Method for testing a communication bus

Abstract

A method for monitoring the integrity of the communication between multiple network devices, connected via a shared communication medium, that are each able to transmit a message via the shared communication medium within a transmission cycle initiated by a first network device comprises eavesdropping on at least some parts of the communication on the communication medium within a transmission cycle. The eavesdropping comprises at least detecting and evaluating data bits or octets that mark the start and end of the transmission cycle and the start and end of a transmission by a network device. The eavesdropping also comprises detecting and evaluating a transmission opportunity that is not used by a network device within a transmission cycle. According to the invention, the duration of a transmission cycle is ascertained and a volume of data transmitted within the transmission cycle or a data rate achieved for the transmission cycle is determined. By comparing a volume of data expected within the transmission cycle or the nominal data rate with the transmitted volume of data, or the achieved data rate, the integrity of the communication on the communication medium can be monitored.

Description

[0001] DESCRIPTION

[0002] METHOD FOR TESTING A COMMUNICATION BUS

[0003] FIELD

[0004] The present invention relates to communication over a communication medium shared by multiple network devices, in particular to monitoring the integrity of the communication.

[0005] DEFINITIONS OF TERMS

[0006] In this document, the term communication medium is used to represent wireless or wired or other media-based transmission media, i.e. synonymously with acoustic signals, light waves, radio waves, or electrical signals carried via electrical conductors, unless the context necessarily specifies one of these communication media.

[0007] BACKGROUND

[0008] Secure communication between multiple network devices is required in a variety of technology areas. Communication can occur via point-to-point connections through routers and switches, such as most Ethernet and Internet Protocol (IP)-based networks, or via communication channels shared by multiple network devices, including wireless connections or wired bus connections.

[0009] In the industrial automation sector, various fieldbuses are used, such as EtherCAT, RS-485, UARTs, etc. In the automotive world, MOST, CAN, LIN, and other networks are used, requiring complex gateway devices to communicate with other domains. In the computer server market, I2C, GPIO, SPI, and even CAN from the automotive world are used to manage various subsystems.

[0010] Each of these subsystems uses its own hardware interface with different EMC behavior, and utilizes different software stacks for this purpose. A consistently Ethernet-based network architecture, in contrast, offers many advantages because it always uses the same protocol regardless of the physical layer. A data frame always looks the same, regardless of whether it is transmitted at 10 Mbps or 10 Gbps. Scaling the bandwidth for specific applications does not require complex gateways. A single switch can often be equipped with appropriate interfaces that enable communication at different speeds. The data frames can then move from one domain to another without the data being modified by appropriate caching.

[0011] In many applications, the use of classic Ethernet connections is not feasible due to complexity, space, weight, cost, or other reasons. For example, an electrical Ethernet connection implemented as a point-to-point connection between two network devices or a network device and a switch with a single line requires a dedicated physical interface at both ends of the line, generally referred to as a PHY, which is responsible for encoding and decoding data between the digital side of the system and a propagation or transmission medium. A switch requires a separate PHY for each network device connected to it, so a large number of connections are required in a network. An example system 10 with four network devices 12, 14, 18, and 20 connected via a switch 16 is shown in Figure 1.A total of 8 physical interfaces are required for the four point-to-point connections so that all five network devices can communicate with each other.

[0012] From the early days of Ethernet, Ethernet systems using a bus topology (10BASE2, 10BASE5) are known. One such system is shown as an example in Figure 2. A coaxial cable 22 connects the five network devices 12, 14, 16, 18, and 20. Each of the network devices 12, 14, 16, 18, and 20 is connected to the coaxial cable 22 via a stub cable and a connection box 12a, 14a, 16a, 18a, and 20a. In the case of 10BASE5 Ethernet, the outer conductor of the coaxial cable 22 is interrupted at certain points in the connection boxes 12a, 14a, 16a, 18a, and 20a, and a contact pin is brought into contact with the inner conductor of the coaxial cable 22 without coming into contact with the outer conductor. In the case of 10BASE2, the stub lines are connected via T-connectors with BNC connectors.Although the number of physical interfaces to the bus line is reduced to five, the familiar Ethernet bus topology still requires a coaxial cable, which, compared to a twisted pair, has significant disadvantages in terms of cost, handling, and weight. Furthermore, connecting each network device to the bus line requires a special connection box or at least a T-piece for coaxial cables, which in turn represents a significant expense.

[0013] To make the use of Ethernet connections more attractive in additional applications, a new variant of the Ethernet standard was developed that offers a bandwidth of 10 Mbps over a single physical layer with a single wire pair: IEEE Std 802.3cg-2019. One of the variants specified under this IEEE standard is called 10BASE-T1 S, where the S stands for Short Reach, and can use a multidrop or bus topology in which all nodes are connected via a single twisted-pair wire. This eliminates the need for switches, meaning the number of physical interfaces is fewer than in a system with one switch, and no coaxial cable is required. Connecting drop lines to a twisted-pair cable can also be implemented passively, easily and cost-effectively. A long-reach variant – called 10BASE-T1 L (L for Long Reach) – has been defined for distances of up to 1 km.The long-reach variant uses point-to-point connections.

[0014] A 10BASE-T1 S bus system can interconnect at least eight network devices, with a maximum bus length of 25 m. The individual network devices can be connected to the bus line using stub cables up to 10 cm long. All nodes share the bandwidth of 10 Mbps. Figure 3 shows a corresponding example 10BASE-T1 S network with five network devices 12, 14, 16, 18, and 20 connected via a shared communication medium 24, e.g., a bus line formed by a twisted pair of wires. The dashed line indicates the logical connections between the network devices, while the solid line indicates the physical connections.

[0015] To ensure regulated access of individual network devices to the KBUS, the standard specifies an arbitration scheme that enables full utilization of the available bandwidth with reduced latency and high Quality of Service (QoS). One of the possible arbitration schemes is known as Physical Layer Collision Avoidance (PLCA). Another arbitration scheme, known as Carrier Sense Multiple Access / Collision Detection (CSMA / CD), can have lower utilization of the bus capacity and can be used, for example, as a fallback option.

[0016] The CSMA / CD access method allows any network device to access the network in a transmitting manner as long as no other network device is transmitting. A policy that ensures that each network device in a network has the opportunity to transmit data within a specified time period is not included in the CSMA / CD access method and must be implemented at a higher protocol level.

[0017] The PLCA access method is conceptually similar to a Token Ring method or TDMA (Time Division Multiple Access). In the PLCA access method, each network device is configured with a node ID, and the network device with node ID 0 is designated as the PLCA coordinator. The coordinator initiates a communication cycle by sending a prearranged sequence of data bits or octets, also called a beacon message or beacon frame. The other nodes use this beacon message to coordinate their clocks. The terms beacon message and beacon frame are used synonymously in this description.

[0018] In order to determine when it is allowed to send data using the PLCA access method, each network device "listens" on the bus line and waits until the network device with a node ID one lower than its own completes the transmission. After each transmission by a network device, which can be marked as completed by an agreed sequence of data bits or octets at the end of a transmission, there is a period known as the transmit opportunity or TO time window. The TO time window can be 20 bits long, for example, i.e. it corresponds to a period of time within which 20 bits can be sent at the nominal data rate of the data bus. Within this TO time window, the network device with a node ID one higher than that of the network device that immediately before completed its transmission can begin the transmission.Each node is permitted to send all of its data, although typically each network device sends only one frame. However, a network device can send multiple consecutive data frames in burst mode. Commit messages sent between each data frame mark the communication medium as still occupied by the currently transmitting network device. If a network device does not transmit and allows the TO time slot reserved for it to expire, another TO time slot opens for the next network device. This way, even in a cycle in which not all network devices are transmitting, the coordinator can determine or assume the end of the cycle and start a new cycle.

[0019] After the last network device has received and, if necessary, used the opportunity to transmit data, the PLCA coordinator initiates the next cycle with another beacon message.

[0020] Access via PLCA achieves higher throughput than TDMA or Token Ring because network devices don't have to split their messages into multiple time slots. Furthermore, the transmit opportunity phase, with its 20 bits, is shorter than a token packet. Since bus participants may or may not exercise their opportunity to transmit, the duration of a complete transmission cycle cannot be precisely determined in advance.

[0021] An example representation of the messages sent by network devices in the order of their node IDs over the shared communication medium is shown in Figure 4. The start of a transmission cycle is initiated with a corresponding bit sequence B, also known as a beacon. This is immediately followed by a TO time window, within which the network device with the lowest node ID may begin sending its message - in this case, the node ID with the value 0, which also sent the beacon bit sequence. The TO time window is shown hatched in the figure. The end of transmission by a network device is followed by the T0 time window for the next network device. The network device that is permitted to transmit can begin transmitting immediately at the beginning of the TO time window or at any time within the TO time window. The TO time window can, for example, be started by a signal representing the end of a transmission from a network device.This signal can be, for example, an end-of-frame (EOF) signal. The end of a TO time window can be determined by a counter or timer. The end of the TO time window is reached when the network device that is authorized to transmit has not started a transmission during an agreed time, corresponding to an agreed number of data bits sent at the nominal data rate of the shared communication medium. If the start of a transmission is detected before the TO time window expires, e.g., signaled by a start-of-frame (SOF) signal, the counter for the TO time window can be stopped. This process repeats until the last network device has sent its message or allowed its TO time window to expire. A new beacon bit sequence is then sent, starting a new transmission cycle.The length or duration of each transmission cycle is determined by the length of the beacon bit sequence, the length of the messages sent by the network devices, or the TO time slots that are completely or partially unused, and can vary from transmission cycle to transmission cycle.

[0022] Although the network devices always listen for communication on the KBUS to determine when they are allowed to send, there is no further check to determine whether communication on the KBUS is running error-free. Errors caused by interruptions in the communication medium or by transient disturbances that can disrupt the transmission of individual data packets cannot be detected. Such errors can occur during network operation, for example, in a harsh environment with multiple sources of interference, as a result of an attack, or due to a fault in the connection between the physical interface (PHY) and the microcontroller that is attempting to communicate via the interface. Figure 5 shows the network from Figure 3 with a fault in the connection between the processor and the network interface of the network device 16. The physical connection between the network interface and the bus line 24 is not faulty.Nevertheless, the transmission of data by network device 16 may be incomplete or fail completely. An example representation of the error in the sequence of messages sent by the network devices in the order of their node IDs over the shared communication medium is shown in Figure 6. The representation essentially corresponds to the representation in Figure 4, except that the message from Node 2 is corrupted. This disruption may consist, for example, in Node 2 not sending at all, sending incompletely, or sending random bit sequences due to a disruption in the connection between the processor and the network interface. Such an error is not detectable at the access control level during normal operation and would have to be detected at higher protocol levels.Such capabilities may not always be available, particularly in sensor networks where individual network devices provide little computing power and memory and must also be particularly cost-effective.

[0023] Figure 7 shows the network from Figure 3 with a fault affecting the bus line 24, for example, a temporary disturbance triggered by an electromagnetic interference pulse. Here, too, the physical connection between the network interface and the bus line 24 is not disturbed. Although the disturbance is depicted as local in the figure, due to the short length and low attenuation of the bus line, it occurs at all interfaces almost simultaneously and thus disrupts the correct reception of data bits or octets of a message, for example, by changing a signal level in such a way that the value of one or more data bits is changed, or by a voltage level being applied to the receivers of the interfaces that overdrives them. An example representation of the error in the sequence of messages sent by the network devices in the order of their node IDs over the shared communication medium is shown in Figure 8.The representation essentially corresponds to the representation in Figure 4, except that in the example representation in Figure 8, the beacon bit sequence is disrupted, e.g., by an electrical or electromagnetic interference pulse at the time the coordinator sent the beacon bit sequence. Network devices with node IDs greater than 0 are therefore unable to recognize the start of a new transmission cycle and will not send their messages. The coordinator will therefore supposedly only recognize TO time slots that are not being used by the other network devices and will begin a new transmission cycle when the number of elapsed, unused TO time slots corresponds to the number of network devices connected via the shared communication medium. For the coordinator, the transmission cycle x+1 shown in Figure 8 is very short; for the other network devices, however, the transmission cycle x is longer than for the coordinator.Such a change cannot be reliably detected on the OSI layers 1 and 2 of the communication link during normal operation and would have to be detected and, if necessary, corrected at higher protocol levels, as in the error example described with reference to Figure 5.

[0024] DESCRIPTION OF THE INVENTION

[0025] If a network of the type described above, in which a large number of network devices are connected via a shared communication medium, is used in a system that places high demands on the reliability and security of communication, for example, in a system with multiple network devices communicating with each other in the context of partially or highly automated driving, frequent, ideally continuous, communication integrity checks are essential. In the context of this description, the term "network device" encompasses all possible types of network devices, including networked sensors and network devices that process signals from networked sensors.

[0026] In order to be able to perform this integrity check even in the event of serious errors at any point in the network, it may also be desirable to be able to perform this integrity check independently in as many network devices as possible, for example, to switch to a secure operating mode in response to an error. Since the hardware and computing power in many network devices are not sufficient to execute complex control routines continuously or quasi-continuously, and the use of communication protocols with acknowledgment messages for received data reduces the bandwidth available for data transmission and causes additional delays, there is a great need to be able to perform a simple but reliable integrity check of communication in networks in which multiple network devices communicate over a shared medium.

[0027] It is therefore an object of the present invention to provide a method for checking the integrity of a communication in a network, which requires low computing capacity and which can also be executed in a decentralized manner.

[0028] This object is achieved by the method specified in independent claim 1. Embodiments and further developments of the method are specified in the dependent claims.

[0029] It is also an object of the present invention to provide a network device configured to implement the method according to the invention or its embodiments or further developments. Further objects of the invention relate to the creation of a system comprising at least one network device according to the invention, as well as a computer program product and a computer-readable medium that provides the same for retrieval.

[0030] According to a first aspect of the invention, a method for monitoring the integrity of communication between a plurality of network devices connected via a shared communication medium, which can each send a message via the shared communication medium within a transmission cycle initiated and terminated by a first network device, also referred to as a coordinator, comprises listening to at least certain parts of the communication on the communication medium within the transmission cycle.

[0031] The message sent by the respective network device can be of any length, i.e., it can comprise one or more Ethernet frames, with the length of the Ethernet frame(s) being between 64 and 1518 bytes. Sending so-called jumbo frames with a longer length is also possible in principle, although in this case, all network devices connected via the communication medium must support these jumbo frames. If a network device sends several consecutive frames, which is also known as burst mode, the network device can send a commit signal after a sent frame to signal to the other network devices that another frame is following.

[0032] The beginning of a transmission cycle is marked by a sequence of data bits. The end of a transmission cycle can, for example, be represented by a sequence of data bits that mark the beginning of a subsequent transmission cycle. Alternatively, the end of a transmission cycle can also be represented by a sequence of data bits that mark the end of transmission by the last network device. The latter may require that all network devices executing the method know at least the number of network devices in the network, e.g., through appropriate parameterization or by learning independently during operation.

[0033] Eavesdropping accordingly comprises at least the detection and / or evaluation of data bits or sequences of data bits that mark the start and end of a transmission cycle, and of data bits or sequences of data bits or octets that mark the start and end of a transmission by a network device. The start of a transmission by a network device can be detected by the fact that a first data bit is sent within a TO time window. The protocol used can ensure that only a network device that is actually currently transmitting transmits. Eavesdropping also comprises the detection and / or evaluation of a transmission option not used by a network device within a transmission cycle. If at least one of the network devices in the network transmits messages in burst mode, eavesdropping also comprises the detection and / or evaluation of sequences of data bits that represent commit signals.Network devices that can also send messages in burst mode can announce this, for example, when the network is initialized or, if the number and type of network devices in the system using the network are known from the beginning and remain unchangeable, a corresponding configuration can be made in advance in the network devices.

[0034] Each network device in the network is assigned a unique node ID, usually a number within a range starting with 0 and ending with the number n of network devices in the network. The network device with the lowest node ID, i.e. node ID 0, is the first network device, i.e. the coordinator, which initiates the transmission cycle and is also the first to transmit its data. Each network device implements a node ID counter, which is reset to 0 at the beginning of each transmission cycle. The node ID counter can be a simple counter implemented in software. With each transmission by a network device on the shared communication medium, e.g. at the end of a transmission, each network device increments its node ID counter by 1 and compares the counter value of the node ID counter with its own node ID.If the counter value of the Node ID counter and the own Node ID of a network device match, that network device is allowed to transmit itself over the shared communication medium after the end of the previous transmission.

[0035] As previously mentioned, a network device does not necessarily have to transmit within a transmit cycle. The detection and evaluation of a transmission opportunity not used by a network device can therefore, for example, include the detection and evaluation of a TO time window. A TO time window has a predetermined length of time, e.g. the time it would take to transmit a predetermined number of data bits at the nominal data rate of the shared communication medium. A TO time window follows the end of a transmission, e.g. a sequence of data bits representing the end of a data frame. As soon as no data bits are detected during the entire duration of a TO time window, i.e. until its expiration, which indicate the start of a transmission by the network device that is currently permitted to transmit, each network device increments the Node ID counter and waits during a new TO time window to see whether data bits are received.sends its transmission over the communication medium if the value of the node ID counter equals its node ID.

[0036] A network device can also send a commit message during the TO time window if, for example, the network device is not yet ready to send the message but will be shortly. In this case, the other network devices wait beyond the end of the TO time window until the network device that sent the commit signal has sent its message. In the subsequent TO time window, the next network device whose node ID matches the counter value can then send.

[0037] According to the invention, the method further comprises determining the duration of a transmission cycle. The duration of a transmission cycle can be determined, for example, by measuring the time elapsed between two consecutive sequences of data bits characterizing the beginning of a transmission cycle. If the end of a transmission cycle is signaled by a sequence of data bits that marks the end of transmission by the last network device, the time elapsed between the beginning of the transmission cycle and this sequence can be measured. Since the length of the transmission cycles can vary depending on the number of network devices actually transmitting data and the number of data bits or octets sent by each network device, the duration of each transmission cycle is determined individually.

[0038] Furthermore, according to the invention, the amount of data transmitted within the transmission cycle is determined, and the amount of data expected within the transmission cycle is calculated. The determined amount of data is then compared with the calculated amount of data. Alternatively, a data rate can be determined from the measured duration of the transmission cycle and the amount of data transmitted via the communication medium during the transmission cycle, which data rate is compared with a nominal data rate of the network. If the determined and calculated amount of data, or the determined and nominal data rate, match within a tolerance window, the method is repeated for a subsequent transmission cycle. Otherwise, at least one of the network devices that performed the method goes into error mode. In error mode, a network device can take different measures depending on the type and severity of the error.For example, information related to the error can be stored locally on the network device, in an audit-proof storage device communicatively connected to the network device, and / or in a cloud. The log level—for example, the amount of data and the level of detail of the stored information—can also be increased on a case-by-case basis to provide additional data for troubleshooting. Alternatively or additionally, the network device can stop its own communication via the shared communication medium, or the network device with the lowest node ID, which assumes the role of coordinator, can be notified, preventing further communication on the data bus if necessary.It is also possible to notify other network devices communicating over the shared communication medium of the error if they do not themselves monitor the integrity of communication over the shared communication medium, so that these network devices can adapt their functions to the error if necessary. A fallback to another access mode can also occur in response to an error, e.g., to the CSMA / CD access mode for the shared communication medium. With CSMA / CD (Carrier-Sense Multiple Access / Collision Detection), communication no longer takes place in coordinator-initiated cycles, and no beacon frames are sent. Instead, all network devices listen for possible communication on the communication medium and attempt to transmit if no other network device is currently transmitting.Should collisions occur, the network devices wait for a certain period of time with randomly generated wait times before attempting to transmit again. This reduces the net data rate, but statistically speaking, all participants are still given the opportunity to send data. Such a change in access control must be communicated to all bus participants in an appropriate manner. For example, the network device with the lowest node ID could be notified, which then sends a corresponding message to the other network devices. It is easy to see that after a change to an error mode, monitoring according to the method according to the invention may no longer be possible, for example, if the access method has been switched to the CSMA / CD.

[0039] If the procedure is executed for each transmission cycle, continuous or quasi-continuous monitoring of the communication integrity is feasible. When the end of a transmission cycle is signaled by the start of a subsequent transmission cycle, monitoring for the new transmission cycle is already underway and the amount of data transmitted in the new transmission cycle is determined. The expected data volume for the previous cycle is calculated and the determined data volume is compared with the expected data volume for the completed transmission cycle. Depending on the application, random monitoring may also be sufficient, performed cyclically on a regular basis or at irregular intervals.

[0040] The method can also be carried out over several transmission cycles, i.e. the determination of the transmitted data volume and the calculation of the expected data volume can take place over several transmission cycles. The method can also be carried out for a shorter period of time than one transmission cycle, even over parts of two consecutive transmission cycles. For example, it would be possible to monitor the integrity of the communication for only a selection of network devices. In this case, the "shortened transmission cycle" could be determined using the node ID counter. In principle, it is therefore possible to start and finish determining the transmitted data volume within a transmission cycle, or to start within a first transmission cycle and finish within a later transmission cycle, i.e. not necessarily at the beginning and end.

[0041] Of course, data sent via the communication medium that is addressed to the network device executing the method is not exclusively used to determine the transmitted data volume, but is also forwarded to higher software layers for further processing. According to one or more embodiments, determining the data volume or data rate transmitted within a transmission cycle comprises counting all data bits or octets transmitted via the communication medium within a transmission cycle, possibly including those transmitted by a network device executing the method itself, provided it sends a message within the transmission cycle. This embodiment could, for example, be used on Layer 1 of the OSI layer model if the network device executing the method is not configured to evaluate the communication on a higher layer of the OSI layer model.

[0042] According to one or more embodiments, determining the amount of data transmitted within a transmission cycle, or the data rate, comprises detecting the start and end of a transmission from a network device. The amount of data transmitted by a respective network device can be calculated by multiplying the time between the start and end of the transmission by the nominal data rate of the shared communication medium. The calculated data volumes of all network devices that transmitted during a transmission cycle are summed.

[0043] According to one or more embodiments, determining a data volume or data rate transmitted within a transmission cycle comprises evaluating information contained in transmissions of a transmission cycle about the number of data bits or octets transmitted in the respective transmission, possibly including those transmitted by a network device itself implementing the method, provided it sends a message within the transmission cycle. Depending on whether the information specifies the total number of data bits or octets transmitted or only the number of data bits or octets transmitted as payload, the number of data bits or octets can be corrected by the data bits or octets required for the communication protocol, including the number of data bits or octets that are sent to initiate and, if applicable, to terminate a transmission cycle.

[0044] To determine the amount of data transmitted within a transmission cycle or the data rate, it may be necessary for the network interface of a network device executing the method to be placed in a special operating mode in which the contents of transmissions not sent to the network device are also evaluated. This operating mode is also known as "promiscuous mode." Determining the number of transmitted data bits or octets can then involve evaluating information transmitted in higher protocol layers regarding the amount of data sent in a transmission.

[0045] The method used to determine the data volume or data rate transmitted within a transmission cycle, or the type of data acquired for this purpose, can be selected, for example, depending on the number of network devices connected via the shared communication medium, the maximum duration of the TO time window, and / or the duration of the sequence of data bits or octets characterizing the beginning and end of the transmission cycle. For example, one method may omit the explicit recording of one or more signal components, such as the sequence of data bits or octets characterizing the beginning and end of a transmission cycle, the duration of unused TO time windows, or commit signals, while another method explicitly records one or more of these signal components.Particularly with a small number of network devices connected via the shared communication medium, it may be appropriate to capture only the data sent by network devices to determine the data volume or data rate transmitted within a transmission cycle, because the maximum number of unused TO time slots or the number of data bits or octets that could have been sent during their time periods do not reach the shortest possible length of a network device's transmission. However, if a larger number of network devices are connected via the shared communication medium, or if one or more network devices send multiple data frames connected by a commit signal, it may also be necessary to capture signal components.

[0046] According to one or more embodiments, determining a data volume or data rate transmitted within a transmission cycle comprises replacing a period of time of a TO time window that elapsed before the start of a transmission or an unused transmission opportunity by a network device with the number of data bits or octets that can be transmitted during the elapsed period or the duration of a TO time window. The number of bits that could theoretically have been transmitted before the network device actually started transmitting or the number of data bits or octets that can be transmitted during a TO time window can be calculated, for example, from the nominal transmission rate of the shared communication medium and the elapsed time.This number can also correspond to a predetermined number of data bits, which is taken into account as a representative of the unused transmission opportunity for determining the amount of data transmitted within a transmission cycle, because no data bits or octets are sent during an unused TO time window.

[0047] In one or more embodiments of the method, the node IDs are permanently assigned to the network devices before or during system commissioning. However, it is also possible for the node IDs to be reassigned during operation, e.g., cyclically at fixed intervals to allow access to new network devices added to the network, or to maintain a continuous series of node IDs, for example, if a network device has been removed from the network. The latter can be announced by the network device in a corresponding message, but it can also be assumed, for example, if a network device has not used a predetermined number of TO time slots of consecutive transmission cycles.Instead of reassigning node IDs in the event that a network device has not used a predetermined number of TO time slots of consecutive transmission cycles, at least the network device executing the method can also enter an error mode. The predetermined value can be different for each network device and can be announced via broadcast messages during system commissioning or stored in a memory accessible to the network device executing the method.

[0048] According to one or more embodiments, calculating an expected data volume within a transmission cycle comprises multiplying the cycle duration by the nominal data rate of the communication medium. This embodiment can be used in particular when transmission cycles follow one another immediately without significant delay.

[0049] According to a second aspect of the invention, a network device comprises one or more processors, volatile and non-volatile memory associated with the one or more processors, and a physical network interface communicatively connected to the one or more processors and configured to send and / or receive data via a communication medium shared by multiple network devices. The elements of the network device are communicatively connected to one another by means of one or more data lines or buses. Computer program instructions are stored in the non-volatile memory, which, when executed by the at least one processor, configure the network device to carry out one or more embodiments of the method according to the invention.

[0050] According to a third aspect of the invention, a system, in particular a vehicle system, comprises two or more network devices networked via a communication medium shared by multiple network devices. According to the invention, at least one of the network devices is configured to execute at least one embodiment of the method according to the invention described above.

[0051] A computer program product according to a fourth aspect of the invention contains instructions which, when executed by a computer, cause the computer to carry out one or more embodiments and further developments of the method described above.

[0052] The computer program product can be stored on a computer-readable medium or data carrier. The medium or data carrier can be physically embodied, e.g., as a hard drive, CD, DVD, flash memory, or the like, but the medium or data carrier can also comprise a modulated electrical, electromagnetic, or optical signal that can be received by a computer via a corresponding receiver and stored in the computer's memory.

[0053] The method described above and the network devices executing the method can advantageously be implemented without changes to existing hardware and can be integrated into existing networks accordingly, since the protocols already in use do not have to be changed and the function of the network is not impaired by higher usage or latencies.

[0054] Because the integrity of communication channels is monitored during operation, the operational reliability of systems, such as sensor networks and control units that control and execute actions based on sensor data, can be increased, for example, in vehicles with a high degree of driver assistance or autonomous vehicles. Errors can be detected quickly, and appropriate measures can be taken more quickly to restore safe operation or transition to a safe operating mode.

[0055] The method described above and the network devices executing the method can be used platform-independently and therefore flexibly due to the simple and lean implementation.

[0056] SHORT DESCRIPTION OF THE DRAWING

[0057] The invention is explained below by way of example with reference to the drawing. The drawing shows:

[0058] Fig. 1 shows an exemplary network known from the prior art with four network devices connected via a switch,

[0059] Fig. 2 shows an exemplary network known from the prior art with five network devices connected via a 10BASE2 or 10BASE5,

[0060] Fig. 3 shows an exemplary network known from the prior art with five network devices connected via a twisted pair of wires, Fig. 4 shows an exemplary representation of the messages sent by network devices in the order of their node IDs via the shared communication medium

[0061] Fig. 5 the network from Figure 3 with an error in the network interface of a network device,

[0062] Fig. 6 is an exemplary representation of an error in a network device in the sequence of messages sent by the network devices in the order of their node IDs over the shared communication medium,

[0063] Fig. 7 the network from Figure 3 with a fault acting on the bus line,

[0064] Fig. 8 is an exemplary representation of a transient disturbance acting on the bus line in the sequence of messages sent by the network devices in the order of their node IDs over the shared communication medium,

[0065] Fig. 9 is a schematic flow diagram of the basic procedure of the method,

[0066] Fig. 10 is an exemplary schematic flow diagram of monitoring communication on the shared communication medium,

[0067] Fig. 11 is an exemplary schematic flow diagram for selecting one of two possibilities for determining the amount of data transmitted over the shared communication medium during a transmission cycle depending on parameters of the shared communication medium and the network,

[0068] Fig. 12 is an exemplary schematic flow diagram of an alternative method for selecting one of two measurement methods for determining the amount of data transmitted over the shared communication medium during a transmission cycle as a function of parameters of the shared communication medium and the network when at least one network device transmits messages in burst mode,

[0069] Fig. 13 is an exemplary schematic flow diagram for determining the integrity of communication during a transmission cycle,

[0070] Fig. 14 shows a first part of an exemplary schematic flow diagram of a method for determining the data bits or octets transmitted within a transmission cycle on the physical layer, Fig. 15 shows a second part of an exemplary schematic flow diagram of a method for determining a data volume transmitted within a transmission cycle on the physical layer, and

[0071] Fig. 16 is an exemplary block diagram of a network device configured to carry out one or more aspects of the method according to the invention.

[0072] The same or similar elements may be referenced in the figures with the same reference numerals.

[0073] Figures 1 to 8 have already been described above and will therefore not be discussed again below.

[0074] DESCRIPTION OF EMBODIMENTS

[0075] Figure 9 shows a schematic flow diagram of the basic sequence of method 100. In step 110, the communication on the shared communication medium is listened to or monitored, whereby at least sequences of data bits or octets are detected and evaluated, which indicate the beginning and end of a transmission by a network device, as well as transmission options not used by network devices within a transmission cycle. As soon as the beginning of a transmission cycle is detected, the determination of its duration begins in step 120. For this purpose, for example, the time elapsed between two consecutive sequences of data bits representing the beginning of a transmission cycle can be measured.

[0076] In parallel, in step 130, the amount of data transmitted during the transmission cycle via the shared communication medium is determined, for example by counting the data bits or octets transmitted via the shared communication medium or in another way. Data from the monitoring in step 110 can also be used here, as indicated by the separate arrow, e.g. special sequences of data bits or octets detected during the monitoring which serve to control the transmission. In step 140, an expected amount of data within the transmission cycle is calculated. This can be done based, among other things, on the duration of the transmission cycle and the nominal data rate of the shared communication medium as well as the number of network devices connected via it. For this purpose, the duration of the transmission cycle determined in step 120 is supplied, as indicated by the arrow.

[0077] In step 150, the integrity of the communication via the shared communication medium is checked. Integrity is determined, for example, by comparing the calculated expected data volume with the data volume determined by monitoring the communication. It is also possible to calculate a data rate from the data volume determined by monitoring the communication and the duration of the transmission cycle, which is then compared with the nominal data rate of the shared communication medium. A tolerance range can be used to suppress unavoidable measurement inaccuracies due to the lack of synchronization between the network devices and possibly slightly differing transmission data rates of different network devices when determining integrity.

[0078] Figure 10 shows an example schematic flow diagram of the eavesdropping or monitoring, in step 110, of communication on the shared communication medium. Between two sequences of data bits representing the beginning and end of a transmission cycle, only payload data and signals that control the proper flow of communication between the network devices are to be expected. Network devices that can be operated in so-called promiscuous mode can eavesdrop not only on the address data of data packets not addressed to them, but also on the further content of the transmissions, or at least count the number of data bits or octets of transmissions not addressed to them. In step 111, data from a transmission is received accordingly, and in step 112, the length of the transmission, i.e., the number of data bits or octets, is determined or extracted.If a network device executing the method can also evaluate the content of transmissions not directed to the network device, e.g., information contained in a header about the length of a transmission, counting all data bits or octets of the transmission is not necessary. In this case, it is sufficient if the network device can determine the end of a transmission, e.g., by receiving a signal representing the end of a data frame (EOF) or another signal agreed upon in a protocol used. If the transmission is directed to the network device executing the method, which is determined by a check in step 113, the received data bits or octets are also forwarded for further processing in higher protocol layers in step 114.Otherwise, the data not required to determine the transmitted data volume can be discarded in step 115, unless they are used for other purposes by the network device executing the method. The monitoring of the communication on the shared communication medium is repeated at least until a signal representing the end of a transmission cycle is received, i.e., a corresponding sequence of data bits.

[0079] Figure 11 shows an exemplary schematic flow diagram for selecting one of two options for determining, in step 130, the amount of data transmitted during a transmission cycle via the shared communication medium depending on parameters of the shared communication medium and the network. First, in step 1301, the number of network devices connected via the shared communication medium is determined, in step 1302 the number of data bits or octets in the sequence of data bits representing the start of a transmission cycle and, if applicable, the end of a transmission cycle is determined, and in step 1303 the number of data bits or octets corresponding to the TO time window is determined. This information about the parameters of the protocol used for communication, also referred to as signal components, can, for example,be read out from a configuration file which is accessible locally or via the network to all network devices carrying out the method. In step 1305, a check is carried out to determine whether the total number of data bits or octets of the signal components, which results from the sum of the number of data bits or octets in the sequence of data bits representing the start of a transmission cycle and, if applicable, the end of a transmission cycle and the product of the number of network devices connected via the shared communication medium and the number of data bits or octets representing the TO time window, plus a measurement inaccuracy, is equal to or greater than the number of data bits or octets of the shortest possible transmission of a network device, e.g. the shortest length of a data frame. If the largest possible total number of data bits or octets of the signal components is equal to or greater than the number of data bits orOctets of the shortest possible transmission of a network device, in addition to determining the number of data bits or octets transmitted in the messages of the network devices in step 1307, the number of data bits or octets of the signal components is recorded in step 1306.

[0080] Figure 12 shows an exemplary schematic flow diagram of an alternative method for selecting one of two measurement methods for determining, in step 130, the amount of data transmitted over the shared communication medium during a transmission cycle as a function of parameters of the shared communication medium and the network when at least one network device transmits messages in burst mode. Steps 1301, 1302, and 1303 correspond to those described with reference to Figure 11. In addition, in step 1304, the number of network devices that transmit multiple consecutive data frames in burst mode in a message is determined. If at least one network device transmits in burst mode, a larger number of data bits or octets for signal components can occur within a transmission cycle, among other things.because in burst mode a network device can send up to 255 data frames in succession, and a commit signal is sent for each sent data frame, informing the other network devices in the network that the network device currently actively accessing the communication medium will send further data frames. The more network devices send additional data bits or octets for signal components, the more likely it is that the number of data bits or octets in the shortest possible message from a network device will be reached or exceeded simply by the sum of the data bits or octets of the signal components, so that it becomes necessary to also record the data bits or octets of the signal components and to include them in the calculation of the number of transmitted data bits or octets or the data rate for a transmission cycle. During the check in step 1305, the number of data bits or octets is determined accordingly.Octets for signal components, the product of the number of network devices transmitting in burst mode, the number of data bits or octets of the additional TO time slots, and the maximum number of data packets in burst mode, i.e. 255, is added to the sum described with reference to step 1305 in Figure 11. If this expanded sum, less a measurement inaccuracy, is equal to or greater than the number of data bits or octets of the shortest possible transmission of a network device, the number of data bits or octets of the signal components is recorded in step 1306, as in the example described with reference to Figure 11, in addition to determining the number of data bits or octets transmitted in the messages of the network devices in step 1307.

[0081] Figure 13 shows an exemplary schematic flow diagram of the steps of a method 150 for determining the integrity of communication during a transmission cycle. For this purpose, in step 151, a “real bus load” is first determined by subtracting the number of data bits or octets actually transmitted via the shared communication medium from the number of data bits or octets that can be transmitted at the nominal data rate during the transmission cycle. In step 152, a check is made as to whether the real bus load is a positive number. If this is not the case, i.e., if more data bits or octets were transmitted within the observed cycle than would have been theoretically possible, a first type of error must be present, and the method follows the “no” branch to step 156, in which this error is signaled and / or handled differently. Such an error can, for example,arise because the end of a transmission cycle was not recognized. If the actual bus load is a positive number, the method follows the "yes" branch and a check is made next in step 153 as to whether the number representing the actual bus load is greater than the number of data bits or octets of the shortest possible transmission of a network device, e.g. the shortest length of a data frame. If this is not the case, the method follows the "no" branch to step 154, which may, for example, include waiting for the determination of the integrity of the communication for the next transmission cycle. If the number representing the actual bus load is greater than the number of data bits or octets of the shortest possible transmission of a network device, at least one data frame has been lost and the method follows the "yes" branch to step 155. In step 155, this second type of error is signaled and / or handled differently.

[0082] Figure 14 shows a first part of an exemplary schematic flow diagram of a method 1100 for monitoring and a method 1300 for determining the data bits or octets sent within a transmission cycle on the physical layer, i.e., Layer 1 of the OSI layer model. This method can be used, for example, if a network device executing the method according to the invention does not support monitoring of communication on Layer 2 that is not intended for the network device itself, i.e., the Layer 2 frames cannot be analyzed. In this method, those data bits or octets that are used for signaling are also directly detected, i.e., the sequences of data bits or octets that signal the start of a transmission cycle (beacon), the beginning (SOF) or end of a transmission (EOF), and the sequences of data bits or octets that signal a commit.

[0083] If necessary, an initialization of the network device executing the method can take place before the start of the method, in which, for example, the number of data bits or octets of a message characterizing the start or end of a transmission cycle, the number of network devices and their properties and the like are read from a database (not shown in the figure).

[0084] First, in step 1101, a check is made to determine whether a sequence of data bits or octets indicating the beginning of a new transmission cycle has been received. If this is not the case, the "no" branch of step 1101 is entered, and the check is repeated.

[0085] If a sequence of data bits or octets indicating the beginning of a new transmission cycle has been received, the method branches to the "yes" branch to the methods represented by steps 140 and 150, in which the data volume expected within the previous transmission cycle is calculated and the integrity of the communication for the previous cycle is checked. A flowchart of an exemplary method 150, which can be used in the analysis at Layer 1 of the OSI layer model, is described below with reference to Figure 15. The number of data bits or octets that could have been sent while waiting for a sequence of data bits or octets indicating the beginning of a new transmission cycle is determined in step 1301a and taken into account accordingly when checking the integrity of the communication, indicated by the dashed arrow from step 1301a to step 140.

[0086] In parallel with checking the integrity of the communication, in step 1102, respective counters for the network device that is permitted to transmit next, for the TO time slots not used by network devices, and for the number of data bits or octets transmitted during the current transmission period, as well as a timeout counter for the current TO time slot are reset and started in step 1103. In step 1104, a check is made as to whether all network devices have had the opportunity to transmit in the current transmission cycle, i.e., whether the counter for the network device that is permitted to transmit next has reached a value that corresponds to the last network device in the group of network devices connected via the shared communication medium.If this is the case, i.e., if all network devices had the opportunity to transmit a message during the current transmission cycle, the method follows the "yes" branch from step 1104 back to step 1101, where it waits for the start of the next transmission cycle. Otherwise, the method follows the "no" branch from step 1104 to step 1301, where all data bits or octets transmitted on the shared communication medium are received and counted.

[0087] Received sequences of data bits or octets are checked in step 1302 to determine whether they indicate the start of a transmission by a network device, for example, a start-of-frame signal or the like. If this is the case, the method follows the "yes" branch of step 1302 and waits, in step 1303, for a sequence of data bits or octets that indicate the end of a transmission by a network device. In parallel, the received data bits or octets are checked in step 1304 to determine whether, instead of a sequence of data bits or octets that indicates the end of the transmission, a sequence of data bits or octets that indicates the start of a new transmission cycle was received. If this is the case, "yes" branch of step 1304, an error must have occurred, and the method continues with step 1305. In step 1305, for example,the network device executing the procedure may be placed in an error mode and / or the network device may announce the detected error over the network.

[0088] If a sequence of data bits or octets is received in step 1303, indicating the end of a transmission by a network device (the "yes" branch of step 1303), the counter for the network device permitted to transmit next is incremented in step 1306, and the method continues with step 1104. As already described above, a check is made in step 1104 to determine whether all network devices have had the opportunity to transmit in the current transmission cycle. If this is not the case, the part of the method beginning with step 1301 is continued for the next network device.

[0089] If the check in step 1302 does not find a sequence of data bits or octets that indicates the start of a transmission by a network device, the method follows the "no" branch of step 1302 and checks in step 1307 whether a received sequence of data bits or octets indicates the start of a transmission cycle. If this is the case, "yes" branch of step 1304, an error must have occurred because not all network devices connected via the shared communication medium have yet had the opportunity to send a message or at least allow their respective TO time windows to expire, and the method continues with step 1305. As already described above, in step 1305, for example, the network device executing the method can be placed into an error mode and / or the network device can announce the detected error over the network.If no sequence of data bits or octets marking the start of a transmission cycle was detected in step 1307 (“no” branch of step 1304), a check is made in step 1308 as to whether the timeout counter for the current TO time window has expired. If this is not the case (“no” branch of step 1308), while the shared communication medium is unused, i.e., idle, reception or waiting continues until a data bit marking the start of a transmission or a sequence of data bits or octets marking the start of a transmission has been detected (i.e., whether the network device has started transmitting), until the timeout counter has expired.

[0090] If the timeout counter for the current TO time slot has expired, "yes" branch of step 1308, the counter for the TO time slots not used by network devices is incremented in step 1309 and the method continues with step 1308.

[0091] All data bits or octets received in the meantime, including the sequences of data bits or octets indicating the beginning or end of a transmission, are counted by step 1301, which runs parallel to the checks of the received data bits or octets. The number of data bits or octets that could have been sent by a network device between the beginning of the TO time window and the beginning of the transmission is either added to the number of data bits or octets sent over the shared communication medium at this point, or later when checking the integrity of the communication.

[0092] Data bits or octets intended for the network device executing the procedure are forwarded to higher protocol layers (not shown in the figure).

[0093] The amount of data sent by a network device that is currently authorized to access the shared communication medium or determined for this network device using the method described above is added to the amount of data that has already been sent by other network devices or determined for them during the current transmission cycle.

[0094] Figure 15 shows an exemplary flowchart of the steps for determining the duration of a transmission cycle and for checking the integrity of the communication for a transmission cycle. In step 120, the time elapsed between the receipt of a sequence of data bits or octets indicating the beginning of a transmission cycle and the receipt of a sequence of data bits or octets indicating the end of a transmission cycle is calculated. As previously mentioned, the end of a transmission cycle can also be signaled by the beginning of a subsequent transmission cycle. For the calculation, a timer can be used, for example, which is started at the beginning of a transmission cycle and stopped at the end of a transmission cycle. It is also possible to write a system time to a memory at the beginning and end of a transmission cycle and to calculate the duration of the transmission cycle from this.Other methods familiar to the person skilled in the art for determining the duration of the transmission cycle are conceivable and will not be explained in detail here.

[0095] Subsequently, in step 140, the expected data volume within the transmission cycle is calculated. This can be done, for example, based on the duration of the transmission cycle and the nominal data rate of the shared communication medium.

[0096] In step 150, the amount of data transmitted during the transmission cycle via the jointly used communication medium, as determined in step 130 which runs parallel to the determination of the duration of the transmission cycle, is compared with the expected amount of data calculated in step 140. If the data bits or octets that can theoretically be transmitted during an unused TO time window were not already taken into account when determining the transmitted data bits or octets, these are determined in step 1399 by multiplying the number of network devices that have not transmitted by the number of data bits or octets that can theoretically be transmitted during a TO time window and added to the data bits or octets actually received. If the comparison shows that the amount of data expected within the transmission cycle exceeds the amount of data actually sent, if applicable.within a specified tolerance window, "yes" branch of step 150, the integrity of the communication during the checked transmission cycle is given, and the method can be repeated for the subsequent transmission cycle. If the comparison shows that more or fewer data bits or octets were transmitted within the transmission cycle than theoretically could have been transmitted, "no" branch of step 150, the integrity of the communication via the shared communication medium is not given and the network device executing the method can go into error mode and / or forward the result of the check to other network devices. Depending on whether more or fewer data bits or octets were transmitted than expected, the network device can go into different error operating modes.The possible error modes may include using a different method for accessing the shared communication medium, e.g. CSMA / CD, enhanced logging of communications over the shared communication medium, placing the system in safe mode, sending one or more messages to a remote system, or the like.

[0097] Figure 16 shows an exemplary block diagram of a network device 400 configured to execute one or more aspects of the method according to the invention. In addition to a microprocessor 402, the network device 400 includes volatile and non-volatile memory 404, 406, and a communications interface 408. The elements of the network device are communicatively connected to one another via one or more data connections or buses 410. The non-volatile memory 406 contains computer program instructions which, when executed by the microprocessor 402, configure the network device to execute at least one embodiment of the method according to the invention.

[0098] LIST OF REFERENCE SYMBOLS

[0099] 10 System 400 network devices

[0100] 12 Network device 402 Microprocessor

[0101] 12a Connection box 404 volatile memory

[0102] 14 Network device 406 non-volatile memory

[0103] 14a Connection box 408 communication interface

[0104] 16 network devices / switches 410 data connections / buses

[0105] 16a junction box

[0106] 18 Network Device 1100 Listening

[0107] 18a Connection box 1101 - 1104 Procedure steps “listening in”

[0108] 20 network devices

[0109] 20a Connection box 1300 determine the amount of data sent

[0110] 22 Coaxial cable 1301 - 1307 Process steps

[0111] 24 Communication medium / wire pair “determine the amount of data sent”

[0112] 100 Procedure 1399 Correction of unsent data bits

[0113] 110 Listening or Octets

[0114] 120 Determine transmission cycle duration

[0115] 130 Determine the amount of data sent

[0116] 140 Calculate expected data volume

[0117] 150 Check integrity

[0118] 111-115 Procedural steps “listening in

Claims

CLAIMS 1 . A method (100) for monitoring the integrity of communication between a plurality of network devices (12, 14, 16, 18, 20) connected via a shared communication medium (24), each of which can send a message via the shared communication medium (24) within a transmission cycle initiated by a first network device, comprising: - Listening (110) to at least certain parts of the communication on the communication medium within a transmission cycle, wherein the listening (110) comprises at least the detection and / or evaluation of data bits or sequences of data bits or octets which characterise the beginning and the end of the transmission cycle, wherein the listening also comprises the detection and / or evaluation of a transmission option not used by a network device within a transmission cycle, the method being characterised by the steps: - determining (120) the duration of a transmission cycle, - determining (130) a data volume transmitted within the transmission cycle or a data rate achieved for the transmission cycle, - calculating (140) an amount of data expected within the transmission cycle, - comparing (150) the determined and the expected data volume or the determined data rate with a nominal data rate of the communication medium, wherein, if the determined and the expected data volume or the determined and the nominal data rate agree within a predetermined tolerance range, the method is executed again for a subsequent transmission cycle and otherwise at least one network device executing the method goes into an error mode.

2. The method (100) according to claim 1, wherein determining (130) the amount of data or the data rate transmitted within a transmission cycle comprises counting all data bits or octets transmitted via the communication medium (24) within a transmission cycle, optionally including those transmitted by a network device itself carrying out the method.

3. The method (100) according to claim 1, wherein determining (130) the amount of data or the data rate transmitted within a transmission cycle comprises detecting the start and end of a transmission of a network device, wherein the amount of data sent by a respective network device is calculated by multiplying the time period between the start and end of the transmission by the nominal data rate of the shared communication medium, and wherein the calculated data amounts of all network devices that have transmitted during a transmission cycle are summed up.

4. The method (100) according to claim 1, wherein determining (130) the amount of data or the data rate transmitted within a transmission cycle comprises evaluating information contained in transmissions of a transmission cycle about the number of data bits or octets transmitted in the respective transmission, optionally including those transmitted by a network device itself carrying out the method.

5. The method (100) according to any one of the preceding claims, wherein determining a data volume or data rate transmitted within a transmission cycle comprises replacing a period of time of a TO time window that has elapsed before the start of a transmission or an opportunity for transmission not used by a network device by the number of data bits or octets that can be transmitted during the elapsed period or the duration of a TO time window.

6. The method (100) of any preceding claim, wherein calculating an amount of data expected within a transmission cycle comprises multiplying the cycle duration by the nominal data rate of the communication medium.

7. A network device (400) configured for communication via a communication medium (24) shared by a plurality of network devices, comprising at least one processor (402), volatile (404) and non-volatile (406) memory, and a network interface (408), wherein computer program instructions are stored in the non-volatile memory (406) in a retrievable manner, which, when executed by the at least one processor, cause the network device (400) to execute a method for monitoring the integrity of the communication according to one of the preceding claims 1 to 6.

8. System, in particular a vehicle system, with two or more network devices networked via a communication medium shared by several network devices, wherein at least one of the network devices is a network device according to claim 7.

9. A computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to one or more of claims 1 to 6.

10. A computer-readable medium on which the computer program product according to claim 9 is stored.

Images