Generation of substitute data for use in case of negative verification in automobiles

Abstract

The present invention relates to a system arrangement which generates substitute data that can be used if transmitted data is negatively verified, i.e. if it is detected as faulty. According to the invention, data is replicated, redundantly transmitted, and appropriately encoded at particularly suitable points. In the special combination of features, various safety mechanisms are integrated and linked synergistically in such a way that particularly secure data transmission in automobiles is ensured. The present invention specifically addresses safety requirements and hardware conditions, which are not met, for example, in packet-switched communication. The encoding allows the receiver to detect whether a data integrity error has occurred or whether data has been transmitted incorrectly or not at all. If this is detected, the receiver can rely on the redundantly transmitted data, and the data transmission as a whole is not impaired. The present invention is also directed to a correspondingly designed method that makes it possible to provide and operate the system arrangement. The invention also relates to a computer program product comprising control commands that execute the method or provide or operate the system arrangement.

Description

[0001] Generation of replacement data for use in case of negative verification in the automobile

[0002] The present invention is directed to a system arrangement which generates substitute data which can be used if transmitted data is negatively verified, i.e. if it is identified as being faulty. According to the invention, data is replicated and transmitted redundantly at a particularly suitable location and is encoded accordingly. In the special combination of features, various security mechanisms are integrated and synergistically linked in such a way that particularly secure data transmission in the automobile is guaranteed. The present invention specifically addresses the security requirements and hardware conditions in this area, which is not the case, for example, with packet-switched communication. The encoding makes it possible for the receiver to detect that there may be an error regarding the data integrity or that data was transmitted incorrectly or not at all.If this is detected, the redundantly transmitted data can be accessed at the receiver end, and the data transmission is not impaired overall. The present invention is further directed to a correspondingly configured method that enables the system arrangement to be provided or operated. Furthermore, a computer program product is proposed, with control commands that execute the method or provide or operate the system arrangement.

[0003] Typically, there is no packet-switched data transmission in automobiles. Instead, components are permanently wired or hard-coded, meaning there is no dynamic switching of packets; instead, sequential or serial data communication can be carried out. In automobiles, particularly strict requirements apply to data integrity, and it must be ensured at all times that transmitted data is received completely and correctly by the receiver. Safety functions are typically implemented in automobiles that must be particularly fail-safe and reliable. Another requirement in automobiles is that technical effort must be kept as low as possible and that weight must be saved. In electromobility in particular, increased energy consumption affects the range, which must be avoided at all costs.Furthermore, conventional packet-switched transmission technologies cannot be used in automobiles, as they often do not meet latency requirements or require too much effort for dynamic, packet-switched transmission. This effort includes, among other things, providing components that select a dynamic data path, which is not necessary in automobiles.

[0004] State-of-the-art technology recognizes a layered model as a hierarchical organizational structure. It is used to divide complex systems into manageable layers or levels, with each layer having specific tasks and responsibilities. These layers work together to enable the overall functionality of the system. A state-of-the-art example of a layered model is the OSI (Open Systems Interconnection) model, used in packet-switched networking technology. It consists of seven layers, with each layer performing specific tasks related to communication between computers and devices. The layers range from the physical connection layer to the application layer, with each layer building on the services of the layer below it.

[0005] It is known from the state of the art to transmit data that is potentially transmitted with errors redundantly. This redundancy also creates replacement data, although the disadvantage of this state of the art is that it is possible for the data to be corrupted before it is replicated. In this way, replacement data is created that is redundant but still contains errors. This has the disadvantage of requiring a great deal of technical effort, which consists in having to replicate the data and thus creating a corresponding network load without providing any added value. Thus, conventional methods do not take the underlying architecture or application domain into account and it is wrongly assumed that the data is correct, even though the redundant data is also faulty.In this way, a supposedly reliable method is created in the state of the art, which, however, still delivers incorrect data.

[0006] Data integrity generally refers to the accuracy, reliability, and consistency of data in an information system or database. It ensures that data remains accurate during storage, transmission, and processing and is not accidentally or maliciously altered. Ensuring data integrity is critical to ensuring that information is trustworthy and useful, especially in safety-critical applications such as automotive.

[0007] Forward error correction (FEC) is also known from the prior art. Forward error correction (FEC) is a method of error correction that adds additional redundancy information to the data. This redundancy allows the receiver to detect and correct errors without having to retransmit the packet. FEC is often used in high-speed Ethernet connections such as 10 Gigabit Ethernet (10GbE) to ensure data integrity.

[0008] Error correction mechanisms play a crucial role in ensuring reliable data transmission in networks. They help detect, isolate, and correct transmission errors to ensure data integrity is maintained. Especially in mission-critical environments where large amounts of data are transmitted, error correction mechanisms are essential to maintaining connection quality.

[0009] Furthermore, it is generally known from the state of the art that data transmission over a serial data channel is typically error-prone. To address this problem, various coding techniques are used, such as line coding. This is also referred to as line coding.

[0010] The prior art recognizes the problem of faulty data transmission over a serial communications link and provides for the line-coded data to be provided with forward error correction. The prior art therefore addresses the problem of error correction by providing line-coded data with a non-line-coded addition, namely forward error correction, which in turn is not line-coded. Thus, the prior art has the problem that even if line coding is provided, individual metadata is transmitted unencoded, and thus the advantages of line coding cannot be utilized for all transmitted data. This, in turn, represents a source of errors. The prior art partially overcomes this problem by separately line-coding the forward error correction data and then transmitting it.This creates additional overhead, and in order to protect the line-coded forward error correction data, a new forward error correction would have to be calculated. This, in turn, creates additional overhead and also creates a non-line-coded forward error correction.

[0011] In general, the state of the art is characterized by the problem that it does not adequately analyze where in a system configuration or at which position in a process data can be replicated and transmitted most effectively. Thus, the state of the art does not provide reliable methods that ensure data integrity, even with redundant data transmission. Furthermore, the state of the art is disadvantageous in that a great deal of technical effort is required for data replication and transmission. What is desirable here is a method or system configuration that operates particularly efficiently, or at the hardware level.

[0012] Furthermore, prior art methods that transmit data in a packet-based manner are not applicable, as these are based on completely different network architectures that must ensure dynamic packet switching. Thus, prior art methods require different security mechanisms, such as sequential or serial data transmission.

[0013] It is therefore an object of the present invention to provide a system arrangement for providing replacement data, specifically in an automobile. The system arrangement should be designed to be particularly efficient yet error-robust. Likewise, it is an object of the present invention to provide a correspondingly configured method or a computer program product with control commands that implement the method or provide or operate the system arrangement.

[0014] The problem is solved by the features of patent claim 1. Further advantageous embodiments are specified in the subclaims.

[0015] Accordingly, a system arrangement for generating replacement data in the event of negative verification of data to be transmitted during serial data transmission in an automobile is proposed, comprising a physical application device configured to package application data into cells of a predefined cell format, wherein the application data is received by means of a first number of input interfaces of the application device and is redundantly output to a cell multiplexing device by means of a multiple of the first number of redundant output interfaces of the application device, and wherein further application data is received by means of a second number of input interfaces of the application device and the second number of non-redundant output interfaces of the application device are output to a cell multiplexing device;and the cell multiplexing device comprising, for each output interface of the application device, a receiving interface configured to receive the application data packed in cells, wherein the cell multiplexing device is configured to forward the application data packed in cells to a data transmission device which provides the application data with forward error corrections.;

[0016] According to the invention, substitute data is generated at the sender's end and serves to utilize transmitted data in the event of a faulty transmission or coding errors. Thus, substitute data is the data used when transmitted data cannot be correctly received by the receiver. The receiver can verify the received data, i.e., check its correctness, and if the verification or check is negative, the substitute data can be used. Thus, the substitute data not only serves to verify the correctness of the actual data, but also to verify it, either additionally or alternatively, through forward error correction. If the actual data was transmitted correctly, the substitute data can be discarded.If a positive verification or check is carried out using forward error correction, the replacement data is deleted or no longer taken into account.

[0017] Due to serial data transmission, according to one aspect of the present invention, it is not possible for individual data packets to overtake others. This can occur, for example, with packet-oriented transmission, where data is resent, for example, after a predetermined time period has elapsed. Thus, according to the invention, it is not necessary to add further information about the sequence of the data packets. Serial data transmission takes place via a wired medium, for example, electrically or via fiber optics.

[0018] Thus, the proposed invention is particularly preferably used in automobiles, since the fastest possible yet error-free data transmission is necessary here. The invention thus makes it possible to provide the proposed system arrangement as a single unit, meaning that all components are hard-wired together and cannot be separated without causing damage. This represents an advantage over the prior art, and thus, known methods of packet-switched transmission or internet technology cannot be used.

[0019] The system arrangement comprises a physical application device that receives data from signal sources at the application level. Such a signal source can be, for example, an imaging device that, according to one aspect of the present invention, is connected to the application device via HDMI and / or DisplayPort. Thus, the application device can have multiple inputs or interfaces. Potentially safety-critical data is provided here, which must be securely transmitted to a receiver.

[0020] According to one aspect of the present invention, the application data is packaged in cells according to a predefined cell format. This means that the data can be recoded, or the data remains unchanged and only further information is appended. For example, the data format or cell format can provide for header data to be added to the data, which, for example, describes a virtual path. Even if the proposed system arrangement is hard-wired, it is still possible for the existing data paths to be switched dynamically, for which purpose a path table must be provided. However, the order of the devices passing through is always the same. Different virtual paths can simply be addressed on the existing physical paths, without the order of the devices having to be changed in the flow chart.

[0021] According to the invention, different input interfaces are provided in the application device. For example, a first port serves as an input interface, and a second port also serves as an input interface. It is possible for the first input interfaces to provide particularly safety-critical information, which is then forwarded to a plurality of output interfaces. Within the application device, the data received at the input interface is thus replicated and output at the output interfaces at a multiple of the number of input interfaces.

[0022] The multiple in the number in the ratio between the number of input interfaces and the number of output interfaces refers to a factor with which the number of output interfaces is available in relation to the number of input interfaces. For example, if one input interface is provided, a multiple of this can mean that two or, in another example, three output interfaces are available. If there are two input interfaces, this can be three or six output interfaces in one example. This ensures that the amount of data is replicated in the same ratio as the output interfaces. The multiple should be interpreted in such a way that at least two can be considered a multiple. In this case, whole numbers do not necessarily have to be present as multiples. For example, a number of two input interfaces can also result in three output interfaces.The typical case is that there is one input interface and two output interfaces. Thus, the minimum factor of two refers to the number of one input interface. However, if there are two input interfaces, a factor of 1.5 can also apply. The only important thing here is that the number of input interfaces does not correspond to the number of output interfaces, and that, logically, only whole numbers of input interfaces and output interfaces are present.

[0023] The application device receives data packets or application data, and this data is implicitly replicated through the number of output interfaces. This ensures the efficient generation of redundant replacement data without requiring significant computational effort. The hardware interconnection of the application device alone ensures that the data is forwarded redundantly. This circuit is therefore particularly robust and less prone to errors, as no separate logic needs to be implemented.

[0024] The data is redundantly output to a cell demultiplexing device, which then receives the packaged or encoded data. This device has the same number of receive interfaces as the application device has output interfaces. Communication between these two devices can take place via a communication medium such as a data line or at least a contact. This data channel can also be configured in such a way that virtual communication paths can be established on it.

[0025] In addition, further application data is received via a second number of input interfaces of the application device. This data may be data that is not safety-critical and therefore does not need to be transmitted redundantly. This data can also be encoded according to the cell format, and forward error correction can also be added to this data. This data is simply passed through the application device and is not forwarded redundantly. Thus, there is an equal number of output interfaces for these input interfaces. This can be one interface, or, for example, two, three, or four interfaces. This data is also output to the cell multiplexing device, but without replication.

[0026] In general, the application data can be modified or processed in the application device. Therefore, it is still referred to as application data here and is encoded in cells according to the specified cell format. Furthermore, it is also possible for additional data to be added to the application data. This not only corresponds to framework data, such as header data, but also allows additional user data to be added to this application data. Thus, this data is still present as application data, but has been edited and / or expanded or reduced.

[0027] According to the invention, it is particularly advantageous that the data replication takes place between the application device and the cell multiplex device. Thus, the invention recognized that data replication must occur particularly early in the processing chain, since at this point the data is most likely still uncorrupted. This creates the advantage over the prior art that unnecessary intermediate processing steps are not performed, and the data is only backed up or replicated subsequently. The proposed invention is based on a three-layer model, unlike conventional layer models, which are configured with seven levels. Thus, conventional layer models are not applicable, particularly since these layer models are used in packet-switched data transmission.While the prior art generally involves data replication, the invention synergistically combines replication with error correction, and the special position within the devices creates the special technical effect that the system arrangement as a whole is very error-robust, since the data is replicated right at the beginning of the processing process.

[0028] According to one aspect of the present invention, the output interfaces and / or the input interfaces are each present as physical interfaces. This has the advantage that the input interfaces can be implemented as conventional ports, and the physical design of input interfaces and output interfaces makes it possible for the application data to be replicated without computer-implemented or dynamic logic. Thus, it is not necessary to provide a processor that replicates the data; rather, the application device can be interconnected in such a way that it replicates the data based on the interconnection alone. This creates an error-robust approach that prevents the data from being corrupted. Furthermore, advantages arise in terms of processing time and the technical complexity of providing the proposed system arrangement.

[0029] According to one approach of the present invention, the application data is sent from the application device to the cell multiplexing device and / or from the cell multiplexing device to a data transmission device via virtual communication paths. This has the advantage that the physical communication channels can be optimally utilized, and various virtual channels can be set up via a single physical channel and also controlled separately. This makes it possible to optimize the virtual paths, for example, with regard to bandwidth utilization. Furthermore, the proposed system arrangement is particularly hardware-efficient, since a separate physical channel does not have to be created for each channel.

[0030] According to a further aspect of the present invention, the cell format provides frame data and / or at least one source identifier of a virtual path for data transmission. This has the advantage that the virtual channel via which data is to be sent can be specified in the cell format, which can be done, for example, using a channel identifier. Additionally or alternatively, it is also possible to specify a source identifier, which indicates the interface from which the data originated, making it possible to trace back what the data originally was. Furthermore, it is possible for the source identifier to define an interface and thus indicate which path is to be selected starting from the source. The paths can also be virtual channels or paths, or else a physical path.For example, the virtual paths can be numbered consecutively, thus assigning each path an identifier or numerical value. Furthermore, forward error corrections can also be stored in the framework data.

[0031] According to a further aspect of the present invention, the cell format provides a numerical value that identifies a virtual path for data transmission. This has the advantage that the virtual path can be identified using a simple method, and the application device can already determine which virtual path is to be selected. According to a further aspect of the present invention, a maximum of 128 virtual paths for data transmission can be set up between the application device and the cell multiplex device. This has the advantage that virtual paths can be identified based on a byte, and moreover, it has been empirically determined that 128 virtual paths are sufficient, especially in automobiles. In this way, efficient identification of the virtual paths is possible.

[0032] According to a further aspect of the present invention, the data transmission device is coupled to a data reception device, which is configured to receive the application data and is further configured to check each forward error correction. If the forward error correction check fails, the faulty application data is replaced with redundantly transmitted application data. This has the advantage that the data reception device can check the correctness of the data transmission, since all data or application data and / or cells are provided with forward error correction.Thus, with redundant application data, a first unit of application data can be verified using the forward error correction code, i.e., checked for authenticity. If forward error correction detects that the data is incorrect, the substitute data, i.e., a unit of second, redundantly transmitted application data, can be used. This second application data is also provided with forward error correction, so that it can also be determined whether the data was transmitted correctly.

[0033] According to a further aspect of the present invention, the data receiving device comprises a cell demultiplexing device, which forwards application data from the cells to an application device of the data receiving device using virtual paths. This has the advantage that an application device is also provided on the receiving side, which corresponds to the application device on the transmitting side, and thus the two application devices can communicate with each other. For example, the transmitting device of the receiving device can be configured analogously, and thus the received data passes through the same devices as on the transmitting side.Here, too, it is advantageous to check the data as late as possible, since this is transmitted together with the forward error correction to the application device on the receiver side. This makes it possible to carry over the forward error correction until the end of the processing and to detect any errors. According to a further aspect of the present invention, each cell is encoded with forward error correction. This has the advantage that all data is provided with forward error correction, making it possible not only to detect corresponding errors, but also to correct them. If this is not possible on the receiver side, the invention provides substitute data, which can then also be checked for correctness and can then replace the actual data. This ensures that error-free data is always transmitted, and this can also be verified.

[0034] According to a further aspect of the present invention, the redundant application data is transmitted between the data transmission device and a data reception device via separate communication media. This has the advantage that errors in the communication media, such as cables, can also be detected and corrected. If one communication medium is defective, another communication medium is always available, and the replacement data can be sent via this. This also ensures error robustness in the transmission path.

[0035] According to a further aspect of the present invention, the application device, the cell multiplexing device, and / or the data transmission device are physically configured. This has the advantage of creating a particularly efficient hardware structure that is both error-robust and high-performance. This is particularly advantageous in automobiles.

[0036] According to a further aspect of the present invention, the multiple of the first number of redundant output interfaces is exactly two. This has the advantage that the data is always transmitted in duplicate, and even with a single instance of application data, two instances of application data are present, with one instance corresponding to the actual data and the second instance representing the substitute data.

[0037] In this case, data transmission is secured using a combination of multiple mechanisms that work together synergistically. The data to be transmitted is provided with forward error correction, which enables the receiver to determine whether the data was received correctly, or the forward error correction allows the receiver to correct the data. If data verification is negative, substitute data is used, which is also provided with forward error correction. This also allows the integrity of this data to be checked, and if the first data cannot be used, this substitute data is used. Furthermore, it is particularly advantageous according to the invention for the first data to be sent via a first transmission medium and the second data via a second, different communication medium.This ensures that the data is always available at the same time, which distinguishes the present invention from a packet-switched approach, and also ensures that a correct and functional transmission channel is selected.

[0038] If the data is received incorrectly at the receiver end and cannot be corrected using forward error correction, this may be due to various steps in the transmission process. The invention ensures that, in the event of a defective transmission medium, further data is provided via a different, separate transmission medium. This avoids errors that not only relate to data processing, but also, in particular, ensures that at least one functional transmission medium is available. The process only terminates if both transmission media are faulty. However, this case is atypical, and failures or impairments of the transmission medium typically only occur temporarily.This ensures that in the event of an error, which is actually detected due to the forward error correction, a redundant transmission channel is available to transmit replacement data.

[0039] According to the invention, multiple protection is proposed, whereby the data is redundantly encoded and the individual security mechanisms interact synergistically such that the forward error correction can also be used to select a redundant transmission channel or a redundant transmission medium. If the receiver detects that the first data is faulty, the second data transmission medium ensures that replacement data is available, which can then also be verified using forward error correction. The combination of these features creates the advantage over the prior art of creating a robust method or a robust system arrangement that can be provided with little technical effort. Furthermore, the present invention offers the possibility of implementing the security mechanisms purely on a hardware basis.Data replication can be achieved by having a connection on the transmitter side that automatically duplicates or replicates the data. This can be achieved particularly advantageously by simply connecting input interfaces to output interfaces. Thus, according to the invention, it is possible to have a larger number of output interfaces than input interfaces. This eliminates the need to replicate the data using calculation steps; instead, this mechanism can be implemented on the hardware side, making it particularly error-robust and fail-safe.

[0040] According to the invention, a transmitting device is provided that receives first data units and second data units and forwards them. For this purpose, the first transmitted data is replicated in such a way that a first instance of these data units is created and a second, identical instance of these first data units. The second data units are data units that are not to be transmitted redundantly. Thus, according to the invention, a distinction can be made between particularly security-critical data units, namely the first data units, and data units with a normal security requirement. These can then be forwarded without replication, i.e., non-redundantly.

[0041] The data units themselves can be forwarded or encoded and, in particular, can be divided into any desired segments. These can be individual cells. A forward error correction is calculated for the data units, which enables the data receiver to use this forward error correction to check the accuracy of the received data and correct it if necessary. Thus, the forward error correction can refer to the data units themselves or to individual segments. If the data units are segmented, each segment can receive a forward error correction. The data units can also contain framework data, such as header data, which stores the calculated forward error correction. This allows an appropriate format to be specified.

[0042] The separate data transmission media can be a contact or a cable. The transmission medium can therefore be electrical, optical, or a waveguide. Separate data transmission media are generally media that do not influence each other. It is therefore advantageous to electromagnetically shield the corresponding transmission media and / or to ensure that if a first medium fails, the second medium is still functional. The separate transmission media should therefore not be a single contact or a single cable. This is not contradicted by the fact that both transmission media are arranged on a common circuit board, for example. Thus, the separate transmission media as such are not virtual paths on the same transmission medium. In general, however, it is possible to operate virtual paths on each of the transmission media.

[0043] To ensure that the receiving device receives the data correctly even in the event of a channel failure or impairment, the first instance of the first data units is sent over one communication medium and the second instance, i.e. the same, redundant data, is sent over a second communication medium. The receiver can use the attached forward error correction code to determine whether the data can be transmitted correctly. If this is not the case, this may be due to faulty data processing or the transmission channels are impaired. According to the invention, it is possible that the error does not need to be searched for any further, but that it is still detected. Consequently, the receiving device attempts to repair the received data units using the transmitted forward error correction code, which is often not possible. This is due to the natural limitations of forward error correction.Although forward error correction can generally repair minor errors, such as individual bit errors, this is not possible to an unlimited extent. If this is not possible, it is particularly advantageous if the redundant data, i.e. the second instance, can be transmitted via the second data transmission channel. This occurs in any case, as serial or sequential communication is particularly preferred, i.e. not packet-based communication. It is advantageous here that the first instance and the second instance of the data units are transmitted as simultaneously as possible to ensure that if the first instance of the data units is discarded, the second instance of the data units is already available.

[0044] It is now also possible to check the second instance of the data units using the forward error correction code. If the verification is negative, i.e., if the data transmission is incorrect, the second instance can be corrected using the forward error correction code. This means that if the first instance of the data units is transmitted incorrectly, it is possible to check the second instance and correct it if necessary. The two communication channels thus work synergistically with their respective forward error corrections. If the correction of the first instance fails, it is still possible to check the second instance, which was transmitted via the second channel, and to repair it if necessary. If the transmission of the first instance fails, the second instance can be used as replacement data.The first instance is thus discarded and processing of the second instance continues without delay.

[0045] The second coded data units are optionally transmitted to the receiving device via one of the two data transmission media. Thus, it is possible for any data transmission medium to be selected or for the second data units to be divided into segments and the segments to be optionally sent via one or the other data transmission segment. Thus, the second data units are transmitted, for example, via a first communication path and as soon as further second data units are available, these are sent via the second communication path. Thus, according to the invention, it is possible to transmit the second data units via optionally one data transmission medium, regardless of where the data units of the first data units are transmitted. In this way, load balancing can be achieved such that the most favorable transmission medium is always selected.One metric for selecting the data transmission medium could be, for example, checking latency or bandwidth availability, and then sending the second data units over the data transmission medium that currently exhibits the most favorable parameters. For example, if it is detected that the first data units are always transmitted incorrectly over a particular transmission medium, the other data transmission medium can be selected for the second data units. The selection is not static; rather, the selection for the second data units can also change dynamically at runtime.

[0046] According to one aspect of the present invention, the system arrangement is configured for load distribution with respect to bandwidths and / or latency specifications of the two data transmission media. This has the advantage that the most advantageous data transmission medium can be selected for transmitting the respective data. Since the parameters can also change during runtime, selective selection also means that the data units can also be sent via the other data transmission medium during runtime. This applies in particular to the second data units, which can be sent via the first or second channel.

[0047] According to a further aspect of the present invention, the transmission of the coded data units over the data transmission media is sequential. This has the advantage of ensuring efficient and fast data transmission and eliminating the need to implement additional logic or intermediate components, as is the case with packet-switched transmission. According to one aspect of the present invention, sequential can also mean serial. This means that the data is connected in series and not packetized in such a way that one packet could overtake another. For example, the data segments or data units can also be numbered consecutively and always arrive in the intended order.

[0048] According to a further aspect of the present invention, the receiving unit is configured to check and / or correct the correctness of the first instance and / or the second instance of the data units using forward error correction. This has the advantage that errors themselves can be detected, and moreover, an error can be corrected using forward error correction. Checking the forward error correction of the second instance of the data units is typically only necessary if the verification of the first data units has failed. It can then be checked whether the second instance was transmitted correctly, whether it can be corrected if necessary, and whether it can still be used to replace the first data units in the first instance.

[0049] According to a further aspect of the present invention, the receiving unit is configured to consider the second instance of the data units if the first instance of the data units is not transmitted correctly. This has the advantage that valid data units are always present, and the first data units can then be discarded. Due to a possible serial or sequential transmission, it is possible for the second instance of the data units to be present in the receiver at the same time as the first instance of data units. In this way, it is possible to replace data from the first instance with data from the second instance in real time, without any delay.

[0050] According to a further aspect of the present invention, the receiving unit is configured to consider the second instance of the data units if the first instance of the data units is not transmitted. This has the advantage that data units transmitted via a different data line can be considered, thus avoiding a potential error or impairment in the first data transmission medium. Even if the first data transmission medium is damaged or not functioning according to specifications, the second transmission medium is very likely to be functional.According to the invention, it is also possible for a first instance of data units to be sent via a first data channel or via a first transmission medium and a second instance via the second transmission medium, wherein for a further first instance of the data units the other channel is selected and thus the first channel is also selected for the further second instance of data units. This means that a dynamic switch between the individual data units is possible at runtime. If, for example, there are five first instances of the first data units and thus also five instances of the second data units, the first instance can each be transmitted via one of the data transmission media. For the next instance of the data units, the channel or transmission medium can be changed.Thus, first instances and second instances are sent alternately over the transmission media, making it possible to verify which channel or data transmission medium is functioning according to specifications. For example, if there are five instances of the first data units, these can be sent alternately at the top and bottom, as described in the figures. The same applies to the other instances of the redundant data, which can also be sent alternately over the first or second channel.

[0051] According to a further aspect of the present invention, the data units are divided into cells, and a forward error correction is appended to each cell. This has the advantage that the data units do not have to be provided with a forward error correction as a whole; instead, they can be subdivided, and the subdivisions each receive a forward error correction. This makes it possible to intersperse fine-grained forward error corrections, thus increasing the possibility of correcting errors. This is the case because the forward error corrections then only apply to smaller segments of the data units, and thus only smaller signal sequences or bit sequences need to be protected.

[0052] According to a further aspect of the present invention, the coding comprises line coding. This has the advantage that very robust signal sequences are created, which additionally ensure stable data transmission. Thus, yet another security mechanism is used, which can be advantageously integrated into the existing combination of features. For example, according to the invention it is possible for the data units to be broken down into smaller words and, particularly advantageously, for lines to be encoded. Line coding is also described as line coding and should be used synonymously here. According to a further aspect of the present invention, data transmission can be carried out via virtual paths. This has the advantage that a plurality of virtual paths can be operated on the physical transmission media, which can be operated independently of one another but within the limits of the physical data path.Thus, it is possible, for example, to transmit the first data units with the second data units on the same physical level, i.e., the same physical transmission medium, wherein a first virtual path is provided for the first data units on one physical communication path and another virtual path is provided for the second data units on the same physical transmission medium.

[0053] According to a further aspect of the present invention, the data transmission media are each provided via cables. This has the advantage of creating transmission channels that can be separated particularly easily, meaning that the first data transmission medium does not influence the second data transmission medium. For this purpose, it may be necessary, for example, to provide electromagnetic shielding. This ensures that the first data units and the second data units are truly transmitted separately from one another, i.e., without interaction.

[0054] According to a further aspect of the present invention, a specification of transmission parameters, including their tolerance ranges, for all data units in the two data transmission media is implemented cumulatively. This has the advantage that the system arrangement as a whole must be subject to a certain required performance according to a specification, and thus, it is necessary to ensure which characteristics or parameters the transmission media exhibit. For example, certain latency times or a certain bandwidth may be required, which must be provided by the system arrangement as a whole, i.e., cumulatively.

[0055] According to a further aspect of the present invention, the data transmission media each support 15 gigabits per second. This has the advantage that sufficient bandwidth is available, allowing a total of 30 gigabits per second of data to be transmitted. Empirically, it has been determined that this is particularly advantageous in automobiles. While faster data lines can, of course, also be provided, this would require greater technical effort. The problem is also solved by methods for generating substitute data in the event of a negative

[0056] Verification of transmitted data in a serial data transmission in an automobile, comprising providing a physical application device configured to pack application data into cells of a predefined cell format, wherein the application data is transmitted by means of a first number of input interfaces of the

[0057] Application device and are redundantly output to a cell multiplex device by means of a multiple of the first number of redundant output interfaces of the application device, and wherein further application data are received by means of a second number of input interfaces of the application device and the second number of non-redundant output interfaces of the application device are output to a

[0058] cell multiplexing device; and providing the

[0059] Cell multiplexing device comprising for each output interface of the

[0060] Application device has a receiving interface set up to receive the

[0061] Cells packed application data, wherein the cell multiplexing device is arranged to

[0062] Forwarding the application data packed in cells to a data transmission device which provides the application data with forward error correction.

[0063] The problem is also solved by a computer program product with control commands which implement the proposed method or operate the proposed device.

[0064] According to the invention, it is particularly advantageous that the method can be used to operate the proposed devices and units. Furthermore, the proposed devices and units are suitable for implementing the method according to the invention. Thus, each device implements structural features suitable for executing the corresponding method. However, the structural features can also be configured as method steps. The proposed method also provides steps for implementing the function of the structural features. Furthermore, physical components can also be provided virtually or in a virtualized form.

[0065] Further advantages, features and details of the invention will become apparent from the following description, in which aspects of the invention are described in detail with reference to the drawings. The features mentioned in the claims and in the description can each be essential to the invention individually or in any combination. Likewise, the features mentioned above and those further explained here can each be used individually or in groups in any combination. Parts or components with similar functions or that are identical are sometimes provided with the same reference numerals. The terms “left”, “right”, “top” and “bottom” used in the description of the exemplary embodiments refer to the drawings in an orientation with normally legible figure designations or normally legible reference numerals.The embodiments shown and described are not intended to be exhaustive, but rather are exemplary in nature to illustrate the invention. The detailed description is intended to inform those skilled in the art; therefore, known circuits, structures, and methods are not shown or explained in detail in order not to obscure the understanding of the present description. The figures show:

[0066] Figure 1 : a schematic layered model of an architecture for use in the

[0067] System arrangement for generating replacement data according to one aspect of the present invention;

[0068] Figure 2: a schematic block diagram of the proposed system arrangement for generating replacement data according to one aspect of the present invention;

[0069] Figure 3: another schematic block diagram of the proposed

[0070] System arrangement for generating replacement data according to one aspect of the present invention;

[0071] Figure 4: another schematic block diagram of the proposed

[0072] System arrangement for generating replacement data according to one aspect of the present invention;

[0073] Figure 5: a cell data format according to one aspect of the present invention; and

[0074] Figure 6: a schematic flow diagram of the proposed method for

[0075] Generation of substitute data in the event of negative verification of data to be transmitted during a serial data transmission in an automobile according to a further aspect of the present invention. The present figures partially contain parameters that are familiar to those skilled in the art in their English terminology and are used as parameters and therefore do not require translation.

[0076] Figure 1 shows a schematic block diagram of an architecture as can be used according to one aspect of the present invention. For this purpose, three layers are shown twice, which are analogous but inversely designed, and the communication path runs on the left side from the transmitter downwards to the receiver on the right side upwards. At the very top, the applications APP 1, 2 and 3 are shown, which communicate with the applications on the receiver side. On the top left side, the application device is shown, below that the cell multiplex device is shown, and below that the data transmission device on the physical level is shown. On the left on the transmitter side, this is referred to as the physical transmitter, and on the right side the data reception device is referred to as the physical receiver.

[0077] According to the invention, it was recognized that, precisely in this architecture, and not in a seven-layer architecture, the data should be multiplied or duplicated particularly advantageously between the first two upper layers. This ensures that the application data is redundantly encoded at a particularly early point in time on the upper layer, i.e., the layer between the application device and the cell multiplexing device. On the receiver side, in this case on the right, the data is also checked and corrected for errors between the cell demultiplexing device and the application device at the top right.

[0078] The layers can also be referred to from top to bottom as Application Adaptation Layer AAL (application device), Cell Layer ACL (cell multiplexing device or cell demultiplexing device) and Physical Layer APL (data transmission device).

[0079] The Virtual Path Layers are the Physical Layer, which consists of the Transmission Sublayer and the Physical Medium Sublayer, the Cell Layer and the Application Adaptation Layer, which contains the Segmentation & Reassembly Sublayer and the functions for adapting the data formats to the corresponding application.

[0080] The main task of the physical layer is to establish the physical connection to other physical layers. This connection is fundamentally bidirectional. Theoretically, this connection can be realized using a variety of media. In practice, two serial differential GBps connections are used. Line coding, the insertion of dummy cells to decouple the cell rate from the link rate, and the integration of the cell stream into the serial frame take place in this layer.

[0081] In the cell layer, the segmented data (cell payload) from the upper segmentation and reassembly sublayer is assembled into complete cells using a header, VP identifier, and CRC, or cells are CRC-checked and the payload is forwarded to the segmentation and reassembly sublayer. This is also where the various cell streams of the application adaptation functions are multiplexed, or the cell payloads are distributed among the application adaptation functions according to the VP identifier (feed-in / feed-out).

[0082] The cell layer also multiplexes and demultiplexes cell streams in repeaters and splitters (forwarding).

[0083] The task of the Application Adaptation Layer is to adapt the data of the application interfaces to the format of the payload field of the cell and to transmit control information to the other side or to use control information from the other side for the adaptation (clock generation, frame construction).

[0084] Figure 2 shows a schematic block diagram of the proposed system arrangement according to one aspect of the present invention. The first three units of the proposed system arrangement are shown on the left-hand side, with the leftmost block representing the application device, the middle block the cell multiplexing device, and the right-hand block the data transmission device. The proposed invention can already be implemented using the first two left-hand blocks, with data being transmitted redundantly between the first and second blocks. In this case, two applications are shown on the left-hand side, namely Application 1 and Application 2, which each transmit data to the application device on the far left via an input interface, i.e. a port.The first unit or application device is designed such that it transmits the data of the first application redundantly and transmits the application data of the second application non-redundantly. Thus, the upper arrow of the data transmission between the application device and the cell multiplexing device can also be entered multiple times. In the present case, only two paths are shown: the upper path for the redundant data and the lower path for the non-redundant data. As entered on the cell multiplexing device, it can have multiple input interfaces or data reception interfaces. Cell 1 or cells 1 are thus transmitted multiple times, while cell 2 or cells 2 are transmitted once. In addition, the cells in the application device are each provided with forward error correction.

[0085] As can be seen in Figure 2, the data is replicated early, i.e., already after the first device on the far left. Thus, according to the invention, it is particularly advantageous that the data is still highly likely to be uncorrupted. In the third unit, i.e., the data transmission device, the data lines are encoded and / or provided with forward error correction.

[0086] The first three devices thus represent the transmitter and are designed according to the architecture in Figure 1. The loops in the middle of Figure 2 represent a transmission medium via which the data is transmitted from the transmitter to the receiver on the right-hand side. On the right-hand side, only two devices are shown schematically, but these can also be designed as three devices, analogous to the transmitter. On the far right-hand side, it is indicated that the corresponding applications 1 and 2 can use the data at the end of processing. Due to redundant transmission, the data is available multiple times with forward error correction and thus, for example, cell 1 can be checked for correctness and, if the correctness check is negative, the substitute data is used.

[0087] Figure 3 shows a schematic block diagram of the proposed invention and, in particular, a system configuration. The two left-hand blocks alone can implement the system configuration. Additional blocks, i.e., blocks 3, 4, 5, and 6, are optional.

[0088] As shown here, two applications are provided on the left-hand side, with the first application providing application data that is sent redundantly to the cell multiplexing device. This is represented by two arrows. Application 2 provides non-redundant data, which is thus transmitted with one arrow. The arrows can be transmission media or at least a contact. Virtual data paths can be implemented on these. The transmitter is shown on the left, and the receiver on the right, with both sides being able to be implemented analogously but inversely. Thus, on the receiver side, the application device is entered on the right-hand side, the cell demultiplexing device in the middle, and the data receiving device on the left-hand side.The data is transmitted from left to right as described in the image and is used on the right side by application 1 and application 2.

[0089] Figure 4 also shows a schematic overview of the proposed system arrangement, with two transmission media now shown. Thus, for example, the upper transmission medium can transmit the redundant application data and the lower channel, i.e. the lower communication medium, can transmit a redundant instance of this application data. This ensures that the transmission path is also designed redundantly and, in the event of damage or a fault in one channel, the replacement data is transmitted via another channel. The non-redundant application data can be transmitted optionally via one of the channels. It is also possible for different cells of the non-redundant data to be sent via different communication media. Thus, according to the invention, a redundant data channel is particularly advantageously created which can be balanced with regard to load.

[0090] For example, if application data is transmitted corrupted or incorrectly, this can be detected and corrected using forward error correction. However, if the data is not available because the communication channel fails, the backup data is used, which is always available because the second communication channel is used for this backup data. In the unlikely event that both communication media fail, the process terminates, which is also detected. Thus, not only is the application data replicated, but it is also transmitted separately via its own data channel, further increasing error robustness.

[0091] Figure 5 shows a schematic structure of a target format according to one aspect of the present invention. At the top right, a field is shown which describes a virtual path VP and provides, for example, a numerical value. The numerical value describes the virtual channel via which the cell is to be transmitted. At the bottom left is the abbreviation for a cyclic redundancy check CRC. The additional data fields can be additional frame data or the payload data, which is preferably transmitted in the largest field. Thus, Figure 5 shows an example of a coded cell which has frame data. The cell is coded according to the provided cell format. Thus, Figure 5 shows the coded application data, which is coded as a cell format and thus provides additional information in addition to the payload data.The virtual path enables, for example, redundant data transmission, so that application data packaged in cells can be transmitted via a first virtual path, and the same data, i.e., the backup data, can be transmitted via another virtual path. Thus, it is possible for the packaged application data, as shown in Figure 5, to be present multiple times according to this cell, with only the field of the virtual path being adapted.

[0092] Figure 6 shows, in a schematic flow diagram, a method for generating replacement data in the event of negative verification of transmitted data in a serial data transmission in an automobile, comprising providing 100 a physical application device configured to package 102 application data into cells of a predefined cell format, wherein the application data is received 101 by means of a first number of input interfaces of the application device and is redundantly output 103 to a cell multiplexing device by means of a multiple of the first number of redundant output interfaces of the application device, and wherein further application data is received 104 by means of a second number of input interfaces of the application device and the second number of non-redundant output interfaces of the application device are output 105 to a cell multiplexing device;and providing 106 the cell multiplexing device having, for each output interface of the application device, a receiving interface configured to receive 107 the application data packed in cells, wherein the cell multiplexing device is configured to forward 108 the application data packed in cells to a data transmission device which provides the application data with forward error corrections 109.;

[0093] Accordingly, a system arrangement for securing a data transmission is proposed, comprising a transmitting device configured for redundantly encoding first data units into a first instance of the first data units and a second identical and thus redundant instance of the first data units, and further configured for encoding second data units, wherein a forward error correction is added in each case for all encodings;and exactly two physical, separate data transmission media which communicatively couple the transmitting device and a receiving device, wherein the transmitting device is configured to transmit the first instance of the first data units via exclusively one data transmission medium and to transmit the second instance of the first data units via exclusively the other data transmission medium and further to transmit the second encoded data units to the receiving device via an optional one of the two data transmission media.;

Claims

Patent claims 1. A system arrangement for generating replacement data for use in the event of negative verification of data to be transmitted in a serial data transmission in an automobile, comprising: - a physical application device configured to pack application data into cells of a predefined cell format, wherein the application data is received by means of a first number of input interfaces of the application device and is redundantly output to a cell multiplexing device by means of a multiple of the first number of redundant output interfaces of the application device, and wherein further application data is received by means of a second number of input interfaces of the application device and the second number of non-redundant output interfaces of the application device are output to a cell multiplexing device; and - the cell multiplexing device comprising, for each output interface of the application device, a receiving interface configured to receive the application data packed in cells, wherein the cell multiplexing device is configured to forward the application data packed in cells to a data transmission device which provides the application data with forward error corrections.

2. System arrangement according to claim 1, characterized in that the output interfaces and / or the input interfaces are each present as physical and disjoint interfaces.

3. System arrangement according to claim 1 or 2, characterized in that the application data are sent from the application device to the cell multiplex device by means of virtual communication paths.

4. System arrangement according to one of the preceding claims, characterized in that the cell format provides frame data and / or at least one source identifier of a virtual path for data transmission.

5. System arrangement according to one of the preceding claims, characterized in that the cell format provides a numerical value which identifies a virtual path of a data transmission.

6. System arrangement according to one of the preceding claims, characterized in that a maximum of 128 virtual paths for data transmission can be set up between the application device and the cell multiplex device.

7. System arrangement according to one of the preceding claims, characterized in that the data transmission device is coupled to a data reception device which is set up to receive the application data and is further set up to check each error forward correction and, in the event of a negative check of an error forward correction, incorrect application data is replaced by redundantly transmitted application data.

8. System arrangement according to claim 7, characterized in that the data receiving device has a cell demultiplexing device which forwards application data to an application device of the data receiving device by means of virtual paths.

9. System arrangement according to one of the preceding claims, characterized in that each cell is coded with a forward error correction.

10. System arrangement according to one of the preceding claims, characterized in that the redundant application data are transmitted between the data transmission device and a data reception device via separate communication media.

11. System arrangement according to one of the preceding claims, characterized in that the application device, the cell multiplexing device and / or the data transmission device are physically configured.

12. System arrangement according to one of the preceding claims, characterized in that the multiple of the first number of redundant output interfaces is exactly two.

13. A method for generating replacement data in the event of negative verification of transmitted data in a serial data transmission in an automobile, comprising: - Providing (100) a physical application device configured to package (102) application data into cells of a predefined cell format, wherein the application data is received (101) by means of a first number of input interfaces of the application device and is redundantly output (103) to a cell multiplexing device by means of a multiple of the first number of redundant output interfaces of the application device, and wherein further application data is received (104) by means of a second number of input interfaces of the application device and the second number of non-redundant output interfaces of the application device are output (105) to a cell multiplexing device; and - providing (106) the cell multiplexing device having, for each output interface of the application device, a receiving interface configured to receive (107) the application data packed in cells, wherein the cell multiplexing device is configured to forward (108) the application data packed in cells to a data transmission device which provides the application data with forward error corrections (109).

14. A computer program product comprising instructions which, when the program is executed by at least one computer, cause the computer to carry out the steps of the method according to claim 13.

15. A computer-readable storage medium comprising instructions which, when executed by at least one computer, cause the computer to perform the steps of the method of claim 13.

Images