Subscriber station for serial bus system and method for communicating in serial bus system

Abstract

A subscriber station (10; 10 ') for a serial bus system (1) is provided. 20; 30) and a method for communicating in a serial bus system (1). The subscriber station (10; 20; 30) has a communication control device (11; 21; 31) for controlling a user station (10; 20; 30) of the bus system (1) and at least one further subscriber station (10; 20; 30) and for generating a transmit signal (TxD) from a frame (450); the receiving device (12; 22; 32), which is designed to serially receive at least one signal (CANH, CANL; vDIFF); and manipulating the checking module (15; 25; 35) for checking the receiving device (12; 22; 32) received from the at least one slave bus (40) from a signal (CANH, CANL; vDIFF), and thus received frames (450; 45011, 45012) of at least one predetermined field (457, 458) that has a predetermined first bit value and a predetermined duration (tbt1; tbt2) has at least one pulse (DP) having a second bit value opposite the predetermined first bit value, and wherein the manipulation of the checking module (15; 25; 35) is further designed to discard the received frame (450; 450) after the presence of at least one pulse (DP) having a second bit value opposite the predetermined first bit value. 45011, 45011, 45012) for the first time period.

Description

Technical Field

[0001] The invention relates to a subscriber station for a serial bus system which operates at a high data rate and with great flexibility and robustness against errors, and to a method for communicating in a serial bus system, wherein unauthorized manipulation of the operation of a higher-level technical installation can be prevented. Background Art

[0002] Bus systems used for communication between sensors and control units, for example in vehicles, should be able to transmit large amounts of data in order to ensure the greatest possible number of functions of technical installations or vehicles. It is often necessary to quickly transmit data from the sender to the receiver. In addition, large data packets should be able to be transmitted if necessary.

[0003] Currently, bus systems are already used in many series vehicles, in which data are exchanged as messages between bus users and, for transmission on the bus, are encoded as frames in the standard ISO 11898-1:2015 as the CAN protocol specification with CAN FD. Thus, messages are exchanged between bus users of the bus system, such as sensors, control devices, generators, etc., and for this purpose are transmitted as frames on the bus. CAN FD is used by most manufacturers in vehicles in the first step with a data bit rate of 2 Mbit / s (megabits / second) and an arbitration bit rate of 500 kbit / s (kilobits / second).

[0004] Alternatively, CAN XL can be used, which is the successor bus system of CAN FD. In the case of CAN XL, greater data rates are possible than in the case of CAN FD. In addition, longer messages are possible than in the case of CAN FD. As a result, CAN XL is also suitable for applications that, in addition to pure data transmission via the CAN bus, also support other functions, such as functional safety (Safety), data security (Security) and quality of service (QoS=Quality of Service). These are basic characteristics required, for example, in autonomous vehicles.

[0005] CAN XL is compatible with CAN FD and Classical CAN, wherein CAN XL is at least as robust against errors as CAN FD and Classical CAN. In each of the mentioned CAN versions, any values ​​can be contained in the data field of a frame for a message to be sent via the bus.

[0006] Problems may arise if the operator embeds a second valid CAN frame (attack frame) into the data field of a valid frame (carrier frame).

[0007] The problem here is that messages with different lengths, i.e. different numbers of bytes in the data field, can be sent not only in the case of CAN FD but also in the case of CAN XL. Therefore, the number of bytes of the data field is specified in the DLC field arranged before the data field in the message. It is possible that, due to electromagnetic interference, the receiver sees a value in one of the four bits of the DLC field in the case of a CAN FD frame that is different from the value corresponding to the code for the actual length of the data field of the carrier frame, in particular in the most significant bit of the DLC field. If this error is not visible at the sender, it does not terminate the transmission of the carrier frame. This may result in the receiver instead seeing and receiving two valid CAN frames instead of just one valid CAN frame, i.e. a valid but shortened carrier frame and an attack frame.

[0008] It is thus possible to manipulate the recipient via the attack frame. In particular, the normal operation of the installation could be altered without authorization. This could lead to undesirable consequences and, if necessary, security risks for the higher-level technical installation. Summary of the invention

[0009] The object of the present invention is therefore to provide a subscriber station for a serial bus system and a method for communicating in a serial bus system which solve the above-mentioned problems. In particular, a subscriber station for a serial bus system and a method for communicating in a serial bus system should be provided which provide security against manipulation, so that even at high data rates, arbitrary values ​​in the data field and an arbitrary amount of useful data received per frame, in addition to high error robustness of the communication, a safe operation of the bus system and / or a higher-level technical installation is achieved.

[0010] This object is achieved by a subscriber station for a serial bus system having the features of claim 1. The subscriber station has a communication control device for controlling the communication of the subscriber station with at least one other subscriber station of the bus system and for generating a transmission signal according to a frame, a receiving device which is designed to serially receive at least one signal from the bus, and a manipulation check module for checking whether at least one predetermined field of a frame which the receiving device has created from at least one signal received from the bus and has therefore received has at least one pulse in a received bit having a predetermined first bit value and a predetermined duration, the pulse having a second bit value opposite to the predetermined first bit value, wherein the manipulation check module is further designed to discard the received frame after the presence of at least one pulse having a second bit value opposite to the predetermined first bit value.

[0011] Even when the subscriber station is a receiving node and therefore not the sender of the frames received from the bus, the described subscriber station (node) can check the frames received from the bus with respect to manipulation due to its design. Based on the result of the check, it can react accordingly, in particular discard the frame in order to prevent manipulation of the subscriber station. In particular, no valid frame is incorrectly decoded into two valid frames.

[0012] As a result, a user station infected with malware cannot send frames in an undetected manner, which would interfere with the operation of the bus system or a higher-level installation and / or cause additional damage. Security in the bus system can thus be increased.

[0013] Thus, even with an increasing amount of useful data per frame, the transmission and reception of frames with a high degree of functional reliability and a low error rate is ensured by means of the subscriber stations with a high degree of flexibility in view of current circumstances in the operation of the bus system.

[0014] If at least one CAN subscriber station and / or at least one CAN FD subscriber station and / or at least one CAN XL subscriber station is also present in the bus system, which sends messages according to the CAN protocol and / or the CAN FD protocol and / or the CAN XL protocol, the method executed by the subscriber station can also be used.

[0015] Advantageous further embodiments of the subscriber station are described in the dependent claims.

[0016] The manipulation check module can be designed to check at least one predetermined field of the received frame in addition to comparing the received frame with a frame format valid for the bus system.

[0017] The manipulation detection module may be designed to discard a received frame after the number of at least one pulse having a second bit value opposite to a predetermined first bit value has exceeded a predetermined upper limit.

[0018] For example, the manipulation check module can be designed to check whether, during a received recessive bit, at least one dominant pulse occurs with a duration which is shorter than the received recessive bit.

[0019] In one refinement, the manipulation check module is designed to check whether at least one dominant pulse occurs in a bit sequence of at least two received recessive bits, each having a duration which is shorter than the received recessive bit.

[0020] It is conceivable that the manipulation detection module has a first counter for counting the number of falling edges occurring from the beginning of a predetermined field of a received frame to the end of a predetermined field of the received frame.

[0021] Optionally, the manipulation checking module has a second counter for counting the number of time quanta having opposite bit values ​​and occurring from the beginning of a predetermined field of the received frame until the end of the predetermined field of the received frame.

[0022] In one embodiment, the manipulation check module has a second counter for counting a predetermined number of consecutive time quanta which have opposite bit values ​​and occur from the beginning of a predetermined field of a received frame to the end of a predetermined field of the received frame.

[0023] The manipulation detection module may have a first evaluation block having a first counter and / or a second counter.

[0024] The first evaluation block can be a bit time logic of the communications controller.

[0025] The manipulation detection module may have a second evaluation block for evaluating whether a frame should be discarded, wherein the second evaluation block is designed to exchange signals with the first evaluation block for evaluating a predetermined field of a received frame.

[0026] The second evaluation block can be a bit stream processor of the communications control device.

[0027] At least one predetermined field of the received frame may include at least one of the following fields or bits, namely, an acknowledgment separator bit (ACK delimiter) in the acknowledgment field of the received frame, an end field of the received frame, and an error delimiter of an error frame, wherein the acknowledgment separator bit is after the acknowledgment bit (ACK time slot).

[0028] According to one option, the manipulation check module is designed to perform a check with respect to the dominant pulse in order to detect a predetermined idle state on the bus when integrated into a communication on the bus, which idle state has a predetermined number of bits with the same value which would otherwise not occur during communication on the bus.

[0029] The communication control device for serially generating a transmission signal for transmission onto the bus may be designed such that, for a frame, the bit time of the signal transmitted onto the bus in the first communication phase can differ from the bit time of the signal transmitted in the second communication phase.

[0030] It is possible to negotiate in a first communication phase which of the subscriber stations of the bus system receives at least temporarily exclusive, conflict-free access to the bus in a subsequent second communication phase.

[0031] The user station described above can be part of a bus system, which further comprises a bus and at least two user stations, which are interconnected via the bus so that the user stations can communicate with each other serially. In this case, at least one of the at least two user stations is the user station described above.

[0032] The aforementioned object is also achieved by a method for communication in a serial bus system according to claim 18. The method is performed with a user station of the bus system, the user station having a communication control device, a receiving device and a manipulation check module, wherein the method comprises the following steps: controlling the communication of the user station with at least one other user station of the bus system with the communication control device, wherein the communication control device is designed to generate a transmit signal according to a frame, receiving at least one signal serially from a bus of the bus system with the receiving device, and checking with the manipulation check module whether at least one predetermined field of a frame created by the receiving device from at least one signal received from the bus and thus received has at least one pulse in a received bit with a predetermined first bit value and a predetermined duration, the pulse having a second bit value opposite to the predetermined first bit value, wherein the manipulation check module is further designed to discard the received frame after the presence of at least one pulse having a second bit value opposite to the predetermined first bit value.

[0033] This approach provides the same advantages as mentioned previously with respect to the user stations.

[0034] Other possible implementations of the present invention also include combinations not explicitly mentioned of features or embodiments described above or below with respect to the embodiments. Here, those skilled in the art will also add individual aspects as improvements or supplements to the corresponding basic forms of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The present invention will be described in more detail below with reference to the accompanying drawings and according to embodiments.

[0036] Figure 1 shows a simplified block diagram of a bus system according to a first embodiment;

[0037] Figure 2 A diagram is shown for illustrating the structure of a message which can be sent by a user station of a bus system according to a first exemplary embodiment;

[0038] Figure 3 A simplified schematic block diagram shows a user station of a bus system according to a first embodiment;

[0039] Figure 4 1. shows the time course of bus signals CAN_H and CAN_L at a subscriber station according to a first embodiment;

[0040] Figure 5 FIG. 1 shows the time course of the voltage difference VDIFF of the bus signals CAN-XL_H and CAN-XL_L at the subscriber station according to the first embodiment;

[0041] Figure 6 shows the division of the time amount into frames created by a user station according to the first embodiment, the frames utilizing Figure 4 The bus signals of the bus system are transmitted via the bus;

[0042] Figure 7 shows an example of a part of a receive signal RxD which a subscriber station of the bus system according to the first embodiment generates over time from the signals of frames received from the bus;

[0043] Figure 8 The first counter of the user station according to the first embodiment is shown based on Figure 7 The time variation process of the count value Z1 obtained from the received signal; and

[0044] Fig. 9 The second counter of the user station according to the first embodiment is shown based on Figure 7 The time variation process of the count value Z2 obtained from the received signal.

[0045] In the figures, identical or functionally identical elements are provided with the same reference symbols unless otherwise indicated. DETAILED DESCRIPTION

[0046] Figure 1 As an example, a bus system 1 is shown, which is in particular designed essentially for a CAN bus system, a CAN FD bus system, a CAN XL bus system and / or variants thereof, as described below. The bus system 1 can be used in vehicles, in particular motor vehicles, aircraft, etc., or in hospitals, etc.

[0047] exist Figure 1 In the embodiment, the bus system 1 has a plurality of user stations 10, 20, 30, which are connected to the bus 40 by means of a first bus core 41 and a second bus core 42, respectively. The bus cores 41, 42 may also be referred to as CAN_H and CAN_L or CAN-XL_H and CAN-XL_L, and are used for electrical signal transmission after a dominant level is input for signal coupling in the sending state or a recessive level or other level is generated. Messages 45, 46 in the form of signals can be transmitted serially between the individual user stations 10, 20, 30 via the bus 40. If an error occurs during communication on the bus 40, such as by Figure 1As shown by the jagged black block arrow in FIG. 4 , an error frame 47 (Error Flag) may be optionally sent. The user stations 10 , 20 , 30 are, for example, control devices, sensors, display devices, etc. of a motor vehicle.

[0048] As in Figure 1 As shown in FIG. 1 , the user station 10 has a communication control device 11, a transmitting / receiving device 12, and a manipulation check module 15. The user station 20 has a communication control device 21 and a transmitting / receiving device 22, and optionally has a manipulation check module 25. The user station 30 has a communication control device 31, a transmitting / receiving device 32, and a manipulation check module 35. The transmitting / receiving devices 12, 22, 32 of the user stations 10, 20, 30 are respectively directly connected to the bus 40, even if this Figure 1 Each of the transmitting / receiving devices 12, 22, 32 can optionally be designed as a separate transmitting device and a separate receiving device.

[0049] The communication control devices 11 , 21 , 31 are respectively used to control the communication between the corresponding user station 10 , 20 , 30 and at least one other user station among the user stations 10 , 20 , 30 connected to the bus 40 via the bus 40 .

[0050] The communication control device 11, 31 creates and reads a first message 45, which is, for example, a modified CAN message 45. In this case, the modified CAN message 45 is constructed based on the CAN FD format, which refers to Figure 2 , and wherein corresponding operating modules 15, 35 are used. The communication control device 11, 31 can also be implemented to create and read other modified CAN messages 46, which are constructed based on CAN XL, for example. In this case, the modified CAN message 46 is constructed based on the CAN XL format, which is a further development of CAN FD and is compatible with CAN FD. In the case of a CAN FD message 45, a number of 0 to 64 data bytes can be included, which are also transmitted at a significantly faster data rate than in the case of a classic CAN message. In the case of a CAN XL message 46, a number of 0 to, in particular, approximately 2 kbyte (kilobytes) or any other value can be included, which are also transmitted at a significantly faster data rate than in the case of a CAN FD message 45.

[0051] The communication control device 11, 31 is therefore designed to provide a CAN FD message 45 or a CAN XL message 46 to the transceiver device 12, 32 as required or to receive the CAN FD message 45 or the CAN XL message 46 from the transceiver device 12, 32. The communication control device 11, 31 thus creates and reads a first message 45 or a second message 46, wherein the first and second messages 45, 46 differ by their data transmission standard, namely in this case CAN FD or CAN XL.

[0052] The communication control device 21 can be implemented as a conventional CAN controller according to ISO 11898-1:2015, ie as a CAN FD-tolerant classic CAN controller or a CAN FD controller. The communication control device 21 creates and reads a first message 45, for example a CAN FD message 45. In particular, the communication control device 21 is implemented as a conventional CAN FD controller.

[0053] The transmitting / receiving device 22 can be designed like a conventional CAN transceiver or a CAN FD transceiver according to ISO 11898-1:2015. The transmitting / receiving device 12, 32 can be designed to receive messages 45 according to the CAN FD format or messages 46 according to the CAN XL format from the associated communication control device 11, 31 as required, or to provide messages 45 according to the CAN FD format or messages 46 according to the CAN XL format to the associated communication control device 11, 31.

[0054] With the two subscriber stations 10 , 30 , it is possible to form and then transmit a message 46 in the CAN XL format and to receive such a message 46 .

[0055] Figure 2 For message 45, a CAN FD frame 450 is shown as encoded by communication control device 11 over time t and provided to transceiver 12 for transmission onto bus 40. In this case, communication control device 11 in the present exemplary embodiment creates frame 450 to be compatible with classic CAN and subsequent versions of CAN FD, for example CAN XL, as also shown in Figure 2 The same applies analogously to the communication control device 31 and the transmission / reception device 32 of the user station 30.

[0056] according to Figure 2, a CAN FD frame 450 for CAN communication on the bus 40 is subdivided into different communication phases 451, 452, namely an arbitration phase 451 and a data phase 452. The frame 450 has an arbitration field 453, a control field 454, a data field 455, a checksum field 456 for checksum CRC, an acknowledgement field 457 and an end field 458. The bit duration of the bits of the arbitration phase 451 is longer than the bit duration of the bits of the data phase 452. The physical layer is the same for the frame 450 in the arbitration phase 451 and the data phase 452 as in the case of conventional CAN. The physical layer corresponds to the bit transmission layer or layer 1 of the known OSI model (Open Systems Interconnection Model 1).

[0057] The start of a frame 450 (Frame) is indicated by the bit SOF (Start of Frame). Subsequently, for example, at least one of the subscriber stations 10, 30 sends an identifier (ID) in an arbitration field 453. Accordingly, in an arbitration phase 451, it is negotiated bit by bit between the subscriber stations 10, 20, 30 in the arbitration field 453 by means of bits ID28 to bit 18 of the identifier (ID): which subscriber station 10, 20, 30 currently wants to send a message 45, 46 with the highest priority and thus obtain exclusive access to the bus 40 of the bus system 1 next time for transmission in the subsequent data field 452. At the end of the arbitration field 453, the bit RRS is sent.

[0058] The main point during phase 451 is to use the known CSMA / CR method, which allows user stations 10, 20, 30 to access bus 40 simultaneously without destroying higher-priority messages 45, 46. This makes it relatively easy to add further bus user stations 10, 20, 30 to bus system 1, which is very advantageous.

[0059] The CSMA / CR method requires that a so-called recessive state must be present on the bus 40, which can be overwritten by other subscriber stations 10, 20, 30 with a dominant state on the bus 40. In the recessive state, high-ohmic relationships exist at the individual subscriber stations 10, 20, 30, which, combined with the parasitic effects of the bus circuit, result in longer time constants. This results in the maximum bit rate of the current CAN FD physical layer (FD transceiver according to ISO11898-2:2016) being limited to approximately 2 Mbits per second in practical vehicle use. CAN XL can further increase this maximum bit rate by additionally switching the physical layer, in particular for the data phase 452.

[0060] In the data stage 452, for Figure 2In a frame of CAN FD, the useful data of the CAN FD frame 450 or message 45 from the data field 455 and almost the entire checksum field 456 are transmitted in addition to a part of the control field 454. The control field 454 has the control bits IDE, FDF, res, BRS, ESI and in the DLC field has 4 bits from bit 3 to bit 0. The checksum field 456 has an SBC field and a field for the checksum CRC and a bit CRC delimiter.

[0061] The sender of message 45 starts sending the bits of data phase 452 onto bus 40 only when sender subscriber station 10 has won the arbitration and thus has exclusive access to bus 40 of bus system 1 for sending.

[0062] In complete general terms, the following different characteristics can be achieved in a bus system with CAN XL compared to CAN or CAN FD:

[0063] a) taking over and, if necessary, adapting proven properties which are responsible for the robustness and user-friendliness of CAN and CAN FD, in particular the frame structure with identifiers and arbitration according to the CSMA / CR method,

[0064] b) increase the net data transmission rate, in particular to about 10 Mbps,

[0065] c) Increasing the size of useful data per frame, in particular to approximately 2 kbyte (kilobytes) or any other value.

[0066] like Figure 2 As shown in FIG, in the arbitration phase 451 as the first communication phase, the user station 10 partially, in particular up to and including the FDF bit, uses the format known from CAN / CAN-FD according to ISO 11898-1:2015. For the CAN XL message 46, the user station 10 uses the CAN XL format starting from the FDF bit in the first communication phase and in the second communication phase, the data phase 452.

[0067] In the case of this embodiment, CAN XL is compatible with CAN FD. For CAN XL, use the Figure 2 The res bit known from CAN FD (which is also called the XLF bit in the case of CAN XL) is used to switch from the CAN FD format to the CAN XL format. The frame formats of CAN FD and CAN XL are therefore identical up to the res bit or the XLF bit. The receiver only recognizes in which format the frame 450 is sent when the res bit or the XLF bit is set. CAN XL user stations, i.e. user stations 10, 30 here, also support CAN FD.

[0068] Replacement in Figure 2 , wherein an identifier with 11 bits (bit ID28 to bit ID18) is used according to the CAN FD basic frame format, optionally for CAN FD or CAN XL, an extended frame format is possible, wherein an identifier with 29 bits is used. This is identical to the known CAN FD extended frame format from ISO 11898-1:2015 up to the FDF bit.

[0069] In accordance with Figure 2 In the case of frame 450, bits with fixed values, i.e., 0 or 1, are marked with bold black lines. Figure 2 The bits shown with a bold dash at their bottom line in FIG. 4 are sent as dominant or "0" in frame 450. Figure 2 The bits shown with a bold dash at their top line are sent as recessive or "1" in the frame 450. In the CAN XL data phase 452, when using a special CAN SIC XL transceiver, symmetrical '1' and '0' levels may be used instead of recessive and dominant levels.

[0070] In general, two different stuffing rules are applied when generating CAN XL frames. The dynamic bit stuffing rule of CAN FD applies until the res bit in the control field 454, so that after 5 identical bits, the opposite stuffing bit can then be inserted. Such stuffing bits are also called dynamic stuffing bits. After the res bit in the control field 454, the fixed stuffing rule applies in the case of CAN XL frames, so that after a fixed number of bits, a fixed stuffing bit can be inserted. Alternatively, a number of 2 or more bits can be inserted as fixed stuffing bits instead of just one stuffing bit.

[0071] exist Figure 2 In the frame 450 of CAN FD, the FDF bit is followed by the res bit, which corresponds in position to the "XLF bit" in the CAN XL format, as mentioned previously. If the res bit is sent as 1, i.e. recessive, it thereby identifies the frame 450 as a CAN XL frame. For a CAN FD frame, the communication controller 11 sets the res bit to 0, i.e. dominant.

[0072] In frame 450 , the res bit is followed by the BRS bit, wherein the bit duration for the arbitration phase 451 is switched to the bit duration for the data phase 452 .

[0073] The DLC field adjoins the BRS bit, into which a data length code (DLC=Data Length Code) is inserted, which indicates the number of bytes in the data field 455 of the frame 450. The data length code (DLC) can assume any value from 0 to the maximum length of the data field 455 or the data field length. Since the maximum data field length in the case of CAN FD is 64 bytes, the data length code (DLC) has 4 bits, namely bits 3 to 0. In this case, DLC=0 means a data field length of 0 bytes and DLC=15 means a data field length of 64 bytes. It should thus be ensured that the receiver of the frame 450 receives the useful data correctly and that the end of the frame 450 is reliably recognized using the fields 456, 457, 458. In addition, the bus 40 should be released again as quickly as possible for sending further frames 450 or messages 45, 46 in order to maximize the data rate in the bus system 1. The frame 450 thus does not block the bus 40 longer than necessary.

[0074] exist Figure 2 In the frame 450 of , the DLC field is followed by a data field 455 (DataField). The data field 455 consists of 0 to 64 data fields. The length of the data field 455 is encoded in the DLC field, as previously described.

[0075] After the data field 455, the SBC field with bits SBC3 to SBC0 follows in the frame 450 and then the checksum CRC. The checksum CRC is CRC21 or CRC17 and therefore consists of bits 20 to bit 0 or bits 16 to bit 0 for the checksum CRC. The length of the checksum CRC and thus the length of the CRC polynomial can be selected according to the desired Hamming distance. The checksum CRC safeguards the entire frame 450. With or starting with the bit CRC delimiter of the checksum field 456, the duration of the bits of the frame 450 is switched from the duration for the data phase 452 to the duration for the arbitration phase 451, in other words from short to long, as in Figure 2 As explained in .

[0076] After the bit CRC delimiter and thus the checksum field 456, in the frame 450 follows an acknowledgement field 457 with a bit ACK slot for acknowledging the correct reception of the frame 450. If the receiving user station 10, 30 receives the frame 450 correctly, it sends the ACK slot bit as dominant. The sending user station sends the ACK slot bit as recessive. Thus, the bits originally sent on the bus 40 in the frame 450 can be overwritten by the receiving user station 10, 30. The ACK delimiter bit is sent as a recessive bit, which serves to separate it from the other fields.

[0077] After the acknowledgement field (ACK field) 457, an end field 458 (EOF=End of Frame) follows in the frame 450. The bit sequence bit 1 to bit 7 of the end field 458 (EOF) serves to mark the end of the frame 450. The end of the field (EOF) together with the bit ACK delimiter causes a number of 8 recessive bits to be transmitted at the end of the frame 450. This is a bit sequence that cannot occur within the frame 450. As a result, the end of the frame 450 can be reliably detected by the subscriber station 10, 20, 30.

[0078] After the end field (EOF), the inter-frame distance INT (Intermission Field) follows in the frame 450. The inter-frame distance INT is Figure 2 is not shown, but only in Figure 8 In the case of CAN, the interframe distance (INT) is at least 3 bits. This interframe distance INT is designed as in the case of CAN FD according to ISO 11898-1:2015 even in the case of CAN XL.

[0079] Figure 3 The basic structure of a subscriber station 10 is shown, which has a communication control device 11, a transmitting / receiving device 12 and a manipulation detection module 15, which in the case of the subscriber station 10 is part of the communication control device 11. The subscriber station 30 is constructed in a similar manner, as in Figure 3 As shown in Figure 1 The manipulation checking module 35 is arranged separately from the communication control device 31 and the transmitting / receiving device 32. Therefore, the user station 30 will not be described separately.

[0080] according to Figure 3In addition to the communication control device 11 and the transmitting / receiving device 12, the user station 10 also has a microcontroller 13 assigned to the communication control device 11 and a system ASIC 16 (ASIC=Application Specific Integrated Circuit), which can alternatively be a system basis chip (System Basis-Chip, SBC) on which a plurality of functions required for the electronic components of the user station 10 are combined. In addition to the transmitting / receiving device 12, an energy supply device 17 is also installed in the system ASIC 16, which supplies electrical energy to the transmitting / receiving device 12. The energy supply device 17 usually provides a voltage CAN_Supply of 5V. However, according to requirements, the energy supply device 17 can provide other voltages with other values. Additionally or alternatively, the energy supply device 17 can be designed as a power supply.

[0081] Between the communication control device 11 and the transmission / reception device 12 , a transmission signal TxD is exchanged via the corresponding terminal TXD, and a reception signal RxD is exchanged via the terminal RXD, as described previously and below.

[0082] Figure 3 The manipulation detection module 15 has a first evaluation block 151 and a second evaluation block 152 . The first evaluation block 151 has a first counter 1511 and a second counter 1512 . The second evaluation block 152 has a configuration register 1525 .

[0083] The first evaluation block 151 generates a sampling point SP for the signals CAN_H, CAN_L received from the bus 40 ( Figure 6 ), and outputs the associated signal S1 to the second evaluation block 152 for this purpose. In addition, the first evaluation block 151 determines the bit value BW for the received signal RxD and outputs it to the second evaluation block 152. The bit value BW is 0 or 1. The first evaluation block 151 can be a bit timing logic (BTL=Bit Timing Logic) of the communication control device 11 or a part thereof. The bit timing logic (BTL=BitTiming Logic) is an automatic state machine that is evaluated once per time quantum and is synchronized with the bit stream at the terminal RXD of the device 11. Figure 6 A bit consisting of 8 time quanta TQ1 to TQ8 is shown as an example. In addition, a bit timing logic (BTL=Bit Timing Logic) generates a sampling point SP. In register 1525, parameters 152A, 152B are stored, which the first evaluation block 151 uses for its evaluation, as described below.

[0084] The second evaluation block 152 outputs the signal S2 to the first evaluation block 151. The second evaluation block 152 can be a bit stream processor (BSP) of the communication control device 11 or a part thereof. The bit stream processor (BSP) is an automatic state machine that is evaluated once per CAN bit time, that is, either during the bit duration t_bt1 in the arbitration phase 451 or during the bit duration t_bt2 in the data phase 452. The bit stream processor (BSP) encodes and / or decodes the CAN bit stream at the terminals TXD, RXD after adjusting the CAN protocol.

[0085] The second evaluation block 152, in particular the bit stream processor (BSP=Bit Stream Processor), signals the first evaluation block 151, in particular the bit timing logic (BTL=Bit Timing Logic), with the signal S2 that the first evaluation block 151 should now additionally evaluate the received signal RxD. The signal S2 can also be referred to as the signal "field to be additionally evaluated". As soon as the signal S2 ("field to be additionally evaluated") is deactivated, the first evaluation block 151 resets the counters 1511, 1512, in particular resets their count values ​​to 0.

[0086] The functionality of the manipulation test module 15 is described in more detail below.

[0087] The transmitting / receiving device 12 further comprises a transmitting module 121 and a receiving module 122. Even though the transmitting / receiving device 12 is always mentioned below, it is alternatively possible to arrange the receiving module 122 in a separate device outside the transmitting module 121. The transmitting module 121 and the receiving module 122 can be designed as in the case of a conventional transmitting / receiving device 22. The transmitting module 121 can have, in particular, at least one operational amplifier and / or a transistor. The receiving module 122 can have, in particular, at least one operational amplifier and / or a transistor.

[0088] The transmitting / receiving device 12 is connected to the bus 40, more precisely to its first bus core 41 for CAN_H or CAN-XL_H and its second bus core 42 for CAN_L or CAN-XL_L. The energy supply device 17 is supplied with voltage via at least one terminal 43 for supplying electrical energy, in particular the supply voltage CAN-Suppy, to the first and second bus cores 41, 42. The connection to ground or CAN_GND is achieved via a terminal 44. The first and second bus cores 41, 42 are terminated with a terminating resistor 49.

[0089] The first and second bus cores 41, 42 are connected in the transmitting / receiving device 12 both to the transmitting module 121 (also referred to as a transmitter) and to the receiving module 122 (also referred to as a receiver), even though for the sake of simplicity the first and second bus cores 41, 42 are connected in the transmitting / receiving device 12 both to the transmitting module 121 (also referred to as a transmitter) and to the receiving module 122 (also referred to as a receiver). Figure 3 The connections are not shown.

[0090] During operation of the bus system 1, the transmission module 121 converts the transmission signal TxD of the communication control device 11 into corresponding signals CAN_H and CAN_L for the bus wires 41, 42, and transmits the signals to the bus 40 at the terminals 40 for CAN_H and CAN_L. Figure 4 An example for signals CAN_H and CAN_L is shown in FIG. 4. A difference signal VDIFF=CAN_H-CAN_L is formed on bus 40, as shown in FIG. Figure 5 as shown in .

[0091] Figure 3 The receiving module 122 is composed according to Figure 4 The signals CAN_H and CAN_L received from bus 40 or according to Figure 5 The difference signal VDIFF forms the receiving signal RxD. Figure 3 As shown in FIG. 1 , the receiving module 122 forwards the receiving signal RxD via the terminal RXD of the transmitting / receiving device 12 to the terminal RXD of the communication control device 11 .

[0092] Except in the idle or standby state (Idle or Standby), in normal operation, the sending / receiving device 12 with the receiving module 122 always monitors the transmission of data or messages 45, 46 on the bus 40, that is, it is independent of whether the sending / receiving device 12 is the sender of the message 45 or the message 46.

[0093] according to Figure 4 In the example of CAN_H and CAN_L, at least in the arbitration phase 451, the signals CAN_H and CAN_L have dominant and recessive bus levels 401, 402, as is known from CAN. Figure 5 As shown in FIG. 1 , the receiving module 122 can recognize individual bits of the signal VDIFF with a bit time t_bt1 in the arbitration phase 451 using a receiving threshold T_a of, for example, 0.7 V. In the data phase 452, the bits of the signals CAN_H and CAN_L are transmitted faster than in the arbitration phase 451, i.e., with a shorter bit time t_bt2 ( Figure 7 ) is sent, as referenced Figure 2 Therefore, in data stage 452 Figure 4The signals CAN_H and CAN_L of the arbitration phase 451 differ from the conventional signals CAN_H and CAN_L of the arbitration phase 451 by their faster bit rate. If in the data phase 452 the signals CAN_H and CAN_L are also generated using another physical layer in the case of CAN XL, then the receiving threshold is also switched in the receiving module 122, for example to a receiving threshold T_d of approximately 0.0 V in the data phase 452.

[0094] Used for Figure 4 The sequence of states 401 and 402 of the signals CAN_H and CAN_L in Figure 5 The resulting profile of voltage VDIFF serves only to clarify the function of subscriber station 10. The sequence of data states for bus states 401, 402 can be selected as required.

[0095] in other words, Figure 3 The sending module 121 is based on Figure 4 In the first operating mode of the bus 40, a first data state is generated as a bus state 402 with different bus levels for the two bus cores 41, 42 of the bus line, and a second data state is generated as a bus state 401 with the same bus level for the two bus cores 41, 42 of the bus line. In addition, Figure 3 In the second operating mode including the data phase 452, the transmitting module 121 transmits bits to the bus 40 at a higher bit rate for the time course of the signals CAN_H, CAN_L. As mentioned, the signals for the CAN XL messages 46 in the data phase 452 can also be generated using a different physical layer than in the case of CAN FD. As a result, the bit rate can be increased further in the data phase 452 than in the case of CAN FD.

[0096] Figure 3 The manipulation check module 15, in particular its evaluation block 151, is used to evaluate whether a dominant pulse occurs in the currently received frame 450. The manipulation check helps to identify and prevent certain attacks. In the case of an attack, a user station infected with malware, for example the user station 30, sends a message 45 with a specially selected content in the data field 452. If only one receiving node, for example the user station 10, now finds a bit error in the DLC field of the frame 450, in particular in bit 3 of the DLC field, a frame 450 with a shorter frame length than the frame 450 actually has can be simulated for the receiving node. Figure 3 The manipulation detection module 15 is necessary in particular when receiving the frames 450 in order to detect manipulated frames 450 .

[0097] For the evaluation, the manipulation detection module 15 performs the following Figures 6 to 9Act as explained.

[0098] Figure 6 The bits of the received signal RxD generated by the subscriber station 10, 20, 30 are shown subdivided into time quanta TQ1 to TQ8 (time quantum), as used by the associated communication control device 11, 21, 31. The time quantum TQ1, ..., TQ8 corresponds to the time unit in which the communication control device 11, 21, 31 samples the received signal RxD. For the sake of clarity, the time quantum TQ1, ..., TQ8 corresponds to the time unit in which the communication control device 11, 21, 31 samples the received signal RxD. Figure 6 All time quanta TQ2 to TQ7 which are not arranged between the time quanta TQ1 and TQ8 over time t are provided with reference numerals. The sampling of the bits for evaluating the bit value 1 or 0 takes place at sampling points SP, which are usually at approximately 75% of the bit duration t_bt1. Figure 6 The position of the sampling point SP in the bit can be configured as one of the parameters 152A, 152B in the register 1525 and stored in the register 1525.

[0099] Figure 6 The bit of is, by way of example, a bit with duration t_bt1, which is used in the arbitration phase 451. The number of time quanta TQ1, ..., TQ8 is determined by the first evaluation block 151. In particular, the number of time quanta TQ1, ..., TQ8 in a bit is freely selectable in a manner subject to preset restrictions of the CAN standard. In other words, the division into time quanta, for example time quanta TQ1, ..., TQ8, is performed by the first evaluation block 151. The number of time quanta TQ1, ..., TQ8 in a bit can be configured as one of the parameters 152A, 152B and stored in the register 1525.

[0100] With reference Figure 6 The same as described for the bits of the arbitration phase 451 applies to the bits of the data phase 452 with the bit duration t_bt2 even if this is not explicitly shown in the figure. The bit duration t_bt1 , t_bt2 may be configured as one of the parameters 152A, 152B and stored in the register 1525 .

[0101] Figure 7 A part of a reception signal RxD is shown for frame 450 , which is generated by communication control device 11 from the signal CAN_H, CAN_L or VDIFF received from bus 40 . Figure 7 The receive signal RxD or RxD signal is shown for a data field 455 of a frame 450 with special content which can be used for security-related attacks (security attacks). In this data field, a premature end of the frame 450 is simulated. Figure 7The end of the bit simulation with the aid of the second communication phase 452 is shown, namely starting from the bit CRC delimiter at the end of the data field 455 .

[0102] Figure 7 The result of the evaluation of the currently received frame 450 (carrier frame) is shown. The frame 450 is first evaluated as the first frame 450_1 having the front part 450_1_1 and the end part 450_1_2, although there is actually still a data field 455 for the currently received frame 450 (carrier frame) being sent via the bus 40. The reason for the expected end of the frame 450 in advance is a bit error in the bit of the DLC field, which will be described in more detail later. That is, the communication control device 11 first receives the bit ACK (ACK time slot) and the end field 458 (EOF) in the actual data field 455 of the currently received frame 450 (carrier frame) from the data field 455, and evaluates this as the end part 450_1_2 of the currently received frame 450 (carrier frame).

[0103] The reason for invoking the expected end is that the receiving communication control device 11 has seen a bit error in the DLC field, in particular in bit 3 of the DLC field, so that, for example, the DLC field of the currently received frame 450 (carrier frame) has a value of 0xF before being distorted by the bit error, which due to the bit error notifies that the data field 455 has a length of 7 bytes (DLC field=0x7), although the currently received frame 450 (carrier frame) actually has a data field 455 with a length of 64 bytes. In other words, the communication control device 11 mistakenly expected to have a data field 455 of only 7 bytes. For this reason, according to Figure 7 The currently received frame 450 (carrier frame) contains, starting from the 8th byte in the data field 455, a bit sequence corresponding to a valid checksum CRC, followed by a simulated ACK field 457 with a bit ACK time slot and ACK delimiter, a simulated end field 458 with EOF bits 1 to 7 (see Figure 2 ), simulated inter-frame distance (INT1, inter-frame) and simulated bit sequence for arbitration phase 451 of subsequent frame 450.

[0104] Due to the dynamic CAN bit stuffing mechanism, the currently received frame 450 (carrier frame) cannot represent a sufficiently long recessive level or bit value in the CAN FD data field 455 to accurately simulate, for example, the 8 recessive bits of the ACK delimiter and EOF field 458. Since the value of the bit depends only on the value of the signal RxD at the sampling point (Sample Point), the communication control device 11 is able to filter out short dominant pulses DP in the signals CAN_H, CAN_L or VDIFF received from the bus 40.

[0105] Quite generally, the receiving module 122 can have at least one pulse in a received bit having a predetermined first bit value and a predetermined duration t_bt1 , t_bt2 , which pulse has a second bit value that is opposite to the predetermined first bit value.

[0106] By means of module 15, in particular counters 1511, 1512, the count values ​​Z1, Z2 are Figure 8 and Fig. 9 Targeted Figure 7 Frame 450 shows that the occurrence of a dominant pulse DP can be identified in a recessive bit or the occurrence of a recessive pulse can be identified in a dominant bit. Here, both the first counter 1511 (which can also be called a "falling edge" counter) and the second counter 1512 (which can also be called a "dominant time quantum" counter) can identify the dominant pulse DP and thus count.

[0107] For example, the device 11, in particular the manipulation detection module 15, uses the first counter 1511 to count the number of falling edges of the RxD signal, that is, the change of the RxD signal from the bit value 1 (recessive) to the bit value 0 (dominant) and / or the number of time quanta TQ in the RxD signal that are regarded as the bit value 0 (dominant).

[0108] If the first evaluation block 151, in particular the bit timing logic (BTL=Bit Timing Logic), recognizes a number of falling edges or dominant pulses DP which is configured as an upper limit N for the number of falling edges or dominant pulses DP, the block 151 detects at the next sampling point SP ( Figure 6 ) reports the received dominant bit (bit value 0) to the second evaluation block 152, which is actually consistent with the first evaluation block 151 at the sampling point SP ( Figure 6 ) has already been sampled. In this case, the second evaluation block 152 sees a format error for the currently received frame 450. The upper limit N of the number of falling edges or dominant pulses DP can be configured in one of the parameters 152A, 152B and stored in the register 1525.

[0109] In other words, if the number of time quanta TQ and / or the number of edges in the RxD signal that are considered as bit value 0 (dominant) exceeds a previously selected limit value, the device 11, in particular the manipulation check module 15, processes this as a format error. Due to the format error, the currently received frame 450 is evaluated or classified as invalid for the user station 10 (receiver). Therefore, the user station 10 (receiver) discards the frame 450.

[0110] When the counter reading or count value Z1 of the counter 1511 is, for example, N=2, Figure 8As shown in , the end field 458 (EOF) can be classified as invalid (format error). Figures 7 to 9 In the example case of , reception will be aborted and the user station 10 (receiving node) will not receive the subsequent second frame (attack CAN frame). Instead, the user station 10 (receiving node) starts an error frame 47 (Error-Frame). This prevents an attack via the currently received frame 450 (carrier frame with integrated second frame).

[0111] The device 11, in particular the manipulation detection module 15, evaluates at least one predetermined field or bit, in particular the bit ACK delimiter and / or the field 458 (EOF) and / or the field error delimiter (which is part of the error frame 47), for the received CAN frame 450 using the evaluation block 1511 and at least one of the counters 1511, 1512. The predetermined field or bit can be configured as one of the parameters 152A, 152B and stored in the register 1525.

[0112] For example, the device 11, in particular the manipulation detection module 15, can act as follows for this purpose. If the first evaluation block 151 recognizes a synchronization edge corresponding to a falling edge of the RxD signal in one of the previously mentioned fields to be evaluated of the CAN frame 450, the block 151 stores this point at the next sampling point SP (Sample Point, Figure 6 ) is reported to the second evaluation block 152 via the signal S1, BW as an explicit sampled bit.

[0113] The second evaluation block 152 uses the signals S1 and BW to perform the Figure 2 The CAN format of the frames 450 received is compared and a format error of the currently received frame 450 is detected thereby.

[0114] In this way, in the case of an attack using embedded frames, a bit error in one of the bits of the DLC field of frame 450 can be reliably detected. This makes it possible to protect against manipulations in particular in which a valid frame 450 (carrier frame) contains another valid frame 450, but the receiving subscriber station instead detects two valid frames 450 instead of just one frame 450 (carrier frame) in a very cost-effective manner.

[0115] According to the second embodiment, the device 11, in particular the manipulation verification module 15, acts as follows. For example, at least one counter 1511, 1512 of the first evaluation block 151 counts a sequence or series of N consecutive time quanta TQ, rather than counting individual time quanta TQ. Thus, the resolution can be set with N, i.e. from which width of the dominant pulse DP the counter 1511, 1512 starts counting. Here, N is an arbitrary natural number. In particular, in the case of a specific example, N can be a number between 1 and 500.

[0116] In particular, N=3 is selected so that, for example, the count value Z1 of the counter 1511 is changed, in particular incremented or decremented, only when three time quanta TQ with dominant bit values ​​occur in succession.

[0117] In the case of the second embodiment, robustness can be achieved with respect to short dominant pulses DP. Nevertheless, the above-mentioned attack can be defended against by means of a valid frame 450 (carrier frame) in which a valid CAN frame is embedded. The reason for this is that the sender of the valid frame 450 (carrier frame) is designed to simulate an embedded attack CAN frame only with a resolution of the bit time t_bt2 of the bits of the data phase 452. The sending of the frame 450 (carrier frame) may also occur randomly, the data field 455 of the frame 450 randomly containing a bit sequence that looks like an embedded attack CAN frame (attack CAN frame). Therefore, protection is provided in the case of intentional (attack) and unintentional transmission of carrier frames by means of the check of the manipulation check modules 15, 25, 35.

[0118] Otherwise, the modules 15, 25, 35 are constructed in the same manner as previously described for the first embodiment.

[0119] According to a third embodiment, the manipulation check module 15 has only one counter, either the first counter 1511 or the second counter 1512. In this case, the value N=1 is selected as the upper limit of the count value Z1 or Z2, wherein the manipulation check module 15 determines that the currently received frame 450 has a format error and must therefore be discarded. In this case, the first evaluation block 151 feeds back a dominant bit after the synchronization edge.

[0120] Therefore, the choice of N=1 is very advantageous, since only one counter can be implemented, which counts either the number of synchronization edges (falling edges) or the number of consecutive dominant time quanta TQ1 to TQ8. In addition, a counter which only counts from 0 to 1 is very cost-effective and easy to implement.

[0121] Otherwise, the modules 15, 35 are constructed in the same manner as previously described for the first embodiment.

[0122] According to a fourth exemplary embodiment, the device 11, in particular the manipulation detection module 15, is designed to additionally use the previously described evaluation of the currently received frame 450 during the reintegration of the subscriber station 10 into the ongoing communication at the bus 40. This reintegration becomes necessary when the subscriber station 10 is restarted or waked up again after a rest phase. When CAN XL communication is carried out in a special mode, in which error signaling is already switched off by configuration in the subscriber station, reintegration is even used after each detected reception error.

[0123] In this case, the device 11, in particular the manipulation check module 15, evaluates with blocks 151, 152 whether the device subsequently recognizes 11 recessive bits on the CAN bus 40. If such a sequence of bits is recognized, the device 11, in particular the manipulation check module 15, evaluates this as an idle state ("Idle Condition") of the bus. The bus 40 is therefore free and the device 11 itself can start sending messages 45, 46 onto the bus 40.

[0124] In this way, any ongoing operation of the bus system 1 and of the higher-level technical installations is not disrupted. Thus, the function that can also be used to protect against manipulation of at least a portion of the bus system 1 can be used to contribute to increasing the data rate in the bus system. Undesired disturbances and / or a reduction in the performance data of the bus system 1 can thus be achieved very cost-effectively and effectively.

[0125] Otherwise, the modules 15 , 35 are constructed in the same manner as previously described for the first or second embodiment.

[0126] According to a fifth embodiment, at least one of the user stations 10, 30 is designed to generate a frame 450 due to an identified manipulation and to send the frame via the bus 40 so as to prompt the other user stations 10, 20, 30 that the frame 450 just or previously sent via the bus 40 has been identified as being manipulated.

[0127] All previously described embodiments of the subscriber stations 10, 20, 30, the bus system 1 and the methods implemented therein can be used individually or in all possible combinations. In particular, all features of the previously described embodiments and / or modifications thereof can be combined as desired. Additionally or alternatively, in particular the following modifications are conceivable.

[0128] Although the invention has been described above using a CAN bus system as an example, the invention can be used in the case of any communication network and / or communication method in which two different communication phases are used, wherein different bus states are generated for the different communication phases. In particular, the invention can be used in the case of developing other serial communication networks, such as Ethernet and / or 10BASE-T1S Ethernet, fieldbus systems, etc.

[0129] In particular, the bus system 1 according to the embodiment can be a communication network in which data can be transmitted serially at two different bit rates. It is advantageous, but not a mandatory prerequisite, that in the case of the bus system 1, exclusive, conflict-free access to the common channel for the user stations 10, 20, 30 is guaranteed at least in a certain period of time.

[0130] The number and arrangement of the user stations 10, 20, 30 in the bus system 1 of the embodiment are arbitrary. In particular, the user station 20 in the bus system 1 can be omitted. It is possible that one or more of the user stations 10 or 30 are present in the bus system 1. It is conceivable that all the user stations in the bus system 1 are designed to be identical, that is, only the user station 10 or only the user station 30 is present.

Claims

1. A user station (10; 20; 30) for a serial bus system (1), having A communication control device (11; 21; 31) for controlling the communication of a user station (10; 20; 30) with at least one other user station (10; 20; 30) of a bus system (1) and for generating a transmission signal (TxD) according to a frame (450), A receiving device (12; 22; 32) designed to receive at least one signal (CAN_H, CAN_L; VDIFF) serially from a bus (40), and A manipulation check module (15; 25; 35) for checking whether at least one predetermined field (457, 458) of a frame (450; 450_1_1, 450_1_2) created by a receiving device (12; 22; 32) from at least one signal (CAN_H, CAN_L; VDIFF) received from a bus (40) and thus received has at least one pulse (DP) in the received bit with a predetermined first bit value and a predetermined duration (t_bt1; t_bt2), the pulse having a second bit value opposite to the predetermined first bit value, The manipulation detection module (15; 25; 35) is further designed to discard a received frame (450; 450_1_1, 450_1_2) after the presence of at least one pulse (DP) having a second bit value opposite to a predetermined first bit value.

2. A user station (10; 20; 30) according to claim 1, wherein the manipulation verification module (15; 25; 35) is designed to verify at least one predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) in addition to comparing the received frame (450; 450_1_1, 450_1_2) with a frame format valid for the bus system (1).

3. A user station (10; 20; 30) according to claim 1 or 2, wherein the manipulation detection module (15; 25; 35) is designed to discard the received frame (450; 450_1_1, 450_1_2) after the number of at least one pulse (DP) having a second bit value opposite to a predetermined first bit value has exceeded a predetermined upper limit (N).

4. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation check module (15; 25; 35) is designed to check whether at least one dominant pulse (DP) occurs in a received recessive bit having a duration (t_bt1; t_bt2), and the dominant pulse has a shorter duration than the received recessive bit.

5. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation check module (15; 25; 35) is designed to check whether at least one dominant pulse (DP) occurs in a bit sequence of at least two received recessive bits, each having a duration (t_bt1; t_bt2), and the dominant pulse has a shorter duration than the received recessive bit.

6. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation detection module (15; 25; 35) has a first counter (1511) for counting the number of falling edges occurring from the beginning of a predetermined field (457, 458) of a received frame (450; 450_1_1, 450_1_2) to the end of a predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

7. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation detection module (15; 25; 35) has a second counter (1512) for counting the number of time quanta (TQ) having opposite bit values ​​and occurring from the beginning of a predetermined field (457, 458) of a received frame (450; 450_1_1, 450_1_2) until the end of a predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

8. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation detection module (15; 25; 35) has a second counter (1512) for counting a predetermined number of consecutive time quanta (TQ) having opposite bit values ​​and occurring from the beginning of a predetermined field (457, 458) of a received frame (450; 450_1_1, 450_1_2) until the end of a predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

9. A user station (10; 20; 30) according to any one of claims 6 to 8, wherein the manipulation detection module (15; 25; 35) has a first evaluation block (151), which has a first counter (1511) and / or a second counter (1512).

10. The subscriber station (10; 20; 30) as claimed in claim 9, wherein the first evaluation block (151) is a bit time logic of the communications control device (11).

11. The user station (10; 20; 30) according to claim 9 or 10, wherein the manipulation detection module (15; 25; 35) has a second evaluation block (152) for evaluating whether the frame (450; 450_1) should be discarded, and The second evaluation block (152) is designed to exchange signals (S1, S2, BW) with the first evaluation block (151) for evaluating predetermined fields (457, 458) of received frames (450; 450_1_1, 450_1_2).

12. The subscriber station (10; 20; 30) according to claim 11, wherein the second evaluation block (152) is a bit stream processor of the communication control device (11).

13. A user station (10; 20; 30) according to any of the preceding claims, wherein at least one predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) includes at least one of the following fields or bits, namely, an acknowledgment interval bit (ACK delimiter) in the acknowledgment field (457) of the received frame (450; 450_1_1, 450_1_2), an end field (458) of the received frame (450; 450_1_1, 450_1_2), and an error delimiter of an error frame (47), wherein the acknowledgment interval bit is after the acknowledgment bit (ACK time slot).

14. A user station (10; 20; 30) according to any of the preceding claims, wherein the manipulation check module (15; 25; 35) is designed to perform a check with respect to a dominant pulse (DP) in order to identify a predetermined idle state on the bus (40) when integrated into a communication on the bus (40), said idle state having a predetermined number of bits with the same value, which otherwise would not occur in the communication on the bus (40).

15. A user station (10; 20; 30) according to any of the preceding claims, wherein a communication control device (11; 21; 31) for serially generating a transmit signal (TxD) for sending to a bus (40) is designed so that, for a frame (450), the bit time (t_bt1) of the signal sent to the bus (40) in a first communication phase (451) can be different from the bit time (t_bt2) of the signal sent in a second communication phase (452).

16. The user station (10; 20; 30) according to any one of the preceding claims, In a first communication phase (451), it is negotiated which of the subscriber stations (10, 20, 30) of the bus system (1) is to receive at least temporarily exclusive, conflict-free access to the bus (40) in a subsequent second communication phase (452).

17. A bus system (1) having a bus (40), and At least two user stations (10; 20; 30), which are connected to each other via a bus (40) so that they can communicate with each other serially, and at least one of the user stations (10; 20; 30) is a user station (10; 20; 30) according to any of the preceding claims.

18. A method for communicating in a serial bus system (1), wherein the method is performed using a user station (10; 20; 30) of the bus system (1), the user station having a communication control device (11; 12; 31), a receiving device (12; 22; 32) and a manipulation detection module (15; 25; 35), wherein the method comprises the following steps: Controlling the communication of a user station (10; 20; 30) with at least one other user station (10; 20; 30) of a bus system (1) by means of a communication control device (11; 21; 31), wherein the communication control device (11; 21; 31) is designed to generate a transmission signal (TxD) according to a frame (450), At least one signal (CAN_H, CAN_L; VDIFF) is received serially from a bus (40) of a bus system (1) by means of a receiving device (12; 22; 32), A manipulation check module (15; 25; 35) is used to check whether at least one predetermined field (457, 458) of a frame (450; 450_1_1, 450_1_2) created by a receiving device (12; 22; 32) from at least one signal (CAN_H, CAN_L; VDIFF) received from a bus (40) and thus received has at least one pulse (DP) in the received bit with a predetermined first bit value and a predetermined duration (t_bt1; t_bt2), the pulse having a second bit value opposite to the predetermined first bit value, The manipulation detection module (15; 25; 35) is further designed to discard a received frame (450; 450_1_1, 450_1_2) after the presence of at least one pulse (DP) having a second bit value opposite to a predetermined first bit value.

Images