Subscriber station for serial bus system and communication method in serial bus system

Abstract

A subscriber station (10; 20; 30) of a serial bus system (1) and a communication method in the serial bus system (1) are provided, the subscriber station (10; 20; 30) comprising a communication control device (11; 21; 31) for controlling communication between the subscriber station (10; 20; 30) and at least one other subscriber station (10; 20; 30) of the bus system (1) and for generating a transmission signal (TxD) according to a frame (450), a receiving device (12; 22; 32) configured to serially receive at least one signal (CAN_H, CAN_L; VDIFF) from the bus (40), and a frame (450; 450_1) that the receiving device (12; 22; 32) generates from the at least one signal (CAN_H, CAN_L; VDIFF) received from the bus system (1), and and a manipulation check module (15; 25; 35) for checking whether at least one predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) has at least one pulse (DP) having a second bit value opposite to the predetermined first bit value in received bits having a predetermined first bit value and a predetermined duration (t_bt1; t_bt2), wherein the manipulation check module (15; 25; 35) is further configured to discard the received frame (450; 450_1_1, 450_1_2) after the presence of the at least one pulse (DP) having the second bit value opposite to the predetermined first bit value.

Description

[Technical Field]

[0001] The present invention relates to a subscriber station of a serial bus system and a communication method in a serial bus system, which operates at a high data rate, with high flexibility and high error robustness. In the operation of higher-level technology devices, it is necessary to prevent unauthorized manipulation. [Background technology]

[0002] Bus systems for communication between sensors and control units, for example in vehicles, must be able to transmit large amounts of data to ensure as many functions as possible of the technical devices and vehicles. In many cases, it is necessary to transmit data quickly from transmitter to receiver. Furthermore, it is also necessary to be able to transmit large data packets if necessary.

[0003] Currently, bus systems in which data is exchanged between bus subscribers as messages and encoded with the CAN protocol specification CAN FD for transmission on the bus as frames according to the ISO 11898-1:2015 standard are already in use in many series vehicles. Messages are thus exchanged between bus subscribers of the bus system, such as sensors, control units, and encoders, and are transmitted on the bus as frames. Many manufacturers are using CAN FD for the first time in vehicles, with a data bit rate of 2 Mbit / s and an arbitration bit rate of 500 kbit / s.

[0004] Alternatively, CAN XL, the successor bus system to CAN FD, can also be used. CAN XL allows even higher data rates than CAN FD. Furthermore, it allows longer messages than CAN FD. This makes CAN XL particularly suitable for applications that, in addition to the pure data transfer provided by the CAN bus, also support other functions such as functional safety (safety), data security and quality of service (QoS). These are fundamental properties required, for example, for autonomous vehicles.

[0005] CAN XL, CAN FD, and classical CAN are compatible, and CAN XL has at least the same error robustness as CAN FD and classical CAN. In each of the above CAN versions, the data field of the frame of a message to be transmitted over the bus may contain any value.

[0006] A problem can arise if the manipulator embeds a second valid CAN frame (attack frame) in the data field of a valid frame (carrier frame).

[0007] The problem here is that both CAN FD and CAN XL can transmit messages of different lengths, i.e., with different numbers of bytes in the data field. For this reason, the number of bytes in the data field is specified in the DLC field, which precedes the data field of the message. Electromagnetic interference can cause the receiver to recognize a value in one of the four bits of the DLC field of the CAN FD frame, particularly the most significant bit, that differs from the value corresponding to the code representing the actual length of the data field of the carrier frame. If this error is not recognized by the transmitter, it will not interrupt the transmission of the carrier frame. Therefore, instead of one valid CAN frame, the receiver recognizes and receives two valid CAN frames: a valid but shortened carrier frame and an attack frame.

[0008] This allows attack frames to manipulate the receiver, in particular to tamper with the normal operation of the device, which can lead to undesirable consequences and potentially pose a security risk to higher-level technical devices. Summary of the Invention [Problem to be solved by the invention]

[0009] It is therefore an object of the present invention to provide a subscriber station of a serial bus system and a communication method in a serial bus system that solves the above problems, in particular, a subscriber station of a serial bus system and a communication method in a serial bus system that provide security against manipulation in order to achieve a secure operation of the bus system and / or higher-level technical devices, even with high data rates, arbitrary values in data fields, and arbitrary amounts of data used per frame, in addition to high error robustness of the communication. [Means for solving the problem]

[0010] This problem is solved by a subscriber station of a serial bus system with the features of claim 1. The subscriber station comprises a communication control device for controlling communication between the subscriber station and at least one other subscriber station of the bus system and for generating a transmission signal according to a frame, a receiving device configured to serially receive at least one signal from the bus, and a tamper check module for checking whether at least one predetermined field of a frame created by the receiving device from the at least one signal received from the bus system and thus received by the receiving device has at least one pulse with a second bit value opposite to the predetermined first bit value in a received bit having a predetermined first bit value and a predetermined duration, wherein the tamper check module is further configured to discard the received frame after the presence of at least one pulse with a second bit value opposite to the predetermined first bit value.

[0011] The subscriber station (node) described above is configured to check frames received from the bus for manipulation, even if the subscriber station is the receiving node and therefore was not the sender of the frame received from the bus. Depending on the results of the check, it can react appropriately, in particular discarding the frame to prevent manipulation by the subscriber station. In particular, a valid frame will not be erroneously decoded as two valid frames.

[0012] As a result, a subscriber station infected with malware cannot transmit undetected frames that could disrupt the operation of the bus system or higher-level devices and / or cause further damage, thereby improving the security of the bus system.

[0013] As a result, even if the amount of data used per frame increases, subscriber stations can reliably send and receive frames with high functional safety, great flexibility with regard to current events in the operation of the bus system, and low error rates.

[0014] The method executed by the subscriber station can also be used if the bus system comprises at least one CAN subscriber station and / or at least one CAN FD subscriber station and / or at least one CAN XL subscriber station transmitting messages according to the CAN protocol and / or the CAN FD protocol and / or the CAN XL protocol.

[0015] Advantageous further configurations of the subscriber station are set forth in the dependent claims. The tamper checking module may be configured to perform a check of at least one predetermined field of the received frame in addition to comparing the received frame with a valid frame format for the bus system.

[0016] In some cases, the tamper checking module may be configured to discard the received frame after the number of at least one pulse having a second bit value opposite to the predetermined first bit value exceeds a predetermined upper limit.

[0017] For example, the tamper checking module is configured to check whether at least one dominant pulse occurs in a received recessive bit having a duration shorter than the received recessive bit.

[0018] In one embodiment, the tamper checking module is configured to check whether at least one dominant pulse occurs in a bit string of at least two received recessive bits, each having a duration, the dominant pulse having a duration shorter than the received recessive bits.

[0019] It is conceivable that the tamper checking module comprises a first counter for counting the number of falling edges occurring from the start of a predetermined field of a received frame to the end of the predetermined field of the received frame.

[0020] Optionally, the tamper checking module has a second counter having inverted bit values for counting the number of time quanta occurring from the start of a predetermined field of the received frame to the end of the predetermined field of the received frame.

[0021] In one form, the tamper checking module includes a second counter having an inverted bit value for counting a predetermined number of consecutive time quanta occurring from the start of a predetermined field of the received frame to the end of the predetermined field of the received frame.

[0022] The tamper checking module may optionally comprise a first evaluation block having a first counter and / or a second counter. The first evaluation block may be the bit timing logic of the communications controller.

[0023] The tamper checking module may optionally have a second evaluation block for evaluating whether the frame should be discarded, the second evaluation block being configured to exchange signals with the first evaluation block for evaluating predetermined fields of the received frame.

[0024] The second evaluation block may be a bitstream processor of the communication controller. At least one predetermined field of the received frame may include at least one of the following fields or bits: an acknowledgement spacer bit (ACK delimiter) in the acknowledgement field of the received frame following the acknowledgement bit (ACK slot), an end field of the received frame, and an error delimiter of the error frame.

[0025] According to one option, the tamper checking module, when incorporated into communications on the bus, is configured to perform a check for dominant pulses to detect a predetermined static state on the bus having a predetermined number of bits with the same value that cannot otherwise occur in communications on the bus.

[0026] In some cases, the communication control device for serially generating a transmission signal for transmission to the bus is configured so that the bit time of the signal transmitted to the bus in the first communication phase and the bit time of the signal transmitted in the second communication phase are different relative to the frame.

[0027] In a first communication phase, it can be negotiated which of the subscriber stations of the bus system will, at least temporarily, obtain exclusive, collision-free access to the bus in a subsequent second communication phase.

[0028] The subscriber station described above may be part of a bus system including a bus and at least two subscriber stations connected via the bus so as to be able to serially communicate with each other, where at least one of the at least two subscriber stations is the subscriber station described above.

[0029] The above-mentioned object is further achieved by a method for communication in a serial bus system as set forth in claim 18. The method is executed in a subscriber station of the bus system having a communication control device, a receiving device and a tamper check module, the method comprising the steps of: controlling communication between the subscriber station and at least one other subscriber station of the bus system by the communication control device, the communication control device being configured to generate a transmission signal according to a frame; serially receiving at least one signal from the bus of the bus system by the receiving device; and checking whether at least one predetermined field of the frame created and thus received by the receiving device from the at least one signal received from the bus has at least one pulse having a second bit value opposite to the predetermined first bit value in a received bit having a predetermined first bit value and a predetermined duration; the tamper check module being further configured to discard the received frame after the presence of at least one pulse having a second bit value opposite to the predetermined first bit value.

[0030] This method offers the same advantages as those described above for subscriber stations. Other possible implementations of the invention include not explicitly mentioned combinations of the features or embodiments described above or below with respect to the examples, and those skilled in the art will add individual aspects as improvements or supplements to each basic form of the invention. [Brief explanation of the drawings]

[0031] The invention will now be explained in more detail on the basis of examples with reference to the accompanying drawings. [Figure 1] 1 is a simplified block diagram of a bus system according to a first embodiment. [Figure 2] 3 shows the structure of a message that can be transmitted by a subscriber station of the bus system according to the first embodiment; FIG. [Figure 3] 1 is a simplified schematic block diagram of a subscriber station of a bus system according to a first embodiment; [Figure 4] FIG. 3 is a diagram showing the time characteristics of bus signals CAN_H and CAN_L in the subscriber station according to the first embodiment. [Figure 5] FIG. 10 is a diagram showing the time characteristics of the differential voltage VDIFF between bus signals CAN-XL_H and CAN-XL_L in the subscriber station according to the first embodiment. [Figure 6] 5 shows a diagram of the division of bits into time quanta of a frame created by a subscriber station according to a first embodiment and transmitted with the bus signal of FIG. 4 over a bus of the bus system; [Figure 7] 3 is a diagram showing an example of a portion of a received signal RxD that a subscriber station in the bus system according to the first embodiment generates over time from a signal of a frame received from the bus. FIG. [Figure 8] 8 is a diagram showing the time characteristics of the count value Z1 obtained by the first counter of the subscriber station according to the first embodiment, based on the received signal of FIG. 7. FIG. [Figure 9] 8 is a diagram showing the time characteristics of the count value Z2 obtained by the second counter of the subscriber station according to the first embodiment, based on the received signal of FIG. 7. FIG.

[0032] In the figures, identical or functionally identical elements are designated by the same reference numbers unless otherwise stated. DETAILED DESCRIPTION OF THE INVENTION

[0033] 1 shows an example of a bus system 1, which is constructed in particular based on a CAN bus system, a CAN FD bus system, a CAN XL bus system and / or variants thereof as described below. The bus system 1 can be used in vehicles, in particular automobiles, aircraft, etc., or in hospitals, etc.

[0034] In FIG. 1, a bus system 1 includes multiple subscriber stations 10, 20, and 30, each coupled to a bus 40 having a first bus wire 41 and a second bus wire 42. The bus wires 41 and 42, also referred to as CAN_H and CAN_L or CAN-XL_H and CAN-XL_L, are used for electrical signal transmission after introducing a dominant level or generating a recessive or other level for the transmitted signal. Messages 45 and 46 in the form of signals can be serially transmitted between the individual subscriber stations 10, 20, and 30 via the bus 40. As indicated by the jagged black block arrow in FIG. 1, an error frame 47 (error flag) may optionally be transmitted if an error occurs during communication on the bus 40. The subscriber stations 10, 20, and 30 may be, for example, automobile control devices, sensors, or displays.

[0035] As shown in Figure 1, subscriber station 10 includes a communications controller 11, a transceiver 12, and a tamper-checking module 15. Subscriber station 20 includes a communications controller 21, a transceiver 22, and optionally a tamper-checking module 25. Subscriber station 30 includes a communications controller 31, a transceiver 32, and a tamper-checking module 35. The transceivers 12, 22, and 32 of subscriber stations 10, 20, and 30 are each directly coupled to a bus 40, not shown in Figure 1. Each of the transceivers 12, 22, and 32 may optionally be configured as a separate transmitter and a separate receiver.

[0036] Each of the communication controllers 11, 21, 31 is used to control the communication of a respective subscriber station 10, 20, 30 over the bus 40 with at least one other of the subscriber stations 10, 20, 30 coupled to the bus 40.

[0037] The communication control devices 11, 31 create and read a first message 45, e.g., a modified CAN message 45, based on the CAN FD format, which will be described in more detail in connection with FIG. 2, using the respective tampering modules 15, 35. The communication control devices 11, 31 may also create and read another modified CAN message 46, e.g., based on the CAN XL format, which is a further development of and compatible with CAN FD. The CAN FD message 45 can contain a number of data bytes between 0 and 64, which are transmitted at a significantly higher data rate than classical CAN messages. The CAN XL message 46 can contain a number between 0 and, in particular, approximately 2 kbytes, or any other value, which are transmitted at a significantly higher data rate than the CAN FD message 45.

[0038] Thus, the communication control device 11, 31 is configured to provide or receive, as appropriate, a CAN FD message 45 or a CAN XL message 46 to or from the transceiver device 12, 32. That is, the communication control device 11, 31 creates and reads a first message 45 or a second message 46, the first message 45 and the second message 46 differing in data transmission standard, i.e., in this case CAN FD or CAN XL.

[0039] The communication control device 21 may be configured like a conventional CAN controller in accordance with ISO 11898-1:2015, i.e., like a CAN FD-tolerant classical CAN controller or a CAN FD controller. The communication control device 21 creates and reads a first message 45, for example a CAN FD message 45. In particular, the communication control device 21 is configured like a conventional CAN FD controller.

[0040] The transceiver 22 may be configured as a conventional CAN transceiver or as a CAN FD transceiver in accordance with ISO 11898-1:2015. The transceiver 12, 32 may be configured to receive or provide messages 45 according to the CAN FD format or messages 46 according to the CAN XL format from the associated communication control device 11, 31, as appropriate.

[0041] The two subscriber stations 10, 30 are capable of generating and subsequently transmitting messages 46 in CAN XL format and receiving such messages 45. 2 shows a CAN FD frame 450 for a message 45 that is encoded by the communication controller 11 over time t and provided to the transceiver 12 for transmission to the bus 40. Here, the communication controller 11 creates a frame 450 that is compatible with both classical CAN and a later version of CAN FD, such as CAN XL, in this embodiment, as also shown in FIG. 2. The same is true for the communication controller 31 and transceiver 32 of the subscriber station 30.

[0042] 2, a CAN FD frame 450 for CAN communication on bus 40 is divided into different communication phases 451, 452: an arbitration phase 451 and a data phase 452. Frame 450 has an arbitration field 453, a control field 454, a data field 455, a checksum field 456 for a checksum CRC, an acknowledgement field 457, and an end field 458. The bit duration of the bits in arbitration phase 451 is longer than the bit duration of the bits in data phase 452. The physical layer is the same for frame 450 in arbitration phase 451 and data phase 452, as in classical CAN. The physical layer corresponds to the bit transmission layer or layer 1 of the known OSI model (Open Systems Interconnection Model).

[0043] The start of a frame 450 is indicated by a bit SOF (Start of Frame). Next, for example, at least one of the subscriber stations 10, 30 transmits an identifier (ID) in an arbitration field 453. Based on this, in an arbitration phase 451, using bits ID28 to ID18 of the identifier (ID) in the arbitration field 453, the subscriber stations 10, 20, 30 negotiate bit by bit which subscriber station 10, 20, 30 currently wishes to transmit a message 45, 46 with the highest priority and thus obtains exclusive access to the bus 40 of the bus system 1 for the next transmission time in the subsequent data phase 452. At the end of the arbitration field 453, a bit RRS is transmitted.

[0044] An important point during phase 451 is that the known CSMA / CR scheme is used, which allows simultaneous access of subscriber stations 10, 20, 30 to the bus 40 without corrupting high priority messages 45, 46. This allows further bus subscriber stations 10, 20, 30 to be added to the bus system 1 relatively easily, which is a great advantage.

[0045] The CSMA / CR method requires a so-called recessive state on the bus 40, which can be overwritten by other subscriber stations 10, 20, 30 with a dominant state on the bus 40. In the recessive state, a high-resistance situation prevails at a single subscriber station 10, 20, 30, which, in combination with the parasitics of the bus wires, results in a relatively long time constant. This therefore limits the maximum bit rate of current CAN-FD physical layers (FD transceivers compliant with ISO 11898-2:2016) to approximately 2 Mbit / s in practical vehicle use. CAN XL can further increase this maximum bit rate by additionally switching the physical layer, particularly in the data phase 452.

[0046] 2, in addition to a portion of the control field 454, the usage data of the CAN FD frame 450, or the message 45 from the data field 455, and almost the entire checksum field 456 are transmitted. The control field 454 has control bits IDE, FDF, res, BRS, and ESI, and four bits from bit 3 to bit 0 of the DLC field. The checksum field 456 has an SBC field, a field for the checksum CRC, and a CRC delimiter bit.

[0047] Once the subscriber station 10 as transmitter wins the arbitration and the subscriber station 10 as transmitter has exclusive access to the bus 40 of the bus system 1 for transmission, the transmitter of the message 45 begins transmitting the bits of the data phase 452 onto the bus 40.

[0048] In general, a bus system using CAN XL can achieve the following different characteristics compared to CAN or CAN FD: a) Adopting and possibly adapting the proven properties of CAN and CAN FD that contribute to their robustness and ease of use, in particular the frame structure with identifiers and the arbitration method using CSMA / CR; b) increasing the net data transmission rate, in particular to about 10 megabits per second; c) Increasing the data size used per frame, particularly to about 2 kbytes or any other value.

[0049] 2, the subscriber station 10 uses the format known from CAN / CAN-FD according to ISO 11898-1:2015, particularly up to and including the FDF bit, in the arbitration phase 451 as the first communication phase. For CAN XL messages 46, the subscriber station 10 uses the CAN XL format from the FDF bit onwards in the data phase 452, which is the first and second communication phase.

[0050] In this embodiment, CAN XL and CAN FD are compatible. For CAN XL, the res bit, also called the XLF bit in CAN XL, known from CAN FD according to FIG. 2, is used to switch from the CAN FD format to the CAN XL format. The frame formats of CAN FD and CAN XL are therefore identical up to the res bit or the XLF bit. The receiver detects the format in which the frame 450 is transmitted via the res bit or the XLF bit. The CAN XL subscriber stations, i.e., here the subscriber stations 10, 30, also support CAN FD.

[0051] As an alternative to the frame 450 shown in Fig. 2, in which an 11-bit identifier (bit ID28 to bit ID18) is used according to the CAN FD base frame format, an extended frame format for CAN FD or CAN XL is optionally possible in which a 29-bit identifier is used, which is identical to the known CAN FD extended frame format according to ISO11898-1:2015 up to the FDF bit.

[0052] In frame 450 according to Fig. 2, bits with a fixed value, i.e., 0 or 1, are marked with a thick black line. Bits with a thick lower line in Fig. 2 are transmitted as dominant or "0" in frame 450. Bits with a thick upper line in Fig. 2 are transmitted as recessive or "1" in frame 450. In the CAN XL data phase 452, symmetric "1" and "0" levels may be used instead of recessive and dominant levels when using special CAN SIC XL transceivers.

[0053] Generally, two different stuffing rules are applied when generating CAN XL frames. The CAN FD dynamic bit stuffing rule applies up to the res bit in the control field 454, so a reverse stuff bit must be inserted after five consecutive equal bits. Such a stuff bit is also called a dynamic stuff bit. After the res bit in the control field 454, a fixed stuffing rule applies for CAN XL frames, so a fixed stuff bit must be inserted after a fixed number of bits. Alternatively, instead of one stuff bit, two or more bits may be inserted as fixed stuff bits.

[0054] In frame 450 of Figure 2, the res bit, which corresponds in position to the "XLF bit" in the CAN XL format, immediately follows the FDF bit as described above. If the res bit is transmitted as 1, i.e., recessive, then frame 450 is detected as a CAN XL frame. For a CAN FD frame, the communication control device 11 sets the res bit to 0, i.e., dominant.

[0055] Following the res bit, the BRS bit is set in frame 450 where the bit duration of the arbitration phase 451 is switched to the bit duration of the data phase 452 .

[0056] The BRS bit is followed by a DLC field, in which a data length code (DLC) is inserted, specifying the number of bytes in the data field 455 of the frame 450. The DLC can take values from 0 to the maximum length of the data field 455 or the data field length. Because the maximum data field length in CAN FD is 64 bytes, the DLC is four bits long, from bit 3 to bit 0. DLC=0 means the data field length is 0 bytes, and DLC=15 means the data field length is 64 bytes. This ensures that the receiver of the frame 450 correctly receives the data and reliably detects the end of the frame 450 in fields 456, 457, and 458. Furthermore, to maximize the data rate of the bus system 1, the bus 40 should be reenabled as soon as possible to transmit another frame 450 or message 45, 46. That is, the frame 450 does not block the bus 40 any longer than necessary.

[0057] In frame 450 of Figure 2, the DLC field is followed by a data field 455. The data field 455 consists of 0 to 64 data bytes. The length of the data field 455 is encoded in the DLC field as described above.

[0058] The data field 455 is followed in frame 450 by an SBC field consisting of bits SBC3 to SBC0 and a checksum CRC. The checksum CRC is either CRC21 or CRC17, so the checksum CRC consists of bits 20 to 0 or bits 16 to 0. The length of the checksum CRC, i.e., the length of the CRC polynomial, must be selected depending on the desired Hamming distance. The checksum CRC protects the entire frame. By or starting from the CRC delimiter bit in checksum field 456, the duration of the bits in frame 450 is switched from the duration of the data phase 452 to the duration of the arbitration phase 451, as shown in FIG. 2, in other words, from a short duration to a long duration.

[0059] The CRC delimiter bits, and therefore the checksum field 456, are followed in the frame 450 by an acknowledgement field 457, which includes an ACK slot bit to acknowledge correct reception of the frame 450. If the receiving subscriber station 10, 30 correctly receives the frame 450, it transmits the ACK slot bit as dominant. The transmitting subscriber station transmits the ACK slot bit as recessive. Thus, bits originally transmitted onto the bus 40 in the frame 450 can be overwritten by the receiving subscriber station 10, 30. The ACK delimiter bit is transmitted as a recessive bit used to separate it from the other fields.

[0060] The acknowledgement field (ACK field) 457 is followed by an end of frame field 458 (EOF = End of Frame). The bit sequence bits 1 to 7 of the end field 458 (EOF) are used to indicate the end of the frame 450. The end field (EOF), together with the ACK delimiter bit, results in eight recessive bits being transmitted at the end of the frame 450, a bit sequence that cannot occur within the frame 450. This ensures that the subscriber station 10, 20, 30 can detect the end of the frame 450.

[0061] The end field (EOF) is followed within frame 450 by an intermission field (INT), which is not shown in Figure 2 but is shown only in Figure 8. The intermission field (INT) has a minimum length of 3 bits in CAN. This intermission field INT is configured in accordance with ISO 11898-1:2015 for both CAN XL and CAN FD.

[0062] Figure 3 shows the basic structure of a subscriber station 10, including its communications controller 11, transceiver 12, and a tamper checking module 15 that is part of the communications controller 11 within the subscriber station 10. A subscriber station 30 is configured similarly to that shown in Figure 3, except that the tamper checking module 35 according to Figure 1 is located separately from the communications controller 31 and transceiver 32. Therefore, the subscriber station 30 will not be described separately.

[0063] 3, the subscriber station 10 includes, in addition to the communication controller 11 and the transceiver 12, a microcontroller 13 to which the communication controller 11 is assigned, and a system ASIC 16 (ASIC = application-specific integrated circuit), which may alternatively be a system base chip (SBC) combining several functions required for the electronic module of the subscriber station 10. In addition to the transceiver 12, a power supply 17 is integrated into the system ASIC 16, which supplies power to the transceiver 12. The power supply 17 typically provides a voltage CAN_Supply of 5V. However, the power supply 17 may provide a voltage of a different value if necessary. Additionally or alternatively, the power supply 17 may be configured as a power supply.

[0064] Transmit signals TxD are exchanged between the communication control device 11 and the transceiver device 12 via their respective terminals TXD, and receive signals RxD are exchanged via terminal RXD, as described above and below.

[0065] 3 includes a first evaluation block 151 and a second evaluation block 152. The first evaluation block 151 includes a first counter 1511 and a second counter 1512. The second evaluation block 152 includes a configuration register 1525.

[0066] The first evaluation block 151 generates sampling points SP (FIG. 6) of the signals CAN_H, CAN_L received from the bus 40 and outputs the associated signal S1 to the second evaluation block 152. Furthermore, the first evaluation block 151 calculates a bit value BW of the received signal RxD and outputs it to the second evaluation block 152. The first evaluation block 151 may be or be part of the bit timing logic (BTL = Bit Timing Logic) of the communication control device 11. The bit timing logic (BTL = Bit Timing Logic) is a state machine that is evaluated once per time quantum and synchronized with the bit stream at the terminal RXD of the device 11. FIG. 6 shows eight bits consisting of time quanta TQ1 to TQ8 as an example. The bit timing logic (BTL = Bit Timing Logic) also generates the sampling points SP. Parameters 152A, 152B are stored in a register 1525 and are used by the first evaluation block 151 for their evaluation, as will be described later.

[0067] The second evaluation block 152 outputs a signal S2 to the first evaluation block 151. The second evaluation block 152 may be or be part of a bit stream processor (BSP = Bit Stream Processor) of the communication control device 11. The bit stream processor (BSP = Bit Stream Processor) is a state machine that is evaluated once per CAN bit time, i.e., either during a bit duration t_bt1 in the arbitration phase 451 or during a bit duration t_bt2 in the data phase 452. The bit stream processor (BSP = Bit Stream Processor) encodes and / or decodes the CAN bit stream at the terminals TXD and RXD according to the rules of the CAN protocol.

[0068] The second evaluation block 152, in particular the Bit Stream Processor (BSP = Bit Stream Processor), informs the first evaluation block 151, in particular the Bit Timing Logic (BTL = Bit Timing Logic) by means of a signal S2 that the first evaluation block 151 should additionally evaluate the received signal RxD. The signal S2 is also called the "field to be evaluated additionally" signal. As soon as the signal S2 ("field to be evaluated additionally") becomes inactive, the first evaluation block 151 resets the counters 1511, 1512, in particular their counter values, to zero.

[0069] The functionality of the tamper checking module 15 is described in more detail below. Furthermore, the transceiver 12 comprises a transmitting module 121 and a receiving module 122. Although the following always refers to the transceiver 12, it is alternatively possible for the receiving module 122 to be provided in a separate device external to the transmitting module 121. The transmitting module 121 and the receiving module 122 can be configured similarly to a conventional transceiver 22. The transmitting module 121 may in particular comprise at least one operational amplifier and / or transistor. The receiving module 122 may in particular comprise at least one operational amplifier and / or transistor.

[0070] The transceiver 12 is connected to a bus 40, specifically to a first bus wire 41 for the CAN_H or CAN-XL_H bus and a second bus wire 42 for the CAN_L or CAN-XL_L bus. The power supply 17 for supplying power, in particular a voltage CAN_Supply, to the first and second bus wires 41, 42 is provided via at least one terminal 43. A connection to earth or CAN_GND is provided via a terminal 44. The first and second bus wires 41, 42 are terminated by a termination resistor 49.

[0071] In the transceiver device 12, the first and second bus wires 41, 42 are connected not only to a transmitting module 121, also called a transmitter, but also to a receiving module 122, also called a receiver, even though the connections are not shown in FIG. 3 for simplicity.

[0072] During operation of the bus system 1, the transmitting module 121 converts a transmission signal TxD from the communication control device 11 into signals CAN_H and CAN_L corresponding to the bus wires 41 and 42, and transmits these signals to the bus 40 at the terminals for CAN_H and CAN_L. A differential signal VDIFF=CAN_H−CAN_L shown in FIG. 5 is formed on the bus 40.

[0073] The receiver module 122 of Fig. 3 forms a receive signal RxD from the signals CAN_H and CAN_L received from the bus 40 according to Fig. 4 or from the differential signal VDIFF according to Fig. 5. As shown in Fig. 3, the receiver module 122 transfers the receive signal RxD to the terminal RXD of the communication control device 11 via the terminal RXD of the transceiver device 12.

[0074] Except in an idle or standby state, a transceiver 12 having a receive module 122 always listens for transmissions of data or messages 45, 46 on the bus 40 during normal operation, regardless of whether the transceiver 12 is the sender of the message 45 or message 46.

[0075] According to the example of FIG. 4, signals CAN_H and CAN_L have dominant and recessive bus levels 401, 402, as known from CAN, at least during arbitration phase 451. Individual bits of signal VDIFF, having bit time t_bt1, can be detected by receiver module 122, having a receive threshold T_a of, for example, 0.7 V, during arbitration phase 451, as shown in FIG. 5. During data phase 452, as already explained with reference to FIG. 2, the bits of signals CAN_H and CAN_L are transmitted faster, i.e., with a shorter bit time t_bt2 (FIG. 7), than during arbitration phase 451. Thus, signals CAN_H and CAN_L of FIG. 4 during data phase 452 differ from conventional signals CAN_H and CAN_L during arbitration phase 451 by a faster bit rate. If the signals CAN_H and CAN_L of the CAN XL in the data phase 452 are further generated on different physical layers, the receiving module 122 also switches the receiving threshold, for example, to a receiving threshold T_d of about 0.0V in the data phase 452.

[0076] The sequence of states 401, 402 of signals CAN_H, CAN_L in Figure 4 and the resulting progression of voltage VDIFF in Figure 5 are used only to explain the function of subscriber station 10. The sequence of data states in bus states 401, 402 can be selected as desired.

[0077] In other words, in the first operating mode according to Fig. 4, the transmitting module 121 of Fig. 3 generates a first data state as a bus state 402 with different bus levels for the two bus wires 41, 42 of the bus line, and generates a second data state as a bus state 401 with the same bus level for the two bus wires 41, 42 of the bus line of the bus 40. Furthermore, in the second operating mode including a data phase 452, the transmitting module 121 of Fig. 3 transmits bits at a higher bit rate over time for the signals CAN_H, CAN_L on the bus 40. As mentioned above, the signal of the CAN XL message 46 in the data phase 452 may further be generated on a different physical layer than CAN FD. This allows the bit rate in the data phase 452 to be even higher than in the case of CAN FD.

[0078] The tamper check module 15 of FIG. 3, and in particular its evaluation block 151, is used to evaluate whether a dominant pulse occurs in the currently received frame 450. Tamper checks are useful for detecting and preventing certain attacks, in which a malware-infected subscriber station, e.g., subscriber station 30, transmits message 45 with specially selected content in data field 452. If only one receiving node, e.g., subscriber station 10, recognizes a bit error in the DLC field of frame 450, particularly in bit 3 of the DLC field, the receiving node may be tricked into thinking that frame 450 has a shorter frame length than it actually does. The tamper check module 15 of FIG. 3 is particularly needed when receiving frame 450 to detect a tampered frame 450.

[0079] For evaluation, the tamper checking module 15 proceeds as described below with reference to FIGS. FIG. 6 illustrates the division of the received signal RxD generated by the subscriber station 10, 20, 30 into time quanta TQ1 through TQ8 (Time-Quanta) for the bits, as applied by the associated communication controller 11, 21, 31. The time quanta TQ1, ..., TQ8 correspond to the time units at which the communication controller 11, 21, 31 samples the received signal RxD. For clarity, FIG. 6 does not include all of the time quanta TQ2 through TQ7, which are located over the time t between time quanta TQ1 and TQ8. The bits are sampled to evaluate a bit value of 1 or 0 at a sampling point SP, which is typically located at approximately 75% of the bit duration t_bt1. The bit in FIG. 6 samples a bit value of "1." The location of the sampling point SP for the bit can be configured as one of parameters 152A, 152B in register 1525 and stored in register 1525.

[0080] 6 is a bit having a bit duration t_bt1 used in the arbitration phase 451. The number of time quanta TQ1, ..., TQ8 is determined by the first evaluation block 151. In particular, the number of time quanta TQ1, ..., TQ8 of one bit is limited by the specifications of the CAN standard and is freely selectable. That is, the first evaluation block 151 performs a division into time quanta, e.g., time quanta TQ1, ..., TQ8. The number of time quanta TQ1, ..., TQ8 of the bits can be configured as one of the parameters 152A, 152B and stored in the register 1525.

[0081] 6 for the bits of the arbitration phase 451 also applies to the bits of the data phase 452 having a bit duration t_bt2. The bit durations t_bt1, t_bt2 may be configured as one of the parameters 152A, 152B and stored in a register 1525.

[0082] 7 shows a portion of the receive signal RxD generated by the communication control device 11 from the signals CAN_H, CAN_L, or VDIFF received from the bus 40 for a frame 450. Fig. 7 shows the receive signal RxD or the RxD signal in a data field 455 of a frame 450 with special content that can be used for a safety-related attack (security attack). In this data field, an early end of the frame 450 is spoofed. Fig. 7 shows the spoofed end using bits of the second communication phase 452, more precisely, the end after the CRC delimiter bit at the end of the data field 455.

[0083] 7 shows the evaluation result of the currently received frame 450 (carrier frame). First, the frame 450 is evaluated as a first frame 450_1 having a beginning portion 450_1_1 and an ending portion 450_1_2, but the data field 455 of the currently received frame 450 (carrier frame) is actually still being transmitted via the bus 40. The reason for the early end of the frame 450 is predicted due to a bit error in the DLC field bit, which will be described in detail later. That is, the communication control device 11 first receives the ACK bit (ACK slot) and the end field 458 (EOF) of the actual data field 455 of the currently received frame 450 (carrier frame) from the data field 455, and evaluates them as the ending portion 450_1_2 of the currently received frame 450 (carrier frame).

[0084] The reason for the predicted early termination is that the receiving communication control device 11 has confirmed a bit error in the DLC field, particularly bit 3 of the DLC field. For example, the DLC field of the currently received frame 450 (carrier frame) had a value of 0xF before being tampered with due to the bit error, which indicates a data field 455 with a length of 7 bytes (DLC field = 0x7) due to the bit error, but the currently received frame 450 (carrier frame) actually has a data field 455 with a length of 64 bytes. In other words, the communication control device 11 mistakenly predicts a data field 455 with a length of only 7 bytes. Furthermore, the currently received frame 450 (carrier frame) according to FIG. 7 includes a bit string from the 8th byte onwards of the data field 455 corresponding to a valid checksum CRC, followed by an emulated ACK field 457 having bits for the ACK slot and ACK delimiter, an emulated end field 458 having EOF bits 1 to 7 (see FIG. 2), an emulated inter-frame distance (INT1, intermission), and an emulated bit string for the arbitration phase 451 of the subsequent frame 450.

[0085] Due to the dynamic CAN bit stuffing mechanism, the currently received frame 450 (carrier frame) in the CAN FD data field 455 cannot represent recessive levels or bit values long enough to accurately emulate, for example, the 8 recessive bits of the ACK delimiter and EOF field 458. Since the bit values depend only on the value of the signal RxD at the sample point, the communication control device 11 can filter short dominant pulses DP in the signals CAN_H, CAN_L or VDIFF received from the bus 40.

[0086] In general, the receiving module 122 may provide at least one pulse having a second bit value opposite to the predetermined first bit value in a received bit having a predetermined duration t_bt1, t_bt2.

[0087] The occurrence of a dominant pulse DP in a recessive bit or the occurrence of a recessive pulse in a dominant bit can be detected using module 15, in particular counters 1511, 1512 whose count values Z1, Z2 are shown in Figures 8 and 9 for frame 450 of Figure 7. Here, both the first counter 1511, which may also be called a "falling edge" meter, and the second counter 1512, which may also be called a "dominant time quantum" meter, are able to detect dominant pulses DP and thus count them.

[0088] For example, the device 11, and in particular the tamper checking module 15, uses a first counter 1511 to count the number of falling edges of the RxD signal, i.e., the transition of the RxD signal from a bit value 1 (recessive) to a bit value 0 (dominant), and / or the number of time quanta TQ of the RxD signal that are seen as a bit value 0 (dominant).

[0089] If the first evaluation block 151, in particular the bit timing logic (BTL = Bit Timing Logic), detects the number of falling edges or dominant pulses DP configured as the upper limit N of the number of falling edges or dominant pulses DP, the block 151 reports a dominant received bit (bit value 0) at the next sampling point SP (FIG. 6) to the second evaluation block 152, regardless of what the first evaluation block 151 actually sampled at that sampling point SP (FIG. 6). In this case, the second evaluation block 152 sees a format error in the currently received frame 450. The upper limit N of the number of falling edges or dominant pulses DP can be configured in one of the parameters 152A, 152B and stored in the register 1525.

[0090] In other words, if the number of edges and / or the number of time quanta TQ seen as bit value 0 (dominant) of the RxD signal exceeds a previously selected limit, the device 11, and in particular the tamper checking module 15, treats this as a format error. Due to the format error, the currently received frame 450 is evaluated or classified as invalid by the subscriber station 10 (receiver). As a result, the subscriber station 10 (receiver) rejects the frame 450.

[0091] As shown in Figure 8, a counter reading of, for example, N=2 or counter value Z1 of counter 1511 causes end field 458 (EOF) to be classified as invalid (format error). In the examples of Figures 7-9, this causes reception to be interrupted, and subscriber station 10 (receiving node) will not receive the subsequent second frame (attack CAN frame). Instead, subscriber station 10 (receiving node) will initiate error frame 47 (error frame). Therefore, the currently received frame 450 (carrier frame with the second frame integrated) prevents the attack.

[0092] The device 11, in particular the tamper checking module 15, evaluates at least one predetermined field or bit, in particular the ACK delimiter bit and / or field 458 (EOF) and / or the error delimiter field (which is part of the error frame 47), for the received CAN frame 450 using the evaluation block 1511 and / or the counters 1511, 1512. The predetermined field or bit can be configured as one of the parameters 152A, 152B and stored in the register 1525.

[0093] For example, the device 11, and in particular the tamper checking module 15, may proceed for this purpose as follows: If the first evaluation block 151 detects a synchronization edge corresponding to a falling edge of the RxD signal in one of the above-mentioned fields to be evaluated of the CAN frame 450, it reports this as a dominant sampled bit at the next sampling point SP (sampling point, FIG. 6) via the signal S1, BW to the second evaluation block 152.

[0094] The second evaluation block 152 uses the signals S1, BW to carry out a comparison with the CAN format of the frame according to FIG. 2, thereby detecting a format error in the currently received frame 450.

[0095] In this way, a bit error in one of the bits of the DLC field of frame 450 can be reliably detected in case of a frame padding attack, which makes it possible in a very simple way to avoid manipulation in which a valid frame 450 (carrier frame) contains another valid frame 450, but the receiving subscriber station detects not just one frame 450 (carrier frame), but two valid frames 450.

[0096] According to the second embodiment, the device 11, in particular the manipulation check module 15, proceeds as follows: for example, at least one counter 1511, 1512 of the first evaluation block 151 counts a train or sequence of N consecutive time quantities TQ instead of individual time quantities TQ. N thus defines the resolution, i.e., the width of the dominant pulse DP from which the counters 1511, 1512 count. N may be any natural number. In particular, N may be a number between 1 and 500 in this embodiment.

[0097] In particular, N=3 is selected so that the count value Z1 of the counter 1511 is changed, in particular incremented or decremented, only if, for example, three time quanta TQ with dominant bit values occur consecutively.

[0098] In the second embodiment, robustness against short dominant pulses DP can be achieved. Furthermore, the above-mentioned attack can be avoided by using a valid frame 450 (carrier frame) in which a valid CAN frame is embedded. This is because the transmitter of the valid frame 450 (carrier frame) is configured to emulate the embedded attack CAN frame only with a resolution of the bit time t_bt2 of the data phase 452 bits. It is also possible to accidentally transmit a frame 450 (carrier frame) whose data field 455 happens to contain a bit sequence that looks like the embedded attack CAN frame (attack CAN frame). In this way, the check by the manipulation check module 15, 25, 35 protects against intentional (attack) and unintentional transmission of a carrier frame.

[0099] Otherwise, the modules 15, 25, 35 are configured in the same manner as described above for the first embodiment. According to a third embodiment, the manipulation check module 15 has only one counter, namely either the first counter 1511 or the second counter 1512. In this case, the value N=1 is selected as the upper limit of the counter value Z1 or Z2, at which the manipulation check module 15 determines that the currently received frame 450 has a format error and is therefore to be discarded. In this case, the first evaluation block 151 reports a dominant bit already after one synchronization edge.

[0100] The choice of N=1 is very advantageous because it requires implementing only one counter that counts the number of synchronization edges (falling edges) or the number of consecutive dominant time quanta TQ1 to TQ8. Furthermore, a counter that counts only from 0 to 1 is very simple and cost-effective to implement.

[0101] Otherwise, the modules 15, 35 are configured in the same manner as described above for the first embodiment. According to a fourth embodiment, the device 11, in particular the tamper checking module 15, is configured to additionally use the evaluation of the currently received frame 450 as described above when reintegrating the subscriber station 10 into ongoing communication on the bus 40. Such reintegration is necessary when the subscriber station 10 is restarted or when it is woken up again after hibernation. In the case of CAN XL communication in a special mode in which the error signal is switched off by the subscriber station configuration, reintegration occurs every time a reception error is detected.

[0102] In this case, device 11, and in particular tamper check module 15, uses blocks 151, 152 to evaluate whether 11 consecutive recessive bits are detected on CAN bus 40. If such a bit sequence is detected, device 11, and in particular tamper check module 15, evaluates this as a quiescent state ("idle") of the bus. Therefore, bus 40 is free and device 11 can start transmitting messages 45, 46 onto bus 40 itself.

[0103] In this way, the ongoing operation of the bus system 1 and higher-level technical devices is not disturbed. The function of preventing manipulation of at least part of the bus system 1 can thus also be used to contribute to an increase in the data rate within the bus system. Unexpected disturbances and / or degradation of performance data of the bus system 1 can thus be realized very simply and efficiently.

[0104] Otherwise, modules 15, 35 are configured similarly to those described above for the first or second embodiment. According to a fifth embodiment, at least one of the subscriber stations 10, 30 is configured to generate and transmit over the bus 40 a frame 450 as a result of the detected tampering, and to notify the other subscriber stations 10, 20, 30 that a frame 450 already transmitted or a previously transmitted frame 450 over the bus 40 has been detected as tampered with.

[0105] All embodiments of the subscriber stations 10, 20, 30, the bus system 1 and the methods implemented therein described above can be used individually or in all possible combinations. In particular, all features of the embodiments described above and / or variations thereof can be combined in any way. Additionally or alternatively, the following variations are particularly contemplated:

[0106] Although the invention has been described above using the example of a CAN bus system, the invention can be used in any communication network and / or method in which two different communication phases are used, with different bus states being generated for the different communication phases. In particular, the invention can be used in the development of other serial communication networks such as Ethernet and / or 10BASE-T1S Ethernet, fieldbus systems, etc.

[0107] In particular, the bus system 1 according to the embodiment may be a communications network capable of serially transmitting data at two different bit rates. Advantageously, but not necessarily, the bus system 1 guarantees exclusive and collision-free access to the common channel for the subscriber stations 10, 20, 30, at least for a certain period of time.

[0108] The number and arrangement of subscriber stations 10, 20, 30 in the bus system 1 of the embodiment is arbitrary. In particular, subscriber station 20 in the bus system 1 can be omitted. It is also possible that there are more than one subscriber station 10 or 30 in the bus system 1. It is also possible that all subscriber stations in the bus system 1 are configured identically, i.e., there are only subscriber stations 10 or only subscriber stations 30.

Claims

1. A subscriber station (10; 20; 30) of a serial bus system (1), comprising: a communication control device (11; 21; 31) for controlling communication between said subscriber station (10; 20; 30) and at least one other subscriber station (10; 20; 30) of said bus system (1) and for generating a transmission signal (TxD) according to a frame (450); a receiving device (12; 22; 32) configured to serially receive at least one signal (CAN_H, CAN_L; VDIFF) from said bus (40); a manipulation check module (15; 25; 35) for checking whether at least one predetermined field (457, 458) of a frame (450; 450_1_1, 450_1_2) created and thus received by the receiving device (12; 22; 32) from the at least one signal (CAN_H, CAN_L; VDIFF) received from the bus system (1) contains, in a received bit having a predetermined first bit value and a predetermined duration (t_bt1; t_bt2), at least one pulse (DP) having a second bit value opposite to the predetermined first bit value, the tamper checking module (15; 25; 35) is further configured to discard the received frame (450; 450_1_1, 450_1_2) after the presence of the at least one pulse (DP) having the second bit value opposite to the predetermined first bit value, Subscriber station.

2. 2. The subscriber station (10; 20; 30) of claim 1, wherein the tamper checking module (15; 25; 35) is configured to perform a check of the at least one predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) in addition to comparing the received frame (450; 450_1_1, 450_1_2) with a frame format valid for the bus system (1).

3. 3. The subscriber station (10; 20; 30) of claim 1 or 2, wherein the tamper checking module (15; 25; 35) is configured to discard the received frame (450; 450_1_1, 450_1_2) after the number of the at least one pulse (DP) having the second bit value opposite to the predetermined first bit value exceeds a predetermined upper limit (N).

4. 4. The subscriber station (10; 20; 30) according to claim 1, wherein the tamper checking module (15; 25; 35) is configured to check whether in a received recessive bit having a duration (t_bt1; t_bt2) there occurs at least one dominant pulse (DP) having a duration shorter than the received recessive bit.

5. 5. The subscriber station (10; 20; 30) according to claim 1, wherein the tamper checking module (15; 25; 35) is configured to check whether at least one dominant pulse (DP) occurs in a bit sequence of at least two received recessive bits, each having a duration (t_bt1; t_bt2), having a duration shorter than the received recessive bits.

6. 6. The subscriber station (10; 20; 30) according to claim 1, wherein the manipulation check module (15; 25; 35) comprises a first counter (1511) for counting the number of falling edges occurring from the start of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) to the end of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

7. 7. The subscriber station (10; 20; 30) of claim 1, wherein the manipulation check module (15; 25; 35) comprises a second counter (1512) for counting the number of time quanta (TQ) having inverted bit values and occurring from the start of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) to the end of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

8. 8. The subscriber station (10; 20; 30) of claim 1, wherein the manipulation check module (15; 25; 35) comprises a second counter (1512) for counting a predetermined number of consecutive time quanta (TQ) having inverted bit values and occurring from the start of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) to the end of the predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2).

9. The subscriber station (10; 20; 30) according to any one of claims 6 to 8, wherein the manipulation check module (15; 25; 35) comprises a first evaluation block (151) comprising the first counter (1511) and / or the second counter (1512).

10. 10. The subscriber station (10; 20; 30) of claim 9, wherein the first evaluation block (151) is a bit timing logic of the communication controller (11).

11. the tamper-checking module (15; 25; 35) has a second evaluation block (152) for evaluating whether the frame (450; 450_1_1) should be discarded, 11. The subscriber station (10; 20; 30) of claim 9 or 10, wherein the second evaluation block (152) is configured to exchange signals (S1, S2, BW) with the first evaluation block (151) to evaluate the predetermined fields (457, 458) of the received frame (450; 450_1_1, 450_1_2).

12. 12. The subscriber station (10; 20; 30) of claim 11, wherein the second evaluation block (152) is a bitstream processor of the communication control unit (11).

13. 13. The subscriber station (10; 20; 30) according to claim 1, wherein the at least one predetermined field (457, 458) of the received frame (450; 450_1_1, 450_1_2) comprises at least one of the following fields or bits: an acknowledgement spacer bit (ACK delimiter) in an acknowledgement field (457) of the received frame (450; 450_1_1, 450_1_2) following an acknowledgement bit (ACK slot), an end field (458) of the received frame (450; 450_1_1, 450_1_2), and an error delimiter of the error frame (47).

14. 14. The subscriber station (10; 20; 30) of any one of claims 1 to 13, wherein the tamper checking module (15; 25; 35), when incorporated into communications on the bus (40), is configured to perform the check for a dominant pulse (DP) to detect a predetermined quiescent state on the bus (40) having a predetermined number of bits with the same value that cannot otherwise occur in communications on the bus (40).

15. 15. The subscriber station (10; 20; 30) according to any one of claims 1 to 14, wherein the communication control device (11; 21; 31) for serially generating the transmission signals (TxD) for transmission to the bus (40) is configured such that a bit time (t_bt1) of the signal transmitted to the bus (40) in a first communication phase (451) and a bit time (t_bt2) of the signal transmitted in a second communication phase (452) are different with respect to the frame (450).

16. A subscriber station (10; 20; 30) according to any one of claims 1 to 15, wherein in a first communication phase (451) it is negotiated which of the subscriber stations (10; 20; 30) of the bus system (1) will obtain, at least temporarily, exclusive and conflict-free access to the bus (40) in a subsequent second communication phase (452).

17. Bus (40) and at least two subscriber stations (10; 20; 30) connected via said bus (40) so as to be able to serially communicate with each other, at least one of which is a subscriber station (10; 20; 30) according to any one of claims 1 to 16; A bus system (1) having:

18. A method for communication in a serial bus system (1), the method being carried out in a subscriber station (10; 20; 30) of said bus system (1) comprising a communication control device (11; 21; 31), a receiving device (12; 22; 32) and a tamper checking module (15; 25; 35), The method comprises: - controlling, by said communication control device (11; 21; 31), communication between said subscriber station (10; 20; 30) and at least one other subscriber station (10; 20; 30) of said bus system (1), said communication control device (11; 21; 31) being configured to generate a transmission signal (TxD) according to a frame (450); - said receiving device (12; 22; 32) serially receiving at least one signal (CAN_H, CAN_L; VDIFF) from said bus (40) of said bus system (1); checking whether at least one predetermined field (457, 458) of a frame (450; 450_1_1, 450_1_2) created and thus received by the receiving device (12; 22; 32) from the at least one signal (CAN_H, CAN_L; VDIFF) received from the bus (40) contains, in a received bit having a predetermined first bit value and a predetermined duration (t_bt1; t_bt2), at least one pulse (DP) having a second bit value opposite to the predetermined first bit value, the tamper checking module (15; 25; 35) is further configured to discard the received frame (450; 450_1_1, 450_1_2) after the presence of the at least one pulse (DP) having the second bit value opposite to the predetermined first bit value, method.

Images