WO2022258412A1

WO2022258412A1 - Vehicle data communication system for transmitting vehicle data

Info

Publication number: WO2022258412A1
Application number: PCT/EP2022/064547
Authority: WO
Inventors: Mohammad Kabany
Original assignee: B-Horizon GmbH
Priority date: 2021-05-19
Filing date: 2022-05-30
Publication date: 2022-12-15
Also published as: DE102021113037A1

Abstract

The present invention relates to an IP box (integrated powertrain controller and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing back and/or storing data with regard to passenger data and/or data with regard to energy management of the vehicle and for exchanging data with a charging station and/or a vehicle battery, in particular in order to be able to charge the vehicle battery, wherein, in order to record, manage, play back and/or store data with regard to passenger data and/or data with regard to energy management of the vehicle, wherein the data are able to be exchanged between an MC box (media and communication box) and a BSC box (body & safety control box) bidirectionally in particular only if these data flow with the aid of a security ECU, such that the security ECU is able to identify any data compressions emanating from the MC box on the basis of at least one security gate, wherein the IP box furthermore comprises a first IP module that controls, regulates and/or monitors a first set of management functions and/or security aspects, such as for example vehicle monitoring and/or driver health monitoring, within a vehicle, and, in particular at the same time, the IP module within a vehicle controls, regulates and/or monitors a second set of management aspects, such as for example battery management and/or a battery state of charge, and a vehicle data communication system for transmitting vehicle data between processing boxes of the system, and a method for operating a vehicle data communication system in order to transmit vehicle data between processing boxes of the system by way of a vehicle data communication system.

Description

B-Florizon GmbFI Bruckdorfer Strasse 34 93161 Sinzing

Vehicle data communication system for the transmission of vehicle data

description

The present invention relates to an IP box (integrated powertrain control and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data regarding passenger data and/or data regarding energy management of the vehicle and for data exchange with a charging station and/or a vehicle battery, in particular in order to be able to charge the vehicle battery, recording, managing, playing and/or storing data relating to passenger data and/or data relating to energy management of the vehicle, whereby the data between an MC box (Media and Communication Box) and a BSC box (Body & Safety Control Box) can only be exchanged bidirectionally, in particular, if this data can be exchanged with the help of a security ECU (Security ECU ) flow, so that the security ECU based on at least one security gate any data compression coming from the MC box en can determine, wherein the IP box also comprises a first IP module, which controls, regulates and/or monitors a first set of management functions and/or security aspects, such as vehicle monitoring and/or driver health monitoring, within a vehicle , And, in particular at the same time, another IP module within a vehicle controls, regulates and/or monitors a second set of management aspects and/or management functions, such as battery management and/or a battery state of charge, with at least one management function between the two IP modules during operation at least partially and/or at least temporarily redundantly and/or bidirectionally at least temporarily stored, in particular stored, in at least one of the IP modules, and/or is exchanged at least once between the two IP modules, in particular with this data comparison avoiding data loss and/or data compromising of this management function in one of the two IP modules, further in particular with this management function being the one , which controls, regulates and/or monitors both IP modules, and for this management function the above-mentioned data validation can be carried out.

The present application also relates to a vehicle data communication system for transmitting vehicle data between processing boxes of the system and a method for operating a vehicle data communication system for transmitting vehicle data between processing boxes of the system by means of a vehicle data communication system according to the respective preambles of claims 1 and 10. Previous vehicle data communication systems were among others constructed in such a way that individual “boxes”, i.e. processing units for processing signals and/or data, were directly connected to the vehicle with the corresponding sensors or connection points. Also, in previous configuration structures of a vehicle data communication system, such a system is involved, which is actually constructed with haptic units, i.e. units that are constructed, for example, in the form of an “Apple Box” relative to an Apple TV. These had to be mounted separately in or on the vehicle and were therefore very space-demanding and difficult to coordinate with one another. Corresponding boxes for certain functions are often provided by different manufacturers and have therefore been difficult to configure. A corresponding configuration of a tuning also required a very high computing and memory capacity, a corresponding control unit, for example a corresponding control chip.

The application presented here would therefore like to eliminate the above-mentioned disadvantages, so that it is an object of the present invention to set up a vehicle data communication system for transmitting vehicle data in a particularly inexpensive and simple manner, which requires little installation space and achieves a particularly high security level.

This object is solved by the subject matter of claim 1. Remaining embodiments can be found in purely exemplary form in the corresponding dependent claims (subclaims).

According to at least one embodiment, the vehicle data communication system for transmitting vehicle data includes at least one MC box (media and communication box) for recording, managing, playing back and/or storing audio and/or video data in digital and/or analog form .

According to at least one embodiment, the present application comprises at least one BSC box (Body & Safety Control Box) for recording, managing, playing back and/or storing data by means of which actuators in a vehicle can be addressed in order to protect a passenger in an alarm state from physical protect damage.

According to at least one embodiment, the vehicle data communication system also includes at least one IP box (integrated powertrain control and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data with regard to passenger data and/or data with regard to energy management of the vehicle, the data between the MC box and de4r BSC box can only be exchanged bidirectionally if this data flows with the help of a security ECU (security ECU), so that the security -ECU can determine any data compression coming from the MC-Box on the basis of at least one security gate.

For the purposes of the application, an “ECU” is a control device (ECU = electronic control unit or ECM = electronic control module). ECU ^'s are electronic modules that are mainly built into places where something has to be controlled or regulated. Control devices are used in the automotive sector in all imaginable electronic areas, as well as to control machines, systems and other technical processes. They belong to the embedded systems.

In connection with the terminology "box" is meant in the present invention in particular a self-contained unit either in terms of software technology or structurally haptically with specific tasks. For example, the box is a processing chip including a corresponding memory and/or processing unit.

For example, the box is formed by at least one SoC (system-on-a-chip process).

System-on-a-Chip (SoC, dt. Ein-Chip-System), also System-on-Chip, means the integration of all or a large part of the functions of a configurable and/or programmable electronic system in one chip, for example an integrated circuit (IC) on a semiconductor substrate, also called monolithic integration. Due to the frequent use of silicon as a substrate material, it is also referred to as system-on-silicon (SoS). A system is a combination of different elements (logical circuits, timing, automatic start-up, microtechnical sensors, etc.) that together provide a specific functionality, for example an acceleration sensor including evaluation electronics. SoCs are usually used in embedded systems.

While systems initially consisted of a microprocessor or microcontroller IC and many other ICs for special functions that were soldered onto a circuit board, the integration density possible today allows almost all functions to be combined on a single IC. Digital, analog and mixed-signal functional units are integrated. The main advantages are cost savings, lower energy consumption or power loss and comprehensive miniaturization. For example, in mobile phones today, the digital function, possibly with the exception of the memory, is implemented on an IC. The interfaces to the keyboard, the SIM card or the display, for example, are also already included on this IC.

A similar technology to achieve high integration densities of components from greatly un ferent technology is the so-called system-in-package (SiP). Several chips are combined in one housing.

SoCs are used in mobile devices such as smartphones, tablet computers, other gadgets and data acquisition devices, as well as in control and automation technology (e.g. washing machines, automotive electronics, industrial automation) and in all kinds of modern consumer electronics devices. mostly are to operate many different interfaces (sensors, actuators, networks, buttons, displays) and the quantities are large. The integration of functions that were previously distributed over several components or even several printed circuit boards can also increase reliability and functional safety, especially if a variety of fault detection measures are integrated that would not be marketable with discrete components. Specially adapted SoCs are rarely used for applications that generate smaller quantities, such as in medical technology or avionics, and many of the integrated modules often remain unused.

Today, SoCs are mostly not developed from scratch, but the designs are based - at least in part - on existing or purchased components, so-called IP cores. These are, for example, macros for full CPU cores, or coprocessors - such as hardware accelerators for encryption or graphics calculations. Likewise, these are peripheral blocks for the implementation of storage, Ethernet, Bluetooth or other interfaces, or complete storage units including their management.

Many standard components are included free of charge in chip manufacturers' EDA tools in proprietary form. Other components can be provided by the chip manufacturer or other IP suppliers such as e.g. B. ARM, Transmeta or smaller, often very specialized development companies. Such IP cores can often be generated via parameters adapted to the intended use, for example in the form of the pipeline length, the cache size or the bus bit widths.

Other required components of a SoC have already been developed in earlier projects and ideally can be used directly - or changes have to be made, at best parameterization of the IP cores is sufficient. Another option is to use "free hardware". This is how more and more open source projects are emerging in the hardware sector (e.g. on OpenCores.org), which are often still in the development stage. Anything missing here must be developed by the user himself or have it developed.

The transitions between what is implemented in software and what is implemented in hardware are becoming increasingly fluid, depending on the application - see Software Defined Radio (SDR). As a rule, SoCs have a debug interface. This is often a simple RS-232 interface, but USB is increasingly used here as well. Error messages and general information can then be output via this debug interface during operation, for example on a terminal, i.e. a console application. In more complex environments, this function is often also performed by a JTAG interface. This is typically used not only to transmit error messages, but also to communicate with a FLARD or software debug module in the SoC.

Such a module allows the user, for example, to "stop" the SoC and carry out the processing in the CPU core in single-step mode ("step-by-step") and, if necessary, to change individual register values or, for example, to shorten a loop or a jump instruction evade.

Another application of this interface is the programming of programmable areas of a SoC, e.g. B.RAM, EEPROM, Flash or even individual circuit parts up to the entire SoC design (only in an FPGA or similar). Other external components are usually attached as a "chain" to the same JTAG interface, which are addressed via a so-called boundary scan.

In this respect, the individual boxes or a box can be manufactured monolithically integrated with one another on a common substrate, for example a silicon substrate. It is conceivable that all boxes, i. H. all processing and data units are arranged and installed on a single chip, for example on a SoC monolith, in particular monolithically integrated.

Due to the feature described here, according to which data between the MX-Box and BSC-Box can only be exchanged bidirectionally if this data flows with the help of a security ECU, so that the security ECU based on at least one security gate any of the MC-Box Outgoing data compression can determine, a particularly flexible and secure security system is created, which can also be integrated with the common boxes based on SoC technology.

In particular, the security ECU, further in particular monolithically integrated, can also be based on a SoC principle and in particular also on a common substrate be generated monolithically integrated together with the other boxes or at least one of the boxes.

A data error or a deviating data structure can be identified as data compression in the sense of the present application. For example, a data error is, among other things, a virus or faulty software that leads to a malfunction of at least one of the components of the vehicle data communication system described here. Such data compression can therefore be filtered out by the security ECU. If the data sent from the MC box to the safety ECU contains a corresponding data compression, this data is not forwarded to the BSC box at all and/or only partially, for example.

It is also conceivable that the security ECU repairs the corresponding data compression and/or cuts it out of the data stream in terms of data or software and only then forwards a correspondingly decompressed data set, i.e. one that has been freed from the corresponding software error, to the BSC box.

In other words, the security ECU forms a so-called “door opener” or “gate keeper”, which prevents the MC box, which is supplied with data or compressed, for example for corresponding downloads or USB connections, corresponding compressed messages not forwarded to the BSC box.

Data exchange between the security ECU and the MC box is preferably bidirectional. This can mean that in the event of an error being detected by the safety ECU, it supplies an error code, for example an error alarm, to the MC box and the MC box therefore corrected accordingly in this case, i. H. error-free data or no further data stream at all to the safety ECU. For example, if an error is detected, a data stream that is still being transmitted from the MC box to the security ECU can then be interrupted.

The interruption can therefore be remedied either by the MC box or by the safety ECU, in particular by mutual agreement on data technology, or it can also be sent back to the MC box by the safety ECU. According to at least one embodiment, a data transfer between the BSC box and the MC box can only be routed directly, i.e. without being redirected via the security ECU, if data is sent from the BSC box to the MC box.

According to at least one embodiment, the BSC box exchanges data, preferably bidirectional data exchange, with a vehicle safety system, for example an airbag controller, the BXC box exchanges data with an emergency seat controller, an emergency braking system and/or another vehicle assistance system.

However, data communication between the BSC box and the MC box can be unidirectional, i. H. exclusively starting from the BSC box to the MC box. A direct exchange of data between the MC box and the BSC box is therefore excluded in at least one embodiment of the above-mentioned invention. This ensures that the MC-Box cannot communicate directly with the BSC-Box and then transmit any error data or even viruses to the BSC-Box. In at least one embodiment of the present invention, only communication from the MC box to the BSC box can take place via the security ECU.

According to at least one embodiment, the IP box is in data exchange with a charging station and/or a vehicle battery, in particular in order to be able to charge the vehicle battery.

The IP box can therefore be such a unit which, as already mentioned above, is preferably constructed as a SoC unit, a unit which regulates a corresponding battery and, in particular, charging management.

In this respect, the IP box is a kind of "powertrain box" that monitors and monitors the safety and performance of the vehicle and monitors and monitors the battery management. For this purpose, the IP box can be controlled separately and/or the IP box controls charging channels, for example direct current or alternating current charging channels, separately by means of corresponding control commands.

This can be done via a corresponding distribution matrix, which is part of the IP box. The distribution matrix is therefore a control element that is able to unlock and/or control and/or regulate corresponding charge channels or energy channels.

The data exchange between the IP box and the BSC box is preferably redundant and/or bidirectional. For example, it is conceivable that in the event of a partial failure of the functions of the IP box, this function is at least partially and/or at least temporarily taken over by the BSC box, which is actually responsible for the passenger's security management. A failure of the IP box can therefore be compensated for at least partially, but preferably completely. The reverse model is also possible, according to which the BSC box can relate in at least one embodiment to, as already mentioned above, sensor management, in particular relating to passenger safety management and/or vehicle safety management. For this purpose, the BSC box can take over the functions of passenger well-being.

An "Al-based sensor fusion function" is conceivable here, which is connected to a passenger safety manager and an "environmental perspective function" as well as any other driver, safety and manager systems within the BSC box.

A system or a data set can be considered compromised when the owner of the system, a database or a data set no longer has control over the correct functioning and its security.

A system, database or even a single record is considered compromised when data could be tampered with and when the owner (or administrator) of the system no longer has control over the correct functioning or correct content, or an attacker controls another reached the goal of the manipulation.

Here, an attacker is understood to mean a user who is not authorized to access the system but who has gained access. It is not decisive whether the unauthorized and uncontrolled access is intentional or unintentional. It is essential that the integrity of the stored information can no longer be guaranteed. Incorrect data (= program errors) that are not intended for controlling the system can also be considered compromised.

Such program errors or software errors or software anomalies, often also called bugs, are terms from software technology used to describe deviations from a required or desired target state for software system components. These can occur when B. a certain definition of the specification is incorrect or has been implemented incorrectly, and initially leads to an internal error state in the program, which in turn leads to unexpected behavior or results occurring during program execution.

In at least one embodiment, the security gate claimed here is a program which is executed by the security ECU, with the security gate having to pass all data from the MC box and/or the BSC box. As soon as it is passed, the corresponding data set to be transmitted is checked for compromises and/or errors.

If a compromise and/or an error is detected by the security gate, the security gate prevents this data record from being forwarded to the MC box and/or to the BSC box. It is therefore possible that the entire data set is therefore deleted or stored on a data medium in the safety ECU, but is separated from the system and any other data sets. This separation can be software-based. It is therefore also conceivable that the damaged data (compromised and/or containing errors) is then isolated on the security ECU and analyzed in more detail. In any case, damaged data sets are stopped by the security gate and are not used to control any actuators or sensors etc. However, the system itself can be set up in such a way that the damaged data is extracted from a larger data set, but the rest of the data set is then extracted allowed to pass through the security gate. Alternatively, however, it is also conceivable that the security gate removes the entire data set from the data flow.

In any case, error warnings or even a shutdown of the entire system are possible.

Errors that occur are generally processed systematically in error management. According to the IEEE standard 1044 (classification of software anomalies), each error goes through a so-called classification process, consisting of the four steps of detection Recognition, Analysis, Investigation, Action, and Disposition. In each of these steps, the management activities Recording, Classifying, Identifying Impact are performed.

Criteria according to which errors can be classified are u. a. (with examples):

• the type of error: According to informatik.uni-oldenburg.de, a distinction is made between: lexical errors (unknown reference), syntactic errors (forgotten semicolon), semantic errors (wrong declaration), runtime errors (wrongly formatted input data) and logical errors (plus instead of minus, loop error, ...)

• the cause of the error: imprecise specification, transposed digits, wrong formula, unchecked (wrong) input data...

• the point in time at which the error occurred ('mistake'): as early as the program specification, in the code draft, during coding,...

• The time at which the error occurred ('fire effect'): A fundamental difference arises from whether the error occurs during program development, for example during testing (here this is a normal case) or in productive operation (where it often represents a critical disruption). ).

• the time of discovery: the longer the "fault dwell time", the more complex i. A. Corrective action passed.

• the effect(s) of the error: display error, incorrect result, program termination, external impact...

• Effort and duration for troubleshooting: minimal ... very high; immediately ... very long duration;

• Processing status: occurred, examined, correction request in progress, retest possible, ... , done

With the help of metrics, “the results [and knowledge about errors] should also be a reason to search for the causes behind the problems”. "Error classifications form the basis for standardized procedures for error handling and also support continuous quality improvement in the sense of quality management." For more information, see the BITKOM guide. To simplify things, program errors in the error processing process are often only divided into categories/classes such as A, B, C... or 1, 2, 3... etc. according to the error severity, which also includes the error effect and the effort required to correct it. See BITKOM guidelines for examples.

The BSC box therefore preferably receives the corresponding passenger data, in particular related to the temperature of the passenger, for example the skin temperature, weight of the passenger, eye movement or other biological characteristics, through direct data exchange with a corresponding sensor and/or sensor network.

Such a sensor can include at least one capacitor with at least two electrodes, which are arranged in a horizontal direction along and on a flexible carrier material to one another, with at least one dielectric layer being arranged between the electrodes, so that on a side facing away from the carrier material at least one electrode and/or dielectric layer, at least one at least partially liquid-permeable and/or liquid-absorbent moisture layer is arranged at least in places, with the electrodes and/or the dielectric layer being arranged in a transverse direction between the carrier material and the moisture layer, so that a capacitance develops changed at least partially by the liquid at least partially hitting the dielectric layer, with a processing unit being directed and provided for measuring and/or storing this change, so that a capacitive the humidity sensor is created, the sensor also being a capacitive pressure sensor, the processing unit being additionally set up and provided for this purpose to measure and/or store a change in capacitance of the capacitor caused by external pressure, and further a capacitive pressure sensor being such a in which the change in capacitance as a result of the bending of a membrane and the resulting change in the distance between the plates is evaluated as a sensor effect, so that the membrane is the dielectric layer or the individual capacitor electrodes, with the sensor having at least one additional capacitor, which is arranged in the transverse direction above or below the capacitor and spaced apart from the capacitor by a further water-impermeable layer on top of or below this further water-impermeable layer, so that a capacitor stack is formed, and further wherein both capacitors are constructed in the same way, and further wherein the two sensors forming the capacitor stack perform the same tasks.

According to at least one embodiment, the BC box receives sensor data from active and/or passive vehicle sensors, in particular in order to be able to forward this data to the vehicle assistance system in whole or in part or in a partially modified form.

According to at least one embodiment, data fusion for data analysis is carried out by various sensors and/or sensor functions within the S-Box.

According to at least one embodiment, the data fusion is carried out on the basis of an AI machine (Artificial Intelligence Machine), in particular with dynamically changing sensor data from the sensors being transmitted during operation, for example only between local AI nodes of a common AI system and further, wherein a Kl node is such a data node that is formed from at least two data streams.

According to at least one embodiment, the security gate is set up and intended to check data transmitted from the MC box to the security box, in particular update data for updating the vehicle assistance system, for data compression, and only after such a compression check of this data at least partially forwarded to the BS box.

According to at least one embodiment, the security box comprises at least one device for vehicle fleet management and/or vehicle parking position management, so that (update) data obtained via the MC box controls and/or changes fleet management and/or parking position management.

Furthermore, the present application relates to a method for operating a vehicle data communication system for the transmission of vehicle data between the processing boxes of the system by means of a vehicle data communication system.

This means that all features disclosed for the vehicle data communication system described here are also disclosed for the method described here and vice versa. According to at least one embodiment, in the method for operating a vehicle data communication system for transmitting vehicle data between processing boxes of the system, using a vehicle data communication system, data is only exchanged bidirectionally between the MC box and the BSC box if this data is exchanged via a safety ECU ( Security ECU) so that the security ECU can determine any data compressions originating from the MC-Box on the basis of at least one security gate.

According to at least one embodiment, the IP box uses (integrated powertrain control and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data relating to passenger data and/or data with regard to energy management of the vehicle and for data exchange with a charging station and/or a vehicle battery, in particular in order to be able to charge the vehicle battery, whereby for recording, managing, playing back and/or storing data with regard to passenger data and/or data with regard to energy management of the Vehicle are used, the data between an MC box (Media and Communication Box) and a BSC box (Body & Safety Control Box), in particular can only be exchanged bidirectionally if this data with the help of a security ECU ( Security ECU) flow, so that the security ECU emanates from the MC box on the basis of at least one security gate nde data compression can determine, the IP box also comprising a first IP module, which controls a first set of administrative functions and/or security aspects, such as vehicle monitoring and/or driver health monitoring, within a vehicle and/or or monitors, and, in particular at the same time, the IP module within a vehicle controls, regulates and/or monitors a second set of management aspects, such as battery management and/or a battery state of charge, which is characterized in that a management function between the two IP modules during operation at least partially and / or at least temporarily redundant and / or bidirectional.

According to at least one embodiment, the IP box is formed by at least one SoC “system-on-a-chip method”, whereby one is also referred to as a system-on-a-chip (SoC, dt. One-chip system). system-on-chip, the integration of all or a large part of the radio functions of a configurable and/or programmable electronic system in a chip, for example an integrated circuit (IC) on a semiconductor substrate, also called monolithic integration.

According to at least one embodiment, the IP box has at least one distribution matrix, which is in bidirectional data exchange and/or energy exchange with at least one IP module and the distribution matrix is in bidirectional exchange with a connection matrix, the connection matrix having at least one DC/DC power connection, an inverter power connection and a charging connection (charging/grid), so that the distribution matrix has the DC/DC power connection, the inverter power connection and the charging connection (charging/grid) via a programmed or manual setting. can be controlled separately or together.

According to at least one embodiment, data are at least one of the IP modules bidirectional with at least one of the DC/DC power connection, the inverter power connection and the charging connection (charging/grid) directly, i.e. without previously running or running via the connection matrix having to exchange data.

According to at least one embodiment, at least one motor, in particular an electric motor, is connected to the INV power connection and can be operated via the INV power connection.

According to at least one embodiment, the IP Power Box controls, preferably regulates, in particular by means of the DC/DC power connection and/or the charging connection (charging/grid), charging management, in particular data communication of an external charging station and charging and/or discharging of a vehicle battery , to drive the motor.

According to at least one embodiment, the method for operating an IP box (integrated powertrain controller and/or control box for controlling and/or monitoring the powertrain system) uses to record, manage, play back and/or store data relating to passenger data and/or data with regard to energy management of the vehicle and for data exchange with a charging station and/or a vehicle battery, in particular in order to be able to charge the vehicle battery, with the purpose of recording, managing, playing and/or storing data with regard to passenger data Data and/or data relating to energy management of the vehicle are used, with the data between an MC box (Media and Communication Box) and a BSC box (Body & Safety Control Box), in particular only being exchangeable bidirectionally if this data flow with the help of a security ECU (security ECU), so that the security ECU can determine any data compressions originating from the MC box on the basis of at least one security gate, the IP box also comprising a first IP module, which controls, regulates and/or monitors a first set of administrative functions and/or safety aspects within a vehicle, such as vehicle monitoring and/or driver health monitoring, and, in particular at the same time, the IP module within a vehicle a second set of administrative functions aspects, such as battery management and/or a battery state of charge, controls, regulates and/or monitors what is there characterized in that a management function between the two IP modules is at least partially and/or at least temporarily redundant and/or bidirectional during operation.

The invention is described in more detail below with reference to a figure and the corresponding reference signs.

1 shows the IP box (integrated powertrain controller and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data with regard to passenger data and/or data with regard to energy management of the vehicle and for data exchange with a charging station and/or a vehicle battery, in particular to be able to charge the vehicle battery, for recording, managing, playing back and/or storing data with regard to passenger data and/or data with regard to energy management of the vehicle zeugs, the data between an MC box (1) (Media and Communication Box) and a BSC box (2) (Body & Safety Control Box), in particular only bidirectionally from exchangeable, if this data using a Security ECU (Security ECU) so that the security ECU determines any data compressions originating from the MC box on the basis of at least one security gate ellen, wherein the IP box also comprises a first IP module, which controls, regulates and/or monitors a first set of administrative functions and/or safety aspects, such as vehicle monitoring and/or driver health monitoring, within a vehicle , And, in particular at the same time, the IP module within a vehicle to a second set Management aspects, such as battery management and/or a battery state of charge, regulates and/or monitors, which is characterized in that a management function between the two IP modules is at least partially and/or at least temporarily redundant and/or bidirectional during operation at least one management function between the two IP modules (12) during operation is at least partially and/or at least temporarily redundant and/or bidirectional in at least one of the IP modules (12) at least temporarily stored, in particular stored, and / or exchanged at least once between the two IP modules (12), in particular with this data comparison avoiding data loss and/or data compromising of this management function in one of the two IP modules (12), further in particular with this management function is the one that controls, regulates and/or both IP modules (12). monitor, and for this management function the above mentioned data validation is feasible.

FIG. 1 also shows the IP box (integrated powertrain controller and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data with regard to passenger data and/or data with regard to energy management of the vehicle and for data exchange with a charging station and/or a vehicle battery, in particular to be able to charge the vehicle battery, for recording, managing, playing and/or storing audio and/or video data in digital and/or analog form, at least one BSC box 2 (Body & Safety Control Box) for recording, managing, playing back and/or storing data by means of which actuators in a vehicle can be addressed in order to protect a passenger from physical damage in an alarm state, and at least one IP -Box 3 (integrated powertrain box) for recording, managing, playing back and/or storing data regarding passenger data and/or data hi nsicht includes an energy management of the vehicle, with data between the MC box 1 and the BSC box 2 can only be exchanged bidirectionally if this data flows with the help of a security ECU (Security ECU), so that the security ECU is based at least one security gate can detect any data compression coming from the MC-Box 1.

It can also be seen from FIG. 1 that the IP box is formed by at least one SoC “system-on-a-chip method, with a system-on-a-chip (SoC, dt. Ein- Chip system), also called system-on-chip, one integrating all or one large Part of the functions of a configurable and / or programmable electronic Sys tems in a chip, such as an integrated circuit (IC) on a semiconductor substrate, also called monolithic integration understands.

A data transfer between the BSC box 2 and the MC box 1 can only be routed directly, i.e. without diversion, via the security ECU if data are sent from the BSC box 2 to the MC box 1 .

It can also be seen from FIG. 1 that the IP box has at least one distribution matrix, which is in bidirectional data exchange and/or energy exchange with at least one IP module, and the distribution matrix on the other hand is in bidirectional exchange with a connection matrix , the connection matrix having at least one DC/DC power connection, an inverter power connection and a charging connection (charging/grid), so that the distribution matrix has a programmed or manual setting for the DC/DC power connection, the inverter power connection and the Charging connection (charging/grid) can be controlled separately or together.

The BSC box 2 exchanges data, preferably bidirectional data exchange, with a vehicle safety system, for example an airbag controller, the BXC box 2 exchanges data with an emergency seat controller, an emergency braking system and/or another vehicle assistance system, with the IP box 3 is in data exchange with a charging station 4 and/or a vehicle battery 5, in particular in order to be able to charge the vehicle battery 5.

It can also be seen from Figure 1 that the data of at least one of the IP modules is sent bidirectionally to at least one of the DC/DC power connection, the inverter power connection and the charging connection (charging/grid) directly, i.e. without having to go through the to walk or have to walk in connection matrix, to be in data exchange.

It can be seen that at least one motor, in particular an electric motor, is connected to the INV power connection and can be operated via the INV power connection. The BSC box 2 receives sensor data from active and/or passive vehicle sensors, in particular in order to be able to forward this data to the vehicle assistance system in whole or in part or in a partially modified form.

It can be seen that the IP Power Box, in particular by means of the DC/DC power connection and the charging connection (charging/grid), provides charging management, in particular data communication with an external charging station and charging and/or discharging a vehicle battery, to drive the motor , controls, preferably regulates.

Within the S-Box, a data fusion is carried out from various sensors and/or sensor functions for data analysis, the data fusion being carried out on the basis of an AI machine (Artificial Intelligence Machine), in particular with the sensor data of the sensors changing dynamically during operation , For example, only between local Kl-node of a common Kl-system are transmitted and further, wherein a Kl-node is such a data node, which is formed from at least two data streams.

It can also be seen from Figure 1 that the security gate is set up and provided for checking data transmitted from the MC box 1 to the security box, in particular update data for updating the vehicle assistance system, for data compression, and only after such a compression check, this data is at least partially forwarded to the BS box 2.

The security box comprises at least one device for vehicle fleet management and/or vehicle parking position management, so that the (update) data obtained via the MC box 1 control and/or change the fleet management and/or parking position management.

1 is also a method for operating an IP box (integrated powertrain control and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data with regard to passenger data and / or data regarding an energy management of the vehicle as well as for data exchange with a charging station (4) and/or a vehicle battery (5), in particular to be able to charge the vehicle battery (5), whereby for charging taking, managing, playing and/or storing data relating to passenger data and/or data relating to energy management of the vehicle, with the data being exchanged between an MC box (1) (media and communication box) and a BSC box (2nd ) (Body & Safety Control Box), in particular only then can be exchanged bidirectionally if this data flows via a security ECU (Security ECU), so that the security ECU, on the basis of at least one security gate, compresses any data coming from the MC-Box determines, wherein the IP box also comprises a first IP module, which controls, regulates and/or monitors a first set of management functions and/or security aspects within a vehicle, such as vehicle monitoring and/or driver health monitoring , and, in particular at the same time, the IP module within a vehicle a second set of management aspects, such as battery management and / or e controls, regulates and/or monitors a battery state of charge, which is characterized in that a management function between the two IP modules is at least partially and/or at least temporarily redundant and/or bidirectional during operation.

In the method for operating a vehicle data communication system for transmitting vehicle data between processing boxes 1, 2, 3 of the system, using a vehicle data communication system, data is only exchanged bidirectionally between the MC box 1 and the BSC box 2 if this data has a security - ECU (Security ECU) flow, so that the security ECU based on at least one safety gate can detect any outgoing data from the MC-Box 1 compression.

It can also be seen that the IP box 3 is connected to a corresponding charging station 4, a motor 6 and/or a battery 5 in order to regulate a charging or discharging process, in particular in the sense of a drive process and/or to control.

It can also be seen that the individual arrows relating to BSC box 2 mean that BSC box 2 can be connected to an airbag, a seat or some other emergency device. A corresponding intervention and/or control and/or regulation can also be seen, in particular in relation to a dynamic vehicle stability device or traffic number recognition or another assistance system, for example in relation to the steering, the braking or the damping/suspension. The redundancy and bidirectionality and/or unidirectionality can also be recognized directly by the individual, different arrow directions between the MC box 1, the BSC box 2 and the IP box 3.

As can be seen from FIG. 1A, the BSC box 2 and the IP box 3 are designed to be integrated with one another, preferably integrated in such a way that they are arranged on a common substrate, for example in the form of an SOC substrate. Both units can therefore share a common, continuous and preferably one-story SOC substrate.

Figure 1 shows that, alternatively or additionally, several base or carrier substrates can also be installed, which, however, are then jointly connected to one another, so that the BSC box and the IP box 3 result in a common, to be integrated and in component to be installed in the vehicle, for example in the form of an "Applebox".

The same was done with the merging of the MC box 1 and the security ECU 7 . These two are also based on a common SOC principle. Preferably, these two boxes are also integrated on a common substrate, for example a silicon substrate, preferably installed monolithically integrated with one another. The BSC box 2 and the IP box 3 can also be integrated with one another.

Together, the BSC box 2 and the IP box 3 can result in a CDI and C box (Central Drive Intelligence and Control Box).

The same can also be devised for the MC box. This can be interpreted as an M and C box (Media and Communication Box).

Also shown in FIG. 1 is that only the security ECU 7 with the M and C box is implemented there on a common SOC substrate, whereas the BSC box 2 and the IP box 3 are each on separate substrates, in particular Separately arranged components, i.e. in separate boxes in the form of an “Apple box”. However, the individual functions can be identical in both versions, independently of the individual exemplary embodiments, with the different construction space requirements, form factor and corresponding installation space installation time of course being adapted here.

reference list

1 MC box

2 BSC box 3 IP box

4 charging station

5 vehicle battery

6 Engine 7 Security ECU 8 Sensor data

9 DC/DC power

10 Inverter power connection 11 Charging/Grid 12 IP module 13 Distribution matrix

400 procedures

Claims

Vehicle data communication system for the transmission of vehicle data patent claims

1 . IP box (3) (integrated powertrain controller and/or control box for controlling and/or monitoring the powertrain system) for recording, managing, playing and/or storing data relating to passenger data and/or data relating to energy management of the vehicle and for data exchange with a charging station (4) and/or a vehicle battery (5), in particular in order to be able to charge the vehicle battery (5), for recording, managing, playing back and/or storing data with regard to passenger data and/or or data relating to energy management of the vehicle, the data between an MC box (1) (media and communication box) and a BSC box (2) (body and safety control box), in particular only then being interchangeable bidirectionally , provided that this data flows with the help of a security ECU (Security ECU), so that the security ECU determines any data compressions originating from the MC box on the basis of at least one security gate can, wherein the IP box (3) further includes a first IP module (12), which controls a first set of management functions and/or security aspects, such as vehicle monitoring and/or driver health monitoring, within a vehicle and/or monitors and, in particular at the same time, another IP module (12) within a vehicle controls, regulates and/or monitors a second set of management aspects and/or management functions, such as battery management, characterized in that at least a management function between the two IP modules (12) during operation at least partially and/or at least temporarily redundantly and/or bidirectionally stored, in particular stored, at least temporarily in at least one of the IP modules (12) and/or between the two IP modules (12) is exchanged at least once, in particular with this data comparison resulting in data loss and/or e A data compromise of this management function in one of the two IP modules (12) is avoided, more particularly where this management function is the one that controls both IP modules (12), re- valid and/or monitor, and for this management function the above mentioned data validation is feasible.

2. IP box (3) according to claim 1, characterized in that the IP box (3) is formed by at least one SoC "system-on-a-chip method, with one under a system-on-a -Chip (SoC, dt. Ein-Chip-System), also System-on-Chip, one means the integration of all or a large part of the functions of a configurable and/or programmable electronic system in one chip, for example an integrated circuit ( IC) on a semiconductor substrate, also called monolithic integration.

3. IP box (3) according to claim 2, characterized in that the IP box (3) has at least one distribution matrix, which is in bidirectional lem data exchange and / or energy exchange with at least one IP module (12), and the distribution matrix on the other hand being in bidirectional exchange with a connection matrix, the connection matrix having at least one DC/DC power connection (9), one inverter power connection (10) and one charging connection (charging/grid) (11), so that the Distribution matrix (8) can control the DC/DC power connection (9), the inverter power connection (10) and the charging connection (charging/grid) (11) separately or together via a programmed or manual setting.

4. IP box (3) according to the preceding claim, characterized in that

At least one of the IP modules transmits data bidirectionally to at least one of the DC/DC power connection (9), the inverter power connection (10) and the charging connection (charging/grid) (11) directly, i.e. without first using the connection matrix to walk or have to walk, is in data exchange.

5. IP box (3) according to the preceding claim, characterized in that at least one motor (6), in particular an electric motor, is connected to the INV power connection and can be operated via the INV power connection.

6. IP box (3) according to the preceding claim, characterized in that the IP power box, in particular by means of the DC / DC power connection (9), and / or the charging connection (charging / grid) (11) a charging management, in particular controls, preferably regulates, data communication from an external charging station (4) and charging and/or discharging a vehicle battery (5) to drive the motor (6).

7. Method (400) for operating an IP box (3) (Integrated Powertrain Box) for data exchange with a charging station (4) and/or a vehicle battery (5), in particular in order to be able to charge the vehicle battery (5). , Wherein for recording, managing, playing, and / or storing data regarding passenger data and / or data regarding an energy management of the vehicle, the data between an MC box (1) (media and communication box) and a BSC box (2) (Body & Safety Control Box), in particular only then exchanged bidirectionally, provided this data flows via a security ECU (Security ECU), so that the security ECU on the basis of at least one security gate any of the MC -Box determines outgoing data compression, the IP box (3) also comprising a first IP module (12) which within a vehicle has a first set of management functions and/or security aspects, such as vehicle monitoring and the like nd/or driver health monitoring, controls, regulates and/or monitors, and, in particular at the same time, the IP module (12) controls, regulates and/or within a vehicle a second set of management aspects, such as battery management and/or a battery state of charge monitored, characterized in that a management function between the two IP modules (12) is at least partially and/or at least temporarily redundant and/or bidirectional during operation.