Vehicle network for inter-component data communication of vehicle, system comprising said vehicle network and method for monitoring vehicle network

Abstract

The invention relates to a vehicle network (10) for data communication (30) between components (14) of a vehicle. The vehicle network (10) comprises a first data bus (16) and at least two first switching devices (20). The first switching device (20) has a first data bus data interface (22) for connection to a first data bus (16) and a first component data interface (24) for connection to a component (14) of the vehicle. In a connected state (36), the first data bus data interface is connected to the first component data interface (24), and in a disconnected state (130), the first data bus data interface (22) is disconnected from the component data interface (24). A data communication (30) on the first data bus (16) is monitored by means of a first monitoring unit (28) and a first switching device is actuated in order to switch between the connected state (36) and the disconnected state (130) depending on the data communication (30). The invention also relates to a system (12) having a vehicle network (10) and a method (110) for monitoring a vehicle network (10).

Description

Technical Field

[0001] The present invention relates to the field of vehicles and in particular to the field of commercial vehicles. Such commercial vehicles include in particular tractor vehicles, such as trucks or tractors, wherein the present invention can also be used in the field of trailer vehicles. Background Art

[0002] The vehicle under consideration here is a vehicle comprising a plurality of controllers (these controllers are also referred to as "electronic control units", or ECUs for short). The controllers are used to control various functions of the vehicle. Preferably, actuators of the vehicle are controlled or sensors of the vehicle are read by the controllers. Examples of such controllers are brake controllers for controlling different types of brake functions, motor controllers for controlling internal combustion engines and / or electric drives, air spring controllers for controlling air suspensions, and steering controllers for controlling electronic steering.

[0003] These controllers are connected to one another via a vehicle network for data communication, in particular a data bus, in order to exchange data with one another. Thus, for example, the mass of the vehicle can be determined by the controller of the air spring system. For this purpose, a sensor is arranged in each air bellows of the air spring system, which measures the pressure present in the air bellows and transmits it to the controller of the air spring system. The controller can determine the mass from the present pressure and make the determined mass available, for example, to the brake controller, wherein the brake controller can use this mass to actuate an actuator for carrying out a braking function.

[0004] The increasing number of such controllers and their interaction has increased the requirements on the vehicle network for data exchange, especially in terms of the reliability of the entire system, including the control unit and the vehicle network itself. The requirements for reliability have become particularly important due to the increasing number of driving functions that allow the vehicle to act partially or completely autonomously and are also automated by the above-mentioned controllers. For this purpose, such controllers must be able to access the vehicle's sensors and actuators without failure. Such controllers for controlling autonomous or semi-autonomous driving (they are also called "virtual drivers") are also connected via existing networks.

[0005] In order to improve the reliability, various efforts have been made for such or similar applications in vehicles and, for example, redundant control systems or redundant networks have been implemented in order to be able to switch to the redundant system in the event of a problem with the primary system.

[0006] Thus, for example, document EP 3 758 301 A1 describes a method of connecting each of a plurality of controllers to two different communication networks, which are connected to redundant superior control units. Thus, when one of the superior controllers fails, it is possible to switch to another superior control unit and control the controllers via the redundant network.

[0007] However, in the latter solutions and in many other known solutions for improving reliability, not all fault situations can be safely handled by simple component redundancy. In particular, when the vehicle is operated in a partially or fully autonomous manner, faults may still occur that lead to system failure. Summary of the invention

[0008] Therefore, the object of the present invention is to address the problems of the prior art. In particular, a fault-tolerant network architecture for a vehicle should be found in order to ensure safe operation of the vehicle, especially in the case of a high degree of automation, for example in the range of level 2 to level 5. At least an alternative to the prior art should be proposed.

[0009] To this end, the invention relates to a vehicle network for data communication between components of a vehicle according to claim 1 .

[0010] The vehicle network for data communication between components of the vehicle comprises a first data bus and at least two switching devices. Therefore, a plurality of (i.e. at least two, but in particular more than two, for example more than five or more than ten) first switching devices are part of the vehicle network. In addition, the vehicle network also comprises a first monitoring unit.

[0011] At least two first switching devices respectively include a first data bus data interface for connecting to a data bus and a first component data interface for connecting to exactly one of the components of the vehicle. These components include, for example, a controller of the vehicle. Each of the first switching devices respectively includes a connection state and a disconnection state, in which the data bus data interface is connected to the component data interface and in which the data bus data interface is disconnected from the component data interface.

[0012] In addition, each switching device further comprises a first switching input for controlling the switching device to switch between a connected state and a disconnected state. The first switching input of at least one first switching device is connected to the monitoring unit, and in particular the first switching input of each first switching device is connected to the monitoring unit. The first monitoring unit is configured to control the switching device via the first switching input to switch between a connected state and a disconnected state.

[0013] Furthermore, the monitoring unit is connected to the first data bus in order to monitor the data communication on the first data bus. Furthermore, the monitoring unit is designed to control the first switching device as a function of the data communication on the first data bus.

[0014] In addition to the conventional data bus that is usually connected to the components of the vehicle for data exchange, according to the present invention, a switching device and a monitoring unit are provided for each component. The switching device can be connected between the components of the vehicle and the data bus. The monitoring unit can then monitor the data bus and disconnect one or more of the components from the data bus via the switching device assigned to the component in the vehicle in the event of an abnormality.

[0015] Therefore, each component of the vehicle connected to the data bus is preferably assigned its own switching device, which can be controlled individually by the monitoring unit, i.e. via the first switching input of the respective switching device, so that the components are either connected to the data bus or disconnected from the data bus. The switching device thus enables components that seriously affect the entire communication on the data bus due to a fault to be disconnected from the data bus safely.

[0016] In particular, in the case of a component that is constantly transmitting (also known as a constant transmitter or "babbling idiot"), targeted disconnection of this component can ensure that the communication of the remaining components is still guaranteed. Otherwise, such a constant transmitter often leads to an overload of the data network connected to it, and thus to the result that other connected components either no longer transmit data or only transmit data with a time delay.

[0017] According to a first embodiment, the vehicle network further comprises a second data bus and at least two second switching devices. In particular, more than two (i.e., more than a plurality of, in particular more than five or more than ten) second switching devices are part of the vehicle network. The plurality of second switching devices respectively comprise a second data bus data interface and a second component data interface for connecting to the second data bus. Each second component data interface is respectively used to connect to a component of the vehicle that has been connected to the first component data interface of the first switching device.

[0018] In addition, the second switching device also has a connected state and a disconnected state, in which the second data bus data interface is connected to the second component data interface; in the disconnected state, the second data bus data interface is disconnected from the second component data interface. The second switching devices each include a second switching input, which is used to drive the switching device so as to switch between the connected state and the disconnected state. Preferably, a redundant data bus, i.e., the second data bus, is thus provided.

[0019] If the first switching device fails, so that the component that also fails cannot be disconnected from the first data bus, the data communication can be transferred to the second data bus. Due to the independent second switching device, when the first switching device of the component is damaged, the damaged component can still be safely disconnected from the second data bus with a high probability, because the probability that both switching devices of the damaged component are damaged is relatively small. Therefore, the reliability of network communication is further improved, and therefore also includes troubleshooting when one or more of the first switching devices fail.

[0020] According to another embodiment, according to a first variant of the embodiment, at least one of the second switching inputs of the second switching device, in particular each of the second switching inputs of each of the second switching devices, is also connected to the first monitoring unit in order to individually drive the second switching device to switch between the connected state and the disconnected state. In addition, according to the first variant, the first monitoring unit is connected to the second data bus in order to monitor the data communication on the second data bus and also drive the second switching device depending on the data communication on the second data bus and / or the data communication on the first data bus.

[0021] According to a second variant of this embodiment, the vehicle network includes a second monitoring unit, which is connected to at least one of the second switching inputs of the second switching device, in particular to each of the second switching inputs of the second switching device, in order to individually actuate the second switching device to switch between the connected state and the disconnected state. According to a second variant, the second monitoring unit is connected to the second data bus, in order to monitor data communication on the second data bus, and actuate the second switching device as a function of the data communication on the second data bus.

[0022] According to a first variant, the data bus and the switching device are centrally monitored by a single monitoring unit and can therefore be implemented with relatively little technical effort compared to two monitoring units. According to a second variant, not only a redundant bus is provided for maintaining communication in the event of a failure of one of the first switching devices, but also a second monitoring unit is additionally provided which continues to safely monitor data communication on the second data bus in the event of a failure of the first monitoring unit. The reliability of the vehicle network is thus further increased.

[0023] According to another embodiment, the vehicle network further comprises a plurality of third switching devices. The third switching devices respectively comprise a main voltage input for connecting to a main vehicle voltage supply of the vehicle, in particular a main vehicle battery, and a voltage output for connecting to one of the components of the vehicle. In addition, the third switching devices also have a main voltage connected state and a voltage disconnected state. In the main voltage connected state, the main voltage input is connected to the voltage output. In the voltage disconnected state, the main voltage input is disconnected from the voltage output. In addition, the third switching devices also respectively comprise a third switching input, which is used to control the third switching devices so as to switch between the main voltage connected state and the voltage disconnected state.

[0024] If a component connected to the first data bus via the first switching device and a component connected to the second data bus via the second switching device fails and the first switching device and the second switching device also fail, the third switching device allows the failed component to be disconnected from the voltage source. By switching the third switching device, the failed component is no longer supplied with energy, and therefore, in particular in the case of continuous transmission, data will no longer be sent to the first and / or second data bus after the disconnection. Even in the case where the component is connected to the first data bus only by the first switching device, the component can be disconnected from the voltage source via the third switching device when the first switching device fails. In addition, the third switching device can also be used to quickly identify the failed component in the following way, that is, these components are switched to no voltage one by one by the third switching device until the data communication on the first and / or second data bus works again without failure. In particular, different components can also be connected to the bus and can be turned off via the third switching device, so as to identify the failed component or the combination of components without failure as quickly as possible in an appropriate combination.

[0025] According to another embodiment, the third switching device also includes a secondary voltage input terminal, which is used to connect to a secondary vehicle voltage supply of the vehicle, in particular a secondary vehicle battery. In addition, the third switching device also includes a secondary voltage connection state, which is used to connect the secondary voltage input terminal to the voltage output terminal. It is particularly preferred that according to this embodiment, in the main voltage connection state, the secondary voltage input terminal is disconnected from the voltage output terminal. In the secondary voltage connection state, the main power input terminal is preferably disconnected from the voltage output terminal, and in the voltage disconnection state, both the main voltage input terminal and the secondary voltage input terminal are disconnected from the voltage output terminal.

[0026] Due to this embodiment, faults which occur when the components are supplied with power from the primary vehicle voltage supply can additionally be eliminated by means of the third switching device, ie by switching the voltage source to the secondary vehicle voltage supply.

[0027] According to another embodiment, the first monitoring unit and / or the second monitoring unit or at least one voltage monitoring unit is connected to each of the third switching input terminals of the third switching device so as to individually control the third switching device to switch between a main voltage connection state, in particular a secondary voltage connection state, and a disconnect voltage state.

[0028] According to another embodiment, the first data bus and the second data bus are configured according to the same communication standard, wherein the communication standard is, for example, the CAN bus standard or the Ethernet standard, such as the automotive Ethernet communication standard. According to an alternative, the first data bus is configured differently from the second data bus based on the communication standard. For example, the first data bus is a CAN bus and the second data bus is an Ethernet communication bus.

[0029] According to another embodiment, the first switching device and / or the second switching device each include a switch for switching between a disconnected state and a connected state, wherein the switch is implemented as an electromechanical switch, such as a relay for providing electrical isolation, or as an electronic switch including a transistor. Likewise, a semiconductor relay can be used for this purpose, which can also provide electrical isolation. Preferably, the switch is in the disconnected state in the non-driven state.

[0030] The present invention also relates to a system having a vehicle network according to one of the above embodiments and a plurality of components, wherein each component has a first data interface connected to one of the first component data interfaces of one of the first switching devices.

[0031] According to one embodiment of the system, the plurality of components each have a second data interface, which is connected to one of the second component data interfaces of one of the second switching devices.

[0032] Therefore, each component has a first data interface and a second data interface, which are respectively connected to different component data interfaces of different switching devices. If a component fails and one of the two connected switching devices fails, the component can be successfully disconnected from the data bus using the other switching device, and the data bus can continue to operate without being affected by the component.

[0033] According to a further embodiment, a plurality of components each have exactly one voltage input, which is connected to a voltage output of a third switching device assigned to the respective component. The components can be connected via the third switching device either to a primary vehicle voltage supply, preferably to a secondary vehicle voltage supply, of the vehicle, or can be disconnected from both voltage sources in order to individually switch off the respective component. If, in addition to the component, the first switching device and the second switching device assigned to the respective component are also defective, these components can be switched to voltage-free via the third switching device, for example in order to counteract a continuous transmission of these components.

[0034] According to another embodiment, one or more components respectively correspond to the actuator controller of the actuator of the vehicle. Such actuator controllers are, for example, motor controllers, brake controllers and steering controllers. In addition, one or more components respectively correspond to autonomous driving controllers, which are also referred to as "autonomous driving artificial intelligence" or "virtual drivers". The autonomous driving controller provides control signals to drive the actuator controllers based on target predetermined parameters retrieved from other connected controllers and sensor information. Preferably, one or more components are respectively constructed as gateways. The gateway is used to connect another component, which can also be constructed as a controller and has only a single data interface for connecting to two data buses via a first switching device and a second switching device. To this end, the gateway includes an interface for the data interface of another component and two other interfaces for connecting to the first switching device and the second switching device.

[0035] In the event of a fault, components which have only a single data interface (such as actuator controllers) can thus also be disconnected from one or both data buses via the gateway.

[0036] According to a further embodiment, a plurality of components are designed as main components and other components are designed as secondary components, wherein each secondary component preferably corresponds to exactly one main component. This means that according to this embodiment, some components, in particular safety-related components (such as autonomous vehicle control units or brake controllers), are provided in the system in duplicate, i.e. one as a main component and one as a secondary component. Thus, in the event of a failure of the main component, it is possible to switch to the operation of the secondary component. This can be achieved by disconnecting or connecting using the first, second and / or third switching device.

[0037] According to a further embodiment, the components and the switching devices are arranged in separate housings. In particular, each first switching device is thus installed in a separate housing. Furthermore, each second switching device is installed in a separate housing. Furthermore, each component is installed in a separate housing. This ensures that if moisture enters one of the housings, for example one of the components or the switching devices, due to damage to the housing, only the corresponding switching device or component is affected by the moisture.

[0038] A housing filled with liquid, for example due to splashing water, often leads to damage, for example due to a short circuit, so that the functionality of the electronic components in the housing can no longer be ensured. Such a short circuit or damage caused by moisture (for example a large amount of water) often does not directly lead to a complete failure of the electronic components of the housing, but rather to an erroneous behavior, which may also manifest itself in the form of continuous transmission in the case of components, for example. Since at least the first switching device and the second switching device are arranged in a housing separate from the components, it can be assumed that the housing of the switching device is still reliably protected against the ingress of moisture or water in the event of a damaged component. Even in the event that the first switching device or the second switching device is damaged by the ingress of water or moisture and the associated component can no longer be disconnected from the correspondingly assigned data bus, the possibility of at least the other switching devices being able to disconnect the component from the assigned data bus will be increased by independently installing the switching devices in different housings.

[0039] The invention also relates to a vehicle having a vehicle network according to one of the above embodiments or a system according to one of the above embodiments. The vehicle is preferably a commercial vehicle, such as a truck or a tractor.

[0040] Furthermore, the present invention relates to a method for monitoring a vehicle network according to one of the above-described embodiments or a system according to one of the above-described embodiments. According to the method, a first data bus is monitored by a first monitoring unit. Faulty data communications on the first data bus are then identified. For example, if the data transmission exceeds a certain amount, or the number of data packets from one and the same component is unexpectedly large, while at the same time the number of data packets from other components is unexpectedly small, there may be faulty data communications. Preferably, the requirements for data communications are predefined and stored in the monitoring unit, by which the difference between faulty data communications and fault-free data communications can be identified. Thus, for example, fault-free data communications exist when the data packets and the data volume on the data bus correspond to the usual data packet volume achieved with a common data transmitter and data receiver. The usual data communications can be determined in advance by experiments or simulations and used to be predefined and stored in the monitoring unit.

[0041] In addition, the method further comprises controlling the first switching device and / or the third switching device to identify a fault source, in particular identifying a faulty component connected to the first data bus via the first switching device or a faulty first switching device. In addition, the method further comprises controlling the first switching device and / or the third switching device in dependence on the identified fault source to reestablish fault-free communication.

[0042] According to one embodiment of the method, the method further comprises monitoring the second data bus using the first monitoring unit or the second monitoring unit. In addition, the faulty data communication on the first data bus or the second data bus is identified by monitoring. In addition, the first switching device and / or the second switching device, in particular the third switching device, is controlled to identify the source of the fault that caused the data communication to fail. The source of the fault can be a faulty switching device, a faulty component or a faulty monitoring unit itself. In addition, the first switching device and / or the second switching device, in particular the third switching device, is controlled depending on the identified source of the fault.

[0043] According to another embodiment, the monitoring of the first data bus and / or the second data bus is performed sequentially, for example at predefined time intervals. In particular, the monitoring is performed in a system check before the vehicle starts a journey.

[0044] According to another embodiment, in order to identify the source of the fault, the first switching device and / or the second switching device, preferably the third switching device, are driven until the faulty data communication becomes fault-free again. For example, it is identified that the faulty data communication is no longer recognized once the source of the fault is disconnected. In particular, all components are disconnected from the first data bus by the first switching device, and the individual components are reconnected to the first data bus in sequence. For example, this can be controlled in a priority order so that certain components, especially safety-related components, are first connected to the first data bus again via the first switching device. As soon as a data communication fails, the faulty component is also identified. In contrast, if the data communication on the first data bus cannot be converted into a fault-free data communication by switching the first switching device to the disconnected state, this is evaluated as a sign of a fault in the first switching device, so that the components connected to it cannot be disconnected from the first data bus. In this case, the source of the fault can be further identified by disconnecting all components from the second data bus by the second switching device and connecting the individual components in sequence via the second switching device. If there is also a problem with one of the second switching devices, the component can preferably be switched to voltage-free via the third switching device in order to deactivate its communication interface with the first data bus and the second data bus. Particularly preferably, if the identified component is the source of the fault and at the same time corresponds to a primary component, the secondary component corresponding to the primary component is connected to the first data bus and / or the second data bus.

[0045] According to a further embodiment, in order to identify the faulty component, a first subset of components, in particular including a plurality of or all primary components, is disconnected from the second data bus by means of a second switching device and remains connected to the first data bus. A second subset of components, in particular including a plurality of or all secondary components, is disconnected from the first data bus by means of the first switching device and remains connected to the second data bus. Preferably, a third subset of components, in particular including all components that are neither primary components nor secondary components, is disconnected from both data buses. In this way, there is a high probability that one of the two data buses with the components connected thereto is fault-free, thereby ensuring that the vehicle continues to operate with all safety-related functions. The other of the two data buses that has a fault can then be checked according to the above-described embodiment in order to isolate the source of the fault. In particular, the fault-free components of the disconnected subset of components can also be reconnected one by one.

[0046] According to another embodiment, the method comprises disconnecting the identified fault source from the first data bus and / or the second data bus and / or the voltage source. If the faulty component is a primary component, the method comprises connecting the secondary component to the first data bus and / or the second data bus and disconnecting the faulty associated primary component. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Further implementations based on the embodiments described in detail in the accompanying drawings.

[0048] Figure 1 A first embodiment of the system is shown;

[0049] Figure 2 A second embodiment of the system is shown;

[0050] Figure 3 A third embodiment of the system is shown, and

[0051] Figure 4 The steps of a method according to one embodiment are shown. DETAILED DESCRIPTION

[0052] Figure 1 A vehicle network 10 of a system 12 is shown. According to a first embodiment, the system 12 includes a plurality of components 14 and a vehicle network 10 for data communication between the components 14. The vehicle network 10 includes a first data bus 16 and a second data bus 18. The first data bus 16 is connected to a plurality of first switching devices 20 in a star shape. To this end, the first switching devices 20 each have a first data bus data interface 22, which is connected to the first data bus 16. Each of the first switching devices 20 further includes a first component data interface 24, which is set up to be connected to a first data interface 25 of one of the components 14. In addition, each of the first switching devices 20 further includes a first switching input 26, which enables the first switching device 20 to be switched between two states.

[0053] Furthermore, a first monitoring unit 28 is shown, which is connected to the first data bus 16 in order to monitor data communication 30 on the first data bus 16. The first monitoring unit 28 is connected to each of the first switching devices 20 via an independent first control line 32 in order to switch the first switching device between a connected state and a disconnected state. Figure 1 , all first switching devices 20 are represented by switches 34 of the first switching devices 20 in a connected state 36. In the connected state 36, the first data bus data interface 22 is connected to the first component data interface 24, so that the component 14 associated with the first switching device 20 is connected to the first data bus 16.

[0054] The second data bus 18 is connected to a plurality of second switching devices 40, each of which is configured identically to the first switching device 20. Therefore, the second switching device 40 also includes a data bus data interface 42 connected to the second data bus 18 and a component data interface 44 that can be connected to a second data interface 45 of one of the components 14. In addition, a second switching input 46 is provided to switch the second switching device 40 between a connected state and a disconnected state. For this purpose, a second monitoring unit 48 is provided, which is connected to the second switching input 46 via an independent second control line 52 to switch the second switching device 40. In addition, the second monitoring unit 48 is also connected to the second data bus 18 for monitoring the second data bus 18.

[0055] The component 14 includes a main component 54 and a secondary component 56, each of which is assigned exactly one secondary component 56. The main components 54 and secondary components 56 assigned to each other are also connected to each other via data lines 58. In addition, the component 14 also includes a gateway 60 in order to connect another component 62 to the two data buses 16, 18 via the assigned first and second switching devices 20, 40. Regardless of whether the component 14 is redundantly formed as a main component 54 with secondary components 56 or the component 14 is provided non-redundantly, some of the components 14 are formed as actuator controllers 64. Other components 14 are configured as autonomous driving controllers 66.

[0056] Figure 1 , each first switching device 20 is arranged in a single housing 68. Each second switching device 40 is also arranged in a single housing 68. In addition, the first monitoring unit 28 and the second monitoring unit 48 are also arranged in a single housing 68. Each component 14 also has a single housing 68. Therefore, the switching devices 20, 40, the monitoring units 28, 48 and the components 14 all have independent housings 68. The housing 68 is a housing that protects the respective components installed therein from moisture and at least the influence of splashing water.

[0057] Figure 2 An alternative design of the system 12 is shown, in which the first monitoring unit 28 and the second monitoring unit 48 are each integrated into a component 14. The components 14 correspond to Figure 1 The autonomous driving controller 66, the autonomous driving controller is as follows Figure 1 As in FIG. 5 , the main part 54 and the secondary part 56 are constructed. Therefore, Figure 2The system 12 in the embodiment includes a main component 54, which is configured as an autonomous driving controller 66 and includes a first monitoring unit 28. The first autonomous driving controller 66 and the first monitoring unit 28 are installed in a common housing 68. In addition, the associated secondary component 56 is also configured so that it includes a second monitoring unit 48 and is configured as a redundant autonomous driving controller 66. The main component 54 with the first monitoring unit 28 is referred to as a main combination unit 70, and the secondary component 56 with the second monitoring unit 48 is referred to as a secondary combination unit 72. The first and second combination units 70, 72 each include a target value generator 67, a trajectory planner 69 and a controller 71, which are connected to the respective data buses 16, 18 via a further gateway 73.

[0058] The main combination unit 70 is connected via each first control line 32 as Figure 1 In other aspects, the first switching device 20 is connected to the first switching device 20. Figure 1 Therefore, Figure 1 and Figure 2 The same reference numerals in the figure correspond to the same features. Accordingly, the second switching devices 40 are connected to the secondary combination unit 72 via the second control line 52. These second switching devices 40 are also connected to Figure 1 The consistency in .

[0059] The corresponding monitoring units 28, 48 are used to control the first switching device 20 or the second switching device 40. In addition, the first data bus 16 connects the main combination unit 70 with the first switching device 20 in a star shape. Similarly, the second data bus 18 connects the secondary combination unit 72 with the second switching device. Each component in the assembly 14 that does not belong to the main combination unit 70 or the secondary combination unit 72 is connected to the first switching device 20 on the one hand and to the second switching device 40 on the other hand via its data interface 25, 45. In addition, other components 62 such as Figure 1 as shown in .

[0060] Figure 3 Additional embodiments of system 12 are shown. Figure 3 The structure of the system 12 in is basically the same as Figure 1 The system shown in 12 corresponds, therefore, Figure 1 and Figure 3 The same features also have the same reference numerals.

[0061] However, with Figure 1The difference is that a third switching device 80 is provided. The switching device 80 includes a main voltage input 82, a secondary voltage input 84 and a voltage output 86. Each of the main voltage inputs 82 is connected to a main vehicle voltage supply 88, and each of the secondary voltage inputs 84 is connected to a secondary vehicle voltage supply 90. The voltage output 86 is connected to a voltage input 91 of the component 14 or another component 62. In addition, each of the third switching devices 80 has a third switching input 92. The switching input 92 is used to switch the respective switches 94 in each of the third switching devices 80. These switching devices are partially connected to a first voltage monitoring unit 96 and partially connected to a second voltage monitoring unit 98, wherein the first voltage monitoring unit 96 and the second voltage monitoring unit 98 can switch the switch 94 between three states via these connections constructed as a third control line 100. The first voltage monitoring unit 96 is combined with the first monitoring unit 28 in a first housing 102 and is referred to as a first combined monitoring unit 103. The second voltage monitoring unit 98 is combined with the second monitoring unit 48 in the second housing 104 and is referred to as the second combined monitoring unit 106. The first voltage monitoring unit 96 is also connected to the main vehicle voltage supply 88 in order to check the voltage and, depending on the voltage, switch the third switching device 80 connected to the first voltage monitoring unit 96. The second voltage monitoring unit 98 is connected to the secondary vehicle voltage supply 90 in order to monitor its voltage and, depending on the voltage, switch the third switching device 80 connected to the second voltage monitoring unit 98. The advantageously shown construction of the system 12 indicates that the first voltage monitoring unit 96 controls at least the third switching device connected to the main components 54 in order to supply these main components with voltage. The second voltage monitoring unit 98 is connected to the third switching device 80 connected to the secondary components 56 in order to supply these secondary components with voltage.

[0062] Figure 4 The steps of a method 110 for monitoring a vehicle network 10 according to one embodiment are shown. First, step 112 is performed, which includes steps 114, 116, 118 and 120 and is repeated in sequence at time intervals 122.

[0063] In step 114, the first data bus 16 is monitored by the first monitoring unit 28; in step 116, the second data bus 18 is monitored by the second monitoring unit 48; in step 118, the voltage of the primary vehicle voltage supply 88 is monitored by the first voltage monitoring unit 96; in step 120, the voltage of the secondary vehicle voltage supply 90 is monitored by the second voltage monitoring unit 98. If a fault is identified in the monitoring in step 112, different measures are taken depending on the fault.

[0064] If a fault in the data communication on the first data bus 16 is detected by the first monitoring unit 28 in step 124, the faulty component is identified in step 126. For this purpose, in step 128, all first switching devices 20 are first transferred from the connected state 34 to the disconnected state 130. Then, in a step 132 that is repeated several times, the first switching devices 20 are successively switched back to the connected state 36. For this purpose, step 132 is repeated several times, wherein one of the components is switched on in each step 132. At the same time, the data communication is monitored further in step 134. If the switching on of a component by the first switching device 20 again causes a fault in the data communication, the faulty component 14 is identified.

[0065] If it has been determined in step 132 that despite the establishment of the disconnected state 130 of all first switching devices 20, there is still a faulty data communication, then there is a loss of the first switching device 20. In this case, the connected state 36 is not established again via step 132, since the fault on the first data bus 16 cannot be eliminated by switching the first switching devices 20. In this case, the first data bus 16 is no longer used for communication, but only the second data bus 18 is used for communication in step 136.

[0066] However, as described above, if a faulty component can be identified in step 132, then in step 138, the faulty component 14 is disconnected from the first data bus by the first switching device 20, and if the component 14 is a primary component 54, the associated secondary component 56 is used in order to maintain the overall functionality of the system 12. Step 112 is performed again.

[0067] If, during monitoring in step 116, a fault on the second data bus 18 is now detected in step 140, an attempt is likewise made to identify the fault in step 142. For this purpose, all components 14 are again transferred to the disconnected state 130 in step 144 and the components 14 are switched on in a similar manner to step 132 via the second switching device 48 in step 146. If a further faulty component 14 is detected during this switching on, this component is disconnected from the second data bus 18 and, if this component is a primary component 54, the secondary component 56 is connected to the second data bus 18 in step 148. If it is confirmed in step 146 that a faulty data communication is still taking place on the second data bus 18 despite the disconnection of all components 14 from the second data bus 18, this is considered to be an indication of a further defective second switching device 40. This is confirmed in step 150. All components 14 are then switched to a voltage-free state via the third switching device in step 152. For this purpose, the third switching device is switched to a voltage-off state 154. In step 156, components 14 are then successively switched to the main voltage connection state 158 until the fault reappears. The faulty component 14 is thus identified and the voltage is disconnected by means of the associated third switching device 80. If the component 14 is the main component 54, the system 12 continues to operate with the secondary component 56. Step 112 is carried out again.

[0068] Independently or additionally to the above-described method 110, in step 118, the primary vehicle voltage supply 88 is monitored by means of the first voltage monitoring unit, and in step 120, the voltage of the secondary vehicle voltage supply 90 is monitored by means of the second voltage monitoring unit 98. If a voltage fault in the primary vehicle voltage supply 88 or the secondary vehicle voltage supply 90 is detected in step 160, in step 162 the third switching device 80 is switched depending on the faulty voltage detected in step 160, so that the component 14 is either supplied with power from the primary vehicle voltage supply in the primary voltage connection state 158 of the third switching device 80 or supplied with power from the secondary vehicle voltage supply 90 in the secondary voltage connection state 166 of the third switching device 80. Then, step 112 is performed again.

[0069] List of reference numerals (part of the description)

[0070] 10Vehicle Network

[0071] 12 Systems

[0072] 14 parts

[0073] 16 First data bus

[0074] 18 Second data bus

[0075] 20First switching device

[0076] 22 First data bus data interface

[0077] 24 First component data interface

[0078] 25 First data interface

[0079] 26 First switching input terminal

[0080] 28 First Monitoring Unit

[0081] 30Data Communication

[0082] 32 first control circuit

[0083] 34 switches

[0084] 36Connection Status

[0085] 40 Second Switching Device

[0086] 42 Second data bus data interface

[0087] 44 Component data interface

[0088] 45 Second data interface

[0089] 46 Second switching input terminal

[0090] 48 Second Monitoring Unit

[0091] 52 Second control circuit

[0092] 54 Main Parts

[0093] 56 parts

[0094] 58 data lines

[0095] 60 Gateway

[0096] 62 Additional components

[0097] 64 Actuator Controller

[0098] 66 Autonomous Driving Controller

[0099] 67 Target Value Generator

[0100] 68 Shell

[0101] 69 Trajectory Planner

[0102] 70 Main combination unit

[0103] 71 Controller

[0104] 72 combination units

[0105] 73Additional Gateways

[0106] 80 Third switching device

[0107] 82 Main voltage input terminal

[0108] 84th voltage input terminal

[0109] 86 Voltage output terminal

[0110] 88 Main vehicle voltage supply unit

[0111] 90 times vehicle voltage supply

[0112] 91 Voltage input terminal

[0113] 92 third switching input terminal

[0114] 94 Switches

[0115] 96 first voltage monitoring unit

[0116] 98 Second voltage monitoring unit

[0117] 100 Third control line

[0118] 102 first shell

[0119] 103 First Combined Monitoring Department

[0120] 104 Second Shell

[0121] 106 Second Combined Monitoring Department

[0122] 110 Methods

[0123] 112 Monitoring

[0124] 114 monitors the first data bus

[0125] 116 monitors the second data bus

[0126] 118 monitors the voltage of the main vehicle voltage supply

[0127] 120 monitors the voltage of the secondary vehicle voltage supply unit

[0128] 122 Time interval

[0129] 124 Identify failed data communications

[0130] 126 Identify the faulty component

[0131] 128 Transfer the connection state to the disconnected state

[0132] 130 disconnected state

[0133] 132 Switch the first switching device back to

[0134] 134 Monitoring data communication

[0135] 136 Use the second data bus for communication

[0136] 138 Disconnect the failed component from the first data bus

[0137] 140 Identify fault

[0138] 142 Identification Fault

[0139] 144 Transfer the component to the disconnected state

[0140] 146 Switching on the component via the second switching device

[0141] 148 Connecting the secondary component to the second data bus

[0142] 150 Confirmation of data communication failure on the second data bus

[0143] 152 Switch the components to no voltage

[0144] 154 Voltage disconnection status

[0145] 156 Switch the component to main voltage connection state

[0146] 158 Main voltage connection status

[0147] 160 Detection of voltage failure in the main vehicle voltage supply unit

[0148] 162 Switching the third switching device

[0149] 166 voltage connection status

Claims

1. A vehicle network (10) for data communication (30) between components (14) of a vehicle, wherein: The vehicle network (10) comprises: - First data bus (16), - at least two first switching devices (20), each of the first switching devices having: - a first data bus data interface (22) for connecting to the first data bus (16), - a first component data interface (24) for connecting to one of the components (14) of the vehicle, - a connected state (36), in which the first data bus data interface (22) is connected to the first component data interface (24), - a disconnected state (130), in which the first data bus data interface (22) is disconnected from the component data interface (24), and - a first switching input (26), the first switching input being used to control the first switching device (20) so as to switch between the connected state (36) and the disconnected state (130), - a first monitoring unit (28) connected to at least one of the first switching inputs (26), in particular each first switching input (26), of the first switching device (20) in order to individually control the first switching device (20) to switch between the connected state (36) and the disconnected state (130), wherein: The first monitoring unit (28) is connected to the first data bus (16) in order to monitor data communication (30) on the first data bus (16) and to control the first switching device (20) as a function of the data communication (30) on the first data bus (16).

2. The vehicle network (10) according to claim 1, wherein: The vehicle network (10) further includes: - Second data bus (18), - at least two second switching devices (40), each of which has: - a second data bus data interface (42) for connecting to the second data bus (18), - a second component data interface (44) for connecting to a component (14) of the vehicle which is already connected to the first component data interface (24) of the first switching device (20), - a connected state (36), in which the second data bus data interface (42) is connected to the second component data interface (44), - a disconnected state (130), in which the second data bus data interface (42) is disconnected from the second component data interface (44), and - a second switching input (46), which is used to drive the second switching device (40) so as to switch between the connected state (36) and the disconnected state (130).

3. The vehicle network (10) according to claim 2, wherein: a) the first monitoring unit (28) is connected to at least one of the second switching inputs of the second switching device (40), in particular each second switching input (46), in order to individually control the second switching device (40) to switch between the connected state (36) and the disconnected state (130), and The first monitoring unit (28) is connected to the second data bus (18) in order to monitor data communication on the second data bus (18) and to control the second switching device (40) as a function of data communication (30) on the second data bus (18) and / or data communication (30) on the first data bus (16), or b) the vehicle network comprises a second monitoring unit (48), which is connected to at least one of the second switching inputs (46), in particular each second switching input (46), of the second switching device (40) in order to individually control the second switching device (40) to switch between the connected state (36) and the disconnected state (130), wherein: The second monitoring unit is connected to the second data bus (18) in order to monitor data communication (30) on the second data bus (18) and to control the second switching device (40) as a function of the data communication (30) on the second data bus (18).

4. The vehicle network (10) according to any one of the preceding claims, wherein: The vehicle network (10) further includes: A plurality of third switching devices (80), each of the third switching devices comprising: - a main voltage input (82) for connection to a main vehicle voltage supply (88) of the vehicle, - a voltage output (86) for connection to one of the components (14) of the vehicle, - a main voltage connection state (158), in which the main voltage input terminal (82) is connected to the voltage output terminal (86), - a voltage disconnect state (154), in which the main voltage input (82) is disconnected from the voltage output (86), and - a third switching input (92) for driving the third switching device (80) so as to switch between the main voltage connected state (158) and the voltage disconnected state (154).

5. The vehicle network (10) according to claim 4, wherein: The third switching device (80) further comprises: - a secondary voltage input (84) for connection to a secondary vehicle voltage supply (88) of the vehicle; and - a secondary voltage connection state (166) for connecting the secondary voltage input terminal (84) to the voltage output terminal (86).

6. The vehicle network (10) according to claim 4 or 5, wherein: The first monitoring unit (28) and / or the second monitoring unit (48) or at least one voltage monitoring unit (96, 98) is connected to each third switching input (92) of the third switching device (80) so as to individually control the third switching device (80) to switch between the main voltage connection state (158), in particular the secondary voltage connection state (166) and the voltage disconnection state (154).

7. A system (12) comprising a vehicle network (10) according to any one of claims 1 to 6 and a plurality of components (14), wherein: The components (14) each have a first data interface (25) which is connected to a first component data interface (24) of the first switching device (20).

8. The system (12) according to claim 7, wherein: The plurality of components (14) each have a second data interface (45) which is connected to a second component data interface (44) of the second switching device (40).

9. The system (12) according to claim 7 or 8, wherein: The plurality of components (14) each have exactly one voltage input (91) which is connected to a voltage output (86) of a third switching device (80) associated with the respective component.

10. The system (12) according to any one of claims 7 to 9, wherein: The components (14) include a main component (54) and a secondary component (56), wherein each secondary component (56) preferably corresponds to exactly one main component (54).

11. The system (12) according to any one of claims 7 to 10, wherein: Each component (14) is mounted in one of a plurality of independent housings (68), and / or each first switching device (20) is mounted in a housing (68) different from each second switching device (40).

12. A method (110) for monitoring a vehicle network (10) according to any one of claims 1 to 6 or a system (12) according to any one of claims 7 to 11, the method comprising the following steps: - monitoring the first data bus (16) by means of a first monitoring unit (28), - identifying a faulty data communication (30) on the first data bus (16), - actuating the first switching device (20) and / or the third switching device (80) to identify a faulty component (14) or a faulty switching device (20, 80), - controlling the first switching device and / or the third switching device as a function of the identified faulty component (14) or the faulty switching device (20, 80), in particular for reestablishing fault-free data communication (30).

13. The method (110) according to claim 12, wherein: The method further comprises: - monitoring the second data bus (18) by means of the first monitoring unit (28) or the second monitoring unit (48), - identifying a faulty data communication (30) on the first data bus (16) or the second data bus (18), - actuating the first switching device (20) and / or the second switching device (40) and / or the third switching device (80) in order to identify a faulty component (14), a faulty switching device (20, 40, 80) or a faulty monitoring unit (28, 48), - actuating the first switching device (20) and / or the second switching device (40) and / or the third switching device (80) as a function of the identified faulty component (14), switching device (20, 40, 80) or monitoring unit (28, 48).

14. The method (110) according to claim 12 or 13, wherein: In order to identify a faulty component (14), a switching device (20, 40, 80) or a monitoring unit (28, 48), the first switching device (20) and / or the second switching device (40) and / or the third switching device (80) are controlled until the data communication (30) detected as faulty is detected again as fault-free, wherein in particular The second switching device (40) is used to disconnect a first subset of components (14), in particular a plurality of or all of the main components (54), from the second data bus (18), and the first switching device (20) is used to disconnect a second subset of components (14), in particular a plurality of or all of the secondary components (56), from the first data bus (16), and preferably, the first switching device (20) and the second switching device (40) are used to disconnect a third subset of components (14), in particular all components (14) that do not correspond to the main components (54) or the secondary components (56), from the two data buses (16, 18).

15. The method (110) according to any one of claims 12 to 14, comprising reestablishing a fault-free data communication (30) by: a) if the component (14) detected as having a fault is a main component (54) associated with a secondary component (56), connecting the associated secondary component (56) to the first and / or second data bus and disconnecting the main component (54) having a fault from the first data bus and the second data bus, b) if it is detected that the first switching device (20) has failed or the second switching device (40) has failed, connect all components to the data bus (16, 18) that is not connected to the failed switching device (20, 40) and disconnect the data bus (16, 18) that is connected to the failed switching device (20, 40), c) if a fault in the monitoring unit is detected, disconnecting all components from the data bus (16, 18) connected to the faulty monitoring unit and connecting the components via the data bus (16, 18) not connected to the faulty monitoring unit (28, 48).

Images