Computer-implemented method for evaluating network communication and communication systems received via redundant communication channels

Abstract

A computer-implemented method for evaluating network communication received via redundant communication channels (115, 125), wherein the method comprises: A first communication message is received from a first controller (110) and transmitted by a second controller (120); a second communication message is received by the first controller (110), which is then transmitted by the second controller (120); a rolling counter of the second communication message is evaluated by the first controller (110) to determine the validity of the data in the second communication message based on the fact that a current value of the rolling counter is within a first predetermined range when the first communication message and the second communication message are both received via a first communication channel (115), and that the current value of the rolling counter is within a second predetermined range when the first communication message and the second communication message are each received via a first communication channel (115) and via a second communication channel (125); and In response to the fact that the data are valid based on the assessment, the first controller (110) uses the data from the second communication message.

Description

BACKGROUND

[0001] A vehicle may include one or more electronic control units (ECUs) that communicate with each other. Communication may include transferring data, commands, and the like between one or more ECUs associated with an electric power steering (EPS) system in the vehicle and other ECUs in the vehicle.

[0002] The increasing reliance on advanced driver assistance systems (ADAS) has led to one or more controllers of different subsystems in a vehicle communicating with each other even more closely, and this communication has become more critical to the vehicle's operation. For example, communication enables subsystems to share information, which in turn allows one subsystem to automatically respond to actions performed by other subsystems.

[0003] In addition, increasing vehicle safety requirements are driving system redundancy to achieve higher levels of safety. Redundancy is achieved by expanding the vehicle's control system to the point where redundant ECUs are available. This, in turn, requires a robust and fail-safe communication process between the two ECUs. A poor communication link between ECUs has a detrimental effect on the behavior of the overall system, resulting in a safety risk.

[0004] In the case of vehicles, the safety of operators and passengers is of the utmost priority. To increase safety levels, vehicles are equipped with redundant systems. For example, redundancy is achieved by expanding a control system and, in some cases, by providing redundant microcontrollers. A system with redundant microcontrollers introduces many complexities into various operations, including a communication strategy between the redundant microcontrollers.

[0005] It is therefore desirable to enable redundant microcontrollers to communicate without causing any errors.

[0006] CN 1 03 490 966 A discloses a method for receiving and processing CAN bus data with double redundancy, comprising the steps of simultaneously transmitting data consisting of data frames on a first channel and a second channel of a dual-redundant CAN bus, receiving the data of the first channel of the dual-redundant CAN bus and the data of the second channel of the dual-redundant CAN bus, judging whether repeated data discrimination needs to be performed on the data frames of the data received from the two channels, directly using the data for which repeated data discrimination is not required, discriminating the data frames for which repeated data discrimination is required, using non-repeated data in the discrimination-treated data frames, and discarding the repeated data. SUMMARY

[0007] The object of the invention is to provide an improved computer-implemented method for evaluating network communication received over redundant communication channels and an improved communication system.

[0008] To achieve this object, a method having the features of claim 1 and a communication system having the features of claim 10 are provided. Advantageous embodiments of the invention can be found in the subclaims, the description, and the drawings.

[0009] The technical solutions described here address technical problems associated with redundant communication channels between microcontrollers (MCUs). For example, the technical solutions enable the sequence of communication messages between the MCUs in a redundant communication network to be evaluated and responded to appropriately.

[0010] In accordance with one or more embodiments, a computer-implemented method for evaluating a network communication received over redundant communication channels includes receiving, by a first controller, a first communication message transmitted by a second controller and receiving, by the first controller, a second communication message transmitted by the second controller.The method further includes the first controller evaluating a rolling counter of the second communication message to determine the validity of the data in the second communication message based on a current value of the rolling counter being within a first predetermined range when the first communication message and the second communication message are both received over a first communication channel, and the current value of the rolling counter being within a second predetermined range when the first communication message and the second communication message are each received over a first communication channel and a second communication channel. The method further includes the first controller using the data from the second communication message in response to the data being valid based on the evaluation.

[0011] In accordance with one or more embodiments, a communication system includes a first controller, a second controller, and one or more redundant communication channels coupling the first controller and the second controller. The first controller transmits data to the second controller over the one or more communication channels in a redundant manner, and the second controller evaluates the validity of the data received from the first controller over the one or more redundant communication channels.The evaluation of data validity is based on a current value of a rolling counter being within a first predetermined range when the data and previous data were both received via a first communication channel, and the current value of the rolling counter being within a second predetermined range when the data and previous data were received via the first communication channel and a second communication channel, respectively. The second controller uses the data in response to the data being valid based on the evaluation.

[0012] In accordance with one or more embodiments, a computer program product includes a non-transitory computer-readable medium having computer-executable instructions stored thereon. When executed by a first controller, the computer-executable instructions cause the first controller to communicate with a second controller, wherein communicating comprises receiving a first communication message transmitted by the second controller and receiving a second communication message transmitted by the second controller.The first controller further evaluates a rolling counter of the second communication message to determine the validity of the data in the second communication message based on a current value of the rolling counter being within a first predetermined range when the first communication message and the second communication message are both received over a first communication channel, and the current value of the rolling counter being within a second predetermined range when the first communication message and the second communication message are each received over a first communication channel and a second communication channel. In response to the data being valid based on the evaluation, the first controller uses the data from the second controller.

[0013] These and other advantages and features will become more apparent from the following description when read in conjunction with the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The subject matter regarded as the invention is particularly pointed out and separately claimed in the claims at the conclusion of the specification. The foregoing and other features and advantages of the invention will become apparent from the following detailed description when read in conjunction with the accompanying drawings, in which: Fig. 1 illustrates a vehicle having a steering system in accordance with one or more embodiments; Fig. 2 illustrates a redundant communication system in accordance with one or more embodiments; Fig.3 illustrates a flowchart for performing error checking in a redundant communication system in accordance with one or more embodiments; Fig. 4 illustrates a flowchart for an exemplary method for receiving data by a receiver MCU of a redundant communication system in accordance with one or more embodiments; Fig. 5 illustrates a flowchart for an exemplary method for responding to the rolling counter test in accordance with one or more embodiments; Fig. 6 illustrates a flowchart for an exemplary method for performing a rolling counter check in accordance with one or more embodiments; Fig.7 illustrates a flowchart for an exemplary method for performing validation of a rolling counter in accordance with one or more embodiments; and Fig. 8 illustrates a flowchart for detecting a reset status of the source MCU in accordance with one or more embodiments. DETAILED DESCRIPTION

[0015] As used herein, the terms module and submodule refer to one or more processing circuits, such as an application-specific integrated circuit (ASIC), an electronic circuit, a processor (shared, dedicated, or group) with memory executing one or more software or firmware programs, a combinational logic circuit, and / or other suitable components that provide the described functionality. As will be appreciated, the submodules described below may be combined and / or further subdivided.

[0016] With reference now to the figures, in which the invention is described with reference to specific embodiments without limiting it, in Fig.1 illustrates an exemplary embodiment of a vehicle 10 with a steering system 12. In various embodiments, the steering system 12 includes a steering wheel 14 coupled to a steering shaft system 16, which includes a steering column, an intermediate shaft, and the necessary joints. In one exemplary embodiment, the steering system 12 is an EPS system that further includes a steering assist unit 18 coupled to the steering shaft system 16 of the steering system 12 and to tie rods 20, 22 of the vehicle 10. Alternatively, the steering assist unit 18 may couple the upper portion of the steering shaft system 16 to the lower portion of this system. The steering assist unit 18 includes, for example, a steering mechanism (not shown) with a rack and pinion gear, which may be coupled through the steering shaft system 16 to a steering actuator motor 19 and a steering gear.In operation, when a vehicle operator turns the steering wheel 14, the steering actuator motor 19 provides assistance to move the tie rods 20, 22, which in turn moves steering knuckles 24, 26, respectively, which are coupled to road wheels 28, 30, respectively, of the vehicle 10.

[0017] As in Fig.1, the vehicle 10 further includes various sensors 31, 32, 33 that detect and measure observable conditions of the steering system 12 and / or the vehicle 10. The sensors 31, 32, 33 generate sensor signals based on the observable conditions. In one example, sensor 31 is a torque sensor that detects an input driver steering wheel torque (HWT) applied to the steering wheel 14 by the operator of the vehicle 10. Based on this, the torque sensor generates a driver torque signal. In another example, sensor 32 is a motor angle and speed sensor that detects a rotational angle and rotational speed of the steering actuator motor 19. In yet another example, sensor 32 is a steering wheel position sensor that detects a position of the steering wheel 14. Based on this, sensor 33 generates a steering wheel position signal.

[0018] The control module 40 receives the one or more sensor signals input from the sensors 31, 32, 33, and may receive other inputs, such as a vehicle speed signal 34. The control module 40 generates a command signal for controlling the steering actuator motor 19 of the steering system 12 based on one or more of the inputs and further based on the steering control systems and methods of the present disclosure. The steering control systems and methods of the present disclosure apply signal conditioning and perform friction classification to determine a surface friction level 42 as a control signal that may be used to control aspects of the steering system 12 by the steering assist unit 18.The surface friction level 42 may also be sent as an alarm to an ABS 44 and / or an ESC system 46 indicating a change in surface friction, which may be further classified as on-center slip (i.e., at a lower steering wheel angle) or off-center slip (i.e., at a higher steering wheel angle), as further described herein.

[0019] Communication with the ABS 44, the ESC system 46, and other systems (not shown) may be performed, for example, using a controller-area network (CAN) bus or other vehicle network known in the art for exchanging signals, such as the vehicle speed signal 34. In one or more examples, hardware limitations and the expansion of communication channels are driving communication interfaces between microcontrollers to utilize other protocols, including, for example, CAN, the Serial Communications Interface (SCI), or the Multiprocessor Interconnect Interface (MLI). Each protocol may address some of the safety aspects of data handling, but inherently does not ensure that all safety aspects are addressed.

[0020] The control module 40 may be an ECU. The vehicle 10 includes additional ECUs. The control module 40 receives information from the other ECUs, such as the vehicle speed signal 34, the sensor information, and various other information. As described above, there are many communication methods designed for communication between microprocessors, including, but not limited to, the SCI, CAN, and MLI protocols. The components that enable communication between two (or more) ECUs in the vehicle 10 or between two (or more) microcontrollers within the control module 40 are collectively referred to herein as a communication system.

[0021] In a communication system, two microcontrollers (MCUs) can be connected for communication using several architectures. The architecture used determines a methodology by which the two MCUs are connected to a communication bus that carries communication messages between the two MCUs. The technical solutions described here address technical problems for a communication system that has a redundant communication channel between the MCUs that carries the same information as the information carried by the communication messages on the communication bus. For each communication message carried between the two MCUs, the validity of the received information is essential.In certain cases, validity is also tied to the order in which the messages are received, for example, a receiving MCU may need to detect 120 conditions, including a lost message, an expired message, and an out-of-order message.

[0022] Typically, a rolling counter is used for this purpose, and the sequence of the rolling numbering is evaluated to assess the nature of the message. A rolling counter is a sequential number appended to the message payload. Typically, the sequential number is evaluated upon receipt of the message, and the sequence is verified. The technical solutions described here include an algorithm for evaluating the sequence of transported messages and responding accordingly in a redundant communications system.

[0023] Fig.2 illustrates an exemplary redundant communication system in accordance with one or more embodiments. The communication system 100 is a "redundant" communication system because it includes at least two MCUs 110 and 120 that communicate with each other in a redundant manner using two communication channels 115 and 125, with each communication channel sending the same data. The data is transmitted in the form of a communication message over the communication channels 115 and 125. The two communication channels 115 and 125 between the MCUs 110 and 120 may use the same or different communication protocols. For each communication, data is read from each of the communication channels 115 and 125, and valid data from the two received data channels is used by the receiving MCU 110 or 120 for further processing.The validity of the data is determined using algorithms such as cyclic redundancy check (CRC), rolling counters, etc. Such a communication system 100 may be used in an autonomous or semi-autonomous vehicle, or with a steering system used to control such a vehicle, or in various other applications. In the one or more examples described herein, the MCU 110 is considered the MCU that sends data, i.e., a source MCU 110; whereas the MCU 120 is considered the MCU that receives the data, i.e., a receiver MCU 120. However, it should be understood that the roles may be reversed in other examples.

[0024] Due to the redundant communication channels 115 and 125, the communication system 100 is confronted with technical problems involving different protocols having different data handling methods, which can cause the data received from the two redundant communication channels 115 and 125 to be different at any given moment. Furthermore, the technical problems include that the different handling of the different protocols can affect the functionality planning of the receiver MCU 120, which further causes the receiver MCU 120 to process different data at any given moment. Furthermore, the technical problems include that a reset of one of the MCUs 110 and 120 causes a loss of synchronization in the communication system 100.Furthermore, a channel-level failure / error causes a loss of messages and, consequently, a loss of synchronization between MCUs 110 and 120. The technical solutions described here address these technical problems and determine a robust approach for handling communication between the two MCUs using the redundant channels. The technical solutions described here therefore address technical problems originating in computer technology, specifically in a redundant communication system. The technical solutions described here further improve computer technology, specifically a redundant communication system, by improving communication synchronization in redundant communications across multiple channels that use different communication protocols.

[0025] In one or more examples, the technical solutions use two periodic operations to enable the evaluation of the message order between the two MCUs 110 and 120. A first periodic operation is a data receive, which is performed at a message receive rate. In one or more examples, a data receive module performs the data receive operation. The data receive evaluates the validity of the message received from the two communication channels 115 and 125 and evaluates whether good data is available from one of the channels 115 and 125. The data receive further processes valid data from one of the channels 115 and 125.

[0026] A second periodic operation is detecting a reset, which is performed at a slower rate—slower than the typical time required for communication system 100 to reset and return to the network. In one or more examples, a reset detection module performs reset detection at the predetermined rate. Reset detection supports immediate resynchronization in a reset scenario.

[0027] The technical solutions described here also enable validation of the data sequence of messages from the two communication channels 115 and 125 using an approach based on checking a rolling counter. The technical solutions described here enable identification of the communication channel 115 or 125 from which the data is used for further processing. The technical solutions described here enable validation of a data sequence from the communication channels 115 and 125 that have the same or different properties. The technical solutions described here enable one MCU 110 (or 120) to detect a reset of the other MCU 120 (or 110) and resynchronize the rolling counter check.The technical solutions described here enable resynchronization of the rolling counter check during a data failure on channels 115 or 125. The technical solutions described here also enable resynchronization of the rolling counter check when a rolling counter reference changes. The technical solutions described here enable indication of whether a rolling counter error needs to be reported. The technical solutions described here therefore address technical problems arising from computer technology, specifically in a redundant communication system that uses a synchronization check based on a rolling counter.The technical solutions described here further improve the computer-derived technology, specifically a redundant communication system that uses rolling counter checking, by improving the synchronization of communication in the redundant communications across multiple channels and further synchronizing the rolling counter-based checking in the event of a failure / reset of one of the MCUs in the redundant communication system.

[0028] Fig.3-9 illustrate flowcharts of example methods for evaluating communication between two MCUs using redundant communication channels, in accordance with one or more embodiments. The flowcharts illustrate methods performed by a receiver MCU 120 in the communication system 100. In the examples described herein, DataValid is a flag indicating whether valid data has been received from a communication channel 115 and 125. Further, ValidDataSource indicates which of the two redundant communication channels 115 and 125 has valid data, such as based on a CRC check or a rolling counter check. Further, MessageLostCount is a counter indicating the number of lost messages in the form of "no data" or invalid data.Additionally, MCUResetCounter is a counter indicating the number of times no data is received from communication channel 115 or 125. This indicates a reset of the other MCU 110 (or 120). Furthermore, RollingCounterResyncCounter is a counter indicating the number of times data is lost due to a problem with the rolling counter alone. ResyncThreshold is the number of consecutive rolling counter problems after which it can be assumed that one of the MCUs 110 and 120 has lost synchronization of the rolling counter and, consequently, a resync must occur.

[0029] Furthermore, as used in the examples herein, a Rolling Counter Error flag indicates whether a rolling counter error needs to be reported to an operator. A Reset Status flag indicates whether a reset has occurred in the other MCU 110 (or 120). The receiving MCU 120 further uses a Counter Threshold, which is a value related to the typical amount of latency in data transmission in the communication channel 115 or 125. Furthermore, Channel Switch Delay provides a value related to the dynamics of the redundant communication channels 115 and 125. This indicates the typical delay in message reception between the communication channels 115 and 125 at any given moment. A Previous Rolling Counter is also maintained, which is the value of the rolling counter of the previously stored valid message.

[0030] Fig.3 illustrates a flowchart for performing error checking in a redundant communication system in accordance with one or more embodiments. The receiver MCU 120 determines whether an error exists after performing one or more data checks on data received over both communication channels 115 and 125. As illustrated, the receiver MCU 120 checks at 305 whether no data was received from the first communication channel 115. If data was received, the receiver MCU 120 checks the validity of the data at 310 using an algorithm such as a CRC. If the CRC check passes, the receiver MCU 120 performs another check, such as the rolling counter check at 315. If the rolling counter check also passes, the receiver MCU 120 uses the data from the first communication channel 115 at 320.

[0031] If one of the performed checks (305, 310, 315) fails, the receiver MCU 120 checks whether the data from the second communication channel 125 can be used. The receiver MCU 120 checks at 325 whether data has been received from the second communication channel. If data has been received, the receiver MCU 120 performs a validity check, such as a CRC check, on the data received via the second communication channel 125 at 330. If the validity check passes, the receiver MCU 120 further performs a rolling counter check on the data from the second communication channel 125 at 335. If the rolling counter check also passes, the receiver MCU 120 uses the data from the second communication channel 125 at 340.

[0032] If the data checks of the second communication channel 125 also fail, the receiver MCU 120 performs one or more error handling operations depending on which data check fails. If no data is received via the second communication channel 125 at 325, the receiver MCU performs a first error handling operation at 345. The first error handling operation includes updating the MessageLostCounter, the MCUResetCounter, the ResyncCounterForRollingCounter, the DataValid flag, and the Error_RollingCounter flag. The updates are as shown in Table 1. Table 1 MessageLostCounter ++ McuResetCounter++ ResyncCounterForRollingCounter = 0 DataValid = False Error_RollingCounter = False

[0033] If the data validity check of the data received over the second communication channel 125 fails at 330, the receiver MCU 120 performs a second error handler at 350. The second error handler includes updating the MessageLostCounter, the MCUResetCounter, the ResyncCounterForRollingCounter, the DataValid flag, and the Error_RollingCounter flag. The updates are as shown in Table 2. Table 2 MessageLostCounter ++ McuResetCounter = 0 ResyncCounterForRollingCounter = 0 DataValid = False Error_RollingCounter = False

[0034] If the rolling counter check of the data received over the second communication channel 125 fails at 335, the receiver MCU 120 performs a rolling counter resynchronization check at 335. If resynchronization is required, the receiver MCU 120 performs resynchronization at 340 using the data received over the second communication channel 125. Otherwise, if resynchronization is in progress, the receiver MCU 120 performs a third error handling step at 360. The third error handling step includes updating the MessageLostCounter, the McuResetCounter, the ResyncCounterForRollingCounter, the DataValid flag, and the Error_RollingCounter flag. The updates are as shown in Table 3. Table 3 MessageLostCounter ++ McuResetCounter = 0 ResyncCounterForRollingCounter ++ DataValid = False Error_RollingCounter = True

[0035] If the data is deemed valid and used by the receiving MCU 120 at 320 and 340, whether from the first communication channel 115 or the second communication channel 125, the receiving MCU 120 updates the MessageLostCounter, the MCUResetCounter, the ResyncCounterForRollingCounter, the DataValid flag, and the RollingCounterError flag. The updates are shown in Table 4. Table 4 MessageLostCounter = 0 McuResetCounter = 0 ResyncCounterForRollingCounter = 0 DataValid = True Error_RollingCounter = False

[0036] Fig.4 illustrates a flowchart for an exemplary method for receiving data by a receiver MCU of a redundant communication system in accordance with one or more embodiments. The method includes the receiver MCU 120 receiving data on one or both of the communication channels 115 and 125 at 410. The method further includes performing data checks on the received data at 420. The data checks are performed, if necessary, on the first communication channel 115 and on the second communication channel 125, as described herein ( Fig.3). If the data received from one or both communication channels 115 and 125 is valid, the DataValid flag is set to TRUE. Consequently, if the flag is TRUE, the receiver MCU 120 uses the data from the respective communication channel 115 or 125 that was indicated to have valid data at 430 and 440. If no data received from communication channels 115 and 125 is valid, the receiver MCU 120 continues to update and report an error status as needed, as described further.

[0037] Fig.5 illustrates a flowchart for an exemplary method for responding to the rolling counter test in accordance with one or more embodiments. If the rolling counter test is passed, the receiver MCU 120 updates the MessageLostCounter, the MCUResetCounter, the RollingCounter ResyncCounter, the DataValid Flag, and the RollingCounterError Flag at 510 and 520. The updates are shown in Table 4. Further, the receiver MCU 120 indicates at 522 that the data source currently in use is the second communication channel 125 (or 115). If the rolling counter test is not passed, the receiver MCU 120 updates the MessageLostCounter, the MCUResetCounter, and the RollingCounter ResyncCounter at 530.The receiving MCU 120 further determines at 540 and 550 whether the rolling counter error needs to be reported based on the status of the Rolling Counter Error flag and reports the rolling counter error to an operator. If at 540, the rolling counter error is not reported based on the status of the Rolling Counter Error flag, the value of the DataValid flag is not changed.

[0038] Fig.6 illustrates a flowchart for an exemplary method for performing a rolling counter check in accordance with one or more embodiments. The method includes, at 610, the receiver MCU 120 checking whether the source MCU 110 has set the reset flag to TRUE. If the source MCU 110 has set the reset flag, the receiver MCU 120 sets its own reset flag to FALSE at 620. Further, the receiver MCU 120 uses the received data as valid data by setting the DataValid flag to TRUE at 625. Further, at 625, the receiver MCU 120 sets the RollingCounter Error flag to FALSE so that the rolling counter error is not reported to the operator.

[0039] Alternatively, if the source MCU 110 has not set the reset flag, the receiver MCU 120 determines at 630 whether a rolling counter resynchronization should be performed. The resynchronization check is performed by checking whether the rolling counter resync counter has exceeded a predetermined resynchronization threshold. If performing a resynchronization is deemed necessary, the receiver MCU 120 determines at 635 that the received data is valid and sets the DataValid flag to TRUE. Furthermore, at 635, the receiver MCU 120 sets the RollingCounterError flag to FALSE so that an error related to the rolling counter is not reported to the operator.

[0040] If the receiver MCU 120 instead determines that resynchronization of the rolling counter is not needed, the receiver MCU 120 validates the rolling counter value at 640 to determine if a rolling counter error has occurred.

[0041] Fig. 7 illustrates a flowchart for an exemplary method for performing validation of a rolling counter in accordance with one or more embodiments. The validation is performed as described herein during a test of the rolling counter (block 640 in Fig. 6). Validation is performed at 710 based on calculating an expected value of the rolling counter based on the current value of the rolling counter (PreviousRollingCounter) and the MessageLostCounter. The calculation is performed as: Expected_Rolling_Counter_Value = PreviousRolling_Counter + MessageLost_Counter + 1. The method further includes determining at 715 whether the previous valid data was received over the same communication channel as the current data. For example, if the previous valid data used by the receiver MCU 120 was received over the first communication channel 115, and if the current data being tested for validity was also received over the first communication channel 115, the communication channels are the same; otherwise, if one of the above communication channels is the second communication channel 125, the receiver MCU 120 uses a different test.In other words, successive messages originate from the same communication channel if a first message is received at a time t1 from the first communication channel 115 (or 125) and a second message is also received at a time t2 from the first communication channel 115 (or 125).

[0042] If the previous valid communication channel is the same as the current communication channel, the method includes ensuring at 720 that the lower bound with the latency does not result in the reading of old data. For example, the receiver MCU 120 checks whether MessageLostCounter ≥ CounterThreshold. If the threshold is exceeded, the lower bound is updated at 725 to LowerBound = CounterThreshold; otherwise, the lower bound is updated at 727 to LowerBound = MessageLostCounter.

[0043] The method further includes determining at 730 whether the value of the rolling counter is within a predetermined range. In one or more examples, the data is considered valid at 735 if, for consecutive messages from the same communication channel 115 (or 125), the new rolling counter falls within the range (Expected_Rolling_Counter_Value - LowerLimit) ≤ CurrentRolling_Counter ≤ Expected_Rolling_Counter_Value + CounterThreshold), where Expected_Rolling_Counter_Value = PreviousRolling_Counter + MessageLostCounter + 1, LowerLimit = CounterThreshold if CounterThreshold is less than MessageLostCounter, otherwise LowerLimit = MessageLostCounter. The CounterThreshold value depends on a typical channel interference level and, in one or more examples, is a calibratable preset value.

[0044] If the data is considered valid, the receiver MCU 120 sets the DataValid flag to TRUE and the RollingCounterError flag to FALSE.

[0045] If the rolling counter is not within the predetermined range, the receiver MCU 120 considers the received data invalid at 737. The receiver MCU 120 sets the DataValid flag to FALSE and the RollingCounterError flag to TRUE.

[0046] In the case of different communication channels (block 715), the method alternatively includes ensuring at 740 that the lower limit with the latency does not result in the reading of old data. For example, the receiver MCU 120 checks whether MessageLostCounter ≥ (CounterThreshold + ChannelSwitchDelay). If the threshold is exceeded, the lower limit is updated at 745 to LowerLimit = CounterThreshold + ChannelSwitchDelay; otherwise, the lower limit is updated at 747 to LowerLimit = MessageLostCounter. Here, consecutive messages from different communication channels indicate that a first message was received at a time t1 from the first communication channel 115 (or 125) and a second message was received at a time t2 from the second communication channel 125 (or 115).

[0047] The received data is considered valid at 750 if, for consecutive messages from the different communication channels 115 and 125, the new rolling counter falls within a second predetermined range. The predetermined range used in the case with the same communication channels is a different range than the second predetermined range used in the case with different communication channels. The second predetermined range is specified by (Expected_Rolling_Counter - LowerLimit) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter + (CounterThreshold + ChannelSwitchingDelay)), where Expected_Rolling_Counter = Previous_Rolling_Counter + MessageLost_Counter + 1, LowerLimit = CounterThreshold + ChannelSwitchingDelay if CounterThreshold is less than MessageLost_Counter, otherwise LowerLimit = MessageLost_Counter.The CounterThreshold value depends on a typical channel interference level and is, in one or more examples, a calibratable preset value. The ChannelSwitchDelay value depends on the dynamics of the two communication channels 115 and 125 and is, in one or more examples, a calibratable preset value.

[0048] If the value of the current rolling counter satisfies the second predetermined range, the data is considered valid at 755. The receiver MCU 120 sets the DataValid flag to TRUE and the RollingCounterError flag to FALSE if the data is considered valid.

[0049] If the rolling counter is not within the second predetermined range, the receiver MCU 120 checks at 760 whether a rolling counter error should be reported. The determination is made based on a comparison specified by: (Expected_Rolling_Counter - (CounterThreshold + ChannelSwitchDelay)) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter + (CounterThreshold + ChannelSwitchDelay)), where (Expected_Rolling_Counter = Previous_Rolling_Counter + MessageLost_Counter + 1). If the condition is met, the rolling counter error is not reported to the operator. The receiver MCU 120 assumes the received data is invalid at 770 and does not report a rolling counter error. The receiver MCU 120 sets the DataValid flag to FALSE and the Error_RollingCounter flag to FALSE.If the condition is not met, the receiver MCU 120 assumes that the received data is invalid and reports a rolling counter error at 775. The receiver MCU 120 sets the DataValid flag to FALSE and the RollingCounterError flag to TRUE.

[0050] Alternatively or additionally, the received data is considered valid if the ResetStatus flag is set to TRUE (Block 610, Fig. 6).

[0051] Fig.8 illustrates a flowchart for detecting a reset status of the source MCU in accordance with one or more embodiments. At 810, the receiver MCU 120 assumes that the source MCU 110 has been reset when the number of "no data" occurrences exceeds a particular predetermined threshold. The number of "no data" occurrences may be determined based on an amount of time that no data has been received on either of the communication channels 115 and 125. For example, the receiver MCU 120 monitors the amount of time that the source MCU 110 has not sent any data over either of the communication channels 115 and 125 since the receiver MCU 120 received previous data. If the time since the last data exceeds a predetermined reset threshold, the receiver MCU 120 determines at 820 that the source MCU 110 has been reset.To indicate such a case, the Reset Status flag of the receiver MCU 120 is set to TRUE. Alternatively, if the Reset Threshold is not exceeded, the receiver MCU 120 continues at 830 by waiting for data from the source MCU 110 and monitoring the time since the last data. The Reset Status flag of the receiver MCU 120 is maintained to indicate FALSE in this case. The Reset Threshold is based on a typical time required by the communication system 100 to reset an MCU 110 / 120 and restart operations.

[0052] The receiver MCU 120 maintains the MessageLostCounter, which is incremented with each lost message. The receiver MCU 120 expects the next (new) rolling counter to have a value greater than the previous rolling counter value by the value of MessageLostCounter. If consecutive problems occur with the rolling counter's Resynchronization Threshold amount, the receiver MCU 120 detects that one of the MCUs 110 and 120 in the communication system 100 has lost synchronization of the rolling counter and, accordingly, initiates a resynchronization with the source MCU 110. A problem with the rolling counter here indicates that the next rolling counter does not exceed the value of the previous rolling counter by the value of MessageLostCounter.In one or more examples, the synchronization loss case is not triggered if the next rolling counter exceeds the value of the previous rolling counter by more than (or equal to) the value of the MessageLostCounter.

[0053] Furthermore, the receiver MCU 120 uses a latency value of CounterThreshold for evaluating the rolling counter within the same communication channel 115 (or 125). Furthermore, the receiver MCU 120 uses an additional latency value of ChannelSwitchDelay for evaluating the rolling counter in different communication channels 115 and 125.

[0054] The communication system 100 may be part of a vehicle, where the MCUs are electronic control units (ECUs) that operate one or more components of the vehicle. Communication between the MCUs in such a case may occur via a CAN bus or other such network bus within the vehicle.

[0055] The technical solutions described here enable a communication system between two MCUs with redundant communication channels between the MCUs, which transmit the same information to evaluate the communication messages for validity when the MCUs use a rolling counter algorithm. The technical solutions enable such a communication system to detect lost messages, expired messages, and out-of-order messages by evaluating the order of the rolling counter value to assess the nature of the message.

[0056] The technical solutions described here address technical problems associated with redundant communication channels between microcontrollers (MCUs) that transmit the same information and use rolling counters. For example, the technical solutions include a method for evaluating the sequence of communication messages between the MCUs in a redundant communication network and reacting accordingly.

[0057] The present technical solutions may be a system, a method, and / or a computer program product at any possible level of technical detail. The computer program product may include one or more computer-readable storage media storing computer-readable program instructions for causing a processor to execute aspects of the present technical solutions.

[0058] Aspects of the present technical solutions are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products in accordance with embodiments of the technical solutions. It is understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may be implemented by computer-readable program instructions.

[0059] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products in accordance with various embodiments of the present technical solutions. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or section of instructions, which includes one or more executable instructions to implement the described logical functions. In some alternative implementations, the functions described in the blocks may occur out of the order indicated in the figures.For example, two blocks shown in succession may actually execute substantially concurrently, or the blocks may sometimes execute in the reverse order depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be implemented by special-purpose hardware-based systems that perform the described functions or acts, or by combinations of special-purpose hardware and computer instructions.

[0060] It should also be noted that any modules, units, components, servers, computers, terminals, or devices described herein by way of example that execute instructions may contain or otherwise have access to computer-readable media, such as memory media, computer storage media, or data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes. Computer storage media may include volatile and non-volatile, removable and non-removable media, implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. These computer storage media may be part of, accessible to, or connectable to the device.Any applications or modules described herein may be implemented using computer-readable / executable instructions that may be stored or otherwise maintained by such computer-readable media.

[0061] Although the technical solutions have been described in detail in connection with only a limited number of embodiments, it is readily understood that the technical solutions are not limited to these disclosed embodiments. Instead, the technical solutions may be modified to incorporate any number of variations, alterations, substitutions, or equivalent arrangements not described hereinabove, but which are consistent with the spirit and scope of the technical solutions. Furthermore, although various embodiments of the technical solutions have been described, it is to be understood that aspects of the technical solutions may include only some of the described embodiments. Consequently, the technical solutions should not be considered limited to the above description.

Claims

[1] A computer-implemented method for evaluating a network communication received over redundant communication channels (115, 125), the method comprising: a first controller (110) receives a first communication message transmitted by a second controller (120); the first controller (110) receives a second communication message transmitted by the second controller (120); the first controller (110) evaluates a rolling counter of the second communication message to determine the validity of the data in the second communication message based on a current value of the rolling counter being within a first predetermined range when the first communication message and the second communication message are both received via a first communication channel (115), and the current value of the rolling counter being within a second predetermined range when the first communication message and the second communication message are each received via a first communication channel (115) and a second communication channel (125); and in response to the data being valid based on the evaluation, the first controller (110) uses the data from the second communication message. [2] The computer-implemented method of claim 1, wherein determining whether the current value of the rolling counter is within the first predetermined range is evaluated by checking that: (Expected_Rolling_Counter_Value - Lower_Limit) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter_Value + CounterThreshold), where Expected_Rolling_Counter_Value = Previous_Rolling_Counter + Message_Lost_Counter + 1 and Lower_Limit is a predetermined value. [3] A computer-implemented method according to claim 2, wherein LowerLimit is dynamically calculated as LowerLimit = CounterThreshold if CounterThreshold is less than MessageLostCounter, otherwise as LowerLimit = MessageLostCounter, where MessageLostCounter is a counter indicating a number of lost messages. [4] The computer-implemented method of claim 1, wherein determining whether the current value of the rolling counter is within the second predetermined range is evaluated by checking whether: (Expected_Rolling_Counter_Value - Lower_Limit) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter_Value + (CounterThreshold + ChannelSwitchingDelay)), where Expected_Rolling_Counter_Value = Previous_Rolling_Counter + MessageLost_Counter + 1 and Lower_Limit is a predetermined value. [5] A computer-implemented method according to claim 4, wherein LowerLimit is dynamically calculated as LowerLimit = CounterThreshold + ChannelSwitchingDelay if CounterThreshold is less than MessageLostCounter, otherwise LowerLimit = MessageLostCounter, where MessageLostCounter is a counter indicating a number of lost messages. [6] The computer-implemented method of claim 1, further comprising: in response to the data not being valid based on the evaluation, determining whether to generate a rolling counter error based on a previous rolling counter value being within a predetermined range. [7] The computer-implemented method of claim 6, wherein the rolling counter error is generated when (Expected_Rolling_Counter_Value - (CounterThreshold + ChannelSwitchDelay)) ≤ CurrentRolling_Counter ≤ (Expected_Rolling_Counter_Value + (CounterThreshold + ChannelSwitchDelay)), where (Expected_Rolling_Counter_Value = PreviousRolling_Counter + MessageLostCounter + 1). [8] The computer-implemented method of claim 1, wherein the first controller (110) transmits data to the second controller (120) over the first communication channel (115) and over the second communication channel (125) in a redundant manner. [9] The computer-implemented method of claim 1, wherein the first controller (110) and the second controller (120) are part of a steering system. [10] Communication system (100) comprising: a first controller (110); a second controller (120); and one or more redundant communication channels (115, 125) coupling the first controller (110) and the second controller (120), wherein the first controller (110) is configured to transmit data to the second controller (120) via the one or more communication channels (115, 125) in a redundant manner; and wherein the second controller (120) is configured to evaluate the validity of the data it receives from the first controller (110) via the one or more redundant communication channels (115, 125), the evaluation comprising: the validity of the data is assessed based on whether a current value of a rolling counter is within a first predetermined range when the data and previous data were both received via a first communication channel (115), and whether the current value of the rolling counter is within a second predetermined range when the data and the previous data were received via the first communication channel (115) and a second communication channel (125), respectively; and wherein the second controller (120) uses the data in response to the data being valid based on the evaluation. [11] The communication system (100) of claim 10, wherein determining whether the current value of the rolling counter is within the first predetermined range is evaluated by checking whether: (Expected_Rolling_Counter_Value - Lower_Limit) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter_Value + CounterThreshold), where Expected_Rolling_Counter_Value = Previous_Rolling_Counter + Message_Lost_Counter + 1 and Lower_Limit is a predetermined value. [12] The communication system (100) of claim 11, wherein LowerLimit is dynamically calculated as LowerLimit = CounterThreshold if CounterThreshold is less than MessageLostCounter, otherwise as LowerLimit = MessageLostCounter, where MessageLostCounter is a counter indicating a number of lost messages. [13] The communication system (100) of claim 10, wherein determining whether the current value of the rolling counter is within the second predetermined range is evaluated by checking whether: (Expected_Rolling_Counter_Value - Lower_Limit) ≤ Current_Rolling_Counter ≤ (Expected_Rolling_Counter_Value + (CounterThreshold + ChannelSwitchingDelay)), where Expected_Rolling_Counter_Value = Previous_Rolling_Counter + MessageLost_Counter + 1 and Lower_Limit is a predetermined value. [14] The communication system (100) of claim 13, wherein LowerLimit is dynamically calculated as LowerLimit = CounterThreshold + ChannelSwitchDelay if CounterThreshold is less than MessageLostCounter, otherwise as LowerLimit = MessageLostCounter, where MessageLostCounter is a counter indicating a number of lost messages. [15] The communication system (100) of claim 10, wherein the second controller (120) is further configured to: in response to the data not being valid based on the evaluation, determine whether to generate a rolling counter error based on whether a previous rolling counter value is within a predetermined range, the rolling counter error being generated when (Expected_Rolling_Counter_Value - (CounterThreshold + ChannelSwitchDelay)) ≤ CurrentRolling_Counter ≤ (Expected_Rolling_Counter_Value + (CounterThreshold + ChannelSwitchDelay)), where (Expected_Rolling_Counter_Value = PreviousRolling_Counter + MessageLostCounter + 1).

Images