Patent Description:
The invention relates to the technical field of automotive ethernet connectivity, as for example defined in IEEE Std. 3TM-<NUM> - IEEE Standard for Ethernet. Particularly, the invention relates to reliable communication links for safety critical applications in cars. In such applications failure modes of data transmission must be prevented, which are for example loss of communication peer, message corruption, message unacceptable delay, message loss, unintended message repetition, incorrect sequencing of messages, message insertion, message masquerading, message incorrect addressing or similar failures (see for example ISO <NUM>-<NUM>:<NUM>€ Annex D.

Faults shall be detected within a low fault detection time interval (FDTI) and be handled within a short fault handling time interval (FHTI), which brings the system to a safe state. The safe state is ideally safe operational, in the sense that data communication of safety critical communication links is still possible in case of a failure. This is important for applications like drive-by-wire or brake-by-wire.

From the prior art it is known to provide end-to-end protection of ethernet data transfers on the OSI (Open Systems Interconnection model) application layer. For example, AUTOSAR E2E Protocol Specification discloses to end-to-end data protection for sending data from one node to another node by attaching a checksum generated by the application layer to the payload data, before sending the payload data. The receiving application receives the payload data including the checksum and checks the data integrity before using the data by calculating the checksum for the received payload data and comparing this calculated checksum with the received checksum attached to payload data. This approach has the advantage, that the full communication chain of data between two applications is covered. For example, if a data package gets corrupted within an ECU (Electronic Control Unit) or even inside one processor due to a lack of failure mechanisms (e.g. ECC (Error Correcting Code) memory), the application can check the integrity of each data package. This approach has the disadvantage that the application can only detect an integrity issue, but not the reason for the integrity issue. Furthermore, integrity issues can only be detected if the receiving nodes receives any data and the sender cannot find out anything at all. Safety mechanisms for event-based messages are not possible at all, because an application has no prediction, when to receive a message.

Additionally, random failures can occur. The application cannot switch to a degradation mode after one or two corrupted packages because it could be a random failure. For CAN-based (Controller Area Network) communication it is common to accept up to <NUM> corrupted packages before going into any degradation mode. For a message, that is received cyclically in <NUM> cycle time, a degradation mode can earliest be started after <NUM>, which can be problematic for safety critical communication links.

From the prior art it is also known to provide data protection of ethernet data transfers on the OSI transport layer. In this case it must be distinguished between connected and connectionless transport protocols because of their different data integrity capabilities.

Connected transport protocols (like TCP) are usually not used for safety related communication, even they offer some interesting reliability features like message acknowledge and message resend. For real-time protocols transport protocols have some disadvantages that also lead to nondeterministic reliability. Establishing connections is a complex process with many states. The state-machines for the connection handling have to be fully defined and free of dead or life locks on both sides. Message acknowledges and message resends can lead to undefined bus load scenarios up to full bus congestion. Critical messages always need an open connection. Either the connection has to be always open, which creates unnecessary overhead and traffic, or has to be established before sending the message, which is highly risky. Furthermore, connected transport protocols usually only support point to point connections. Unicast or broadcast scenarios have a very high protocol complexity and implementations are not commonly used.

Connectionless transport protocols (like UDP) are not so feature rich for data reliability features, but much easier to handle and also support multi-cast and broad-cast, which is quite interesting for state of the art applications that e.g. use brokerless publish subscribe architectures (e.g. OMG DDS). The main reliability feature connectionless transport protocols can implement is another data checksum on top of the OSI data link layer.

From the prior art it is further known to provide data protection of ethernet data transfers on the OSI data-link layer. The main function of a data link layer is, to form a data package from a symbol stream and check its integrity. Therefore, data packages are typically extended by a CRC (Cyclic Redundancy Check) on the sender side and the data integrity is checked by the CRC on the receiver side. The CRC can be used as strong feature for data integrity. However, check can only be done if data is received on the received side. If the sender needs to know about a malfunctioning receiver side, e.g. for data re-routing, the data-link-layer does not support this.

<CIT> presents a solution for safety critical ethernet data transmission by using two redundant physical layers. The check of the channel health condition is done by loopback tests, where multiple levels of loopbacks are proposed on MAC (Media Access Control) and physical layer level. This has the drawback that additional loopback data has to be send and the link is not operational during the loopback testing.

<CIT> discloses a redundant ethernet data link where channels are switched using a relay circuit directly at the MDI (Media Dependent Interface) of the transceiver to provide a bypath path over an ethernet physical layer.

According to <CIT> errors within ethernet Frames on the physical layer level can be detected by checking the CRC checksum that is generated by the MAC within the physical layer. However, <CIT> does not define what "one specified or specifiable action" is to be executed in case a CRC check fails. Another method for checking CRCs within ethernet frames has been disclosed in <CIT>.

<CIT> proposes to detect failures of ethernet communication channels by generation and sending of a periodic test signal over the link. This has the drawback that during test signal transmission no payload signal can be send over the link and the fault detect time interval is limited to the period of the test signal transmission. <CIT> only reports the indication of a link failure and not the reaction to it.

<CIT> discloses a redundant data link for data packet transmission where data packets are transmitted over several routes from a first transceiver to a second transceiver and are compared at the second transceiver. This mechanism does not work without payload data streams.

<CIT> discloses physical layer Ethernet bit stream handling, where a Serial Interface Adaptor Transceiver unit has two Ethernet channels. The Serial Interface Adaptor Transceiver unit detect a fault on the first Ethernet channel and switches the Ethernet traffic from the first Ethernet channel to the second Ethernet channel.

It is an object of the present invention to ensure reliable transmission of safety critical ethernet packets between two ethernet devices. Re-routing of safety critical ethernet packets between the two ethernet devices over a redundant link must be provided and the solution must be compliant with ethernet devices from the prior art.

The object is solved by an ethernet device with safety features at the physical layer, comprising:.

The ethernet device according to the invention comprises a first ethernet physical layer access device and a second ethernet physical layer access device. The first ethernet physical layer access device comprises a first PCS/PMA (Physical Coding Sublayer/Physical Medium Attachment) unit for accessing a first ethernet channel and the second ethernet physical layer access device comprises a second PCS/PMA unit for accessing a second ethernet channel. Thus, using the ethernet device according to the invention data can be transmitted over a first ethernet channel and over a second ethernet channel.

The first ethernet physical layer access device comprises a first media independent interface port for ethernet data communication, a second media independent interface port for ethernet communication and a first media independent interface switch, which in a first operating state connects the first media independent interface port to the PCS/PMA unit of the first ethernet physical layer access device and in a second operating state connects the first media independent interface port to the second media interface port.

The second ethernet physical layer access device comprises a third media independent interface port for ethernet data communication, a fourth media independent interface port for ethernet data communication and a second media independent interface switch, which in a first operating state connects the second PCS/PMA unit of the second ethernet physical layer access device to the third media independent interface port and in a second operating state connects the second PCS/PMA unit of the second ethernet physical layer access device to the fourth media independent interface port.

Thus, in the first operating state first ethernet data can be communicated over the first media independent interface port, the first media independent interface switch and the first PCS/PMA unit via the first ethernet channel. Simultaneously and independently of the first ethernet data, in the first operating state second ethernet data can be communicated over the third media independent interface port, the second media independent interface switch and the second PCS/PMA unit via the second ethernet channel. Thus, first ethernet data and second ethernet data are independent of each other and transmitted in parallel over two separate ethernet channels.

According to the invention the first ethernet physical layer access device further comprises a first physical layer safety mechanism unit for detecting a safety problem of the physical layer of the first ethernet channel, like a loss of the link, a degradation of link quality or errors in the received ethernet data packets. The first physical layer safety mechanism unit is connected to the first media independent interface switch and to the second media independent interface switch for switching the first media independent interface switch and the second media independent interface switch from the first operating states to the second operating states if a problem has been detected by the first physical layer safety mechanism unit.

In this second operating state, the first media independent interface port is connected to the second media interface port and the second PCS/PMA unit to the fourth media independent interface port. Since the second media independent interface port of the first ethernet physical layer access device is connected to the fourth media independent interface port of the second ethernet physical layer access device, in the second operating state, the first ethernet data previously being transmitted over the first media independent interface port, the first media independent interface switch and the first PCS/PMA unit via the first ethernet channel is in the second operating transmitted over the first media independent interface port, the first media independent interface switch, the second media independent interface port, the fourth media independent interface port, the second media independent interface switch and the second PCS/PMA unit via the second ethernet channel. The second ethernet data transmission is stopped in the second operating state.

Thus, if the first physical layer safety mechanism unit detects a safety problem of the physical layer of the first ethernet channel, the traffic previously being transmitted via the first ethernet channel, is re-routed via the second ethernet channel, while the second ethernet data transmission transmitted in the first operating state via the second ethernet channel, is stopped in the second operating state
The ethernet device according to the invention can detect safety problems of the physical layer of the first ethernet channel and re-route the safety critical ethernet data over the second ethernet channel. If the other ethernet device connected to the first ethernet channel and second ethernet channel is an ethernet device with safety features at the physical layer according to the present invention, it can also detect the safety problem and re-route the safety critical ethernet data over the second ethernet channel. If the other ethernet device connected to the first ethernet channel and second ethernet channel is an ethernet device without safety features at the physical layer, the re-routing of the safety critical ethernet data can be detected at the application layer and the safety critical data can be re-assembled at the application layer without the need to change the underlying ethernet device.

Pursuant to a variant of the invention, the second ethernet physical layer access device further comprises a second physical layer safety mechanism unit for detecting a safety problem of the physical layer of the second ethernet channel, like a loss of the link, a degradation of link quality or errors in the received ethernet data packets. Thus, the ethernet device can detect that the second ethernet channel has a safety problem and therefore is no longer an available back-up link for the first ethernet channel. This information can be for example forwarded to a device or application using the ethernet device according to the invention, so that this device or application is aware that a further safety problem of the first ethernet channel results in a loss of communication because there is no back-up ethernet channel available.

In a variant of the invention, the ethernet device with safety features at the physical layer further comprises a safety controller, wherein the first physical layer safety mechanism unit and/or the second physical layer safety mechanism unit send notifications to the safety controller if safety problems have been detected on the corresponding first ethernet channel and/or second ethernet channel. The safety controller can issue warnings to the system using the ethernet device that the first ethernet channel and/or second ethernet channel has safety problems. Thus, the safety controller supervises the availability of the first ethernet channel and second ethernet channel and can provide corresponding information to systems and/or applications using the ethernet device with safety features at the physical layer.

According to a variant of the invention, the ethernet device with safety features at the physical layer further comprises a first medium access controller (MAC), which connected to the first media independent interface port of the first ethernet physical layer access device, and a second medium access controller (MAC), which is connected to the third media independent interface port of the second ethernet physical layer access device. Such MACs are commonly known from the prior art and provide a connection from higher OSI layers to the OSI physical layer.

Pursuant to an advantageous variant of the invention, the first physical layer safety mechanism unit and/or the second physical layer safety mechanism unit comprise an input interface for receiving external safety signals. The external safety signal preferably relates to safety problems that can be not directly detected by the first physical layer safety mechanism unit and/or the second physical layer safety mechanism unit, but which can affect the safety of the first ethernet channel and/or second ethernet channel.

In a variant of the invention, the external safety signal originates from the hardware using the ethernet device with safety features at the physical layer. Particularly, the external safety signal refers to supply voltage range violations, temperature range violations, hardware or software built-in self-test results that indicate a component failure during operation, or similar safety critical issues of the external components. The voltage range violation is for example detected by a voltage sensor and the temperature range violation by a temperature sensor.

According to a preferred variant of the invention, the first physical layer safety mechanism unit and/or the second physical layer safety mechanism unit detect the loss of the respective link, the degradation of the respective link quality or errors in the received ethernet data packets through link status monitoring through:.

For example, the observation of the link idle symbols allows to detect a safety problem even if no payload data is transmitted via the respective ethernet channel.

Pursuant to an advantageous variant of the invention, the first PCS/PMA unit for accessing the first ethernet channel and/or the second PCS/PMA unit for accessing the second ethernet channel send a predetermined pattern on the respective ethernet channel if the first physical layer safety mechanism unit respectively the second physical layer safety mechanism unit detects a safety problem for the respective ethernet channel. This predetermined pattern can be identified by other ethernet devices using the first ethernet channel and/or second ethernet channel and thereby detect that that there is a safety problem with the respective first ethernet channel and/or second ethernet channel. If the other ethernet device is an ethernet device with safety features at the physical layer according to the invention, it can directly switch from the first operating state to the second operating state if it detects the predetermined pattern on the first ethernet channel. If it detects the pattern on the second ethernet channel, it can inform the device and/or application using the ethernet device about the safety problem of the backup ethernet channel. This allows to detect faults in communication channels within a short time interval.

In a variant of the invention, in the first operating state of the first media independent interface switch and of the second media independent interface switch, the first ethernet channel is used for safety critical data traffic and the second ethernet channel is used for non-safety critical data traffic. In the second operating state of the first media independent interface switch and of the second media independent interface switch the non-safety critical data traffic over the second ethernet channel is interrupted and replaced by the safety critical data traffic of the corrupted first ethernet channel. Thus, the first ethernet channel is used for the safety critical data traffic and the second ethernet channel is used as a backup for the first ethernet channel and used for non-safety critical ethernet traffic, as long as the first ethernet channel has no security problems. Particularly, in the second operating State the non-safety critical data traffic over the second ethernet channel is immediately interrupted and replaced after a certain threshold by the safety critical data traffic. Thereby, the other ethernet device of the second ethernet channel can detect the interruption of the second ethernet channel and is not expecting further data communication. Furthermore, a clear changeover from the non-safety critical data traffic to the safety critical data traffic is guaranteed.

According to a preferred variant of the invention, the ethernet device retransmits data traffic that has not been completely transmitted before the first media independent interface switch and the second media independent interface switch have switched from the first operating state to the second operating state. Thereby, it is guaranteed that all ethernet data traffic, particularly the safety critical ethernet data traffic, is transmitted and no loss of data occurs because corrupted ethernet frames due to the safety problems of the ethernet channel are retransmitted. The retransmission can be initiated by the ethernet device with safety features at the physical layer according to the invention or by an OSI application layer.

The object is further solved by a method for a bi-directional data transfer between two ethernet devices, wherein at least one of the two ethernet devices is an ethernet device with safety features at the physical layer according to the invention, comprising the steps of:.

According to this method safety critical data traffic is transmitted bi-directionally via the first ethernet channel, while at the same time non-safety critical data traffic is transmitted via the second ethernet channel. If a safety problem of the first ethernet channel is detected by the ethernet device with safety features at the physical layer, like a loss of the link, a degradation of link quality or errors in the received ethernet data packets, the non-safety critical data traffic via the second ethernet channel is interrupted and the safety critical data transfer is re-routed from the first ethernet channel to the second ethernet channel. Thus, the second ethernet channel is a backup for the first ethernet channel, in case safety problems of the first ethernet channel can be compensated by the second ethernet channel. While the first ethernet channel is operating properly without safety problems, the second ethernet channel can be used for non-safety critical data traffic.

Pursuant to a variant of the invention the method comprises the step of reassembling the safety critical data after rerouting over the second ethernet channel at the physical layer or application of the other ethernet device. Thus, the safety critical data is transferred completely without any loss of information. The safety critical data can be reassembled at the physical layer if both ethernet devices of the safety critical data transfer provide safety features at the physical layer according to the invention. In this case, both ethernet devices can detect the safety problem and automatically reroute the traffic via the second ethernet channel. If only one of the ethernet devices provides safety features at the physical layer, the safety critical data must reassembled at the application layer for the ethernet device without safety features at the physical layer because this ethernet device cannot detect the safety problem and the rerouting via the second ethernet channel. However, the application can detect this rerouting by inspection of the transferred data and reassemble the safety critical data accordingly.

In a variant of the invention the method further comprises the step of sending a predetermined pattern on the respective ethernet channel for which a safety problem has been detected. This predetermined pattern can be used by another ethernet device of the first ethernet channel or second ethernet channel to detect the safety problem and initiated for example rerouting or other measures.

According to a variant of the invention the method comprises the step of sending a notification to the system using the ethernet device if a safety problem on one of the two ethernet channels has been detected, particularly if a safety problem has been detected on both ethernet channels. The system using the ethernet device for safety critical data transfer is thereby informed that either the first ethernet channel for the safety critical data transfer has a safety problem and the safety critical data transfer has been rerouted to the second ethernet channel or that the second ethernet channel has a safety problem and is not available as a backup ethernet channel. In both cases, the reliability of the safety critical data transfer is under threat. If the first ethernet channel and the second ethernet channel have a safety problem, a severe warning should be issued to the system using the ethernet device because there is no reliable channel for the safety critical data transfer and the system can take necessary actions, like for example de-activating certain features like autonomous driving.

Pursuant to a variant of the invention the method comprises the step of receiving an external safety signal regarding the first ethernet channel and/or the second ethernet channel. Preferably, the external safety signal refers to supply voltage range violations, temperature range violations, hardware or software built-in self-test results that indicate a component failure during operation, or similar safety critical issues of the external components. Thus, not only safety problems of the physical layer are considered by the method, but also external factors which potentially degrade the safety of the ethernet channels are considered. This enhances the overall reliability and security of the inventive method.

In a variant of the invention the non-safety critical data transfer on the second ethernet channel is immediately interrupted in the second operating state and replaced after a certain threshold by the safety critical data traffic. Thereby, the other ethernet device of the second ethernet channel can detect the interruption of the second ethernet channel and is not expecting further data communication. Furthermore, a clear changeover from the non-safety critical data traffic to the safety critical data traffic is guaranteed.

According to a preferred variant of the invention the method further comprises the step of retransmitting data traffic that has not been transmitted before the switch from the first operating state to the second operating state.

In the following, the invention will be further explained with respect to the embodiments shown in the figures.

<FIG> shows a schematic diagram of an ethernet device <NUM>, <NUM> with safety features at the physical layer according to the invention. The ethernet device <NUM>, <NUM> comprises a first ethernet physical layer access device <NUM>, <NUM> and a second ethernet physical layer access device <NUM>, <NUM>.

The first ethernet physical access device <NUM>, <NUM> comprises a first PCS/PMA unit <NUM>, <NUM> for accessing a first ethernet channel <NUM>; a first media independent interface port <NUM>, <NUM> for ethernet data communication; a second media independent interface port <NUM>, <NUM> for ethernet data communication; and a first media independent interface switch <NUM>, <NUM>, which in a first operating state connects the first media independent interface port <NUM>, <NUM> to the PCS/PMA unit <NUM>, <NUM> and in a second operating state connects the first media independent interface port <NUM>, <NUM> to the second media interface port <NUM>, <NUM>.

The second ethernet physical layer access device <NUM>, <NUM> comprises a second PCS/PMA unit <NUM>, <NUM> for accessing a second ethernet channel <NUM>; a third media independent interface port <NUM>, <NUM> for ethernet data communication; a fourth media independent interface port <NUM>, <NUM> for ethernet data communication; and a second media independent interface switch <NUM>, <NUM>, which in a first operating state connects the second PCS/PMA unit <NUM>, <NUM> to the third media independent interface port <NUM>, <NUM> and in a second operating state connects the second PCS/PMA unit <NUM>, <NUM> to the fourth media independent interface port <NUM>, <NUM>.

The second media independent interface port <NUM>, <NUM> of the first ethernet physical layer access device <NUM>, <NUM> is connected to the fourth media independent interface port <NUM>, <NUM> of the second ethernet physical layer access device <NUM>, <NUM>.

The first ethernet physical layer access device <NUM>, <NUM> further comprises a first physical layer safety mechanism unit <NUM>, <NUM> for detecting a safety problem of the physical layer of the first ethernet channel <NUM>, like a loss of the link, a degradation of link quality or errors in the received ethernet data packets. The first physical layer safety mechanism unit <NUM>, <NUM> is connected to the first media independent interface switch <NUM>, <NUM> and to the second media independent interface switch <NUM>, <NUM> for switching the first media independent interface switch <NUM>, <NUM> and the second media independent interface switch <NUM>, <NUM> from the first operating states to the second operating states if a problem has been detected by the first physical layer safety mechanism unit <NUM>, <NUM>.

The second ethernet physical layer access device <NUM>, <NUM> also further comprises a second physical layer safety mechanism unit <NUM>, <NUM> for detecting a safety problem of the physical layer of the second ethernet channel <NUM>, like a loss of the link, a degradation of link quality or errors in the received ethernet data packets.

The ethernet device <NUM>, <NUM> with safety functions at the physical layer shown in <FIG> further comprises a safety controller <NUM>, <NUM>, wherein the first physical layer safety mechanism unit <NUM>, <NUM> and the second physical layer safety mechanism unit <NUM>, <NUM> send notifications to the safety controller <NUM>, <NUM> if safety problems have been detected on the corresponding first ethernet channel <NUM> respectively second ethernet channel <NUM>. The safety controller <NUM>, <NUM> can issue warnings to the system <NUM>, <NUM>, <NUM>, <NUM> using the ethernet device <NUM>, <NUM> that the first ethernet channel <NUM> and/or second ethernet channel <NUM> has safety problems.

The first ethernet physical layer access device <NUM>, <NUM> further comprises a first medium access controller <NUM>, <NUM>, which is connected to the first media independent interface port <NUM>, <NUM> and the second medium access controller <NUM>, <NUM> comprises a second medium access controller <NUM>, <NUM>, which is connected to the third media independent interface port <NUM>, <NUM>. The first medium access controller <NUM>, <NUM> and second medium access controller <NUM>, <NUM> are used for example by systems <NUM>, <NUM> to access the physical layer for ethernet communication.

According to the embodiment shown in <FIG> the first physical layer safety mechanism unit <NUM>, <NUM> and the second physical layer safety mechanism unit <NUM>, <NUM> comprise an input interface <NUM>, <NUM>, <NUM>, <NUM> for receiving external safety signals. The external safety signal originates for example from the hardware using the ethernet device <NUM>, <NUM> with safety features at the physical layer, like systems <NUM>, <NUM>. The external safety signal refers e.g. to supply voltage range violations, temperature range violations, hardware or software built-in self-test results that indicate a component failure during operation, or similar safety critical issues of the external components.

The first physical layer safety mechanism unit <NUM>, <NUM> and/or the second physical layer safety mechanism unit <NUM>, <NUM> detects the loss of the respective link, the degradation of the respective link quality or errors in the received ethernet data packets through link status monitoring through evaluation and/or checking of link idle symbols, through:.

In a preferred embodiment the first PCS/PMA unit <NUM>, <NUM> for accessing the first ethernet channel <NUM> and/or the second PCS/PMA unit <NUM>, <NUM> for accessing the second ethernet channel <NUM> sends a predetermined pattern on the respective ethernet channel <NUM>, <NUM> if the first physical layer safety mechanism unit <NUM>, <NUM> respectively the second physical layer safety mechanism unit <NUM>, <NUM> detects a safety problem for the respective ethernet channel <NUM>, <NUM>.

In the first operating state of the first media independent interface switch <NUM>, <NUM> and of the second media independent interface switch <NUM>, <NUM> the first ethernet channel <NUM> is used for safety critical data traffic and the second ethernet channel <NUM> is used for non-safety critical data traffic and in the second operating state of the first media independent interface switch <NUM>, <NUM> and of the second media independent interface switch <NUM>, <NUM> the non-safety critical data traffic on the second ethernet channel <NUM> is interrupted and replaced by the safety critical data traffic of the corrupted first ethernet channel <NUM>. Preferably, the non-safety critical data traffic over the second ethernet channel <NUM> is immediately interrupted in the second operating state and replaced after a certain threshold by the safety critical data traffic.

In an embodiment of the invention, the ethernet device <NUM>, <NUM> retransmits data traffic that has not been completely transmitted before the first media independent interface switch <NUM>, <NUM> and the second media independent interface switch <NUM>, <NUM> have switched from the first operating state to the second operating state.

The use of the ethernet device <NUM>, <NUM> with safety features at the physical layer shown in <FIG> is explained in more detail with respect to <FIG>, which shows a schematic diagram of ethernet connection between two ethernet devices <NUM>, <NUM> with safety features at the physical layer according to the invention. The first ethernet device <NUM> with safety features at the physical layer and the second ethernet device <NUM> with safety features at the physical layer both are identical to the ethernet device <NUM> shown in <FIG>. Thus, we refer to the above description regarding the details of the first and second ethernet device <NUM>, <NUM> with safety features at the physical layer. The corresponding parts of the first and second ethernet device <NUM>, <NUM> have corresponding reference numerals, only differing by the first digit, which indicates the first respectively second ethernet device <NUM>, <NUM>.

According to <FIG> a first ethernet channel <NUM> and a second ethernet channel <NUM> are provided between two ethernet devices <NUM>, <NUM> with safety features at the physical layer according to the present invention. The first ethernet channel <NUM> is accessed by the respective first ethernet physical access devices <NUM>, <NUM> and the second ethernet channel <NUM> is accessed by the respective second ethernet physical access devices <NUM>, <NUM>.

The first ethernet channel <NUM> is used for a bi-directional safety critical data transfer and the second ethernet channel <NUM> is used for a bi-directional non-safety critical data transfer.

If a safety problem of the physical layer of the first ethernet channel <NUM> is detected by the first and/or second ethernet device <NUM>, <NUM>, the first and second ethernet devices <NUM>, <NUM> switch from a first operating state to a second operating state. In the second operating state the bi-directional non-safety critical data transfer over the second ethernet channel <NUM> is interrupted and the bi-directional safety critical data traffic re re-routed over the second ethernet channel <NUM>.

Particularly, the non-safety critical data transfer on the second ethernet channel <NUM> is immediately interrupted in the second operating state and replaced after a certain threshold by the safety critical data traffic.

The safety critical data is reassembled after re-routing over the second ethernet channel <NUM> at the physical layer of the respective ethernet device <NUM>, <NUM> with safety features at the physical layer. In a variant of the invention, data traffic that has not been transmitted before the switch from the first operating state to the second operating state is retransmitted to avoid any loss of data.

If one of the ethernet devices <NUM>, <NUM> detects a safety problem on the first and/or second ethernet channel <NUM>, <NUM> is sends a predetermined pattern on the respective ethernet channel <NUM>, <NUM>. This pattern can be identified by the other ethernet device <NUM>, <NUM> and thereby also detect the safety problem on that respective ethernet channel <NUM>, <NUM>. In many cases, one of the two ethernet devices <NUM>, <NUM> detects the safety problem earlier and using the predetermined pattern the other ethernet device can be informed about the detected safety problem.

If a safety problem has been detected for the first ethernet channel <NUM> and/or the second ethernet channel, a corresponding notification is sent to the systems <NUM>, <NUM> using the ethernet devices <NUM>, <NUM> for the safety critical data transfer. A corresponding notification can also be sent to the systems <NUM>, <NUM> using the ethernet devices <NUM>, <NUM> for non-safety critical data transfer.

The ethernet devices <NUM>, <NUM> can further receive external safety signals regarding the first ethernet channel <NUM> and/or second ethernet channel <NUM> via respective input interfaces <NUM>, <NUM>, <NUM>, <NUM>. The external safety signal originates for example from the hardware, like systems <NUM>, <NUM>, <NUM>, <NUM>, using the ethernet device <NUM>, <NUM> with safety features at the physical layer. The external safety signal e.g. refers to supply voltage range violations, temperature range violations, hardware or software built-in self-test results that indicate a component failure during operation, or similar safety critical issues of the external components.

<FIG> shows a schematic diagram of ethernet connection between an ethernet device <NUM>, <NUM> with safety features at the physical layer according to the invention and an ethernet device <NUM> without safety features at the physical layer.

The ethernet device <NUM>, <NUM> with safety features at the physical layer corresponds to the one shown in <FIG>. For further details we refer to the above description of <FIG>.

Claim 1:
Ethernet device (<NUM>, <NUM>) with safety features at the physical layer, comprising:
a first ethernet physical layer access device (<NUM>, <NUM>) comprising:
a first PCS/PMA unit (<NUM>, <NUM>) for accessing a first ethernet channel (<NUM>);
a first media independent interface port (<NUM>, <NUM>) for ethernet data communication;
a second media independent interface port (<NUM>, <NUM>) for ethernet data communication; and
a first media independent interface switch (<NUM>, <NUM>), which in a first operating state connects the first media independent interface port (<NUM>, <NUM>) to the PCS/PMA unit (<NUM>, <NUM>) and in a second operating state connects the first media independent interface port (<NUM>, <NUM>) to the second media interface port (<NUM>, <NUM>);
a second ethernet physical layer access device (<NUM>, <NUM>) comprising:
a second PCS/PMA unit (<NUM>, <NUM>) for accessing a second ethernet channel (<NUM>);
a third media independent interface port (<NUM>, <NUM>) for ethernet data communication;
a fourth media independent interface port (<NUM>, <NUM>) for ethernet data communication; and
a second media independent interface switch (<NUM>, <NUM>), which in a first operating state connects the second PCS/PMA unit (<NUM>, <NUM>) to the third media independent interface port (<NUM>, <NUM>) and in a second operating state connects the second PCS/PMA unit (<NUM>, <NUM>) to the fourth media independent interface port (<NUM>, <NUM>);
wherein the second media independent interface port (<NUM>, <NUM>) of the first ethernet physical layer access device (<NUM>, <NUM>) is connected to the fourth media independent interface port (<NUM>, <NUM>) of the second ethernet physical layer access device (<NUM>, <NUM>);
wherein the first ethernet physical layer access device (<NUM>, <NUM>) further comprises a first physical layer safety mechanism unit (<NUM>, <NUM>) for detecting a safety problem of the physical layer of the first ethernet channel (<NUM>);
wherein the first physical layer safety mechanism unit (<NUM>, <NUM>) is connected to the first media independent interface switch (<NUM>, <NUM>) and to the second media independent interface switch (<NUM>, <NUM>) for switching the first media independent interface switch (<NUM>, <NUM>) and the second media independent interface switch (<NUM>, <NUM>) from the first operating states to the second operating states if said safety problem has been detected by the first physical layer safety mechanism unit (<NUM>, <NUM>).