Safe transmission of data in connected vehicles – the backbone of modern mobility

Modern cars have developed into connected high-tech systems. Autonomous vehicles, in particular, generate large quantities of data that has to be transmitted in real time. Safe transmission of these data flows is crucial as a failure or data communication error can have serious consequences in situations critical to safety. To avoid this, automotive manufacturers and their suppliers are massively investing in reliable data transmission technologies. So what are these technologies and what makes them so safe?

The flood of data and increasing demands

The quantities of data generated in vehicles have been continuously increasing for years. Sensors for Advanced Driver Assistance Systems (ADAS) – from cameras to radar and LiDAR – generate streams of data in the gigabit range. Modern test vehicles for highly automated driving are already reaching data rates of around 5 Gbit/s (approx. 625 MB/s). Individual high-resolution cameras can take up bandwidths of up to 3.5 Gbit/s. This huge flood of data must be distributed around the vehicle without any time lag so that central control units can make the right decisions in a fraction of a second. At the same time, new functions are requiring data paths to be increasingly reliable. For instance, time-critical information such as brake commands or collision warnings must not get lost or arrive too late under any circumstances. Therefore, the key requirements for on-board networks are high bandwidth, reliability/safety and low latency. To meet these requirements, modern vehicles are increasingly relying on a standardized, Ethernet-based on-board network. Compared to the previous, heterogeneous networks (CAN, LIN, FlexRay, MOST, etc.), Ethernet offers scalability and – thanks to new protocol extensions – mechanisms which ensure the best possible latencies and fail-safe operation. Some of today’s vehicles are equipped with over 150 control devices that exchange data. Without a high-performance network, this increasing complexity would be virtually impossible to control.

Data cables and connectors

Data cables in vehicles are the backbone of modern on-board network architectures. Today, twisted copper cables, usually designed as Single Pair Ethernet (SPE), are mainly used. The advantage of twisted pair cables is that they can significantly reduce interference factors and crosstalk. By choosing between unshielded and shielded variants, a suitable EMC (electromagnetic compatibility) concept can be implemented. Shielded twisted pair cables are typically used in environments with high interference radiation (e.g. near electric motors), whereas in “quieter” areas, unshielded cables reduce weight and save on costs. The mechanical load capacity is also important: vehicle cables must be able to resist vibrations, temperature fluctuations and humidity for many years without losing their transmission quality. Connectors are just as critical; they are crucial to ensuring that data connections remain stable in the long term, even when subjected to vibrations. Unlike in the building sector where RJ45 connectors are mostly used, the automotive industry relies on special, robust connector systems. These are equipped with screws or locks which reliably prevent the connection from unintentionally becoming loose in the event of vibrations. Such high-performance connectors meet all current automotive standards and can be used with different cable types (STP, UTP, etc.). Additional safety mechanisms exist for safety-critical applications (e.g. autonomous driving functions), such as Connector Position Assurance (CPA), which is a mechanism designed to prevent unintentional loosening of connectors and only engages when the connection is fully inserted. This type of hardware innovation by suppliers ensures that data paths remain permanently stable even in harsh environments. With the future in mind, discussions are already focusing on optical data transmission technologies that are not only best suited to extreme bandwidths but also have a huge level of electromagnetic compatibility.

Protocols, standards and committees 

Ethernet, which has been adapted to the special requirements in the vehicle, has established itself as a communicative “language” in vehicle networks. Unlike standard Ethernet such as that used in offices (with four wire pairs), Single Pair Ethernet (SPE) or “Automotive Ethernet” is used in vehicles. This uses just one twisted pair of wires which saves space and weight, and is particularly suitable for the confined and demanding conditions in the vehicle.

In this context, standards play a key role: they ensure the smooth interaction of components made by different manufacturers, they define binding performance and test criteria and they enable reliable scaling of new technologies in large-scale production. Without internationally recognized standards such as the IEEE standards or OPEN Alliance test specifications, uniform, safe and interoperable Ethernet communication in the vehicle would hardly be feasible – particularly given the short cycle times and high quality demands of modern vehicles. Therefore, these standards are essential for OEMs and suppliers in order to minimize development risks, pass certifications and secure technological investments in the long term.

These standards also ensure that critical systems, such as emergency stop assist, lane keeping assist or autonomous driving decisions can be reliably controlled via standardized, robust communication paths – a basic element for ensuring functional safety and freedom from error in safety-critical vehicle architectures.

Important standards include:

➔100BASE-T1 (IEEE 802.3bw) – 100 Mbit/s over a single copper pair. Has been in use in series-produced vehicles for several years now, e.g. for camera and sensor data.

➔1000BASE-T1 (IEEE 802.3bp) – 1 Mbit/s over a single copper-wire pair. Serves as a gigabit backbone in the vehicle via which several control units (ECUs) can communicate with each other at high speed. Gigabit-Ethernet is now used e.g. for central infotainment networks and ADAS sensor fusion.

➔2.5/ 5/ 10GBASE-T1 (IEEE 802.3ch) – 2.5/5/10 Mbit/s over a single copper-wire pair. Serves as a multi-gigabit backbone in the vehicle via which several control units (ECUs) can communicate with each other at high speed.

➔10BASE-T1S (IEEE 802.3cg) – 10 Mbit/s over a single copper-wire pair with multidrop bus capability. This standard enables several sensors/actuators to be connected to the same cable, which requires minimal wiring and reduces weight. 10BASE-T1S is particularly suitable for simple sensors/actuators in zone architectures so that each small node does not require its own cable connection to the central switch.

Another important standard is ISO 26262 (Functional Safety). This international standard governs the functional safety of electrical and electronic systems in road vehicles and defines how risks must be systematically identified, assessed and minimized. Network components for safety-critical functions must be classified according to ASIL (Automotive Safety Integrity Levels) – from ASIL A (low risk) to ASIL D (high risk). For example, NXP, a world-leading semi-conductor manufacturer with a strong focus on automotive applications, offers an ASIL-B-compliant 1000BASE-T1 transceiver – i.e. an Ethernet transformer for gigabit communication over a single twisted copper pair which has been specially developed for use in safety-critical vehicle architectures, and supports enhanced diagnosis and safety functions such as integrated fault tolerance and status monitoring. Such components are relevant to safety because they ensure that essential data – i.e. for steering, braking or collision avoidance – is also reliably transmitted in the event of malfunctions. Smooth communication between the systems is a prerequisite for detecting malfunctions and interrupting failure paths.

Redundancy and functional safety

High data rates alone are not enough – networks also need to be fail-safe. According to ISO 26262, individual faults may not lead to a loss of safety function. For this reason, redundancy concepts are used in E/E/ architectures. One use is physical redundancy: critical sensors or actuators (e.g. for steer-by-wire systems) are connected to control units via two independent data cables. If one connection fails, the second takes over. To this are added redundancies on the protocol side, e.g. via frame replication. Each safety-critical data package is sent at the same time via two different paths in the network (defined in IEEE 802.1CB as time-sensitive networking extensions). The recipient uses the first error-free package and rejects any duplicates. Time-Sensitive Networking (TSN), an extension of the IEEE 802.1 standard for determined, time-critical data transmission, enables deterministic communication with very low latency times through time synchronization, time-controlled data transmission and flow control. In this way, braking or steering functions can be processed via Ethernet without delayed or lost packages leading to dangerous situations.

Zone architecture as a future model

Another trend is E/E zone architecture. Instead of many distributed domain control units (for the engine, power transmission and chassis, etc.), a few central high-performance computers and zone control units are used in the vehicle zones (front, rear, left and right). These zone control units combine the sensors and actuators in their zone and communicate with the central computer via high-performance data cables. In the process, automotive Ethernet is the key technology used to connect the zones to the central computer (regularly serving as the gigabit backbone). At the same time, a single 10BASE-T1S bus line inside the zone interconnects the local sensors and actuators. Not only does this combination significantly reduce the length, complexity and weight of the wiring as each sensor no longer requires its own cable connection to the central system, but, in addition, the zone architecture also plays an important role in ensuring functional safety. Local errors – such as a defective sensor or a faulty connection – are restricted to the respective zone and do not affect the entire vehicle network. The clear separation of responsibilities within the zones enables better fault diagnosis and restriction of faults and therefore ensures a faster reaction to faults. Redundancy can also be implemented in a more targeted manner as safety-critical functions can be directly secured in several zones. This modularization ensures that, in the event of a malfunction, the vehicle can be brought to a safe state in a controlled manner – a key requirement in the context of ISO 26262 and autonomous driving.