WO2017045733A1

WO2017045733A1 - Method for message transmission on a bus system of a vehicle, bus system for a vehicle, bus device for a bus system and vehicle controller

Info

Publication number: WO2017045733A1
Application number: PCT/EP2016/001255
Authority: WO
Inventors: Andre Bork; Vladislav RUMYANTSEV; Otmar Struwe; Holger Thies; Andreas Wolff
Original assignee: Wabco Gmbh
Priority date: 2015-09-17
Filing date: 2016-07-18
Publication date: 2017-03-23
Also published as: DE102015012123A1

Abstract

The invention relates to a method for message transmission on a bus system of a vehicle, wherein bus devices connected to the bus system, more particularly for example sensors, actuators and controllers, are able to exchange, more particularly to send and receive, messages (12, 13, 15) via the bus system. The method is distinguished in that in order to prevent overload of the bus system and/or of the bus devices, a minimum time interval (14) is observed between two messages (12; 13; 15) of the same type during sending and/or receiving and/or transmission. Furthermore, bus systems, bus subscribers and vehicle controllers for implementing the method are described.

Description

Method for message transmission on a bus system of a vehicle, bus system for a vehicle, bus subscriber for a bus system, vehicle control unit

description

The invention relates to a method for message transmission on a bus system of a vehicle with the preamble of claim 1. Furthermore, the invention relates to a bus system for a vehicle, in particular motor vehicle, according to the preamble of claim 14. Furthermore, the invention relates to a bus subscriber for a bus system according to the preamble of claim 22.

Finally, the invention relates to a vehicle control device according to the preamble of claim 23.

For a wide variety of control tasks in vehicles or motor vehicles, such as trucks and the like, they have corresponding communication systems. As a rule, these are so-called bus systems on which the corresponding data are transmitted in the vehicle.

Connected to the bus system are typically several bus subscribers, which may be, for example, sensors, actuators, control devices and the like. These bus participants exchange messages, usually in digital form, via the bus system with one another. For example, a brake request of a driver by means of acting as a bus participant brake pedal from the corresponding brake control unit as a further bus subscriber be received. This should also be implemented in a corresponding braking operation.

When communicating on the bus system, in particular for safety-critical components, such as the brake system, it must be ensured that corresponding safety-relevant messages can be forwarded unhindered at any time. For this purpose, on the one hand, a prioritization of messages take place so that safety-critical messages with higher priority are forwarded on the bus system. Thus, it can be ensured in most cases that, for example, a brake request is forwarded immediately, while less security-relevant messages may be forwarded only late.

Despite a corresponding prioritization of messages, it may still happen that at least temporarily a full utilization of the transmission capacity or bandwidth of the bus system takes place. This can then mean that the bus system temporarily has no free transmission capacity and security-related messages or messages of the highest priority can not be transmitted immediately. Such a situation may arise, for example, when a bus subscriber has a defect or software error. Also, a bus subscriber may even have been specifically provided with defective software to overload the bus system by a variety of messages. Typically, such "denial-of-service" attacks are driven by quickly repeating individual messages or at least one message type.

Basically, all messages are transmitted within the transmission capacity on a bus system. Thus, the bus system but can be utilized by a fast message repetition to a standstill and thus paralyzed.

A disadvantage of the known bus system in vehicles is therefore that neither effective safeguards against defective bus users against targeted Attacks are provided, if they are based on a full utilization of the bus system.

The object of the present invention is therefore to specify a method for message transmission on a bus system of a vehicle that prevents a corresponding overloading of the bus system or the bus subscriber.

The method for message transmission on a bus system of a vehicle with the measures of claim 1 solves this problem. Accordingly, a minimum time interval between two messages is maintained to prevent overloading the bus system and / or the bus users. In particular, the minimum time interval between two messages of the same type is complied with. The method is characterized in particular by the fact that the minimum time interval during the transmission and / or reception and / or transmission of messages is ensured. By ensuring a minimum time interval or a time interval between two messages, further messages can be transmitted in this intermediate time. In particular, these may be safety-critical messages. In a further embodiment of the invention, since no message transmission takes place in the meantime, at least the bus users can be protected against overloading by a large number of disturbing messages. Also, by rapid or frequent repetition of messages apart from the bus system and individual bus users, such as vehicle control units, are overloaded. This can go so far that no more messages can be received. The bus user can be busy with the processing of the large number of messages for a long time. However, this can be prevented by ensuring or ensuring a corresponding time interval between messages. A paralysis or a blockage of the bus system by any number of repetitions of messages is thus prevented.

Preferably, the minimum time interval between two messages of the same type is predefined. This means that the repetition rate of messages of the same type is predefined. This is done typically and in particular in the context of specifications, to which the bus system or the bus subscribers should basically comply with the specification. Should this not be the case, for example, in the case of a defective bus user or in the event of an attack by malware, such as computer viruses or the like, appropriate countermeasures must be taken.

Preferably, the minimum time interval is maintained by the bus system and / or bus users. This serves in particular to counteract the so-called denial of service attacks, that is, attacks based on an overload of components. Accordingly, the method described here is preferably implemented in the bus system or in the bus subscribers.

Particularly preferably, the transmission and / or transmission and / or reception of several messages of the same type within a time interval is prevented. This means that already on the bus side a transmission of several messages of the same type within a time interval is prevented. This ensures compliance with the specification or the predefined time intervals for a message type. It can be prevented on the part of the bus system that several messages of the same type are transmitted within a predefined time interval or time interval. Likewise, the transmission and / or reception of several messages of the same type within a time interval can be prevented. In this case, the corresponding sending or receiving is to be prevented in the area of the bus subscribers. Likewise, here too the bus system can intervene in the transmission or reception process by accepting or delivering corresponding messages again. However, this can usually only be done with bus systems that contain active components as part of the actual bus system.

Preferably, after the transmission and / or transmission and / or reception of a first message of one type, transmission and / or reception and / or transmission of further messages of the same type within the time interval is performed. prevented. As a result, the object of the invention is achieved to effectively prevent overloading of the bus system.

Particularly preferably, after the transmission and / or transmission and / or reception of a first message of a type within a subsequent time interval, further messages of the same type are ignored by the bus system and / or the bus users. This means that both the bus participants and the bus system do not observe or process corresponding further messages. Optionally, it can be ensured in the area of amplifiers or other active components of the bus system that further processing or forwarding is prevented. Bus subscribers can also ignore corresponding unwanted messages.

After transmitting and / or transmitting and / or receiving a first message of one type, further messages of the same type are discarded or deleted by the bus system and / or the bus subscribers. This can be achieved in particular in the case of the active forwarding of the amplification of the signals or messages running on the bus system. But other measures to suppress the signals of unwanted messages may be provided, for example by electrical means.

Preferably, after transmitting and / or transmitting and / or receiving a first message within a subsequent time interval, further messages of the same type are not transmitted or not forwarded by the bus system and bus subscribers. This usually corresponds to an active control of the bus system.

Particularly preferably, the messages on the bus system are filtered by the bus system and / or the bus users. In particular, a message filter is provided. The filtering preferably takes place with respect to a minimum time interval between two messages, in particular between two messages of the same type. By appropriate filtering, the above-described objects of the invention described above can be achieved, namely that particular Messages are ignored, not transmitted, deleted or similar.

Particularly preferably, the transmission and / or transmission and / or reception of further messages of one type after a first message of one type is prevented until the end of the predefined time interval. In particular, this is done by at least one filter or at least one filter function. Thus, compliance with appropriate time intervals between messages can be achieved.

Particularly preferably, a transfer of the bus system and / or the bus users is prevented by a message filter is provided. Such a message filter ensures that there is no full utilization of the bus system or its transmission bandwidth.

Compliance with the minimum time interval between two messages of the same type is ensured in particular by the at least one message filter. The message filter is designed so that a temporal filtering can take place.

The at least one message filter is assigned in particular to the bus system and / or at least one of the bus users. Preferably, all bus users are provided with a corresponding message filter. This ensures that there is no overloading of one of the bus participants in the treatment of messages.

The object described above is also achieved by a bus system for a vehicle, in particular a motor vehicle, with the measures of claim 14. The bus system preferably has at least one bus subscriber, which is suitable for carrying out the method according to the above descriptions. The bus system is in particular for transmitting messages, and the bus users are designed in particular for transmitting and / or receiving messages via the bus system. Accordingly, the bus system or the bus users ensure that minimal time intervals between see two messages of the same type are respected when sending and / or receiving and / or transmitting. This ensures that an overload of the bus system is prevented by bus subscribers.

The bus system and / or the bus users are preferably designed to suppress the transmission and / or the transmission and / or the reception of unwanted messages. This preferably takes place on the basis of predefined criteria, in particular with regard to a minimum time interval between two messages of the same type or a corresponding predefined time interval. Consequently, in particular by ignoring excess messages in a time interval, overloading of individual bus subscribers can be prevented by a large number of messages to be handled. A minimum time interval between messages is ensured.

Preferably, at least one message filter is implemented for filtering messages. A message filter is used to handle messages according to predefined criteria.

Particularly preferably, the message filter is assigned to the bus system and / or at least one of the bus users. Preferably, all bus users are provided with a corresponding message filter. Thus, an overload can be prevented for all bus users and the bus system itself. An overload of the transmission bandwidth of the bus can be prevented.

Preferably, the message filter is designed to select and / or accept and / or ignore messages. Thus, individual messages can be handled by the message filter accordingly.

The message filter is designed in particular to prevent the transmission of unwanted messages. This ensures that individual messages can already be treated during the transmission. Preferably, the message filter is designed to delete messages. By providing a corresponding forwarding for the transmission of messages or the direct removal of corresponding messages, the transmission on the bus can be actively acted upon.

More preferably, the message filter is provided for removing and / or ignoring further messages of one type within a predefined minimum time interval after a first message of the type. Thus, the maintenance of a corresponding minimum time interval between two messages of one type is ensured.

The object stated in the introduction is also achieved by a bus subscriber according to claim 22 for a bus system according to the previous embodiments. The bus subscriber is in particular equipped with at least one message filter. The message filter is designed in particular for selecting and / or accepting and / or ignoring messages, in particular according to the above statements. Thus, a corresponding treatment of the messages is already reached in the bus subscriber.

The object set in the introduction is also achieved by a vehicle control unit having the features of claim 23. Accordingly, the vehicle control apparatus implements the above-described method. A vehicle control unit can accordingly be designed as a bus subscriber for a bus system described above.

The vehicle control device preferably has a message filter for filtering messages. This message filter is thus designed to select and / or accept and / or ignore messages.

The message filter is preferably designed to prevent the transmission and / or deletion of messages, in particular individual messages. This can be actively acted in particular on the transmission on the bus system. A preferred embodiment of the invention will be described in more detail below with reference to the drawings:

1 shows a timeline for a bus communication under normal load,

Fig. 2 shows a timeline of bus communication under critical load, and

Fig. 3 shows a timeline of a bus communication under critical load with inventive filtering.

Vehicles, in particular motor vehicles, have a multiplicity of components which communicate with one another. These are vehicle control units, sensors, actuators and similar components.

The communication between the individual components of a vehicle takes place at least largely via so-called bus systems. The various components are then connected to the bus system as bus subscribers and can communicate or exchange data via it. For this purpose, the bus subscribers have corresponding transmitting and / or receiving devices.

The bus system ensures a forwarding or distribution of the data along the bus. Optionally, the bus system may also include other active components that control, for example, the communication on the bus system or maintained, for example by amplifiers or couplers. Optionally, a forwarding between different sections of the bus system can take place.

The data exchanged between bus users is transmitted in the form of data packets as messages or message packets. This means that such a message contains at least the actual user data as a data packet. In addition, to allow assignment on the bus system, sender address and / or destination address can be added. If necessary, further information on the importance of wise priority of the message can be provided. Supplementary data, such as the time of sending or similar, may also be included.

On the basis of the content of the user data or the destination address, corresponding bus subscribers can receive the message and react appropriately. For example, a brake request can be triggered by a brake request of a brake pedal as a bus subscriber by means of a brake control device as a further bus subscriber. But also any other control and regulation measures can be done in the vehicle.

A communication on the bus system under normal load is shown by way of example in FIG.

In the diagram 10, a time beam 11 pointing to the right in the direction of the arrowhead shows the time sequence of message packets or messages 12, 13, 15.

After a first message 12 has been sent on the bus system, another message packet 12 of the same type typically follows at a common time interval. This time interval is referred to as time interval 14. In this case, it is for example 10 milliseconds (10 ms). Thus, purely mathematically, 100 of these messages 12 can be transmitted via the bus system every second, if this minimum time interval 14 is maintained. Typically, such time intervals are sufficient for almost all processes in a vehicle, including time-critical processes such as braking, etc.

As such, due to the time interval 14 and the relatively short length of a single message 12, 13, 15, between two of the messages 12, 13, 15 of one type, there is sufficient time to transmit other, other data, such as message packets 3. Accordingly, many other control and regulation tasks and measurement functions can be done in the meantime in the vehicle. Thus, the bus system can indeed be used in parallel for a variety of different control and control operations. Therefore, under normal conditions and because of the comparatively large Time intervals 14 between two messages of a type are virtually always ensured that safety-critical messages 12 with high priority can be sent, transmitted and received almost at any time.

In Fig. 2, however, another situation is shown.

In this case, a bus system is shown under heavy load. In fact, a plurality of further message packets 15 is then transmitted between two message packets 12 at a high repetition rate. These may be both repetitions of the message packet 12 and message packets of another type, which are transmitted as messages 15 on the bus system.

The time interval 14 between two message packets 12, 15 is in this case only 0.3 milliseconds (0.3 ms) or 300 microseconds (300 ps). This also corresponds approximately to the duration of a single message packet. As a result, it is generally no longer possible to send, transmit or receive further message packets between these message packets 15. Consequently, we are talking about overloading the bus system.

This leads, in particular, to the fact that messages of high priority, which relate, for example, to security-relevant functions, can no longer be transmitted securely. Consequently, for example, a brake request on a bus system overloaded in this way can no longer be securely transmitted, transmitted and received.

The case described here can occur, for example, in the case of a defective vehicle control unit or, in the case of a targeted attack on the bus system. For example, the software of a vehicle controller may be manipulated to disable the bus system by issuing a plurality of high-repetition messages 15. This virtually overrides all communication on the bus system. Of course, this can have very serious consequences in the case of a motor vehicle, since possibly safety-related information can no longer reach the corresponding vehicle control devices. This state counteracts the procedure according to the invention according to FIG. 3.

In this case, as in FIG. 2, the overloaded bus system is first sketched over time. However, filters or filter functions 16 are shown here as dotted frames which schematically enclose a large number of messages 15. The filter functions serve to filter certain messages 15 that are sent to the bus system at a high repetition rate. This means that only messages 12 that are transmitted with a typical low repetition rate and thus with a typical large time interval 14 are not detected by the filter 16. These messages 12 can be sent, transmitted and received.

On the other hand, the messages 15 present on the bus system with a small time interval between them are detected and hidden by the filter 16. This can be achieved in different ways. For example, the filter 16 may be arranged in the region of the transmission units for the bus system. Then the discontinuation of messages 15 with too high repetition rate is prevented from the outset. Alternatively, a filter function 16 may also be arranged in the area of the transmission components of the bus. Then components typically present on the bus system are used to prevent transmission, routing or even passage of components on the bus system. Finally, the filter function 16 can also be provided in the area of the transmitters and / or receivers, ie typically in the bus users themselves. In this case, for example, messages 15 are prevented from being accepted by the recipient if they are transmitted at too high a repetition rate.

Specifically, this means that a minimum time interval between a first transmitting packet 12 and another transmitting packet 12 in the form of a time interval 14 must be present. Otherwise, corresponding messages 15 are not processed. By suitable arrangement and design of the filter function 16 can be prevented, for example, that the bus system is flooded with disturbing news. Optionally, unwanted messages 15 can also be removed from the bus system.

On the other hand, individual bus subscribers can be protected from being overloaded by rapidly repeated messages 15 by accepting only messages 12 that have a minimum time interval to a predecessor message packet 12. In this way, in particular, safety-relevant operations can be ensured practically at any time. An overload of individual bus participants is thus effectively prevented.

Claims

claims

1. A method for message transmission on a bus system of a vehicle, being connected to the bus system bus subscribers, in particular sensors, actuators and control units, messages (12, 13, 15) via the bus system exchange, in particular can send and receive, characterized in that Prevention of overloading of the bus system and / or the bus subscribers a minimum time interval (14) between two messages (12; 13; 15) of the same type when sending and / or receiving and / or transmitting is met.

2. The method according to claim 1, characterized in that the minimum time interval (14) is predefined.

3. The method of claim 1 or 2, characterized in that the minimum time interval (14) is maintained by the bus system and / or by the bus subscribers, in particular to counteract denial-of-service attacks.

4. The method according to any one of the preceding claims, characterized in that the transmission and / or transmission and / or receiving a plurality of messages of the same type is inhibited within a time interval.

5. The method according to any one of the preceding claims, characterized in that after the transmission and / or transmission and / or reception of a first message of a type transmitting and / or transmitting and / or receiving further messages (12, 13, 15) of the same type within the time interval (14) is prohibited.

6. The method according to any one of the preceding claims, characterized in that after transmitting and / or transmitting and / or receiving a first message (12) of a type within a subsequent time interval further messages (15) of the same type from the bus system and / or the bus participants be ignored.

7. The method according to any one of the preceding claims, characterized in that after transmitting and / or transmitting and / or receiving a first message (12) of a type within a subsequent time interval further messages (15) of the same type from the bus system and / or bus participants discarded or deleted.

8. The method according to any one of the preceding claims, characterized in that after transmitting and / or transmitting and / or receiving a first message (12) of a type within a subsequent time interval further messages (15) of the same type from the bus system and / or bus participants not be transmitted or forwarded.

9. The method according to any one of the preceding claims, characterized in that a filtering of the messages (12, 13, 15) on the bus system by the bus system and / or the bus participants, preferably with respect to a minimum time interval (14) between two messages (12 , 13, 15), in particular between two messages (12) of the same type.

10. The method according to any one of the preceding claims, characterized in that transmitting and / or transmitting and / or receiving further messages (15) of a type according to a first message (12) of a type until the end of the predefined time interval (14) is prevented.

11. The method according to any one of the preceding claims, characterized in that at least one filter or message filter (16) is provided to prevent overloading of the bus system and / or the bus participants.

12. The method according to any one of the preceding claims, characterized in that the maintenance of the minimum time interval (14) between two messages (12) of the same type by the at least one message filter (16) is ensured.

13. The method according to any one of the preceding claims, characterized in that the at least one message filter (16) is associated with the bus system and / or at least one of the bus users.

14. Bus system for a vehicle, in particular a motor vehicle, preferably with at least one bus subscriber, for carrying out the method according to one of the preceding claims, wherein the bus system for transmitting and / or the bus subscribers for transmitting and / or receiving messages (12, 13, 15) are formed via the bus system.

15. Bus system according to claim 14, characterized in that the bus system and / or the bus subscribers for suppressing the transmission and / or transmission and / or reception of messages (12, 13, 15) are formed, preferably on the basis of predefined criteria, in particular due to the minimum time interval (14) of two messages (12) of the same type.

16. Bus system according to claim 14 or 15, characterized in that at least one filter or message filter (16) for filtering messages (12, 13, 15) is implemented.

17. Bus system according to one of claims 14 to 16, characterized in that the message filter (16) is associated with the bus system and / or at least one of the bus subscribers.

18. Bus system according to one of claims 14 to 17, characterized in that the message filter is designed for selecting and / or accepting and / or ignoring messages.

19. Bus system according to one of claims 14 to 18, characterized in that the message filter (16) for preventing the transmission of messages (15) is formed.

20. Bus system according to one of claims 14 to 19, characterized in that the message filter (16) for deleting messages (15) is formed.

A bus system according to any one of claims 14 to 20, characterized in that the message filter (16) is provided for removing and / or ignoring further messages (15) of a type within a predefined minimum time interval after a first message (12) of the type.

22. Bus subscriber for a bus system according to one of claims 14 to 21, characterized in that the message filter (16) for selecting and / or accepting and / or ignoring messages (12, 13, 15) is implemented in the bus subscriber.

23. Vehicle control device with an implementation of a method of claims 1 to 13 as a bus subscriber, in particular according to claim 22 for a bus system according to one of claims 14 to 21.

24. Vehicle control device according to claim 23, characterized in that a message filter (16) for filtering messages (12, 13, 15) is implemented, preferably for selecting and / or accepting and / or ignoring messages (12, 13, 15) ,

25. Vehicle control unit according to claim 23 or 24, characterized in that the message filter (16) for inhibiting the transmission of messages (12, 13, 15) and / or for deleting messages (12, 13, 15) is formed.