Methods and computer programs for a monitoring instance and a communication component, monitoring instance, communication component, system and vehicle

Abstract

Method (10) for a monitoring instance (30) for monitoring at least one communication component (40), wherein the communication component (40) is configured to communicate with one or more other communication components (50) via a data bus (70) in an event-based manner, comprising the following steps: regular checking (12) of the function of the communication component (40) by the monitoring instance (30); and cyclic communication (14) of the monitoring instance (30) with at least one other monitoring instance (60) which is assigned to another communication component (50) in order to monitor the function of the communication component (40), the function of the other communication component (50) and the function of the data bus (70), further comprising cyclic communication between the monitoring instance (30) and the communication component (40) via a connection different from the data bus (70).

Description

[0001] The present invention relates to methods and computer programs for a monitoring instance and a communication component, a monitoring instance, a communication component, a system and a vehicle, in particular but not exclusively to a concept for monitoring communication components for event-based communication in a motor vehicle.

[0002] In automotive engineering, and also in computer and communications engineering in general, data buses are used to enable data communication between various components connected to or coupled to a data bus. For example, two communication partners or components exchange messages via a data bus, with the communication being event-based. Unlike cyclic communication, in event-based communication messages are only exchanged when a corresponding event occurs. For example, a "turn signal on" message (also called a "request") is sent on a vehicle's bus when the driver activates the turn signal, and a "turn signal off" message is sent when the turn signal lever returns to its neutral position.

[0003] Interference can cause either the communication partner or the communication link (e.g., a data bus interruption) to fail. In this case, the question arises as to how such a failure can be detected. With event-based communication, there is no timeout monitoring, so this failure goes unnoticed without further action. From the perspective of a communication partner, there is no detectable difference between a failure and the non-occurrence of the event, since no message is sent in either case.

[0004] For a continuous target setting, a service-requesting device (also called a "client") would renew its request before a maximum execution time expires. In the example above, the turn signal would be activated for 10 seconds after receiving the "on" message. If the turn signal lever were still activated after these 10 seconds, a new "on" message would have to be sent to keep the turn signal active. If the turn signal lever were deactivated before the 10 seconds had elapsed, a "off" message would have to be sent accordingly. While this mechanism would prevent the turn signal from remaining activated indefinitely in the event of communication errors on the data bus, it would not detect the error itself.

[0005] For safety-critical functions, timeout times are typically less than one second. To account for this, the event-based communication described above would be converted into quasi-cyclic communication to comply with the timeouts. Since this would potentially affect a large number of functions, it would result in a high bus load without providing any functional benefit. Examples of such use cases include turn signals, warning lights, seat adjustment, lighting, ventilation, setpoint specifications (e.g., speed control), fan controls, etc.

[0006] Document DE 10 2013 217 461 A1 relates to a method for monitoring a component, in particular a battery, of a motor vehicle, comprising a first control unit for monitoring the component, a second control unit for monitoring the component, wherein the second control unit is arranged at a distance from the first control unit and communicates with the first control unit, wherein the second control unit is connected to the component via a line, in particular a hardware line, comprising the steps of transmitting operating data to the first control unit by the second control unit, checking the operating data in the first control unit, transmitting data from the first control unit to the second control unit, and switching off the component by the second control unit if a fault is detected by the first control unit and / or the second control unit.This allows for a spatial separation of the control unit under test from the control unit performing the shutdown, whereby the installation position of the control unit under test can be freely chosen.

[0007] Therefore, there is a need for an improved concept for detecting the aforementioned error patterns, without requiring all functions at the application level to implement their own time-out monitoring mechanisms.

[0008] This need is met by methods and computer programs for a monitoring instance and a communication component, a monitoring instance, a communication component, a system, and a vehicle according to the pending independent claims. Advantageous configurations and further developments are the subject of the dependent claims.

[0009] Exemplary embodiments of the present invention are based on the core idea that monitoring instances can be used for functional control of communication components. The monitoring instances can communicate cyclically with each other, thus enabling the detection of a failure of a communication component or a data bus. The cyclical control information exchanged between different monitoring instances can be reduced compared to the control information that would have to be exchanged directly between the communication components for monitoring purposes, particularly when one monitoring instance monitors multiple communication components.

[0010] Exemplary embodiments provide a method for a monitoring instance to monitor at least one communication component, wherein the communication component is configured to communicate with one or more other communication components via a data bus in an event-driven manner. The method includes regular checks of the communication component's function by the monitoring instance and cyclical communication with at least one other monitoring instance assigned to a different communication component to monitor the function of the communication component, the function of the other communication component, and the function of the data bus. The cyclical communication between the monitoring instances allows for monitoring of the communication between the communication components and the data bus.

[0011] Exemplary implementations provide a method for a communication component to communicate with one or more other communication components via a data bus. The method includes event-based communication with the one or more other communication components via the data bus and cyclical communication with the monitoring instance. These exemplary implementations can thus enable efficient monitoring of communication components.

[0012] In some embodiments, cyclic communication between monitoring instances takes place on the data bus, thereby indirectly monitoring the data bus as well. A failure of the cyclic communication with functioning monitoring instances indicates a malfunction on the data bus. In further embodiments, the method includes cyclic communication between the monitoring instance and the communication component via a connection different from the data bus, for example, a local connection. The communication established for direct monitoring is then independent of the data bus, and its success does not depend on the transmission capacities and states of the data bus.

[0013] In some embodiments, the method can further include transmitting an error indication to at least one other monitoring instance when a malfunction or communication error of the communication component is detected. In this way, the communication necessary for monitoring can be limited to the monitoring instances and thus implemented efficiently. The method can also include synchronization with at least one other monitoring instance via the data bus. This can improve the efficiency of cyclic communication. In some embodiments, the communication component can be registered with the monitoring instance. Similarly, the method can include registration of the communication component with the monitoring instance.This allows the monitoring instance and the procedure to be used more universally, for example, for different and multiple communication components. Examples of implementations include monitoring communication components and a data bus in a vehicle.

[0014] Furthermore, exemplary embodiments create one or more computer programs for carrying out one or more of the methods described herein, if the computer program runs on a computer, a processor, or a programmable hardware component.

[0015] Another embodiment is a monitoring instance for a communication component, configured to communicate with one or more other communication components via a data bus. The monitoring instance comprises one or more interfaces for communication via the data bus and for communication with the communication component. The monitoring instance further comprises a control device configured to monitor the one or more interfaces and to communicate cyclically with the communication component and with at least one other monitoring instance of another communication component. In some embodiments, the control device is configured to communicate with the communication component via a connection distinct from the data bus. Monitoring can thus be performed independently of the data bus.

[0016] The control device can be configured to transmit a fault indication to at least one other monitoring instance when a malfunction or communication error of the communication component is detected. Malfunctions can thus be brought to the attention of other monitoring instances. In some embodiments, the control device can be configured to synchronize with at least one other monitoring instance via the data bus and / or to register a communication component. The monitoring instance can be configured to monitor communication components and a data bus in a vehicle.

[0017] Exemplary embodiments also create a communication component for communicating with one or more other communication components via a data bus. The communication component includes one or more interfaces for communication via the data bus and for communication with a monitoring instance. Furthermore, the communication component includes a control device configured to control the one or more interfaces, to communicate with the one or more other communication components in an event-driven manner, and to communicate cyclically with the monitoring instance. Analogous to the description above, the control device can be configured to perform a registration with the monitoring instance.

[0018] Exemplary embodiments also include a system with at least two monitoring instances as described above and at least two communication components assigned to the monitoring instances as described above. Another exemplary embodiment is a vehicle equipped with such a system.

[0019] Further advantageous embodiments are described in more detail below with reference to the exemplary embodiments shown in the drawings, to which the exemplary embodiments are generally, but not entirely, limited. The drawings show: Fig. 1 a flowchart of an exemplary embodiment of a method for a monitoring instance; Fig. 2 a flowchart of an exemplary implementation of a method for a communication component; Fig. 3 an embodiment of a monitoring instance, an embodiment of a communication component and an embodiment of a system; Fig. 4 an architecture of a surveillance service in an exemplary implementation; Fig. 5 a failure of a communication component in an exemplary embodiment; Fig. 6 a failure of a data bus in an exemplary embodiment; Fig. 7 a sequence of exchanged messages in an exemplary embodiment; Fig. 8 a sequence of exchanged messages in a further embodiment; and Fig. 9 a sequence of exchanged messages in a further embodiment.

[0020] Several embodiments are now described in more detail with reference to the accompanying drawings, in which some embodiments are illustrated. Optional features or components are shown in dashed lines.

[0021] Although embodiments can be modified and altered in various ways, the embodiments shown in the figures are examples and are described in detail herein. It should be clarified, however, that the intention is not to limit embodiments to the forms disclosed, but rather that embodiments are intended to cover all functional and / or structural modifications, equivalents, and alternatives within the scope of the invention.

[0022] Note that an element described as "connected" or "coupled" to another element may be directly connected or coupled to that element, or there may be intervening elements. Conversely, if an element is described as "directly connected" or "directly coupled" to another element, there are no intervening elements. Other terms used to describe the relationship between elements should be interpreted similarly (e.g., "between" versus "directly between," "adjacent" versus "directly adjacent," etc.).

[0023] The terminology used herein serves only to describe specific embodiments and is not intended to limit the embodiments. As used herein, the singular forms "a," "an," "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise. Furthermore, it should be clarified that expressions such as "includes," "containing," "exhibits," "comprises," "comprehensive," and / or "indicating," as used herein, indicate the presence of the aforementioned features, integers, steps, workflows, elements, and / or components, but do not preclude the presence or addition of one or more features, integers, steps, workflows, elements, components, and / or groups thereof.

[0024] Fig. Figure 1 illustrates a flowchart of an embodiment of a method 10 for a monitoring instance 30. Fig. Figure 2 shows an associated flowchart of an embodiment of a method 20 for a communication component 40. Fig. Figure 3 shows an overview of an embodiment of a system 80 with embodiments of monitoring instances 30, 60 and embodiments of communication components 40, 50.

[0025] Fig. Figure 1 shows a method 10 for a monitoring instance 30 for monitoring at least one communication component 40. The communication component 40 is configured to communicate with one or more other communication components 50 via a data bus 70 in an event-based manner. The method 10 includes a regular check 12 of the function of the communication component 40 by the monitoring instance 30. The method further includes cyclical communication 14 with at least one other monitoring instance 60, which is assigned to another communication component 50, in order to monitor the function of the communication component 40, the function of the other communication component 50, and the function of the data bus 70.

[0026] Here and in the following, "regular" refers to a rule-based temporal sequence. For example, a rule might stipulate that such communication occurs within a cycle, i.e., within a predetermined time period. Regular checks can therefore be performed based on a defined time base, a clock, or a period, such as every 10 ms, 20 ms, 50 ms, 100 ms, 200 ms, 500 ms, 1 s, 2 s, 5 s, etc. A certain degree of tolerance is to be expected, adapted to practical circumstances, and a (theoretically) perfect period cannot be assumed. In this sense, "regular" communication can also mean "periodic" or "cyclic" communication, in the sense that a maximum time interval between two messages is not exceeded according to a given probability. Cyclical communication can occur according to a guaranteed or at least highly predictable schedule.

[0027] Another rule would be linked to an event, ensuring that a malfunction can be detected with a high degree of certainty within a specific timeframe. In this case, the event is considered to occur with a sufficiently high probability. Finally, a combination of approaches is also conceivable: adapting a monitoring cycle based on specific events. For example, some communication components could be checked more frequently (to detect errors more quickly) after certain events have occurred. A frost warning system, for instance, might be monitored relatively infrequently or not at all at temperatures above 20°C, whereas it would be checked more frequently at lower temperatures.

[0028] Analogously, the Fig. 2 a method 20 for a communication component 40 for communication with one or more other communication components 50 via a data bus 70. The method 20 comprises event-based communication 22 with the one or more other communication components 50 via the data bus 70 and cyclic communication 24 with the monitoring instance 30.

[0029] In exemplary embodiments, the communication components 40, 50 in a communication system 80 can therefore be monitored by the monitoring instances 30, 60 assigned to the communication components 40, 50. Such systems 80 can be used, for example, in vehicles, e.g., motor vehicles, ships, trains, aircraft, trucks, passenger cars, two-wheelers, etc. Here, for example, control units with different functions communicate with each other. On the one hand, there are central control units where information converges and is evaluated, and on the other hand, there are control units that monitor, control, or regulate components such as lights, turn signals, brake lights, sensors, actuators, warning lights, displays, input devices such as buttons or levers, etc. In the following, these control units are also referred to as communication components that communicate with each other via a data bus 70, as described in the Fig. 3 is shown.

[0030] Fig. Figure 3 shows a system 80 with two monitoring instances 30, 60 and two communication components 40, 50, which communicate with each other via a data bus 70. In exemplary embodiments, the data bus 70 can be, for example, the CAN (Controller Area Network) bus or another fieldbus.

[0031] As the Fig. As shown in Figure 3, the individual components 30, 40, 50, 60 each have one or more interfaces 32, 42, 52, 62, and each has a control unit 34, 44, 54, 64, which are also interconnected. The one or more interfaces 32, 42, 52, 62 can, for example, correspond to one or more inputs or outputs for receiving or providing information or signals, such as digital bit values, voltages, currents, or electromagnetic waves, for example, based on a code, within a module, between modules, or between modules of different entities. In this respect, the one or more interfaces 32, 42, 52, 62 are suitable for exchanging signals or information on the data bus 70 or between monitoring instances 30, 60 and communication components 40, 50, i.e., for sending and / or receiving.Additional components may be present or connected between one or more interfaces 32, 42, 52, 62; examples include amplifiers, filters, diplexers, duplexers, mixers, phase shifters, low noise amplifiers (LNAs), plugs, sockets, etc.

[0032] The control device 34, 44, 54, 64 can correspond to any controller or processor or programmable hardware component in exemplary embodiments. For example, a control device 34, 44, 54, 64 can also be implemented as software programmed for a corresponding hardware component. In this respect, a control device 34, 44, 54, 64 can be implemented as programmable hardware with appropriately adapted software. Any processor, such as digital signal processors (DSPs), can be used. Exemplary embodiments are not limited to a specific type of processor. Any processor, or even multiple processors or microcontrollers, are conceivable for implementing the control module.Integrated implementations with other control units are also conceivable, for example, in a control unit for a vehicle that additionally includes one or more other functions. The process steps described herein can be executed in exemplary embodiments by the control devices 34, 44, 54, 64 or by the respective one or more interfaces 32, 42, 52, 62. In this respect, the described process steps can be carried out by the device components.

[0033] The Fig. Figure 3 further illustrates with the double-sided arrows that corresponding communication can take place between the components or between components and the data bus.

[0034] In exemplary embodiments, a first communication component 40 can, for example, be a control unit for a motion manager (also known as a Vehicle Motion Manager, or VMM). This control unit can offer corresponding client functions. Clients, such as other control units besides the communication component 50 that manage a corresponding interface to the driver, can submit requests that can be valid for several seconds (e.g., trajectory) to theoretically minutes or even hours (e.g., target speed). However, if a client function fails (or the communication breaks down), a substitute response must occur promptly (within one second).In this case, this function is performed by the monitoring instances 30, 60, which are directly assigned to the communication components 40, 50 and monitor them locally, through cyclical communication between the monitoring instance 30, 60 and the communication component 40, 50 via a connection that differs from the data bus 70.

[0035] Monitoring instances 30 and 60 can communicate with each other cyclically via data bus 70. If the data bus fails, this cyclical communication stops, and the malfunction of data bus 70 can be detected promptly. If one of the communication components 40 or 50 malfunctions, monitoring instances 30 and 60 can detect this via their local interfaces and communicate with each other via data bus 70.

[0036] In another embodiment, warning lamps (communication component 50) are activated and deactivated by a customer function (communication component 40) based on events, with the monitoring instances 30 and 60 detecting any errors promptly as described above. This can reduce communication on the data bus, since cyclic communication can be limited to the monitoring instances 30 and 60, which can also monitor several communication components simultaneously without placing an additional burden on the data bus 70. This can lead to a lower message density or message size on the data bus 70 than would be the case if the corresponding customer function actively suppressed a warning lamp (e.g., a brake warning lamp), which requires constant individual messages between the respective communication components, and the warning lamp is then activated when the customer function fails.

[0037] The Fig. Figure 3 shows an embodiment of a monitoring instance 30 for at least one communication component 40, which is configured to communicate with one or more other communication components 50 via a data bus 70. The monitoring instance 30 comprises one or more interfaces 32 for communication via the data bus 70 and for communication with the communication component 40. The monitoring instance 30 includes a control device 34, which is configured to control the one or more interfaces 32 and to communicate cyclically with the communication component 40 and with at least one other monitoring instance 60 of another communication component 50.

[0038] As described above, the control device 34 of the monitoring instance 30 is configured to communicate with the communication component 40 via a connection different from the data bus 70, for example via a local interface 32. Furthermore, the control device 34 is configured to transmit an error indication to at least one other monitoring instance 60 when a malfunction or communication error of the communication component 40 is detected.

[0039] The Fig. Figure 3 further illustrates an embodiment of a communication component 40 for communication with one or more other communication components 50 via a data bus 70. The communication component 40 comprises one or more interfaces 42 for communication via the data bus 70 and for communication with a monitoring instance 30. The communication component 40 also comprises a control device 44 configured to control the one or more interfaces 42, to communicate with the one or more other communication components 50 in an event-based manner, and to communicate cyclically with the monitoring instance 30.

[0040] The embodiment of a system 80 in the Fig. 3, comprises at least two monitoring instances 30, 60 as described above and at least two communication components 40, 50 assigned to the monitoring instances 30, 60 as described above. Another embodiment is a vehicle with such a system 80.

[0041] Fig. Figure 4 shows an architecture of a monitoring service in an exemplary implementation. The monitoring service is also referred to as the watchdog service in the following; analogously, the monitoring instance 30, 60 is also referred to as the watchdog. Fig. Figure 4 shows a first control unit "SG 1" on the left, on which a client "foo" is implemented as a communication component 40 and a "Watchdog 1" as a monitoring instance 30. On the right is a second control unit "SG 2" on which a second communication component 50 is implemented as a (service) "bar" and a second monitoring instance 60 as a "Watchdog 2". "foo" and "bar" are placeholders for any "clients" and services. As the Fig. As shown in Figure 4, several more control units may be present, with monitoring instances 30 and 60 communicating cyclically with each other via the dotted arrows. Communication between monitoring instances 30 and 60 and the associated communication components 40 and 50 takes place locally (double dashed arrows).

[0042] The clients (communication components 40, 50) are monitored cyclically on a local processor, also known as "localhost" (SG 1, SG2), so that the bus load is irrelevant. The monitoring service (watchdog service) for the two communication components 40, 50 is implemented via the two monitoring instances 30, 60. A local instance of the watchdog service (method 10, monitoring instances 30, 60) is implemented on each "SG 1, SG 2" participating in the event-based communication. The local instances of the watchdog service 30, 60 synchronize with each other via bus 70. A "client", in this case a communication component 40, 50, can register with the watchdog service 30, 60. In the event of a communication error, the watchdog service 30, 60 informs the communication partner of the "client" 40, 50 as a fallback response.

[0043] Fig. Figure 5 illustrates a failure of a communication component 40 in the embodiment shown in the Fig. As explained in section 4, client "foo" 40 fails in this embodiment, as indicated by the lightning bolt. The monitoring instance 30 "Watchdog 1" detects this due to the local cyclic communication with client "foo," which can also fail, for example, or through which client "foo" can report an error to the watchdog. Watchdog 1 30 can then transmit a corresponding message via cyclic communication with watchdog 2 60, which watchdog 2 can then forward to service bar 50. In this way, watchdog 1 30 can inform service bar 50 about the error.

[0044] In this embodiment, the method 10 for the monitoring instance 30 comprises transmitting an error indication to at least one other monitoring instance 50 when a malfunction or communication error of the communication component 40 is detected. In further embodiments, transmission to several additional monitoring instances 60 is also possible.

[0045] Fig. Figure 6 shows a failure of a data bus 70 in an exemplary embodiment. The scenario already described in the Fig. 4 and Fig. 5 was explained. The lightning in Fig. 6 indicates that a fault or failure has occurred on data bus 70. This also interrupts the cyclic communication between monitoring instances 30 and 60, allowing both sides to detect the fault and report it to their communication components 40 and 50. The delay with which such a fault can be detected and reported depends on the frequency of the cyclic communication on data bus 70. Furthermore, synchronizing the individual monitoring instances 30 and 60 can help avoid additional delays. Therefore, procedure 10, which is executed in a monitoring instance 30 or 60, can include synchronization with at least one other monitoring instance 60 via data bus 70. If the monitoring instances 30 and 60, which are cyclically active on data bus 70, are synchronized with each other, i.e., have a common time base or clock, communication on data bus 70 can be more efficient.The data bus's transmission capacity can be better utilized.

[0046] The control device 34 of the monitoring instance 30 can be designed to synchronize with at least one other monitoring instance 60 via the data bus 70, or vice versa.

[0047] This can also be achieved through efficient management of the capacities of monitoring instance 30, 60 itself. To accomplish this, procedure 10 for monitoring instance 30, 60 can provide for the registration of communication component 40, 50 with monitoring instance 30, 60. Similarly, procedure 20 for communication component 40, 50 can also provide for registration with monitoring instance 30, 60.

[0048] The control unit 34, 64 of the monitoring instance 30, 60 can be configured to perform a registration of a communication component 40, 50. The control unit 44, 54 of the communication component can be configured to perform a registration with the monitoring instance 30, 60.

[0049] Fig. Figure 7 shows a sequence of exchanged messages in an exemplary embodiment, wherein the Fig. Figure 7 shows the normal operation of the watchdog service, in which no errors occur. Fig. Figure 7 shows the "Client foo" 40 on the left, as described above. In the middle is the monitoring service "Watchdog," which is implemented by the monitoring instances 30 and 60 described above. Both communication components 40 and 50 register for the Watchdog service. In this embodiment, the "Client foo" 40 can request a notification service with a timeout, where the timeout specifies the time after which a message about an error should be distributed, at the latest after the error occurs. The communication direction is important or necessary for bus monitoring, at least for some services, as will be explained below. In the illustrated embodiment, the cyclic communication between the "Client foo" 40 and the Watchdog service 30 and 60 is implemented such that the "Client foo" sends requests to the Watchdog 30 at regular intervals."Keep alive Request," which is then answered by Watchdog 30. Like the... Fig. As shown in section 7 below, the service can also be cancelled (also called "remove").

[0050] Fig. Figure 8 shows a sequence of exchanged messages in a further embodiment. Fig. 8 shows the scenario from Fig. 7 and the exchanged messages in the error pattern after Fig. 5. Accordingly, the lightning bolt again displays the error "Client foo" 40. This error occurs in the case based on the Fig. Scenario 7, already described, occurs when the "client foo" (40) does not send a request to the watchdog service within the set time limit. The watchdog service (30, 60) then distributes (multicast) a corresponding message "Time-Out foo" (time limit exceeded by "foo").

[0051] In the following example, if a bus error occurs, the watchdog service reports which communication connections of the registered clients are affected. In other words, the watchdog service knows which communication paths the registered clients have with the services they use. If a bus error then occurs, the watchdog service can report, via an event on both sides of the interruption, which communication paths between clients and services are disrupted. Fig. Figure 9 shows a sequence of exchanged messages in a further embodiment with a data bus error according to Fig. 6. After detection of the error (indicated by the lightning bolt), the watchdog service 30, 60 distributes a corresponding message “Time-Out foo” (time limit exceeded by “foo”) to “Service bar” 50 and a message “Time-Out bar” to “Client foo” 40.

[0052] In exemplary embodiments, the methods 10 and 20 disclosed herein can be used to monitor communication components 40 and 50 and a data bus 70 in a vehicle. Similarly, the monitoring instances 30 and 60 can be configured to monitor communication components 40 and 50 and a data bus 70 in a vehicle. These exemplary embodiments can be used, for example, in passenger cars, trucks, trains, aircraft, or vehicles in general. For this purpose, these exemplary embodiments can, for example, utilize central services for monitoring the communication buses at a top-level communication layer.

[0053] Further embodiments include computer programs for carrying out one of the methods described herein, when the computer program runs on a computer, a processor, or a programmable hardware component. Depending on specific implementation requirements, embodiments of the invention can be implemented in hardware or in software. The implementation can be carried out using a digital storage medium, for example, a floppy disk, a DVD, a Blu-ray disc, a CD, a ROM, a PROM, an EPROM, an EEPROM, a FLASH memory, a hard disk, or other magnetic or optical storage media on which electronically readable control signals are stored. These control signals can interact with, or interact with, a programmable hardware component in such a way that the respective method is carried out.

[0054] A programmable hardware component can be a processor, a computer processor (CPU = Central Processing Unit), a graphics processor (GPU = Graphics Processing Unit), a computer, a computer system, an application-specific integrated circuit (ASIC = Application-Specific Integrated Circuit), an integrated circuit (IC = Integrated Circuit), a system-on-a-chip (SOC = System on Chip), a programmable logic element, or a field-programmable gate array with a microprocessor (FPGA = Field Programmable Gate Array).

[0055] The digital storage medium can therefore be machine-readable or computer-readable. Some embodiments thus include a data carrier containing electronically readable control signals capable of interacting with a programmable computer system or programmable hardware component to execute one of the methods described herein. An embodiment is therefore a data carrier (or a digital storage medium or a computer-readable medium) on which the program for performing one of the methods described herein is recorded.

[0056] In general, embodiments of the present invention can be implemented as a program, firmware, computer program, or computer program product with program code or as data, wherein the program code or data is / are effective in carrying out one of the methods when the program runs on a processor or a programmable hardware component. The program code or data can, for example, also be stored on a machine-readable medium or data carrier. The program code or data can be in the form of source code, machine code, bytecode, or other intermediate code, among others.

[0057] The embodiments described above merely illustrate the principles of the present invention. It is understood that modifications and variations of the arrangements and details described herein will be obvious to other people skilled in the art. Therefore, it is intended that the invention be limited only by the scope of protection set forth in the following claims and not by the specific details presented herein by way of description and explanation of the embodiments. Reference symbol list 10 procedures for the supervisory authority 12. Regular checks 14, 24 cyclical communication 20 methods for communication components 22 event-based communication 30, 60 Monitoring Authority 32, 42, 52, 62 one or more interfaces 34, 44, 54, 64 Control device 40, 50 communication component 70 Data bus 80 System

Claims

[1] Method (10) for a monitoring instance (30) for monitoring at least one communication component (40), wherein the communication component (40) is configured to communicate with one or more other communication components (50) via a data bus (70) in an event-based manner, comprising the following steps: regular checking (12) of the function of the communication component (40) by the monitoring instance (30); and cyclic communication (14) of the monitoring instance (30) with at least one other monitoring instance (60) which is assigned to another communication component (50) in order to monitor the function of the communication component (40), the function of the other communication component (50) and the function of the data bus (70), further comprising cyclic communication between the monitoring instance (30) and the communication component (40) via a connection different from the data bus (70). [2] Method (10) according to claim 1, wherein the cyclic communication takes place on the data bus (70). [3] Method (10) according to one of the preceding claims, further comprising transmitting an error indication to at least one other monitoring instance (50) when a malfunction or communication error of the communication component (40) is detected. [4] Method (10) according to one of the preceding claims, further comprising synchronizing with at least one other monitoring instance (60) via the data bus (70). [5] Method (10) according to one of the preceding claims, further comprising registering the communication component (40) with the monitoring instance (30). [6] Method (10) according to one of the preceding claims for monitoring communication components (40; 50) and a data bus (70) in a vehicle. [7] Method (20) for a communication component (40) for communication with one or more other communication components (50) via a data bus (70), with event-based communication with one or more other communication components (50) via the data bus (70); and cyclic communication between the monitoring instance (30) and the communication component (40) via a connection different from the data bus (70). [8] Method (20) according to claim 7, further comprising registering with the monitoring authority (30). [9] Computer program for carrying out one of the methods according to any one of claims 1 to 8, if the computer program runs on a computer, a processor, or a programmable hardware component. [10] Monitoring instance (30) for at least one communication component (40) designed to communicate with one or more other communication components (50) via a data bus (70), with one or more interfaces (32) for communication via the data bus (70) and for communication with the communication component (40); and a control device (34) configured to control the one or more interfaces (32) and to communicate cyclically with the communication component (40) and with at least one other monitoring instance (60) of another communication component (50), wherein the control device (34) is configured to communicate with the communication component (40) via a connection different from the data bus (70). [11] Monitoring instance (30) according to claim 10, wherein the control device (34) is configured to transmit an error indication to at least one other monitoring instance (60) when a malfunction or communication error of the communication component (40) is detected. [12] Monitoring instance (30) according to one of claims 10 or 11, wherein the control device (34) is configured to synchronize with at least one other monitoring instance (60) via the data bus (70). [13] Monitoring instance (30) according to one of claims 10 to 12, wherein the control device (34) is configured to perform a registration of a communication component (40). [14] Monitoring instance (30) according to one of claims 10 to 13, which is configured to monitor communication components (40; 50) and a data bus (70) in a vehicle. [15] Communication component (40) for communication with one or more other communication components (50) via a data bus (70), with one or more interfaces (42) for communication via the data bus (70) and for communication with a monitoring instance (30); a control device (44) which is designed to control the one or more interfaces (42), to communicate with the one or more other communication components (50) on an event-based basis, and to communicate cyclically with the monitoring instance (30) via a connection different from the data bus (70). [16] Communication component (40) according to claim 15, wherein the control device (44) is configured to perform a registration with the monitoring instance (30). [17] System (80) comprising at least two monitoring instances (30; 60) according to one of claims 10 to 14 and at least two communication components (40; 50) assigned to the monitoring instances (30; 60) according to one of claims 15 or 16. [18] Vehicle with a system (80) according to claim 17.

Images