Vehicle network for data communication between components of a vehicle, system comprising the vehicle network and method for monitoring the vehicle network

Abstract

The invention relates to a vehicle network (10) for data communication (30) between components (14) of a vehicle. The vehicle network (10) comprises a first data bus (16) and at least two first switching devices (20). The first switching devices (20) have a first data bus data interface (22) for connection to the first data bus (16) and a first component data interface (24) for connection to one of the components (14) of the vehicle. In a connected state (36), the first data bus data interface is connected to the first component data interface (24) and, in a disconnected state (130), the first data bus data interface (22) is disconnected from the component data interface (24). The data communication (30) on the first data bus (16) is monitored by a first monitoring unit (28) and the first switching devices are driven on the basis of the data communication (30) so as to switch between the connected state (36) and the disconnected state (130). The invention furthermore relates to a system (12) comprising a vehicle network (10) and to a method (110) for monitoring a vehicle network (10).

Description

[0001] Vehicle network for data communication between components of a vehicle and system and vehicle therewith and method therefor

[0002] The invention relates to the field of vehicles, particularly commercial vehicles. Such commercial vehicles include, in particular, towing vehicles, such as trucks or semi-trailer trucks, although the invention can also be used in the field of trailer vehicles.

[0003] The vehicles considered here are vehicles that include a multitude of control units, also called "Electronic Control Units" (ECUs for short). The control units are used to control individual functions of the vehicle. Preferably, the control units control, for example, vehicle actuators or read vehicle sensors. Examples of such control units include brake control units for controlling various braking functions, engine control units for controlling an internal combustion engine and / or an electric drive, air suspension control units for controlling an air suspension, and steering control units for controlling an electronic steering system.

[0004] These control units are connected to one another via a vehicle network for data communication, in particular a data bus, in order to exchange data. For example, a control unit of an air suspension system can determine the mass of the vehicle. For this purpose, a sensor is arranged in each of the air bellows of the air suspension system, which measures the prevailing pressure in the air bellows and transmits it to the control unit of the air suspension system. From the prevailing pressure, the control unit can determine the mass and provide the determined mass, for example, to a brake control unit. The brake control unit can also use this mass to control the actuators for performing a braking function.Due to the increasing number of such control units and the resulting increase in the interaction between the control units, the demands placed on the vehicle network for data exchange are increasing, particularly with regard to the reliability of an overall system that includes the controllers and the vehicle network itself. The reliability requirements are becoming particularly relevant due to the increasing number of automated driving functions that enable partially or fully autonomous vehicle operation and are also implemented by the aforementioned control units. To achieve this, such control units must be able to access the vehicle's sensors and actuators without error. Such control units for controlling autonomous or semi-autonomous driving, also known as "virtual drivers," are also connected via an existing network.

[0005] In order to improve reliability, various efforts are being made for such or similar applications in vehicles, for example by implementing redundant controls or redundant networks in order to be able to switch to a redundant system in the event of a problem with a main system.

[0006] For example, document EP 3 758 301 A1 describes the connection of each of several control units to two different communication networks connected to redundant higher-level control units. In the event of a failure in one of the higher-level control units, it is possible to switch to the other higher-level control unit and control the control units via the redundant network.

[0007] However, with the latter solution, as well as with a number of other known solutions for improving reliability, not all failure scenarios can be reliably handled simply by component redundancy. Particularly with regard to partially or fully autonomous vehicle operation, errors can still occur that lead to system failure.

[0008] The object of the present invention is therefore to address the problems of the prior art. In particular, a fault-tolerant network architecture for a vehicle is to be found to ensure safe operation of the vehicle, especially at a higher degree of automation, for example, in the range from Level 2 to Level 5. In any case, an alternative to the prior art is to be proposed.

[0009] The invention relates to a vehicle network for data communication between components of a vehicle according to claim 1.

[0010] The vehicle network for data communication between components of a vehicle comprises a first data bus and at least two switching devices. Accordingly, several, namely at least two, but in particular more than two, e.g., more than five or more than ten, first switching devices are part of the vehicle network. Furthermore, the vehicle network comprises a first monitoring unit.

[0011] The at least two first switching devices each comprise a first data bus data interface for connecting to the data bus and a first component data interface for connecting to exactly one of the components of the vehicle. Such components include, for example, control units of the vehicle. Each of the first switching devices comprises a connection state in which the data bus data interface is connected to the component data interface and a disconnection state in which the data bus data interface is disconnected from the component data interface.

[0012] Furthermore, each of the switching devices comprises a first switching input for controlling the switching device to switch between the connected state and the disconnected state. The first switching input of at least one first switching device, and in particular of each first switching device, is connected to the monitoring unit. The first monitoring unit is configured to control the switching device via the first switching input to switch between the connected state and the disconnected state.

[0013] Furthermore, the monitoring unit is connected to the first data bus to monitor the data communication on the first data bus. Furthermore, the monitoring unit is configured to control the first switching devices depending on the data communication on the first data bus.

[0014] In addition to a conventional data bus, to which vehicle components are usually connected for data exchange, the invention provides each component with associated switching devices and a monitoring unit. The switching devices can be interposed between the vehicle components and the data bus. The monitoring unit can then monitor the data bus and, in the event of an abnormality, disconnect one or more of the components from the data bus via their associated switching device.

[0015] Accordingly, preferably each component of the vehicle connected to the data bus is assigned its own switching device, which can be individually controlled by the monitoring unit, namely via the corresponding first switching input of the respective switching device, so that the component is either connected to the data bus or disconnected from it. The switching devices thus make it possible to safely disconnect components that significantly impact the entire communication on the data bus due to a fault.

[0016] Particularly in the case of a continuously transmitting component, also known as a "babbling idiot," selectively disconnecting this component can ensure that communication with the remaining components continues. Otherwise, such a continuously transmitting component often leads to an overload of the connected data network, resulting in either no data transmission at all or only a delayed transmission of data to the other connected components.

[0017] According to a first embodiment, the vehicle network further comprises a second data bus and at least two second switching devices. In particular, more than two, i.e., several, in particular more than five or more than ten, second switching devices are part of the vehicle network. The plurality of second switching devices each comprise a second data bus data interface for connecting to the second data bus and a second component data interface. Each of the second component data interfaces serves to connect to one of the components of the vehicle, which is already connected to a first component data interface of a first switching device.

[0018] Furthermore, the second switching devices each have a connection state in which the second data bus data interface is connected to the second component data interface, and a disconnection state in which the second data bus data interface is disconnected from the second component data interface. The second switching devices each include a second switching input for controlling the switching device to switch between the connection state and the disconnection state. Preferably, a redundant data bus, namely the second data bus, is thus provided.

[0019] In the case of a faulty first switching device that prevents a faulty component from being disconnected from the first data bus, data communication can be shifted to the second data bus. Thanks to the separate second switching device, the faulty component can still be safely disconnected from the second data bus with a high degree of probability in the case of a faulty first switching device of the component, since a fault in both switching devices of a faulty component is comparatively unlikely. The reliability of the network communication is thus further increased and thus also includes error correction in the event of a failure of one or more of the first switching devices.

[0020] According to a further embodiment, according to a first variant of this embodiment, at least one of the second switching inputs of the second switching devices, in particular each second switching input of each of the second switching devices, is also connected to the first monitoring unit in order to individually control the second switching device to switch between the connected state and the disconnected state. Furthermore, according to this first variant, the first monitoring unit is connected to the second data bus in order to monitor the data communication on the second data bus and, depending on the data communication on the second data bus and / or the data communication on the first data bus, also to control the second switching devices.

[0021] According to a second variant of this embodiment, the vehicle network comprises a second monitoring unit connected to at least one of the second switching inputs of the second switching devices, in particular to each of the second switching inputs of the second switching devices, in order to individually control the second switching devices to switch between the connected state and the disconnected state. According to the second variant, the second monitoring unit is connected to the second data bus in order to monitor the data communication on the second data bus and to control the second switching devices depending on the data communication on the second data bus.

[0022] According to the first variant, central monitoring of the data buses and switching devices is carried out with a single monitoring unit, thus requiring less technical effort compared to two monitoring units. According to the second variant, not only is a redundant bus provided to maintain communication in the event of a failure of one of the first switching devices, but also a second monitoring unit that can continue to reliably monitor data communication on the second data bus in the event of a failure of the first monitoring unit. The reliability of the vehicle network is thus further increased.

[0023] According to a further embodiment, the vehicle network further comprises a plurality of third switching devices. The third switching devices each comprise a primary voltage input for connecting to a primary vehicle voltage supply, in particular the primary vehicle battery, of the vehicle and a voltage output for connecting to one of the components of the vehicle. Furthermore, the third switching devices have a primary voltage connection state and a voltage disconnection state. In the primary voltage connection state, the primary voltage input is connected to the voltage output. In the voltage disconnection state, the primary voltage input is disconnected from the voltage output. Furthermore, the third switching devices each comprise a third switching input for controlling the third switching device to switch between the primary voltage connection state and the voltage disconnection state.

[0024] In the event that a component that is connected to the first data bus by a first switching device and to the second data bus by a second switching device causes an error, and in addition the first switching device and the second switching device are faulty, the third switching device makes it possible to disconnect the error-causing component from the power supply by the third switching device. The faulty component is no longer supplied with power by switching the third switching device and can therefore no longer send data to the first and / or second data bus after disconnection, particularly in the case of previous continuous transmission. Even in the event that the component is only connected to a first data bus by a first switching device, the component can be disconnected from the power supply via the third switching device in the event of a fault in the first switching device.Furthermore, the third switching devices can also be used to quickly identify a faulty component by successively de-energizing the components until data communication on the first and / or second data bus functions correctly again. In particular, different components on the buses can also be switched on and off via the third switching devices in order to identify the faulty component or fault-free component combination as quickly as possible in a suitable combination.

[0025] According to a further embodiment, the third switching devices each further comprise a secondary voltage input for connecting to a secondary vehicle voltage supply, in particular a secondary vehicle battery, of the vehicle. Furthermore, the third switching devices comprise a secondary voltage connection state for connecting the secondary voltage input to the voltage output. Particularly preferably, in the primary voltage connection state according to this embodiment, the secondary voltage input is disconnected from the voltage output. In the secondary voltage connection state, the primary supply input is preferably disconnected from the voltage output, and in the voltage disconnection state, the primary voltage input and the secondary voltage input are disconnected from the voltage output.

[0026] Thanks to this embodiment, an error in supplying the components with a primary vehicle voltage supply can also be remedied by the third switching devices, namely by switching the voltage supply to a secondary vehicle voltage supply. According to a further embodiment, the first monitoring unit and / or the second monitoring unit or at least one voltage monitoring unit is connected to each of the third switching inputs of the third switching devices in order to individually control the third switching devices to switch between the primary voltage connection state, in particular the secondary voltage connection state, and the disconnection voltage state.

[0027] According to a further embodiment, the first data bus and the second data bus are designed according to the same communication standard, wherein the communication standard is, for example, a CAN bus standard or an Ethernet standard, such as an automotive Ethernet communication standard. According to an alternative, the first data bus is designed based on a communication standard that differs from the second data bus. The first data bus is, for example, a CAN bus, and the second data bus is an Ethernet communication bus.

[0028] According to a further embodiment, the first switching devices and / or the second switching devices each comprise a switch for switching between the disconnected state and the connected state, wherein the switches are designed as electromechanical switches, such as a relay for providing galvanic isolation, or as electronic switches comprising transistors. Semiconductor relays, which can also provide galvanic isolation, can also be used for this purpose. The switches are preferably in the disconnected state when not controlled.

[0029] Furthermore, the invention relates to a system comprising a vehicle network according to one of the aforementioned embodiments and a plurality of components. Each of the components has a first data interface connected to one of the first component data interfaces of one of the first switching devices. According to one embodiment of the system, the plurality of components each has a second data interface connected to one of the second component data interfaces of one of the second switching devices.

[0030] Accordingly, each component has a first data interface and a second data interface, each of which is connected to different component data interfaces of different switching devices. In the event of a component failure and a failure of one of the two connected switching devices, the component can thus be successfully disconnected from a data bus with the other switching device, which can then continue to operate without interference from the component.

[0031] According to a further embodiment, the plurality of components each have precisely one voltage input, which is connected to the voltage output of a third switching device assigned to the respective components. The components can be connected via the third switching devices either to the primary vehicle voltage supply, preferably to a secondary vehicle voltage supply, of the vehicle, or can be separated from both voltage supplies in order to switch off the respective component individually. In the event that, in addition to a component, the first switching device and the second switching device assigned to the respective component are defective, the component can be de-energized via the third switching device, for example to counteract continuous transmission by the component.

[0032] According to a further embodiment, one or more of the components each correspond to an actuator control unit of an actuator of the vehicle. Such actuator control units include, for example, engine control units, brake control units, and steering control units. Furthermore, one or more components each correspond to an autonomous driving control unit, also referred to as "autonomous driving artificial intelligence" or "virtual driver." The autonomous driving control unit provides control signals for controlling the actuator control units depending on target specifications and sensor information retrieved from other connected control units. Preferably, one or more components are each designed as a gateway.A gateway serves to connect another component, which can also be embodied as a control unit and has only a single data interface for connecting to two data buses via a first switching device and a second switching device. For this purpose, a gateway comprises an interface for a data interface of another component and two additional interfaces for connecting to a first switching device and a second switching device.

[0033] A gateway can therefore also be used to disconnect components such as actuator control units that only have a single data interface from one or both data buses in the event of a fault.

[0034] According to a further embodiment, several of the components are designed as primary components and others as secondary components, wherein each secondary component is preferably identical to exactly one primary component. This means that some components, in particular safety-relevant components, such as the autonomous vehicle control or the brake control unit, are provided twice in the system according to this embodiment, namely once as a primary component and once as a secondary component. In the event of a fault in the primary component, it is thus possible to switch to operation of the secondary component. This can be done by disconnecting or connecting to the first, second, and / or third switching devices.

[0035] According to a further embodiment, the components and the switching devices are arranged in separate housings. In particular, each of the first switching devices is housed in a separate housing. Furthermore, each of the second switching devices is housed in a separate housing. Furthermore, each of the components is housed in a separate housing. This ensures that in the event of moisture entering one of the housings due to a defect in the housing, for example, one of the housings of the components or the switching devices, only the corresponding switching device or component is affected by the moisture.

[0036] A housing filled with liquid, for example from splashing water, often leads to defects, for example due to short circuits, so that the functionality of an electrical component in the housing can no longer be guaranteed. Such short circuits or damage caused by moisture, such as large amounts of water, often do not immediately lead to a complete failure of the electronic component in the housing, but rather to malfunctions that can manifest themselves, for example, in the form of continuous transmission in the case of a component. By arranging at least the first switching devices and the second switching devices in separate housings from the components, it can be assumed that in the event of a defective component, the housings of the switching devices will continue to reliably prevent the ingress of moisture or water.Even in the event that the first switching device or the second switching device is subject to a defect due to water ingress or moisture ingress and thus an associated component can no longer be separated from the correspondingly associated data bus, the separate accommodation of the switching devices in different housings increases the probability that at least the other switching device will enable the component to be separated from the associated data bus.

[0037] Furthermore, the invention relates to a vehicle with a vehicle network according to one of the aforementioned embodiments or a system according to one of the aforementioned embodiments. The vehicle is preferably a commercial vehicle, such as a truck or a semi-trailer.

[0038] Furthermore, the invention relates to a method for monitoring a

[0039] Vehicle network according to one of the aforementioned embodiments or a system according to one of the aforementioned embodiments. According to the method, a first data bus is monitored with a first monitoring unit. Faulty data communication on the first data bus is then identified. Faulty data communication can occur, for example, when a certain amount of data transmission is exceeded or when there are unexpectedly many data packets from one and the same component, whereas at the same time there are unexpectedly few data packets from another component. Preferably, requirements for the data communication are predefined and stored in the monitoring unit, which allow the monitoring unit to distinguish between faulty data communication and error-free data communication.Error-free data communication is therefore present, for example, when data packets and data volumes on the data bus correspond to typical data packet volumes with typical data senders and receivers. Typical data communication can be determined in advance through tests or simulations for pre-definition and storage in the monitoring unit.

[0040] The method further comprises controlling the first switching devices and / or the third switching devices to identify a fault source, namely, in particular, a faulty component connected to the first data bus via the first switching device or a faulty first switching device. The method further comprises controlling the first switching devices and / or the third switching devices depending on the identified fault source to restore error-free communication.

[0041] According to one embodiment of the method, this further comprises monitoring the second data bus with the first monitoring unit or the second monitoring unit. Furthermore, faulty data communication on the first data bus or the second data bus is identified by the monitoring. Furthermore, the first switching devices and / or the second switching devices, and in particular the third switching devices, are controlled to identify a fault source causing the faulty data communication. The fault source can be a faulty switching device, a faulty component, or a faulty monitoring unit itself. Furthermore, the first switching devices and / or second switching devices, and in particular the third switching devices, are controlled depending on the identified fault source.

[0042] According to a further embodiment, the first data bus and / or the second data bus are monitored sequentially, for example, at predefined intervals. In particular, the monitoring occurs during a system check of the vehicle before starting a journey.

[0043] According to a further embodiment, to identify the source of the error, the first switching devices and / or second switching devices and preferably the third switching devices are controlled until faulty data communication becomes error-free again. Identification occurs, for example, in the case that faulty data communication is no longer detected as soon as the source of the error is removed. In particular, this involves disconnecting all components with the first switching devices from the first data bus and sequentially reconnecting the individual components to the first data bus. This can be controlled with priority, for example, so that certain components, namely in particular safety-relevant components, are reconnected to the first data bus via the first switching devices first. As soon as the data communication becomes faulty, the faulty component is also identified.If, on the other hand, switching the first switching devices to the disconnected state does not change the data communication on the first data bus to error-free data communication, this is to be interpreted as an indication of a faulty first switching device, so that a component connected to it cannot be disconnected from the first data bus. In this case, a source of error can be further identified by disconnecting all components from the second data bus using the second switching device and sequentially connecting the individual components via the second switching device. If a problem occurs in one of the second switching devices here too, a component can preferably be de-energized via the third switching device in order to deactivate its communication interface with the first data bus and second data bus.Particularly preferably, in the case of an identified component which is a source of error and at the same time corresponds to a primary component, the secondary component corresponding to the primary component is connected to the first data bus and / or the second data bus.

[0044] According to a further embodiment, to identify a faulty component, a first subset of the components, in particular comprising several or all primary components, is disconnected from the second data bus using the second switching devices and remains connected to the first data bus. A second subset of the components, in particular comprising several or all secondary components, is disconnected from the first data bus using the first switching devices and remains connected to the second data bus. Preferably, a third subset of the components, in particular comprising all components that correspond neither to a primary component nor to a secondary component, is disconnected from both data buses. In this way, there is a high probability that one of the two data buses with the connected components will be fault-free, thus ensuring that the operation of the vehicle with all safety-relevant functions can be maintained.A faulty other of the two data buses can then be tested according to the above explanations to isolate the source of the error. In particular, the fault-free components of the separated subsets can also be successively reconnected.

[0045] According to a further embodiment, the method comprises disconnecting the detected fault source from the first data bus and / or the second data bus and / or the power supply. If the faulty component is a primary component, the method comprises connecting the secondary component to the first data bus and / or the second data bus and disconnecting the faulty associated primary component.

[0046] Further embodiments are illustrated in the figures, which show:

[0047] Fig. 1 shows a first embodiment of the system,

[0048] Fig. 2 shows a second embodiment of the system,

[0049] Fig. 3 a third embodiment of the system and

[0050] Fig. 4 shows the steps of the method according to an embodiment.

[0051] Fig. 1 shows a vehicle network 10 of a system 12. The system 12 comprises a plurality of components 14 and the vehicle network 10 for data communication between the components 14 according to a first exemplary embodiment. The vehicle network 10 comprises a first data bus 16 and a second data bus 18. The first data bus 16 is connected in a star configuration to a plurality of first switching devices 20. For this purpose, the first switching devices 20 each have a first data bus data interface 22 which is connected to the first data bus 16. Each of the first switching devices 20 also comprises a first component data interface 24 which is configured to be connected to a first data interface 25 of one of the components 14. Furthermore, each of the first switching devices 20 has a first switching input 26 which makes it possible to switch the first switching device 20 between two states.

[0052] Furthermore, a first monitoring unit 28 is shown, which is connected to the first data bus 16 in order to monitor data communication 30 on the first data bus 16. The first monitoring unit 28 is connected to each of the first switching devices 20 via separate first control lines 32 in order to switch them between a connected state and a disconnected state. In Fig. 1, all first switching devices 20 are shown in the connected state 36 by a switch 34 of the first switching devices 20. In the connected state 36, the first data bus data interface 22 is connected to the first component data interface 24, so that a component 14 assigned to the first switching devices 20 is connected to the first data bus 16.

[0053] The second data bus 18 is connected to a plurality of second switching devices 40, each of which is identical to the first switching device 20. Accordingly, the second switching devices 40 also comprise a data bus data interface 42, which is connected to the second data bus 18, and a component data interface 44, which can each be connected to a second data interface 45 of one of the components 14. In addition, a second switching input 46 is provided to switch the second switching devices 40 between a connected state and a disconnected state. For this purpose, a second monitoring unit 48 is provided, which is connected to the second switching inputs 46 via separate second control lines 52 in order to switch the second switching devices 40. Furthermore, the second monitoring unit 48 is also connected to the second data bus 18 for monitoring the second data bus 18.

[0054] The components 14 comprise primary components 54 and secondary components 56. Exactly one secondary component 56 is assigned to each primary component 54. Mutually assigned primary components 54 and secondary components 56 are additionally connected to one another via a data line 58. In addition, the components 14 here comprise a gateway 60 for connecting a further component 62 to both data buses 16, 18 via the associated first and second switching devices 20, 40. Regardless of whether a component 14 is designed as a primary component 54 redundantly by a secondary component 56 or a component 14 is provided non-redundantly, some of the components 14 are designed as actuator control units 64. Further components 14 are designed as autonomous driving control units 66.

[0055] Fig. 1 shows that each of the first switching devices 20 is arranged in a single housing 68. Each of the second switching devices 40 is also arranged in a single housing 68. Furthermore, the first monitoring unit 28 and the second monitoring unit 48 are each arranged in a housing 68. Each of the components 14 also has a single housing 68. Switching devices 20, 40, monitoring units 28, 48, and components 14 thus have separate housings 68. The housings 68 are housings that protect the respective component housed therein against moisture and at least splash water.

[0056] Fig. 2 shows an alternative design of a system 12 in which the first monitoring unit 28 and the second monitoring unit 48 are each integrated into a component 14. The components 14 each correspond to an autonomous driving control unit 66 from Fig. 1, which, as in Fig. 1, are designed as primary component 54 and secondary component 56.

[0057] Accordingly, the system 12 in Fig. 2 comprises a primary component 54, which is designed as an autonomous driving control unit 66 and includes the first monitoring unit 28. The first autonomous driving control unit 66 and the first monitoring unit 28 are housed in a common housing 68. Furthermore, the associated secondary component 56 is also designed such that it includes the second monitoring unit 48 and is designed as a redundant autonomous driving control unit 66. The primary component 54 with the first monitoring unit 28 is referred to here as the primary combination unit 70, and the secondary component 56 with the second monitoring unit 48 is referred to as the secondary combination unit 72. The first and second combination units 70, 72 each comprise a setpoint generator 67, a trajectory planner 69, and a controller 71, which are connected to respective data buses 16, 18 via a further gateway 73.

[0058] The primary combination unit 70 is connected to first switching devices 20 via individual first control lines 32, as shown in Fig. 1. The first switching devices 20 are otherwise constructed identically to Fig. 1.

[0059] Accordingly, like reference numerals in Figs. 1 and 2 correspond to like features. Accordingly, second switching devices 40 are connected to the secondary combination unit 72 via second control lines 52. These second switching devices 40 are also identical to those in Fig. 1.

[0060] The corresponding monitoring units 28, 48 serve to control the first switching devices 20 and the second switching devices 40, respectively. Furthermore, the first data bus 16 connects the primary combination unit 70 to the first switching devices 20 in a star configuration. Similarly, the second data bus 18 connects the secondary combination unit 72 to the second switching devices 40. Each of the components 14 that do not correspond to the primary combination unit 70 or secondary combination unit 72 is connected, on the one hand, to a first switching device 20 and, on the other hand, to a second switching device 40 via their data interfaces 25, 45. Furthermore, the further component 62 is as shown in Fig. 1.

[0061] Fig. 3 shows a further embodiment of the system 12. The structure of the system 12 in Fig. 3 essentially corresponds to the system 12 shown in Fig. 1. The same features in Figs. 1 and 3 therefore also have the same reference numerals.

[0062] In contrast to Fig. 1, however, third switching devices 80 are provided. The switching devices 80 each comprise a primary voltage input 82, a secondary voltage input 84, and a voltage output 86. Each of the primary voltage inputs 82 is connected to a primary vehicle voltage supply 88, and each of the secondary voltage inputs 84 is connected to a secondary vehicle voltage supply 90. The voltage outputs 86 are each connected to a voltage input 91 of a component 14 or another component 62. Furthermore, each of the third switching devices 80 has a third switching input 92. The switching inputs 92 each serve to switch a respective switch 94 in each of the third switching devices 80.The switching devices are partially connected to a first voltage monitoring unit 96 and partially to a second voltage monitoring unit 98, wherein the first voltage monitoring unit 96 and the second voltage monitoring unit 98 can switch the switches 94 between three states via these connections, which are designed as third control lines 100. The first voltage monitoring unit 96 is combined with the first monitoring unit 28 in a first housing 102 and is referred to as a first combination monitor 103. The second voltage monitoring unit 98 is combined with the second monitoring unit 48 in a second housing 104 and is referred to as a second combination monitor 106.The first voltage monitoring unit 96 is further connected to the primary vehicle voltage supply 88 to check the voltage and, depending on this voltage, to switch the third switching devices 80 connected to the first voltage monitoring unit 96. The second voltage monitoring unit 98 is connected to the secondary vehicle voltage supply 90 to monitor its voltage and, depending on this voltage, to switch the third switching devices 80 connected to the second voltage monitoring unit 98. An advantageous embodiment of the system 12 shown shows that the first voltage monitoring unit 96 controls the third switching devices, which are connected at least to the primary components 54, in order to supply them with voltage.The second voltage monitoring unit 98 is connected to the third switching devices 80, which are connected to secondary components 56 to supply them with voltage. Fig. 4 shows the steps of a method 110 according to an embodiment for monitoring a vehicle network 10. First, a step 112 is executed, which includes steps 114, 116, 118, and 120 and is repeatedly executed sequentially at a time interval 122.

[0063] In step 114, a first data bus 16 is monitored by a first monitoring unit 28. In step 116, a second data bus 18 is monitored by a second monitoring unit 48. In step 118, a voltage of a primary vehicle voltage supply 88 is monitored by a first voltage monitoring unit 96. In step 120, a voltage of a secondary vehicle voltage supply 90 is monitored by a second voltage monitoring unit 98. If an error is identified during the monitoring in step 112, different measures are taken depending on this error.

[0064] If the first monitoring unit 28 detects faulty data communication on the first data bus 16 in step 124, a faulty component is identified in step 126. For this purpose, all first switching devices 20 are first transferred from the connection state 34 to a disconnection state 130 in step 128. In step 132, which is repeated several times, the first switching devices 20 are then successively switched back to the connection state 36. Step 132 is executed several times for this purpose, with one of the components being connected in each step 132. In parallel, the data communication continues to be monitored in step 134. If the connection of a component by the first switching device 20 causes faulty data communication to occur again, the faulty component 14 is identified.

[0065] If it is already determined in step 132 that faulty data communication still exists despite establishing the disconnection state 130 of all first switching devices 20, then a defective first switching device 20 is present. In this case, the connection state 36 is not re-established in step 132, since the error on the first data bus 16 cannot be remedied by switching the first switching devices 20. In this case, the first data bus 16 is no longer used for communication, and in step 136, only the second data bus 18 is used for communication.

[0066] However, if, as previously described, a faulty component is detected in step 132, the faulty component 14 is disconnected from the first data bus by the first switching device 20 in step 138. If the component 14 is a primary component 54, the associated secondary component 56 is used to maintain the overall function of the system 12. Step 112 is executed again.

[0067] If, in step 116, an error is detected on the second data bus 18 during monitoring in step 140, an attempt is also made to identify the error in a step 142. For this purpose, all components 14 are again transferred to the disconnection state 130 in step 144, and in step 146 the components 14 are connected via the second switching devices 48 in a similar way to step 132. If, during this connection, a further faulty component 14 is detected, it is disconnected from the second data bus 18, and if this is a primary component 54, the secondary component 56 is connected to the second data bus 18 in step 148. If it is determined in step 146 that faulty data communication continues to occur on the second data bus 18 despite all components 14 being disconnected from the second data bus 18, this is to be interpreted as an indication of a further defective second switching device 40. This is determined in step 150.Subsequently, in step 152, all components 14 are de-energized via third switching devices. For this purpose, the third switching devices switch to a voltage isolation state 154. In step 156, the components 14 are then successively switched to a primary voltage connection state 158 until the fault recurs. The offending component 14 is thus identified and disconnected from the voltage using the associated third switching device 80. If this component 14 is a primary component 54, the system 12 continues to operate with the secondary component 56. Step 112 is executed again.

[0068] Independently of or in addition to the previously described method 110, the primary vehicle voltage supply 88 is monitored in step 118 using the first voltage monitoring unit, and the voltage of the secondary vehicle voltage supply 90 is monitored in step 120 using the second voltage monitoring unit 98. If a faulty voltage of the primary vehicle voltage supply 88 or the secondary vehicle voltage supply 90 is detected in step 160, the third switching devices 80 are switched in step 162 depending on the faulty voltage determined in step 160 such that the components 14 are supplied with either the primary vehicle voltage supply in a primary voltage connection state 158 of the third switching devices 80 or with a supply voltage of the secondary vehicle voltage supply 90 in a secondary voltage connection state 166 of the third switching devices 80. Step 112 is then executed again.

[0069] Reference symbol (part of the description):

[0070] 10 Vehicle network

[0071] 12 systems

[0072] 14 components

[0073] 16 first data bus

[0074] 18 second data bus

[0075] 20 first switching devices

[0076] 22 first data bus data interface

[0077] 24 first component data interface

[0078] 25 first data interface

[0079] 26 first switching input

[0080] 28 first monitoring unit

[0081] 30 Data communication

[0082] 32 first control lines

[0083] 34 switches

[0084] 36 Connection status

[0085] 40 second switching devices

[0086] 42 second data bus data interface

[0087] 44 Component data interface

[0088] 45 second data interface

[0089] 46 second switching input

[0090] 48 second monitoring unit

[0091] 52 second control lines

[0092] 54 primary components

[0093] 56 secondary components

[0094] 58 data line

[0095] 60 Gateway

[0096] 62 additional components

[0097] 64 actuator control units

[0098] 66 Autonomous driving control unit

[0099] 67 Setpoint generator

[0100] 68 Housing Trajectory planner Primary combination unit Controller Secondary combination unit Further gateway Third switching devices Primary voltage input

[0101] Secondary voltage input Voltage output Primary vehicle voltage supply Secondary vehicle voltage supply Voltage input Third switching input

[0102] Switch first voltage monitoring unit second voltage monitoring unit third control lines first housing first combination monitoring second housing second combination monitoring

[0103] Proceedings

[0104] Monitor

[0105] Monitoring a first data bus Monitoring a second data bus Monitoring a voltage of a primary vehicle power supply Monitoring a voltage of a secondary vehicle power supply at a time interval

[0106] Detect faulty data communication

[0107] Identify faulty component Transfer connection state to disconnection state Disconnection state

[0108] Downshift first switching devices

[0109] Monitor data communication

[0110] Use second data bus for communication

[0111] Disconnect faulty component from the first data bus

[0112] Detect errors

[0113] Identify errors

[0114] Transferring components into separation state

[0115] Switching components via the second switching devices

[0116] Connect secondary component to the second data bus

[0117] Detect faulty data communication on the second data bus

[0118] Switch off components

[0119] Voltage separation state

[0120] Switch components into primary voltage connection state

[0121] Primary voltage connection state

[0122] Detect faulty voltage of the

[0123] Primary vehicle power supply

[0124] Switching the third switching devices

[0125] Secondary voltage connection state

Claims

Patent claims:

1. Vehicle network (10) for data communication (30) between components (14) of a vehicle, wherein the vehicle network (10) comprises: a first data bus (16), at least two first switching devices (20), each having: a first data bus data interface (22) for connecting to the first data bus (16), a first component data interface (24) for connecting to one of the components (14) of the vehicle, a connection state (36) in which the first data bus data interface (22) is connected to the first component data interface (24), a disconnection state (130) in which the first data bus data interface (22) is disconnected from the component data interface (24), and a first switching input (26) for controlling the first switching device (20) to switch between the connection state (36) and the disconnection state (130), a first monitoring unit (28) which is connected to at least one, in particular each,the first switching inputs (26) of the first switching devices (20) are connected to control the first switching devices (20) individually for switching between the connection state (36) and the disconnection state (130), wherein the first monitoring unit (28) is connected to the first data bus (16) to monitor the data communication (30) on the first data bus (16) and to control the first switching devices (20) depending on the data communication (30) on the first data bus (16).

2. Vehicle network (10) according to claim 1, wherein the vehicle network (10) further comprises: a second data bus (18), at least two second switching devices (40), each comprising: a second data bus data interface (42) for connecting to the second data bus (18), a second component data interface (44) for connecting to one of the components (14) of the vehicle, which is already connected to a first component data interface (24) of a first switching device (20), a connection state (36) in which the second data bus data interface (42) is connected to the second component data interface (44), a disconnection state (130) in which the second data bus data interface (42) is disconnected from the second component data interface (44), and a second switching input (46) for controlling the second switching device (40) in order to switch between the connection state (36) and the disconnection state (130).

3. Vehicle network (10) according to claim 2, wherein either: a) the first monitoring unit (28) is connected to at least one, in particular each, of the second switching inputs (46) of the second switching devices (40) in order to control the second switching devices (40) individually for switching between the connection state (36) and the disconnection state (130), and the first monitoring unit (28) is connected to the second data bus (18) in order to monitor the data communication on the second data bus (18) and to control the second switching devices (40) depending on the data communication (30) on the second data bus (18) and / or the data communication (30) on the first data bus (16), or b) the vehicle network comprises a second monitoring unit (48) which is connected to at least one, in particular each, of the second switching inputs (46) of the second switching devices (40),to control the second switching devices (40) individually for switching between the connection state (36) and the disconnection state (130), wherein, the second monitoring unit is connected to the second data bus (18) in order to monitor the data communication (30) on the second data bus (18) and to control the second switching devices (40) in dependence on the data communication (30) on the second data bus (18).

4. Vehicle network (10) according to one of the preceding claims, wherein the vehicle network (10) further comprises: a plurality of third switching devices (80), each having: a primary voltage input (82) for connecting to a primary vehicle voltage supply (88) of the vehicle, a voltage output (86) for connecting to one of the components (14) of the vehicle, a primary voltage connection state (158) in which the primary voltage input (82) is connected to the voltage output (86), a voltage disconnection state (154) in which the Primary voltage input (82) is separated from the voltage output (86) and a third switching input (92) for controlling the third switching devices (80) to switch between the primary voltage connection state (158) and the voltage separation state (154).

5. The vehicle network (10) of claim 4, wherein the third switching devices (80) each further comprise: a secondary voltage input (84) for connecting to a secondary vehicle voltage supply (88) of the vehicle and a secondary voltage connection state (166) for connecting the secondary voltage input (84) to the voltage output (86).

6. Vehicle network (10) according to claim 4 or 5, wherein the first monitoring unit (28) and / or the second monitoring unit (48) or at least one voltage monitoring unit (96, 98) is connected to each of the third switching inputs (92) of the third switching devices (80) is to control the third switching devices (80) individually for switching between the primary voltage connection state (158), in particular the secondary voltage connection state (166), and the voltage separation state (154).

7. System (12) with a vehicle network (10) according to one of claims 1 to 6 and a plurality of components (14), wherein the components (14) each have a first data interface (25) which is connected to the first component data interface (24) of the first switching device (20).

8. The system (12) of claim 7, wherein the plurality of components (14) each have a second data interface (45) connected to the second component data interface (44) of the second switching devices (40).

9. System (12) according to claim 7 or 8, wherein the plurality of components (14) each have exactly one voltage input (91) which is connected to the voltage output (86) of a third switching device (80) associated with the respective component.

10. System (12) according to one of claims 7 to 9, wherein the components (14) comprise primary components (54) and secondary components (56), wherein each secondary component (56) is preferably identical to exactly one primary component (54).

11. System (12) according to one of claims 7 to 10, wherein each of the components (14) is housed in one of a plurality of separate housings (68) and / or each of the first switching devices (20) is housed in a different housing (68) than each of the second switching devices (40).

12. A method (110) for monitoring a vehicle network (10) according to one of claims 1 to 6 or a system (12) according to one of claims 7 to 11, comprising the steps: Monitoring the first data bus (16) with the first monitoring unit (28), Identifying a faulty data communication (30) on the first data bus (16), Controlling the first switching devices (20) and / or third switching devices (80) to identify a faulty component (14) or a faulty switching device (20, 80), Controlling the first switching devices and / or third switching devices depending on the identified faulty component (14) or faulty switching device (20, 80), in particular to restore error-free data communication (30).

13. The method (110) of claim 12, wherein the method further comprises: Monitoring the second data bus (18) with the first monitoring unit (28) or the second monitoring unit (48), Identifying a faulty data communication (30) on the first data bus (16) or the second data bus (18), Controlling the first switching devices (20) and / or second switching devices (40) and / or third switching devices (80) to identify a faulty component (14), a faulty switching device (20, 40, 80) or a faulty monitoring unit (28, 48), Controlling the first switching devices (20) and / or second switching devices (40) and / or third switching devices (80) depending on the identified faulty component (14), switching device (20, 40, 80) or monitoring unit (28, 48).

14. Method (110) according to claim 12 or 13, wherein for identifying a faulty component (14), switching device (20, 40, 80) or monitoring unit (28, 48), the first switching devices (20) and / or second switching devices (40) and / or the third switching devices (80) are controlled in such a way until a data communication (30) which was identified as faulty is again identified as error-free, wherein for this purpose in particular a first subset of the components (14), in particular several or all of the primary components (54), is separated from the second data bus (18) by the second switching devices (40) and a second subset of the components (14), in particular several or all of the secondary components (56), is separated from the first data bus (16) by the first switching devices (20) and preferably a third subset of the components (14), in particular all components (14) which correspond neither to a primary component (54) nor to a secondary component (56), is separated from both data buses (16, 18) by the first switching devices (20) and the second switching devices (40).

15. Method (110) according to one of claims 12 to 14, comprising restoring error-free data communication (30) by: a) in the case of a detected faulty component (14) which is a primary component (54) to which a secondary component (56) is assigned, connecting the assigned secondary component (56) to the first and / or second data bus and disconnecting the faulty primary component (54) from the first data bus and the second data bus, b) in the case of a detected faulty first switching device (20) or a faulty second switching device (40), connecting all components to the data bus (16, 18) to which the faulty switching device (20, 40) is not connected, and disconnecting them from the data bus (16, 18) to which the faulty switching device (20, 40) is connected, c) in the case of a detected faulty monitoring unit, disconnecting all components from the data bus (16, 18) to which the faulty monitoring unit is connected,and connecting the components via the data bus (16, 18) to which the faulty monitoring unit (28, 48) is not connected.,

Images