units, are overloaded. This can go so far that no more messages can be received. The bus user can be busy with the processing of the large number of messages for a long time. But this can be done by ensuring or ensuring one appropriate time interval between messages are prevented. A paralysis or a blockage of the bus system by any number of repetitions of messages is thus prevented.

Preferably, the minimum time interval between two messages of the same type is predefined. This means that the repetition rate of messages of the same type is predefined. This is done typically and in particular in the context of specifications, to which the bus system or the bus subscribers should basically comply with the specification. Should this not be the case, for example, in the case of a defective bus user or in the event of an attack by malicious software, such as computer viruses or the like, appropriate countermeasures must be taken.

Preferably, the minimum time interval is maintained by the bus system and / or bus users. This serves in particular to counteract the so-called denial-of-service attacks, ie attacks based on an overload of components. Accordingly, the method described here is preferably implemented in the bus system or in the bus subscribers.

Particularly preferably, the transmission and / or transmission and / or reception of several messages of the same type within a time interval is prevented. This means that already on the bus side a transmission of several messages of the same type within a time interval is prevented. This ensures compliance with the specification or the predefined time intervals for a message type. It can be prevented on the part of the bus system that several messages of the same type are transmitted within a predefined time interval or time interval. Likewise, the transmission and / or reception of several messages of the same type within a time interval can be prevented. In this case, the corresponding sending or receiving is to be prevented in the area of the bus subscribers. Likewise, here too the bus system can intervene in the transmission or reception process by accepting or delivering corresponding messages again. However, this can usually only be done with bus systems that contain active components as part of the actual bus system.

Preferably, after the transmission and / or transmission and / or reception of a first message of one type, transmission and / or reception and / or transmission of further messages of the same type within the time interval is prevented. As a result, the object of the invention is achieved to effectively prevent overloading of the bus system.

Particularly preferably, after the transmission and / or transmission and / or reception of a first message of a type within a subsequent time interval, further messages of the same type are ignored by the bus system and / or the bus users. This means that both the bus participants and the bus system do not observe or process corresponding further messages. Optionally, it can be ensured in the area of amplifiers or other active components of the bus system that further processing or forwarding is prevented. Bus subscribers can also ignore corresponding unwanted messages.

After transmitting and / or transmitting and / or receiving a first message of one type, further messages of the same type are discarded or deleted by the bus system and / or the bus subscribers. This can be achieved in particular in the case of the active forwarding of the amplification of the signals or messages running on the bus system. But other measures to suppress the signals of unwanted messages may be provided, for example by electrical means.

Preferably, after transmitting and / or transmitting and / or receiving a first message within a subsequent time interval, further messages of the same type are not transmitted or not forwarded by the bus system and bus subscribers. This usually corresponds to an active control of the bus system.

Particularly preferably, the messages on the bus system are filtered by the bus system and / or the bus users. In particular, a message filter is provided. The filtering preferably takes place with respect to a minimum time interval between two messages, in particular between two messages of the same type. By means of an appropriate filtering, the above-described objects according to the invention described above can be achieved, namely that messages in particular are ignored, not transmitted, deleted or the like.

Particularly preferably, the transmission and / or transmission and / or reception of further messages of one type after a first message of one type is prevented until the end of the predefined time interval. In particular, this is done by at least one filter or at least one filter function. Thus, compliance with appropriate time intervals between messages can be achieved.

Particularly preferably, a transfer of the bus system and / or the bus users is prevented by a message filter is provided. Such a message filter ensures that there is no full utilization of the bus system or its transmission bandwidth.

Compliance with the minimum time interval between two messages of the same type is ensured in particular by the at least one message filter. The message filter is designed so that a temporal filtering can take place.

The at least one message filter is assigned in particular to the bus system and / or at least one of the bus users. Preferably, all bus users are provided with a corresponding message filter. This ensures that there is no overloading of one of the bus participants in the treatment of messages.

The object described above is also achieved by a bus system for a vehicle, in particular a motor vehicle, with the measures of claim 14. The bus system preferably has at least one bus subscriber, which is suitable for carrying out the method according to the above descriptions. The bus system is in particular for transmitting messages, and the bus users are designed in particular for transmitting and / or receiving messages via the bus system. Accordingly, the bus system or the bus users ensure that minimum time intervals between two messages of the same type are adhered to during transmission and / or reception and / or transmission. This ensures that an overload of the bus system is prevented by bus subscribers.

The bus system and / or the bus users are preferably designed to suppress the transmission and / or the transmission and / or the reception of unwanted messages. This preferably takes place on the basis of predefined criteria, in particular with regard to a minimum time interval between two messages of the same type or a corresponding predefined time interval. Consequently, in particular by ignoring excess messages in a time interval, overloading of individual bus subscribers can be prevented by a large number of messages to be handled. A minimum time interval between messages is ensured.

Preferably, at least one message filter is implemented for filtering messages. A message filter is used to handle messages according to predefined criteria.

Particularly preferably, the message filter is assigned to the bus system and / or at least one of the bus users. Preferably, all bus users are provided with a corresponding message filter. Thus, an overload can be prevented for all bus users and the bus system itself. An overload of the transmission bandwidth of the bus can be prevented.

Preferably, the message filter is designed to select and / or accept and / or ignore messages. Thus, individual messages can be handled by the message filter accordingly.

The message filter is designed in particular to prevent the transmission of unwanted messages. This ensures that individual messages can already be treated during the transmission.

Preferably, the message filter is designed to delete messages. By providing a corresponding forwarding for the transmission of messages or the direct removal of corresponding messages, the transmission on the bus can be actively acted upon.

More preferably, the message filter is provided for removing and / or ignoring further messages of one type within a predefined minimum time interval after a first message of the type. Thus, the maintenance of a corresponding minimum time interval between two messages of one type is ensured.

The object stated in the introduction is also achieved by a bus subscriber according to claim 22 for a bus system according to the previous embodiments. The bus subscriber is in particular equipped with at least one message filter. The message filter is designed in particular for selecting and / or accepting and / or ignoring messages, in particular according to the above statements. Thus, a corresponding treatment of the messages is already reached in the bus subscriber.

The object set in the introduction is also achieved by a vehicle control unit having the features of claim 23. Accordingly, the vehicle control apparatus implements the above-described method. A vehicle control unit can accordingly be designed as a bus subscriber for a bus system described above.

The vehicle control device preferably has a message filter for filtering messages. This message filter is thus for selection and / or accepting and / or ignoring messages.

The message filter is preferably designed to prevent the transmission and / or deletion of messages, in particular individual messages. This can be actively acted in particular on the transmission on the bus system.

A preferred embodiment of the invention will be described in more detail below with reference to the drawings:

1 A timeline for bus communication under normal load,

2 a timeline of bus communication under critical load, and

3 a timeline of a bus communication under critical load with filtering according to the invention.

Vehicles, in particular motor vehicles, have a multiplicity of components which communicate with one another. These are vehicle control units, sensors, actuators and similar components.

The communication between the individual components of a vehicle takes place at least largely via so-called bus systems. The various components are then connected to the bus system as bus subscribers and can communicate or exchange data via it. For this purpose, the bus subscribers have corresponding transmitting and / or receiving devices.

The bus system ensures a forwarding or distribution of the data along the bus. Optionally, the bus system may also include other active components that control, for example, the communication on the bus system or maintained, for example by amplifiers or couplers. Optionally, a forwarding between different sections of the bus system can take place.

The data exchanged between bus users is transmitted in the form of data packets as messages or message packets. This means that such a message contains at least the actual user data as a data packet. In addition, to allow assignment on the bus system, sender address and / or destination address can be added. Optionally, further information on the importance or priority of the message can be provided. Supplementary data, such as the time of sending or similar, may also be included.

On the basis of the content of the user data or the destination address, corresponding bus subscribers can receive the message and react appropriately. For example, a brake request can be triggered by a brake request of a brake pedal as a bus subscriber by means of a brake control device as a further bus subscriber. But also any other control and regulation measures can be done in the vehicle.

A communication on the bus system under normal load is exemplary in the 1 shown.

It shows in the diagram 10 a timeline 11 running to the right in the direction of the arrowhead, the time sequence of message packets or messages 12 . 13 . 15 at.

After a first message 12 is sent on the bus system is typically followed by another message packet 12 of the same type at a common time interval. This time interval is called the time interval 14 designated. In this case, it is for example 10 milliseconds (10 ms). 100% of these messages can be calculated per second 12 be transmitted via the bus system, if this minimum time interval 14 is complied with. Typically, such time intervals are sufficient for almost all processes in a vehicle, including time-critical processes such as braking, etc.

Due to the time interval 14 and the relatively short length of a single message 12 . 13 . 15 as such is between two of the news 12 . 13 . 15 one type sufficient time for other, other data, such as message packets 13 transferred to. Accordingly, many other control and regulation tasks and measurement functions can be done in the meantime in the vehicle. Thus, the bus system can indeed be used in parallel for a variety of different control and control operations. Therefore, under normal conditions and due to the comparatively large time intervals 14 between two messages of a type practically at any time be sure that also safety-critical messages 12 can be sent, transmitted and received almost always with high priority.

In the 2 However, another situation is shown.

In this case, a bus system is shown under heavy load. In fact, it will then be between two message packets 12 a variety of other news packages 15 transmitted at a high repetition rate. It can be both repetitions of the news package 12 Act as well as message packets of another type as messages 15 be transmitted on the bus system.

The time interval 14 between two message packets 12 . 15 is in this case only 0.3 milliseconds (0.3 ms) or 300 microseconds (300 microseconds). This also corresponds approximately to the duration of a single message packet. Thus, it is usually no longer possible to have more message packets between these message packets 15 to send, transmit or receive. Consequently, we are talking about overloading the bus system.

This leads, in particular, to the fact that messages of high priority, which relate, for example, to security-relevant functions, can no longer be transmitted securely. Consequently, for example, a brake request on a bus system overloaded in this way can no longer be securely transmitted, transmitted and received.

The case described here can occur, for example, in the case of a defective vehicle control unit or, in the case of a targeted attack on the bus system. For example, the software of a vehicle controller may be manipulated to protect the bus system by issuing a plurality of messages 15 paralyze with high repetition rate. This virtually overrides all communication on the bus system. Of course, this can have very serious consequences in the case of a motor vehicle, since possibly safety-related information can no longer reach the corresponding vehicle control devices.

This state of the procedure of the invention acts according to the 3 opposite.

In this case, first as in 2 sketchy the overloaded bus system shown in the course of time. However, here are filters or filter functions 16 displayed as a dotted frame, which schematically displays a variety of messages 15 enclose. The filter functions are used to send certain messages 15 which are sent to the bus system at a high repetition rate. This means that only messages 12 that with a typical low repetition rate and thus with a typical large time interval 14 not transferred from the filter 16 be recorded. These messages 12 can be sent, transmitted and received.

The messages present on the bus system with too little time interval between them 15 are on the other hand by the filter 16 captured and hidden. This can be achieved in different ways. For example, the filter 16 may be arranged in the region of the transmission units for the bus system. Then the posting of messages 15 Prevented with too high repetition rate from the outset. Alternatively, a filter function can also be used 16 be arranged in the range of transmission components of the bus. Then components typically present on the bus system are used to prevent transmission, routing or even passage of components on the bus system. Finally, the filter function 16 also in the area of the transmitter and / or receiver, so typically in the bus participants themselves, be provided. In this case, for example, prevents messages 15 be accepted by the recipient if they are transmitted at too high a repetition rate.

Specifically, this means that there is a minimum time interval between a first transmitting packet 12 and another transferring package 12 in the form of a time interval 14 must be present. Otherwise, corresponding messages will be sent 15 not edited. By suitable arrangement and design of the filter function 16 can be prevented, for example, that the bus system is flooded with disturbing messages. If necessary, can be unwanted messages 15 also remove from the bus system.

On the other hand, individual bus subscribers can be overloaded by fast repeated messages 15 protect by only messages 12 be accepted, which is a minimum time interval to a predecessor message packet 12 comply. In this way, in particular, safety-relevant operations can be ensured practically at any time. An overload of individual bus participants is thus effectively prevented.

Claims (25)

Method for message transmission on a bus system of a vehicle, bus subscribers connected to the bus system, in particular sensors, actuators and control units, messages ( 12 . 13 . 15 ) via the bus system, in particular can send and receive, characterized in that to prevent overloading of the bus system and / or the bus subscribers a minimum time interval ( 14 ) between two messages ( 12 ; 13 ; 15 ) of the same type is maintained during transmission and / or reception and / or transmission. Method according to claim 1, characterized in that the minimum time interval ( 14 ) is predefined. Method according to claim 1 or 2, characterized in that the minimum time interval ( 14 ) is maintained by the bus system and / or the bus subscribers, in particular to counteract denial-of-service attacks. Method according to one of the preceding claims, characterized in that the transmission and / or transmission and / or the reception of a plurality of messages of the same type within a time interval is inhibited. Method according to one of the preceding claims, characterized in that after the transmission and / or transmission and / or reception of a first message of one type, the transmission and / or the transmission and / or the reception of further messages ( 12 . 13 . 15 ) of the same type within the time interval ( 14 ) is prevented. Method according to one of the preceding claims, characterized in that after transmission and / or transmission and / or reception of a first message ( 12 ) of a type within a subsequent time interval further messages ( 15 ) of the same type are ignored by the bus system and / or the bus users. Method according to one of the preceding claims, characterized in that after transmission and / or transmission and / or reception of a first message ( 12 ) of a type within a subsequent time interval further messages ( 15 ) of the same type are discarded or deleted by the bus system and / or the bus subscribers. Method according to one of the preceding claims, characterized in that after transmission and / or transmission and / or reception of a first message ( 12 ) of a type within a subsequent time interval further messages ( 15 ) of the same type are not transmitted or forwarded by the bus system and / or the bus subscribers. Method according to one of the preceding claims, characterized in that a filtering of the messages ( 12 . 13 . 15 ) takes place on the bus system by the bus system and / or the bus users, preferably with respect to a minimum time interval ( 14 ) between two messages ( 12 . 13 . 15 ), especially between two messages ( 12 ) of the same type. Method according to one of the preceding claims, characterized in that the transmitting and / or sending and / or receiving further messages ( 15 ) of a type after a first message ( 12 ) of a type until the end of the predefined time interval ( 14 ) is prevented. Method according to one of the preceding claims, characterized in that at least one filter or message filter ( 16 ) is provided to prevent overloading of the bus system and / or the bus users. Method according to one of the preceding claims, characterized in that compliance with the minimum time interval ( 14 ) between two messages ( 12 ) of the same type by the at least one message filter ( 16 ) is ensured. Method according to one of the preceding claims, characterized in that the at least one message filter ( 16 ) is assigned to the bus system and / or at least one of the bus users. Bus system for a vehicle, in particular a motor vehicle, preferably with at least one bus subscriber, for performing the method according to one of the preceding claims, wherein the bus system for transmitting and / or the bus users for sending and / or receiving messages ( 12 . 13 . 15 ) are formed via the bus system. Bus system according to Claim 14, characterized in that the bus system and / or the bus subscribers for suppressing the transmission and / or transmission and / or reception of messages ( 12 . 13 . 15 ) are formed, preferably on the basis of predefined criteria, in particular due to the minimum time interval or time interval ( 14 ) of two messages ( 12 ) of the same type. Bus system according to claim 14 or 15, characterized in that at least one filter or message filter ( 16 ) for filtering messages ( 12 . 13 . 15 ) is implemented. Bus system according to one of Claims 14 to 16, characterized in that the message filter ( 16 ) is assigned to the bus system and / or at least one of the bus users. Bus system according to one of claims 14 to 17, characterized in that the message filter for selecting and / or accepting and / or Ignore is formed of messages. Bus system according to one of Claims 14 to 18, characterized in that the message filter ( 16 ) to prevent the transmission of messages ( 15 ) is trained. Bus system according to one of Claims 14 to 19, characterized in that the message filter ( 16 ) to delete messages ( 15 ) is trained. Bus system according to one of Claims 14 to 20, characterized in that the message filter ( 16 ) for removing and / or ignoring further messages ( 15 ) of a type within a predefined minimum time interval after a first message ( 12 ) of the type is provided. Bus user for a bus system according to one of claims 14 to 21, characterized in that the message filter ( 16 ) for selecting and / or accepting and / or ignoring messages ( 12 . 13 . 15 ) is implemented in the bus subscriber. Vehicle control device with an implementation of a method of claims 1 to 13 as a bus subscriber, in particular according to claim 22 for a bus system according to one of claims 14 to 21. Vehicle control unit according to claim 23, characterized in that a message filter ( 16 ) for filtering messages ( 12 . 13 . 15 ), preferably for selecting and / or accepting and / or ignoring messages ( 12 . 13 . 15 ). Vehicle control device according to claim 23 or 24, characterized in that the message filter ( 16 ) to prevent the transmission of messages ( 12 . 13 . 15 ) and / or delete messages ( 12 . 13 . 15 ) is trained.

Images