DE102012221055A1 - Method for checking message reception in end device, involves determining reception time at which end device has received message over communication medium - Google Patents

Abstract

The method involves determining a reception time (t-E1) at which the end device has received a message over a communication medium. An evaluation time (t-A1) is determined at which an evaluation of the message takes place by the end device. A difference between the evaluation time and reception time is imaged. The receiving of error-free message is determined as a function of the difference. The difference is compared with a predetermined time interval for determining reception of error-free message. Independent claims are included for the following: (1) a computing unit for executing the message reception checking method; and (2) a computer program with program code unit stored in a machine-readable storage medium.

Description

The present invention relates to a method for checking message reception in a terminal.

State of the art

In modern vehicles, a large number of control units are used, which communicate intensively with each other. In addition to standard communication via a so-called Controller Area Network (CAN), FlexRay networks are increasingly being used for fast and secure information exchange.

A FlexRay bus is a timed bus that can transfer messages between a first and a second terminal (e.g., controller). The messages may be sent in a predetermined time frame (e.g., every 10ms) or event based (e.g., depending on a speed).

In addition to the actual content of the message, it is important for the receiving terminal, in particular for security-critical data, to know whether the sending terminal is still working correctly and is sending the current data and whether the transmission took place without errors.

The terminals and the FlexRay bus work in each case clocked: The transmitting terminal provides a message with each clock pulse, the FlexRay bus takes over with each clock pulse provided by the sending terminal message and transmits it to the receiving terminal. Finally, the receiving terminal evaluates a message transmitted by the FlexRay bus with each clock pulse.

Even with the same clock frequency, the clocks of the FlexRay bus (exact bus driver) and terminals each have their own time base, so that the clock pulses of said elements can be regularly offset from one another. The clock frequency and the respective time base together specify the times at which the respective element (FlexRay bus or terminal) can become active.

Optimally, the time bases are matched to one another such that the FlexRay bus can accept and transmit a message just at the time the transmitting terminal provided the message, and that the receiving terminal can evaluate the message at the moment which the FlexRay bus can provide.

In reality, however, the time bases are offset from each other in such a way that there are delays (latencies) in the transmission.

Also, the hypothesis of the clock compliance and thus the regularity of the shift are not realistic. Rather, so-called jitter occurs, i. it comes to accuracy fluctuations in the observance of the clock by the elements involved. Even if, for example, a receiving terminal and the FlexRay bus (as described above) are optimally set to each other (so that the receiving terminal could evaluate a message in principle exactly at the time at which the clock of the FlexRay bus specifies the transmission), Receiving terminal evaluate the message only if the FlexRay bus really provides the message until at the latest provided time: In a delay, however, the message from the receiving terminal can only be evaluated at its next clock pulse. Likewise, the evaluation time in the receiving terminal can vary due to fluctuating computing load. The same applies to the interaction of FlexRay bus and sending terminal. The said disturbances must be detected in the receiving terminal in the event of debouncing of the message counters, i. when checking whether a message has been received regularly or whether the message content is still up-to-date. If you want to initiate an error response in the absence of a message, so the error response can be started only after two clock cycles due to the jitter influence in the transmission and the fluctuating load in the receiver to avoid false reactions (unjustified error responses). Further tolerances and delays in the signal chain, e.g. in the sending terminal, are not considered here.

Increasing safety requirements, especially for hybrid vehicles, require ever faster detection of fault conditions and the rapid triggering of predetermined fault responses. In addition, because of increasing bus load, messages are sometimes shifted to slower time slots and thus any clock loss becomes more critical until fault detection.

The present invention therefore has the object to provide a way that allows to reduce waiting times in the reliable monitoring of a communication system.

Disclosure of the invention

According to the invention, a method for checking a message reception in a terminal with the features of patent claim 1 proposed. Advantageous embodiments are the subject of the dependent claims and the following description.

Advantages of the invention

The invention results in a shortening of the detection period until a defect in the communication system (i.e., in the transmitting terminal or in the communication medium) can be detected by a receiving terminal. It is not necessary to wait for three or more missed messages. Rather, the invention makes use of the test function of evaluating the time of reception, i. the time at which the message was received from the terminal and determines the difference at the time of evaluation, i. at the time the message is processed in the terminal. Based on this difference can be detected, in particular by threshold comparison, whether the evaluation takes place in a permissible time frame after receiving or not.

For this purpose, it is advantageous to define a time interval with a lower and an upper limit, for which the following applies: If the difference lies below the lower limit, the functionality can be determined. If the difference is above the upper limit, the defectiveness can be determined. If the difference lies in the interval, the decision is not possible and the test function must be called again at a later time, preferably in the next clock interval. In this next clock interval, there is either a new message, or it can be safely concluded that a missing message, since the time between last received message and current evaluation time is well above the upper limit of the permissible time interval.

Preferably, the time to the next call of the check function is shortened if the difference between the evaluation and the reception time lies in the interval. For example, the test function can be called again after half a clock interval. This allows a faster detection of an error.

The times of embassy reception and the processing of the message in the terminal (corresponds approximately to the location of the clocks on the bus and in the terminal to each other) are not yet evaluated. For the monitoring of the messages in the terminal, this means that with time-based evaluation, the application of the debounce time is extended by a time interval to intercept possible jitter effect. In cases where the timing of the clocks is such that no jitter effects can occur, the debounce time is unnecessarily extended by one clock. (Debouncing means not to immediately start an error reaction with a recognized error, but to wait for a certain amount of time (debounce time) / number of function calls If the error disappears during this time (eg a new message is coming), then nothing will happen Error reaction triggered).

The result of the invention is, by evaluating the message reception and processing times in the terminal (e.g., a control unit in a motor vehicle), to limit this additional debouncing clock to those instances where jitter displacement may actually occur. As a result, the necessary debounce time can be reduced by one time cycle for a majority of cases.

Preferably, a decision tact interval is determined in which the decision as to whether the communication system is faulty or not takes place. Depending on the difference, this may be the current clock interval in which the difference was determined or an immediately following clock interval (in each case related to the terminal clocking).

The invention is particularly suitable for use with flexray buses because the FlexRay bus has a timebase. Thus, the measurement of the reception time can be done very easily. However, the invention is also applicable to other bus systems, e.g. CAN, can be used advantageously. Optionally, in this case a corresponding device of the terminal to determine the reception time is necessary.

In a first alternative, e.g. the FlexRay driver block in the terminal in addition to the message the time of reception in its own time base from. For conversion into the terminal time base, the terminal uses the offset of the time bases. The offset can be determined during operation.

In a second alternative, e.g. the FlexRay driver module in the terminal when receiving a message the current terminal time in the terminal time base and stores this in addition to the message.

In a third alternative, the e.g. FlexRay or a CAN driver module in the terminal when receiving a message the terminal and this stores the time of reception in the terminal time base.

An arithmetic unit according to the invention, e.g. a control device of a motor vehicle is, in particular programmatically, configured to perform a method according to the invention.

The implementation of the method in the form of software is also advantageous, since this causes particularly low costs, in particular if an executing control device is still used for further tasks and therefore exists anyway. Suitable data carriers for the provision of the computer program are, in particular, floppy disks, hard disks, flash memories, EEPROMs, CD-ROMs, DVDs, and the like. It is also possible to download a program via computer networks (Internet, intranet, etc.).

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

The invention is illustrated schematically with reference to an embodiment in the drawing and will be described in detail below with reference to the drawing.

Brief description of the drawings

1 schematically shows the sequence of a preferred embodiment of the method according to the invention.

Embodiment (s) of the invention

In 1 a preferred embodiment of a method according to the invention is illustrated by means of a timing diagram. In the scheme are individual numbered clock intervals 10 plotted along time t. An upper timeline 100 shows the time base of a here as FlexRay bus formed communication medium (contains the FlexRay driver blocks on the terminals), a lower timeline 200 shows the time base of the computer core of a here designed as a control unit (receiving) terminal. Communication medium and terminal are part of a communication system, which usually has at least one further, transmitting terminal.

As explained in the introduction, both the FlexRay bus and the control unit work in a clocked fashion, so that individual process steps, such as message transmission, in 1 for the first time at time t _{E, 0} = "1", and message processing, in 1 for the first time at time t _{A, 0} = "7", proceed in clock intervals. The terminals connected to a FlexRay bus are managed according to a Time Division Multiple Access (TDMA) scheme. Each FlexRay driver block on the terminals is synchronized with the same clock and waits until it is its turn to write on the bus.

For the non-event-based (ie the conventional time-based) transmission of messages, a time interval T _{0 is} defined, which defines the distance between two regularly transmitted messages (for example from another control device). This time grid (t _{E, 0} , t _{E, 1} ,...) Is usually applied as a function of the respective message, for example safety-critical messages can be transmitted more frequently and less safety-critical messages can be transmitted less frequently. In the same time frame (t _{A, 0} , t _{A, 1} ,...), The processing of the messages also takes place in the control unit. Expediently, the invocation of the check function basically also runs in the clock intervals of the message processing.

Due to the independent time bases of the FlexRay bus, in this case more precisely the driver component of the communication interface of the control unit, and of the control unit, more precisely the computer core of the control unit, a more or less large clock interval shift Δ ₀ (<T ₀ ) between reception time t _{E, 1} and Processing time t _{A, 1} occur.

Due to jitter on the bus, the maximum time T _{0, max} between two messages T _{0, max} = T ₀ + T _{jitter, max} may be in normal operation, where T _{jitter, max} denotes a maximum possible jitter time (designated T _J in the figure) ).

In a preferred embodiment, in addition a computing time T _term (referred to in the figure as T _L ) between the reception and the processing of the messages in the reception control unit are taken into account. Due to computational load fluctuations, there is another jitter and the computing time is between T _{runtime, min} and T _{runtime, max} . Thus, in normal operation, a maximum expected _{delay time} Δt _x.max between message _reception and evaluation of Δt _x.max = T _{0, max} + T _{runtime, max} .

In the previous embassy monitoring without time measurement, the failure of a message must always be awaited to take account of the jitter effects, since the position of the clocks to each other is not known. Thus, from the last valid message _input to the detection of a message _failure depending on the position of the bus and control unit _clocks to each other _{results in a delay time} between minimally Δt _x.Error = 2 · T ₀ + T _{runtime, min} and maximum Δt _x.Error = 3 · T ₀ + T _{runtime, max} .

The invention provides a way to reduce this delay time by time monitoring. For this purpose, the times of message receipt and processing are measured and stored in addition to the message.

The _{delay time} Δt _x = t _x . _Evaluation - t _{x, reception} in normal operation is less than Δt _{x, max} .

Based on these considerations, the following cases can be distinguished when invoking the check function: a) Δt _x <T ₀ + T _{runtime, min} - T _{jitter, max}

In this case, it can already be reliably detected in the current evaluation cycle interval that the processed message is current. The current evaluation clock interval therefore becomes the decision clock interval (ie, the clock interval in which it is decided whether the communication system is operating correctly or erroneously. b) T ₀ + T _{runtime, min} - T _{jitter, max} <Δt _x <T ₀ + T _{runtime, max} + T _{jitter, max}

In this case, it is not yet possible to reliably determine in the current evaluation cycle interval whether the processed message is current. The audit function will be called again at a later time. Expediently, this is at the latest the immediately next evaluation cycle interval. However, to speed up the decision, the test function can also be called again independently of the evaluation clock interval, for example, after only half an evaluation clock interval. c) Δt _x > T ₀ + T _{runtime, max} + T _{jitter, max}

In this case, it can be reliably detected in the current evaluation cycle interval that the processed message is not up-to-date. A sending terminal and / or the communication medium do not work properly. The current evaluation clock interval therefore becomes the decision clock interval.

A message failure is thus already detected when the threshold T ₀ + T _{delay, max} + T _{jitter, max is} exceeded.

With a message clock of 10ms and a total jitter of ± 1ms, it is possible to start from the 11 ms, i. with equal distribution of the time offset between reception time and evaluation time in 90% of cases, recognize a message failure at the first failed message. The remaining unclear cases can be clarified safely at the next clock call.

Claims (17)

Method for checking message reception in a terminal ( 200 comprising the steps of: determining a reception time (t _{E, 0} ) to which the terminal sends a message via a communication medium ( 100 ) has received; Determining an evaluation time (t _{A, 0} ) to which the terminal evaluates the message; Forming a difference (Δt _x ) between the evaluation and the reception time; and determining, depending on the difference (Δt _x ), whether the message reception is error-free. The method of claim 1, wherein determining in dependence on the difference (Δt _x ) whether the message reception is error free comprises comparing the difference (Δt _x ) with a predetermined time interval comprising a lower and an upper interval limit. Method according to claim 2, wherein the upper interval limit of the predetermined interval is at least a sum of one cycle length of the communication medium ( 100 ), a maximum computation time for a message and a maximum jitter time. Method according to claim 2 or 3, wherein the message is sent to the terminal ( 200 ) via a bus ( 100 ) and the predetermined interval is a closed interval whose length is at least twice a maximum jitter time on the bus and / or in the terminal. A method according to any one of claims 2 to 4, wherein it is determined that the reception message is error-free, if the difference (.DELTA.t _x) is less than the lower interval limit. A method according to any one of claims 2 to 5, wherein it is determined that the message reception is not error free if the difference (Δt _x ) is greater than the upper interval limit. Method according to one of the preceding claims, wherein an error routine is initiated when the message reception is not error-free. Method according to one of the preceding claims, wherein the method is carried out again at a later time when the difference (Δt _x ) lies in the predetermined time interval. The method of claim 8, wherein the later time is at the latest an immediately following processing clock of the terminal. Method according to one of the preceding claims, wherein the determination as a function of the difference (Δt _x ) whether the message reception is error-free comprises the following steps: determining a decision clock interval (t _{A, 0} , t _{A, 1} ) as a function of the difference (Δt _x ); Decide, in the decision clock interval (t _{A, 0} , t _{A, 1} ), whether the message reception is error-free. The method of claim 10, wherein the evaluation time is in an evaluation clock interval, and wherein determining the decision clock interval comprises: determining that the difference (Δt _x ) is not within a predetermined time interval and setting the decision clock interval as the evaluation clock interval; or determining that the difference (Δt _x ) is within the predetermined time interval, and setting the decision clock interval as the clock interval immediately following the evaluation clock interval. The method of claim 11, wherein the terminal determines that the difference (Δt _x ) is not within the predetermined time interval, and wherein the method further comprises: determining that the message reception is not error free if it is determined that the difference (Δt _x ) is greater than the upper interval limit of the predetermined time interval and / or determining that the message reception is error-free if it is determined that the difference (Δt _x ) is less than the lower interval limit of the predetermined time interval. Method according to one of the preceding claims, wherein the communication medium is a FlexRay bus or a CAN bus. The method of claim 13, wherein determining the reception time point (t _{E, 0)} comprises: calculating the reception time point (t _{E, 0)} in the terminal-time basis by a FlexRay driver block from a stored from the FlexRay driver block in the FlexRay time base reception time the message and a time base offset between the FlexRay time base and the terminal time base; or calculating the reception time (t _{E, 0} ) in the terminal time base by the terminal from a reception time of the message stored by a FlexRay driver module in the FlexRay time base and a time base offset between the FlexRay time base and the terminal time base, or Initiated by a FlexRay or CAN driver block, the terminal to determine the time of receipt (t _{E, 0} ) upon receipt of the message. Arithmetic unit which is adapted to carry out a method according to one of the preceding claims. Computer program with program code means which cause a computer unit to carry out a method according to one of claims 1 to 14 when executed on the computer, in particular according to claim 15. A machine-readable storage medium having a computer program stored thereon according to claim 16.

Images