Vehicle system and vehicle ECU

Abstract

A vehicle-mounted system includes: a first vehicle-mounted device mounted on a vehicle; a second vehicle-mounted device controlled according to a signal output from the first vehicle-mounted device; a first vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via a signal line; a second vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via the signal line, wherein the first vehicle-mounted ECU and the second vehicle-mounted ECU are connected by a communication line of a different type from the signal line, and a communication path from the first vehicle-mounted device to the second vehicle-mounted device includes a first path relayed by the first vehicle-mounted ECU and a second path relayed by the second vehicle-mounted ECU.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle system and an in-vehicle ECU.

[0002] This application claims priority based on Japanese Application No. 2020-101882 filed on June 11, 2020, and incorporates by reference all of the descriptions recited in the Japanese application. Background Art

[0003] In a vehicle, in-vehicle ECUs (Electronic Control Units) such as a brake ECU are mounted for controlling in-vehicle devices such as a powertrain for engine control and a body system for air-conditioning control. An in-vehicle system is mounted in the vehicle, and the in-vehicle system includes the above-described plurality of in-vehicle ECUs, control devices such as a brake control unit respectively connected to the plurality of in-vehicle ECUs, and actuators such as brakes directly connected to the control devices (see, for example, Patent Document 1).

[0004] Prior Art Documents

[0005] Patent Documents

[0006] Patent Document 1: Japanese Unexamined Patent Application Publication No. 2015-67187 Summary of the Invention

[0007] An in-vehicle system according to one aspect of the present disclosure includes: a first in-vehicle device mounted on a vehicle; a second in-vehicle device controlled according to a signal output from the first in-vehicle device; a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device via a signal line; and a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device via the signal line, wherein the first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a different type from the signal line, and a communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU. Brief Description of the Drawings

[0008] Figure 1 It is a schematic diagram illustrating the structure of the in-vehicle system according to Embodiment 1.

[0009] Figure 2 It is an explanatory diagram illustrating one aspect of each process (in normal times) performed by a first separate ECU or the like.

[0010] Figure 3 It is an explanatory diagram illustrating one aspect of each process (when the first separate ECU is abnormal) performed by a first separate ECU or the like.

[0011] Figure 4 It is an explanatory diagram illustrating one form of each process (when the second individual ECU is abnormal) performed by the first individual ECU or the like.

[0012] Figure 5 It is a flowchart illustrating the processing of the control unit of the first individual ECU.

[0013] Figure 6 It is a flowchart illustrating the processing of the control unit of the second individual ECU.

[0014] Figure 7 It is a schematic diagram illustrating the structure of the vehicle-mounted system of Embodiment 2 (integrated ECU).

[0015] Figure 8 It is an explanatory diagram illustrating one form of each process (when normal) performed by the first individual ECU or the like.

[0016] Figure 9 It is an explanatory diagram illustrating one form of each process (when the first individual ECU is abnormal) performed by the first individual ECU or the like.

[0017] Figure 10 It is an explanatory diagram illustrating one form of each process (when the second individual ECU is abnormal) performed by the first individual ECU or the like.

[0018] Figure 11 It is a flowchart illustrating the processing of the control unit of the integrated ECU.

[0019] Figure 12 It is a schematic diagram illustrating the structure of the vehicle-mounted system of Embodiment 3 (third individual ECU).

[0020] Figure 13 It is an explanatory diagram illustrating one form of each process (when normal) performed by the first individual ECU or the like.

[0021] Figure 14 It is an explanatory diagram illustrating one form of each process (when the first individual ECU is abnormal 1) performed by the first individual ECU or the like.

[0022] Figure 15 It is an explanatory diagram illustrating one form of each process (when the first individual ECU is abnormal 2) performed by the first individual ECU or the like.

[0023] Figure 16 It is a flowchart illustrating the processing of the control unit of the integrated ECU.

[0024] Figure 17 It is a schematic diagram illustrating the structure of the vehicle-mounted system of Embodiment 4 (door lock).

[0025] Figure 18It is a schematic diagram showing the structure of a vehicle-mounted system of exemplary embodiment 5 (wiper).

[0026] Figure 19 It is a schematic diagram showing the structure of a vehicle-mounted system of exemplary embodiment 6 (lamp). Detailed implementation manners

[0027] [Problems to be solved by the present disclosure]

[0028] The vehicle-mounted system described in Patent Document 1 does not consider redundancy in the connection between the actuator and the control device or the vehicle-mounted ECU.

[0029] An object of the present disclosure is to provide a vehicle-mounted system and the like capable of performing redundancy in communication with vehicle-mounted devices such as actuators.

[0030] [Effects of the present disclosure]

[0031] According to one aspect of the present disclosure, it is possible to provide a vehicle-mounted system and the like that perform redundancy in communication with vehicle-mounted devices such as actuators.

[0032] [Description of embodiments of the present disclosure]

[0033] First, embodiments of the present disclosure will be listed and described. Moreover, at least a part of the embodiments described below can be arbitrarily combined.

[0034] (1) A vehicle-mounted system according to one aspect of the present disclosure includes: a first vehicle-mounted device mounted on a vehicle; a second vehicle-mounted device controlled according to a signal output from the first vehicle-mounted device; a first vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via a signal line; and a second vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via the signal line, wherein the first vehicle-mounted ECU and the second vehicle-mounted ECU are connected by a communication line of a different type from the signal line, and the communication path from the first vehicle-mounted device to the second vehicle-mounted device includes a first path relayed by the first vehicle-mounted ECU and a second path relayed by the second vehicle-mounted ECU.

[0035] In this aspect, the first vehicle-mounted device and the second vehicle-mounted device controlled according to the signal output from the first vehicle-mounted device are respectively connected to the first vehicle-mounted ECU and the second vehicle-mounted ECU via a signal line, and the first vehicle-mounted ECU and the second vehicle-mounted ECU are connected by a communication line. In such a connection manner, the communication path from the first vehicle-mounted device to the second vehicle-mounted device includes a first path relayed by the first vehicle-mounted ECU and a second path relayed by the second vehicle-mounted ECU, so that the connection path between the first vehicle-mounted device and the second vehicle-mounted device can be made redundant, and the availability in communication can be improved.

[0036] (2) In a vehicle-mounted system according to an aspect of the present disclosure, the first vehicle-mounted ECU and the second vehicle-mounted ECU each include a control unit that obtains a signal from the first vehicle-mounted device via the signal line, generates control data for controlling the second vehicle-mounted device based on the signal output from the first vehicle-mounted device, and the respective control units of the first vehicle-mounted ECU and the second vehicle-mounted ECU determine whether the other vehicle-mounted ECU is normal or abnormal based on the communication result between the first vehicle-mounted ECU and the second vehicle-mounted ECU via the communication line. When it is determined that the first vehicle-mounted ECU is abnormal, the second vehicle-mounted ECU substitutes for the first vehicle-mounted ECU. When it is determined that the second vehicle-mounted ECU is abnormal, the first vehicle-mounted ECU substitutes for the second vehicle-mounted ECU.

[0037] In this aspect, the control units of the first vehicle-mounted ECU and the second vehicle-mounted ECU determine whether the other vehicle-mounted ECU is normal or abnormal mutually or complementarily. When it is determined that the first vehicle-mounted ECU is abnormal, the second vehicle-mounted ECU substitutes for the first vehicle-mounted ECU. When it is determined that the second vehicle-mounted ECU is abnormal, the first vehicle-mounted ECU substitutes for the second vehicle-mounted ECU. That is, when it is determined that one of the first vehicle-mounted ECU and the second vehicle-mounted ECU is abnormal, they mutually or complementarily substitute for the vehicle-mounted ECU determined to be abnormal, so that the reliability of the process of generating control data based on the signal from the first vehicle-mounted device can be improved.

[0038] (3) In a vehicle-mounted system according to an aspect of the present disclosure, when it is determined by the control unit of the second vehicle-mounted ECU that the first vehicle-mounted ECU is abnormal, the control unit of the second vehicle-mounted ECU outputs the control data to the second vehicle-mounted device using the second path, thereby substituting for the first vehicle-mounted ECU. When it is determined by the control unit of the first vehicle-mounted ECU that the second vehicle-mounted ECU is abnormal, the control unit of the first vehicle-mounted ECU outputs the control data to the second vehicle-mounted device using the first path, thereby substituting for the second vehicle-mounted ECU.

[0039] In this embodiment, the connection path between the first vehicle-mounted device and the second vehicle-mounted device is made redundant via the first vehicle-mounted ECU and the second vehicle-mounted ECU. When it is determined that the first vehicle-mounted ECU is abnormal, the control unit of the second vehicle-mounted ECU outputs control data to the second vehicle-mounted device using the second path. When it is determined that the second vehicle-mounted ECU is abnormal, the control unit of the first vehicle-mounted ECU outputs control data to the second vehicle-mounted device using the first path. Therefore, even when it is determined that the first vehicle-mounted ECU or the second vehicle-mounted ECU is abnormal, by using the redundant connection path between the first vehicle-mounted device and the second vehicle-mounted device, it is possible to reliably perform the process of outputting the control data generated by one of the first vehicle-mounted ECU and the second vehicle-mounted ECU to the second vehicle-mounted device.

[0040] (4) In the vehicle-mounted system according to an embodiment of the present disclosure, when it is determined that both the first vehicle-mounted ECU and the second vehicle-mounted ECU are normal, communication from the first vehicle-mounted device to the second vehicle-mounted device is performed via the first vehicle-mounted ECU and the second vehicle-mounted ECU.

[0041] In this embodiment, when it is determined that both the first vehicle-mounted ECU and the second vehicle-mounted ECU are normal, the control data is output to the second vehicle-mounted device via the first vehicle-mounted ECU and the second vehicle-mounted ECU, that is, via the communication line connecting the first vehicle-mounted ECU and the second vehicle-mounted ECU. Therefore, in a series of processes related to the first vehicle-mounted device and the second vehicle-mounted device, each process is dispersed to the first vehicle-mounted ECU that receives a signal from the first vehicle-mounted device and the second vehicle-mounted ECU that outputs control data to the second vehicle-mounted device, and the load of the first vehicle-mounted ECU and the second vehicle-mounted ECU is dispersed, enabling efficient execution of this series of processes.

[0042] (5) In the vehicle-mounted system according to an embodiment of the present disclosure, when the control unit of the second vehicle-mounted ECU has obtained a signal from the first vehicle-mounted device and has not obtained a signal output from the first vehicle-mounted ECU within a specified period, it is determined that the first vehicle-mounted ECU is abnormal. When a signal output from the first vehicle-mounted ECU is obtained within the specified period, it is determined that the first vehicle-mounted ECU is normal.

[0043] In this embodiment, after the control unit of the second vehicle-mounted ECU has obtained a signal from the first vehicle-mounted device, when it has not obtained a signal output from the first vehicle-mounted ECU within a specified period, it is determined that the first vehicle-mounted ECU is abnormal, and when a signal is obtained, it is determined that the first vehicle-mounted ECU is normal. Therefore, the control unit of the second vehicle-mounted ECU can effectively determine whether the first vehicle-mounted ECU is normal or abnormal.

[0044] (6) In a vehicle-mounted system according to an aspect of the present disclosure, when the control unit of the first vehicle-mounted ECU does not receive a response from the second vehicle-mounted device within a specified period after obtaining a signal from the first vehicle-mounted device, it determines that the second vehicle-mounted ECU is abnormal, and when it receives a response from the second vehicle-mounted device within the specified period, it determines that the second vehicle-mounted ECU is normal.

[0045] In this aspect, when the control unit of the first vehicle-mounted ECU does not receive a response from the second vehicle-mounted device within a specified period after obtaining a signal from the first vehicle-mounted device, it determines that the second vehicle-mounted ECU is abnormal, and when it receives a response from the second vehicle-mounted device within the specified period, it determines that the second vehicle-mounted ECU is normal. Therefore, the control unit of the first vehicle-mounted ECU can effectively determine whether the second vehicle-mounted ECU is normal or abnormal.

[0046] (7) In a vehicle-mounted system according to an aspect of the present disclosure, when the control unit of the first vehicle-mounted ECU does not receive a response to a signal from the second vehicle-mounted device within a specified period, it also outputs a confirmation signal to the second vehicle-mounted ECU via the communication line. When the control unit of the first vehicle-mounted ECU does not receive a response to the confirmation signal from the second vehicle-mounted ECU, it determines that the second vehicle-mounted ECU is abnormal, and when the control unit of the first vehicle-mounted ECU receives a response to the confirmation signal from the second vehicle-mounted ECU, it determines that the second vehicle-mounted ECU is normal.

[0047] In this aspect, when a response to a signal is not received from the second vehicle-mounted device within a specified period, a confirmation signal is also output to the second vehicle-mounted device via the communication line. When a response to the confirmation signal is not received from the second vehicle-mounted device, it is determined that the second vehicle-mounted ECU is abnormal, and when a response is received, it is determined that the second vehicle-mounted ECU is normal. When it is assumed that the second vehicle-mounted device or the second vehicle-mounted ECU is abnormal when a response to a signal is not received from the second vehicle-mounted device within a specified period, a confirmation signal is also output to the second vehicle-mounted ECU via the communication line. Thus, based on the presence or absence of a response from the second vehicle-mounted ECU, the determination of whether the second vehicle-mounted ECU is normal or abnormal can be reliably performed.

[0048] (8) One form of the in-vehicle system of the present disclosure includes a third in-vehicle ECU, which is connected to the first in-vehicle ECU and the second in-vehicle ECU via a communication line. The control unit of the third in-vehicle ECU determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the communication results with the first in-vehicle ECU and the second in-vehicle ECU via the communication line. When it is determined that the first in-vehicle ECU is abnormal, the second in-vehicle ECU replaces the first in-vehicle ECU. When it is determined that the second in-vehicle ECU is abnormal, the first in-vehicle ECU replaces the second in-vehicle ECU.

[0049] In this form, the control unit of the third in-vehicle ECU connected to the first in-vehicle ECU and the second in-vehicle ECU via a communication line determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the communication results with the first in-vehicle ECU and the second in-vehicle ECU. Therefore, it is not necessary for the first in-vehicle ECU and the second in-vehicle ECU to perform this determination process. Thus, through the first in-vehicle ECU, the second in-vehicle ECU, and the third in-vehicle ECU, the load of a series of processes related to the first in-vehicle device and the second in-vehicle device can be dispersed, and the usability of the in-vehicle system can be improved.

[0050] (9) In one form of the in-vehicle system of the present disclosure, the control unit of the third in-vehicle ECU determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the acquisition results of signal detection data output from the first in-vehicle ECU and the second in-vehicle ECU according to the signal output from the first in-vehicle device.

[0051] In this form, the control unit of the third in-vehicle ECU determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the acquisition results of signal detection data output from the first in-vehicle ECU and the second in-vehicle ECU according to the signal output from the first in-vehicle device. Therefore, it is possible to determine the first in-vehicle ECU and the second in-vehicle ECU corresponding to the output of the signal generated by the first in-vehicle device.

[0052] (10) In one form of the in-vehicle system of the present disclosure, the third in-vehicle ECU is not directly connected to the first in-vehicle device and the second in-vehicle device via the signal line, but is connected via the first in-vehicle ECU or the second in-vehicle ECU.

[0053] In this form, the third in-vehicle ECU is not directly connected to the first in-vehicle device and the second in-vehicle device via the signal line, but is connected via the first in-vehicle ECU or the second in-vehicle ECU. Therefore, it is not necessary to wire signal lines between the third in-vehicle ECU and the first in-vehicle device and the second in-vehicle device.

[0054] (11) In one aspect of the present disclosure, an in-vehicle ECU is communicably connected to a first in-vehicle device and a second in-vehicle device mounted on a vehicle via a signal line. The in-vehicle ECU is connected to another in-vehicle ECU via a communication line of a different type from the signal line. The other in-vehicle ECU is communicably connected to the first in-vehicle device and the second in-vehicle device via the signal line. The in-vehicle ECU includes a control unit that obtains a signal from the first in-vehicle device via the signal line, generates control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device, determines whether the other in-vehicle ECU is normal or abnormal based on the communication result with the other in-vehicle ECU, and performs a process of replacing the other in-vehicle ECU when it is determined that the other in-vehicle ECU is abnormal.

[0055] In this aspect, an in-vehicle ECU that can provide a redundant in-vehicle system configured to communicate with in-vehicle devices such as actuators can be provided.

[0056] [Details of Embodiments of the Present Disclosure]

[0057] Regarding the present disclosure, specific descriptions will be made based on the drawings showing its embodiments. Hereinafter, embodiments of the in-vehicle ECU (separate ECUs 1, 2, 3, and integrated ECU 4) of the present disclosure will be described with reference to the drawings. It should be noted that the present disclosure is not limited to these examples, is disclosed by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0058] (Embodiment 1)

[0059] Hereinafter, embodiments will be described based on the drawings. Figure 1 FIG. is a schematic diagram illustrating the structure of an in-vehicle system S according to Embodiment 1. The in-vehicle system S includes a first separate ECU 1 and a second separate ECU 2 mounted on a vehicle C. The first separate ECU 1 and the second separate ECU 2 are communicably connected to a switch 51 as a first in-vehicle device and an actuator 61 as a second in-vehicle device via a signal line 8, respectively.

[0060] The first separate ECU 1 and the second separate ECU 2 are connected to each other via a communication line 7 so as to be able to communicate, and are arranged in respective regions of the vehicle C. The in-vehicle network (in-vehicle LAN) is constituted by the first separate ECU 1, the second separate ECU 2, and the communication line 7 that connects them. The first separate ECU 1 and the second separate ECU 2 may also be configured to function as in-vehicle relay devices such as a gateway or an Ethernet switch that relays communication between the first in-vehicle device 5 (switch 51) and the second in-vehicle device 6 (actuator 61). The first separate ECU 1 and the second separate ECU 2 may also function as a power distribution device, i.e., a PLB (Power Lan Box), that distributes and relays the power output from a power storage device (not shown) and supplies the power to in-vehicle devices such as the first in-vehicle device 5 or the second in-vehicle device 6 connected to this ECU, in addition to relaying communication-related functions.

[0061] As shown in the figure, the first in-vehicle device 5 is, for example, a switch 51, which generates a signal based on an operation by an operator of the vehicle C or the like, and outputs the generated signal to the first separate ECU 1 and the second separate ECU 2 via a signal line 8. An example of the switch 51 will be described later.

[0062] As shown in the figure, the second in-vehicle device 6 is, for example, an actuator 61, which is a drive device that is driven based on a signal output from the switch 51, which is the first in-vehicle device 5. An example of the actuator 61 will be described later.

[0063] As shown in the figure, the first separate ECU 1 is directly connected to the first in-vehicle device 5 (switch 51) and the second in-vehicle device 6 (actuator 61) respectively via the communication line 7. Similarly to the first separate ECU 1, the second separate ECU 2 is also directly connected to the switch 51 and the actuator 61 respectively via the signal line 8. In this way, the connection between the first separate ECU 1 and the second separate ECU 2 and the first in-vehicle device 5 (switch 51) and the second in-vehicle device 6 (actuator 61) becomes a dual-redundant connection method based on the signal line 8.

[0064] With such a redundant structure, even when one of the first and second individual ECUs, i.e., the first individual ECU 1 or the second individual ECU 2, becomes abnormal due to a failure or the like, the other individual ECU can replace the abnormal individual ECU. Therefore, the communication between the first vehicle-mounted device 5 (switch 51) and the second vehicle-mounted device 6 (actuator 61) can be continued, and the availability of the vehicle-mounted system S can be improved. The failure in the first individual ECU 1 or the second individual ECU 2 includes not only the failure of the individual ECU itself, but also the failure caused by the disconnection of one of the signal lines 8 connecting the first vehicle-mounted device 5 (switch 51) and the second vehicle-mounted device 6 (actuator 61). The thus configured first individual ECU 1 corresponds to the first vehicle-mounted ECU, and the second individual ECU 2 is the second vehicle-mounted ECU.

[0065] The vehicle-mounted system S includes a first path relayed by the first individual ECU 1 and a second path relayed by the second individual ECU 2, and can achieve redundancy for the failure of an individual ECU or the failure caused by the disconnection of one of the signal lines 8 or the like. The first path and the second path are formed by the signal lines 8 directly connecting the first vehicle-mounted device 5 and the second vehicle-mounted device 6 to the first individual ECU 1 and the second individual ECU 2, and the communication line 7 directly connecting the first individual ECU 1 and the second individual ECU 2 to each other. From the perspective of the in-vehicle network, the communication line 7 corresponds to the backbone-like line, and the signal line 8 corresponds to the branch-like line, and the communication line 7 and the signal line 8 are based on different physical layer protocols. In the present embodiment, by redundantizing the signal line 8, a robust in-vehicle network can be configured.

[0066] The first individual ECU 1 includes a control unit 11, a storage unit 12, an input / output I / F 14, and a communication unit 13. The control unit 11 is composed of a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), etc., and performs various control processes and arithmetic processes, etc., by reading and executing the control programs and data pre-stored in the storage unit 12. The control unit 11 is not limited to a software processing unit that performs software processing such as a CPU, and may also include a hardware processing unit such as an FPGA, an ASIC, or an SOC that performs various control processes and arithmetic processes, etc., using hardware processing. For example, the control unit 11 receives an input signal from the switch 51 such as the door SW 52 connected via the input / output I / F using a hardware processing unit such as an FPGA, and this hardware processing unit may also start a software processing unit such as a CPU, and thus the CPU performs processing related to the input signal from the switch 51. In this way, by triggering the CPU with the processing of an FPGA or the like performed by the current or voltage generated by the input signal from the switch 51, the power consumption generated by the CPU can be suppressed.

[0067] The storage unit 12 is composed of volatile storage elements such as RAM (Random Access Memory), or non-volatile storage elements such as ROM (ReadOnly Memory), EEPROM (Electrically Erasable Programmable ROM), or flash memory, and stores a control program and data to be referred to during processing in advance. Regarding the control program stored in the storage unit 12, it is also possible to store a control program read out from a recording medium that can be read by the first separate ECU1. Moreover, it is also possible to download a control program from an external computer (not shown) connected to a communication network (not shown) and store it in the storage unit 12.

[0068] The input / output I / F 14 is a communication interface for performing, for example, serial communication. The first separate ECU1 is communicably connected to the first vehicle-mounted device 5 and the second vehicle-mounted device 6 via signal lines 8 such as a wiring harness connected to the input / output I / F 14.

[0069] The communication unit 13 is an input / output interface such as a CAN transceiver or an Ethernet PHY unit that uses a communication protocol such as CAN (Control Area Network) or Ethernet (Ethernet / registered trademark). The control unit 11 communicates with other separate ECUs connected to the vehicle-mounted network, namely the second separate ECU 2, or other vehicle-mounted devices such as other relay devices via the communication unit.

[0070] The second separate ECU 2 also includes a control unit 21, a storage unit 22, an input / output I / F 24, and a communication unit 23, similar to the first separate ECU 1. The control unit 21, the storage unit, the input / output I / F 24, and the communication unit 23 of the second separate ECU 2 are configured with the same structure as those of the first separate ECU 1. The control program and data stored in the storage unit of the second separate ECU 2 are the same as or mutually interchangeable with the control program and data stored in the storage unit 12 of the first separate ECU 1.

[0071] In the first separate ECU 1 and the second separate ECU 2 in this way, the hardware structure and the software structure are the same or mutually interchangeable. Thus, even if one of the separate ECUs becomes abnormal, the other separate ECU can substitute for the functions that the abnormal separate ECU should execute.

[0072] Figure 2This is an explanatory diagram illustrating one form of each process (in normal operation) performed by the first independent ECU 1 and the like. In the present embodiment, the first independent ECU 1 functions as an SW input main ECU that mainly processes the signals received from the switch 51 of the first vehicle-mounted device 5, that is, processes corresponding to the input signal (SW input signal) from the switch 51. The second independent ECU 2 functions as an ACT output main ECU that mainly generates and outputs control data for the actuator 61 of the second vehicle-mounted device 6, that is, processes corresponding to the control data output (ACT output) to the actuator 61. On this basis, when the second independent ECU 2 becomes abnormal, the first independent ECU 1 functions as an ACT output sub-ECU that substitutes for the process corresponding to the control data output (ACT output) to the actuator 61. When the first independent ECU 1 becomes abnormal, the second independent ECU 2 functions as an SW input sub-ECU that substitutes for the process corresponding to the input signal (SW input) from the switch 51.

[0073] In the illustration of the present embodiment, the process flow when both the first independent ECU 1 and the second independent ECU 2 are normal is described. The switch 51 receives an input (S01) generated by an operation performed by an operator of the vehicle C, for example. The switch 51 generates a signal (SW input signal) based on the result of receiving this input, and outputs this signal (SW input signal) to the first independent ECU 1 and the second independent ECU 2 via the signal line 8 (S02).

[0074] The switch 51 includes various sensors, for example, and receives an input generated by an operation performed by the operator based on the detection result of this sensor. Alternatively, the switch 51 may be connected to detection devices such as a CMOS camera or LiDAR (Light Detection and Ranging), receive the input of various data output from these detection devices, and output a signal.

[0075] The first independent ECU 1 and the second independent ECU 2 detect the signal (SW input signal) output from the switch 51 (S03, S04). The first independent ECU 1 and the second independent ECU 2 obtain (receive) this signal by detecting the signal (SW input signal) output from the switch 51.

[0076] The first independent ECU 1 generates a signal (instruction signal) for instructing the generation of control data based on the signal (SW input signal) output from the switch 51, and outputs this signal (instruction signal) to the second independent ECU 2 (instruction signal output) (S05).

[0077] The second separate ECU2 detects the signal (indicating signal) output from the first separate ECU1 (S06). The second separate ECU2 detects the signal (indicating signal) output from the first separate ECU1 within a specified period starting from the time point when the signal (SW input signal) output from the switch 51 is detected. This specified period is a period (input detection period) determined based on the time required for the processing performed by the first separate ECU1, and is a period for determining that the first separate ECU1 is abnormal when a signal from the first separate ECU1 cannot be obtained within this input detection period. The value of the input detection period is stored, for example, in the storage unit 22 of the second separate ECU2.

[0078] Based on the detection result of the signal (indicating signal) output from the first separate ECU1, the second separate ECU2 determines that the first separate ECU1 is normal and no replacement is required (S07).

[0079] The second separate ECU2 generates control data based on the signal (indicating signal) output from the first separate ECU1 (S08).

[0080] The second separate ECU2 outputs the generated control data to the actuator 61 (S09).

[0081] Based on the control data output from the second separate ECU2, the actuator 61 generates a response signal and outputs the generated response signal to the first separate ECU1 (S10).

[0082] Based on the control data output from the second separate ECU2, the actuator 61 drives the device (S11).

[0083] The first separate ECU1 confirms the response signal output from the actuator 61 (output confirmation) (S12). Based on the confirmation result (output confirmation) of the response signal output from the actuator 61, the first separate ECU1 determines that the second separate ECU2 is normal and no replacement is required.

[0084] The first separate ECU1 can determine that the second separate ECU2 is normal by obtaining the response signal output from the actuator 61. In this way, the first separate ECU1 and the second separate ECU2 can effectively determine whether the other separate ECU is normal or abnormal based on the communication results of the switch 51 and the actuator 61, and the communication results between the first separate ECU1 and the second separate ECU2. When determining whether the other separate ECU is normal or abnormal based on these communication results, the first separate ECU1 and the second separate ECU2 determine that the other separate ECU is abnormal when communication from the other separate ECU or the actuator 61 cannot be obtained within a specified period, thereby enabling effective determination.

[0085] Figure 3 This is an explanatory diagram illustrating one form of each process (when the first individual ECU 1 is abnormal) performed by the first individual ECU 1 or the like. In the illustration of the present embodiment, the process flow when the first individual ECU 1 is abnormal and the second individual ECU 2 is normal is described.

[0086] Similar to when the first individual ECU 1 and the second individual ECU 2 are normal, the switch 51 receives an input (F01), and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (F02).

[0087] The second individual ECU 2 detects the signal (SW input signal) output from the switch 51 (F03). Since the first individual ECU 1 is abnormal, the signal (SW input signal) output from the switch 51 cannot be detected.

[0088] The second individual ECU 2 attempts to detect the signal (indication signal) that the first individual ECU 1 should output (F04). Since the first individual ECU 1 is abnormal, the second individual ECU 2 cannot detect the signal from the first individual ECU 1. The second individual ECU 2 outputs a signal (survival confirmation signal) for performing survival confirmation to the first individual ECU 1 (F05). Since the first individual ECU 1 is abnormal, the second individual ECU 2 cannot obtain a response from the first individual ECU 1 to the survival confirmation signal.

[0089] The second individual ECU 2 determines that the first individual ECU 1 is abnormal and needs to be replaced (F06). The second individual ECU 2 generates control data (F07) based on the signal from the switch 51 detected in F03, and outputs the generated control data to the actuator 61 (F08).

[0090] The actuator 61 drives the present device based on the control data obtained from the second individual ECU 2 (F09).

[0091] Figure 4 This is an explanatory diagram illustrating one form of each process (when the second individual ECU 2 is abnormal) performed by the first individual ECU 1 or the like. In the illustration of the present embodiment, the process flow when the first individual ECU 1 is normal and the second individual ECU 2 is abnormal is described.

[0092] Similar to when the first individual ECU 1 and the second individual ECU 2 are normal, the switch 51 receives an input (K01), and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (K02).

[0093] The first separate ECU1 detects the signal (SW input signal) (K03) output from the switch 51. The second separate ECU2 is abnormal, so it cannot detect the signal (SW input signal) output from the switch 51.

[0094] Based on the signal (SW input signal) output from the switch 51, the first separate ECU1 generates a signal (indication signal) for instructing the generation of control data, and outputs this signal to the second separate ECU2 (indication signal output) (K04). Since the second separate ECU2 is abnormal, the signal (indication signal) output from the first separate ECU1 cannot be obtained.

[0095] The first separate ECU1 attempts to confirm the response signal that should be output from the actuator 61 (output confirmation) (K05). Since the second separate ECU2 is abnormal, the actuator 61 does not obtain the control data. Therefore, at this time point, the response signal from the actuator 61 to the first separate ECU1 is not output, so the first separate ECU1 does not obtain the confirmation of the response signal that should be output from the actuator 61, that is, this response signal.

[0096] The first separate ECU1 outputs a signal (survival confirmation signal) for performing survival confirmation to the second separate ECU2 (K06). Since the second separate ECU2 is abnormal, the first separate ECU1 cannot obtain the response from the second separate ECU2 to the survival confirmation signal.

[0097] The first separate ECU1 determines that the second separate ECU2 is abnormal and needs to be replaced (K07). The first separate ECU1 generates control data (K08) based on the signal (SW input signal) output from the switch 51, and outputs the generated control data to the actuator 61 (K09).

[0098] Based on the control data obtained from the second separate ECU2, the actuator 61 drives this device (K10).

[0099] Figure 5 It is a flowchart illustrating the processing of the control unit 11 of the first separate ECU1. The control unit 11 of the first separate ECU1 stably performs the following processing when, for example, the vehicle C is in the starting state (ignition switch is on) or the stop state (ignition switch is off).

[0100] The control unit 11 of the first separate ECU1 detects (obtains) the signal (S101) output from the switch 51 of the first vehicle-mounted device 5.

[0101] Based on the detection result of the signal output by the switch 51, the control unit 11 of the first individual ECU 1 generates an instruction signal and outputs the instruction signal to the second individual ECU 2 (S102). The control unit 11 of the first individual ECU 1 generates a signal (instruction signal) that supports the generation of control data based on the detection result of the signal output by the switch 51, and outputs the instruction signal to the second individual ECU 2.

[0102] The control unit 11 of the first individual ECU 1 determines whether it is possible to obtain (confirm) a response signal output by the actuator 61 of the second vehicle-mounted device 6 (S103). When it is possible to obtain (confirm) the response signal (S103: Yes), the control unit 11 of the first individual ECU 1 determines that the second individual ECU 2 is operating normally (S108), and ends a series of processes. When ending this series of processes, the control unit 11 of the first individual ECU 1 determines that the second individual ECU 2 is operating normally, and may also store the determination result in the storage unit 12 of the first individual ECU 1.

[0103] When it is not possible to obtain (confirm) the response signal (S103: No), the control unit 11 of the first individual ECU 1 outputs a survival confirmation signal for performing survival confirmation to the second individual ECU 2.

[0104] The control unit 11 of the first individual ECU 1 determines whether it is possible to obtain a survival response signal from the second individual ECU 2 for the survival confirmation signal (S105). When it is possible to obtain the survival response signal from the second individual ECU 2 (S105: Yes), the control unit 11 of the first individual ECU 1 determines that the second individual ECU 2 is operating normally (S108), and ends a series of processes. When ending this series of processes, the control unit 11 of the first individual ECU 1 determines that the second individual ECU 2 is operating normally, and may also store the determination result in the storage unit 12 of the first individual ECU 1.

[0105] When it is not possible to obtain the survival response signal from the second individual ECU 2 (S105: No), the control unit 11 of the first individual ECU 1 determines that the second individual ECU 2 is abnormal and needs to be replaced (S106).

[0106] The control unit 11 of the first individual ECU 1 generates control data based on the signal obtained from the switch 51 of the first vehicle-mounted device 5, and outputs the control data to the actuator 61 of the second vehicle-mounted device 6 (S107). The actuator 61 of the second vehicle-mounted device 6 drives the device based on the control data output from the first individual ECU 1.

[0107] Figure 6It is a flowchart illustrating the processing of the control unit 21 of the second separate ECU 2. The control unit 21 of the second separate ECU 2 stably performs the following processing, for example, when the vehicle C is in a starting state (ignition switch is on) or a stopped state (ignition switch is off).

[0108] The control unit 21 of the second separate ECU 2 detects (acquires) the signal (S111) output by the switch 51 of the first in-vehicle device 5. The control unit 21 of the second separate ECU 2 determines whether it is possible to acquire (confirm) the instruction signal output by the first separate ECU 1 (S112). The control unit 21 of the second separate ECU 2 refers to the input detection period stored in the storage unit 22 of the second separate ECU 2 and determines whether it is possible to acquire the instruction signal output by the first separate ECU 1 within the input detection period. The input detection period starts from the detection time point of the signal output by the switch 51, for example, and can also be determined based on the maximum processing time assumed in the first separate ECU 1.

[0109] When the instruction signal can be acquired (S112: Yes), the control unit 21 of the second separate ECU 2 determines that the first separate ECU 1 is normal and no replacement is required (S117). The control unit 21 of the second separate ECU 2 generates control data based on the instruction signal acquired from the first separate ECU 1 and outputs it to the actuator 61 (S118). The actuator 61 of the second in-vehicle device 6 drives the device based on the control data output by the second separate ECU 2.

[0110] When the instruction signal cannot be acquired (S112: No), the control unit 21 of the second separate ECU 2 outputs a survival confirmation signal for performing a survival confirmation to the first separate ECU 1 (S113). The control unit 21 of the second separate ECU 2 determines whether it is possible to acquire the survival response signal from the first separate ECU 1 for the survival confirmation signal (S114).

[0111] When the survival response signal can be acquired from the first separate ECU 1 (S114: Yes), the control unit 21 of the second separate ECU 2 determines that the first separate ECU 1 is operating normally (S117) and performs the subsequent processing, i.e., S118.

[0112] When the survival response signal cannot be acquired from the first separate ECU 1 (S114: No), the control unit 21 of the second separate ECU 2 determines that the first separate ECU 1 is abnormal and replacement is required (S115). The control unit 21 of the second separate ECU 2 generates control data based on the signal acquired from the switch 51 of the first in-vehicle device 5 and outputs it to the actuator 61 (S116). The actuator 61 of the second in-vehicle device 6 drives the device based on the control data output by the second separate ECU 2.

[0113] According to the present embodiment, a first vehicle-mounted device 5 such as a switch 51 and a second vehicle-mounted device 6 such as an actuator 61 controlled according to a signal output from the first vehicle-mounted device 5 are respectively connected to a first separate ECU 1 and a second separate ECU 2 via signal lines 8, and the first separate ECU 1 and the second separate ECU 2 are connected by a communication line 7. The communication path from the first vehicle-mounted device 5 to the second vehicle-mounted device 6 includes a first path relayed by the first separate ECU 1 and a second path relayed by the second separate ECU 2. Therefore, the connection path between the first vehicle-mounted device 5 and the second vehicle-mounted device 6 can be made redundant, improving the availability during communication.

[0114] According to the present embodiment, the first separate ECU 1 and the second separate ECU 2 determine whether the other separate ECU is normal or abnormal. When it is determined that the first separate ECU 1 is abnormal, the second separate ECU 2 substitutes for the first separate ECU 1. When it is determined that the second separate ECU 2 is abnormal, the first separate ECU 1 substitutes for the second separate ECU 2. That is, when it is determined that one of the first separate ECU 1 and the second separate ECU 2 is abnormal, they mutually or complementarily substitute for the separate ECU determined to be abnormal. Therefore, control data is generated based on the signal from the first vehicle-mounted device 5, and the reliability of the process of driving the second vehicle-mounted device 6 can be improved through this control data.

[0115] (Embodiment 2)

[0116] Figure 7 FIG. is a schematic diagram illustrating the structure of a vehicle-mounted system S (integrated ECU 4) according to Embodiment 2. The vehicle-mounted system S includes a first separate ECU 1, a second separate ECU 2, and an integrated ECU 4 mounted on a vehicle C. The first separate ECU 1 and the second separate ECU 2 are communicably connected to a switch 51 as the first vehicle-mounted device 5 and an actuator 61 as the second vehicle-mounted device 6 via signal lines 8 in the same manner as in Embodiment 1.

[0117] The first separate ECU 1 and the second separate ECU 2 are connected via the integrated ECU 4 by a communication line 7. Therefore, the integrated ECU 4 is directly connected to the first separate ECU 1 and the second separate ECU 2 by two communication lines 7, forming a vehicle-mounted network having a star-shaped topology centered on the integrated ECU 4. The integrated ECU 4 is only connected to the first separate ECU 1 and the second separate ECU 2 and is not directly connected to the first vehicle-mounted device 5 and the second vehicle-mounted device 6 via the signal line 8.

[0118] Based on communication with the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 makes determinations related to the normality or abnormality of the above individual ECUs. Based on the determination results, it performs processing related to replacement instructions for the first individual ECU 1 or the second individual ECU 2. For example, it is a central control device such as a vehicle computer. The integrated ECU 4 includes a control unit 41, a storage unit 42, and a communication unit 43, similar to the first individual ECU 1. The control unit 41, storage unit 42, and communication unit 43 of the integrated ECU 4 may also be configured with the same structure as the first individual ECU 1. The control programs and data required for the above processing are stored in the storage unit 42 of the integrated ECU 4. The integrated ECU 4 corresponds to the third in-vehicle ECU.

[0119] Figure 8 It is an explanatory diagram illustrating one form of each process (in normal operation) performed by the first individual ECU 1, etc. In the present embodiment, similar to Embodiment 1, the first individual ECU 1 functions as the SW input main ECU and the ACT output sub-ECU. The second individual ECU 2 functions as the ACT output sub-ECU and the W input sub-ECU. Based on the communication results with the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 determines whether the first individual ECU 1 and the second individual ECU 2 are normal or abnormal, and based on the determination results, performs processing to replace the abnormal individual ECU with the normal individual ECU.

[0120] In the illustration of the present embodiment, the process flow when both the first individual ECU 1 and the second individual ECU 2 are normal is described. Similar to Embodiment 1, the switch 51 receives the input generated by the operation (S21), and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (S22).

[0121] Similar to Embodiment 1, the first individual ECU 1 and the second individual ECU 2 detect the signal (SW input signal) output from the switch 51 (S23, S24). The first individual ECU 1 and the second individual ECU 2 generate a signal (detection signal) based on the signal (SW input signal) detected from the switch 51, and output the detection signal to the integrated ECU 4 (S25, S26).

[0122] The integrated ECU 4 performs input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2 (S27). By performing input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 obtains information related to the signal (SW input signal) output from the switch 51 via the first individual ECU 1 and the second individual ECU 2.

[0123] Based on the input detection of the signals (detection signals) output from the first separate ECU 1 and the second separate ECU 2, the integrated ECU 4 determines that the first separate ECU 1 and the second separate ECU 2 are normal and no replacement is required (S28). The integrated ECU 4 generates an indication signal and outputs the generated indication signal to the second separate ECU 2 (S29).

[0124] Based on the indication signal obtained from the integrated ECU 4, the second separate ECU 2 generates control data in the same manner as in Embodiment 1 (S30), and outputs the generated control data to the actuator 61 (S31).

[0125] The actuator 61 generates a response signal in the same manner as in Embodiment 1, and outputs the generated response signal to the first separate ECU 1 (S32). The actuator 61 drives the device based on the control data output from the second separate ECU 2 (S33). The first separate ECU 1 confirms (output confirmation) the response signal output from the actuator 61 (S34).

[0126] Figure 9 It is an explanatory diagram illustrating one form of each process (when the first separate ECU 1 is abnormal) performed by the first separate ECU 1 and the like. In the illustration of this embodiment, the process flow when the first separate ECU 1 is abnormal and the second separate ECU 2 is normal is described.

[0127] Similar to Embodiment 1, the switch 51 receives the input (F21) generated by the operation, and outputs the generated signal (SW input signal) to the first separate ECU 1 and the second separate ECU 2 via the signal line 8 (F22).

[0128] The second separate ECU 2 detects the signal (SW input signal) output from the switch 51 (F23). Since the first separate ECU 1 is abnormal, it cannot detect the signal (SW input signal) output from the switch 51. Based on the signal (SW input signal) detected from the switch 51, the second separate ECU 2 generates a signal (detection signal) and outputs the detection signal to the integrated ECU 4 (F24).

[0129] The integrated ECU 4 performs input detection of the signal (detection signal) output from the second separate ECU 2 (F25). The integrated ECU 4 attempts to perform input detection of the signal (detection signal) that should be output from the first separate ECU 1, but since the first separate ECU 1 is abnormal, it cannot detect the signal (detection signal) from the first separate ECU 1.

[0130] When the integrated ECU 4 cannot detect the signal (detection signal) from the first individual ECU 1, the integrated ECU 4 outputs a signal (survival confirmation signal) for performing survival confirmation to the first individual ECU 1 (F26). Since the first individual ECU 1 is abnormal, the integrated ECU 4 cannot obtain a response from the first individual ECU 1 to the survival confirmation signal.

[0131] The integrated ECU 4 determines that the first individual ECU 1 is abnormal and needs to be replaced (F27). The integrated ECU 4 outputs a signal (replacement instruction signal) as an instruction for replacing the function of the first individual ECU 1 to the second individual ECU 2 (F28).

[0132] Based on the replacement instruction signal obtained from the integrated ECU 4, the second individual ECU 2 generates control data (F29) in the same manner as in Embodiment 1, and outputs the generated control data to the actuator 61 (F30). Based on the control data output from the second individual ECU 2, the actuator 61 drives the present device (F31).

[0133] Figure 10 It is an explanatory diagram illustrating one form of each process (when the second individual ECU 2 is abnormal) performed by the first individual ECU 1 and the like. In the illustration of the present embodiment, the process flow when the first individual ECU 1 is normal and the second individual ECU 2 is abnormal is described.

[0134] Similar to Embodiment 1, the switch 51 receives the input (K21) generated by the operation, and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (K22).

[0135] The first individual ECU 1 detects the signal (SW input signal) output from the switch 51 (K23). Since the second individual ECU 2 is abnormal, it cannot detect the signal (SW input signal) output from the switch 51. Based on the signal (SW input signal) detected from the switch 51, the first individual ECU 1 generates a signal (detection signal), and outputs the detection signal to the integrated ECU 4 (K24).

[0136] The integrated ECU 4 performs input detection of the signal (detection signal) output from the first individual ECU 1 (K25). The integrated ECU 4 attempts to perform input detection of the signal (detection signal) that should be output from the second individual ECU 2, but since the second individual ECU 2 is abnormal, it cannot detect the signal (detection signal) from the second individual ECU 2.

[0137] When the integrated ECU 4 cannot detect the signal (detection signal) from the second separate ECU 2, the integrated ECU 4 outputs a signal (survival confirmation signal) (K26) for survival confirmation to the second separate ECU 2. Since the second separate ECU 2 is abnormal, the integrated ECU 4 cannot obtain a response from the second separate ECU 2 to the survival confirmation signal.

[0138] The integrated ECU 4 determines that the second separate ECU 2 is abnormal and needs to be replaced (K27). The integrated ECU 4 outputs a signal (replacement instruction signal) (K28) to the first separate ECU 1 as an instruction for replacing the function of the second separate ECU 2.

[0139] Based on the replacement instruction signal obtained from the integrated ECU 4, the first separate ECU 1 generates control data (K29) in the same manner as in Embodiment 1, and outputs the generated control data to the actuator 61 (K30). Based on the control data output from the first separate ECU 1, the actuator 61 drives the device (K31).

[0140] Figure 11 It is a flowchart illustrating the processing of the control unit 41 of the integrated ECU 4. The control unit 41 of the integrated ECU 4 stably performs the following processing when, for example, the vehicle C is in a starting state (ignition switch is on) or a stop state (ignition switch is off).

[0141] The control unit 41 of the integrated ECU 4 determines whether it has received each signal output from the first separate ECU 1 and the second separate ECU 2 (S201). Based on the reception of each signal output from the first separate ECU 1 and the second separate ECU 2, that is, the detection result of the input of the signal, the control unit 41 of the integrated ECU 4 determines whether it has received each signal output from the first separate ECU 1 and the second separate ECU 2.

[0142] When it has received each signal output from the first separate ECU 1 and the second separate ECU 2 (S201: Yes), the control unit 41 of the integrated ECU 4 determines that both the first separate ECU 1 and the second separate ECU 2 are normal (S206). The control unit 41 of the integrated ECU 4 outputs an instruction signal to the second separate ECU 2 (S207).

[0143] Based on the instruction signal (control data generation instruction signal) output from the control unit 41 of the integrated ECU 4, the second separate ECU 2 generates control data in the same manner as in Embodiment 1, and outputs the generated control data to the actuator 61. As the actuator 61 of the second vehicle-mounted device 6, based on the control data output from the second separate ECU 2, the device is driven.

[0144] When the respective signals output from the first separate ECU 1 and the second separate ECU 2 cannot be obtained (S201: No), that is, when the signal from one of the first separate ECU 1 and the second separate ECU 2 cannot be obtained, the control unit 41 of the integrated ECU 4 outputs a survival confirmation signal for performing survival confirmation to the separate ECU for which the signal cannot be obtained (S202).

[0145] The control unit 41 of the integrated ECU 4 determines whether a survival response signal for the output survival confirmation signal has been obtained (S203). When the survival response signal has been obtained (S203: Yes), the control unit 41 of the integrated ECU 4 determines that both the first separate ECU 1 and the second separate ECU 2 are normal (S206).

[0146] When the survival response signal has not been obtained (S203: No), the control unit 41 of the integrated ECU 4 determines that the separate ECU for which the signal cannot be obtained is abnormal (S204). The control unit 41 of the integrated ECU 4 outputs an instruction signal related to substitution indication to the separate ECU that can obtain the signal (S205). The separate ECU that has obtained the instruction signal related to substitution indication performs processing for substituting the separate ECU determined to be abnormal.

[0147] When it is determined that the first separate ECU 1 is abnormal, the processing that the second separate ECU 2 substitutes for the first separate ECU 1, that is, the processing related to the reception of the signal output from the switch 51, generates control data based on this signal, and outputs the generated control data to the actuator 61. When it is determined that the second separate ECU 2 is abnormal, the first separate ECU 1 performs the processing related to the generation of control data and the output to the actuator 61, substituting for the second separate ECU 2, based on the signal output from the switch 51.

[0148] According to this embodiment, the integrated ECU 4 connected to the first separate ECU 1 and the second separate ECU 2 via the communication line 7 determines whether the first separate ECU 1 and the second separate ECU 2 are normal or abnormal based on the communication results with the first separate ECU 1 and the second separate ECU 2. Therefore, it is not necessary for the first separate ECU 1 and the second separate ECU 2 to perform this determination process. Thus, through the first separate ECU 1, the second separate ECU 2, and the integrated ECU 4, it is possible to distribute the load of a series of processes in cooperation between the first vehicle-mounted device 5 and the second vehicle-mounted device 6, and improve the usability of the vehicle-mounted system S.

[0149] (Embodiment 3)

[0150] Figure 12This is a schematic diagram showing the structure of the vehicle-mounted system S of exemplary embodiment 3 (the third separate ECU 3). The vehicle-mounted system S includes a first separate ECU 1, a second separate ECU 2, a third separate ECU 3, and an integrated ECU 4 mounted on the vehicle C.

[0151] The first separate ECU 1 and the second separate ECU 2 are communicably connected to the switch 51, which is the first vehicle-mounted device 5, via the signal line 8. The first separate ECU 1 and the third separate ECU 3 are communicably connected to the actuator 61, which is the second vehicle-mounted device 6, via the signal line 8.

[0152] The first separate ECU 1, the second separate ECU 2, and the third separate ECU 3 are connected via the integrated ECU 4 by the communication line 7. Therefore, the integrated ECU 4 is directly connected to the first separate ECU 1, the second separate ECU 2, and the third separate ECU 3 by three communication lines 7, forming a vehicle-mounted network with a star-shaped topology centered on the integrated ECU 4. The integrated ECU 4 is only connected to the first separate ECU 1, the second separate ECU 2, and the third separate ECU 3, and is not directly connected to the first vehicle-mounted device 5 and the second vehicle-mounted device 6 via the signal line 8.

[0153] Similar to the first separate ECU 1, the third separate ECU 3 includes a control unit 31, a storage unit 32, an input / output I / F 34, and a communication unit 33. The control unit 31, the storage unit 32, the input / output I / F 34, and the communication unit 33 of the third separate ECU 3 are constituted by the same structure as those of the first separate ECU 1. The control programs and data stored in the storage unit 32 of the third separate ECU 3 are the same as or mutually interchangeable with the control programs and data stored in the storage unit 12 of the first separate ECU 1. Thus, in the first separate ECU 1 and the third separate ECU 3, the hardware structures and software structures are the same or mutually interchangeable. Therefore, even when the first separate ECU 1 becomes abnormal, the third separate ECU 3 can substitute for the functions that the abnormal first separate ECU 1 should execute.

[0154] Figure 13This is an explanatory diagram illustrating one form of each process (in normal operation) performed by the first individual ECU 1 or the like. In the present embodiment, the first individual ECU 1 functions as an SW input main ECU that mainly processes the signal received from the switch 51 of the first vehicle-mounted device 5, that is, the process corresponding to the input signal (SW input signal) from the switch 51. The first individual ECU 1 also functions as an ACT output main ECU that mainly generates and outputs control data for the actuator 61 of the second vehicle-mounted device 6, that is, the process corresponding to the control data output (ACT output) to the actuator 61. That is, the first individual ECU 1 functions as an SW input main ECU and an ACT output main ECU. On this basis, when the first individual ECU 1 becomes abnormal, the second individual ECU 2 functions as an SW input sub-ECU that substitutes for the process corresponding to the input signal (SW input) from the switch 51. When the first individual ECU 1 becomes abnormal, the third individual ECU 3 functions as an ACT output sub-ECU that substitutes for the process corresponding to the control data output (ACT output) to the actuator 61.

[0155] Based on the communication results with the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 determines whether the first individual ECU 1 is normal or abnormal, and based on this determination result, performs a process of instructing the third individual ECU 3 to substitute for the first individual ECU 1.

[0156] In the illustration of the present embodiment, the process flow when both the first individual ECU 1 and the second individual ECU 2 are normal is described. Similar to Embodiment 1, the switch 51 receives the input generated by the operation (S41), and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (S42).

[0157] The first individual ECU 1 and the second individual ECU 2 detect the signal (SW input signal) output from the switch 51 in the same manner as in Embodiment 1 (S43, S44). Based on the signal (SW input signal) detected from the switch 51, the first individual ECU 1 and the second individual ECU 2 generate a signal (detection signal) and output the detection signal to the integrated ECU 4 (S45, S46).

[0158] The integrated ECU 4 performs an input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2 (S47). By performing the input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 obtains information related to the signal (SW input signal) output from the switch 51 via the first individual ECU 1 and the second individual ECU 2.

[0159] Based on the input detection of the signals (detection signals) output from the first individual ECU1 and the second individual ECU2, the integrated ECU4 determines that the first individual ECU1 and the second individual ECU2 are normal and that replacement of the first individual ECU1 is not required (S48). The integrated ECU4 generates an indication signal and outputs the generated indication signal to the first individual ECU1 and the third individual ECU3 (S49).

[0160] Based on the indication signal obtained from the integrated ECU4, the first individual ECU1 generates control data (S50), and outputs the generated control data to the actuator 61 (S51). The actuator 61 generates a response signal in the same manner as in Embodiment 1, and outputs the generated response signal to the third individual ECU3 (S52). The actuator 61 drives the present device based on the control data output from the first individual ECU1 (S53).

[0161] Figure 14 It is an explanatory diagram illustrating one form of each process (when the first individual ECU1 is abnormal 1) performed by the first individual ECU1 and the like. In the illustration of the present embodiment, the process flow when the first individual ECU1 is abnormal and the second individual ECU2 and the third individual ECU3 are normal is described.

[0162] Similar to Embodiment 1, the switch 51 receives the input generated by the operation (F41), and outputs the generated signal (SW input signal) to the first individual ECU1 and the second individual ECU2 via the signal line 8 (F42).

[0163] The second individual ECU2 detects the signal (SW input signal) output from the switch 51 (F43). Since the first individual ECU1 is abnormal, the signal (SW input signal) output from the switch 51 cannot be detected. The second individual ECU2 generates a signal (detection signal) based on the signal (SW input signal) detected from the switch 51, and outputs the detection signal to the integrated ECU4 (F44).

[0164] The integrated ECU4 performs input detection of the signal (detection signal) output from the second individual ECU2 (F45). The integrated ECU4 attempts to perform input detection of the signal (detection signal) that should be output from the first individual ECU1, but since the first individual ECU1 is abnormal, the signal (detection signal) from the first individual ECU1 cannot be detected. Based on the fact that the signal (detection signal) from the first individual ECU1 cannot be detected, the integrated ECU4 outputs a signal (survival confirmation signal) for performing survival confirmation to the first individual ECU1 (F46). Since the first individual ECU1 is abnormal, the integrated ECU4 cannot obtain a response from the first individual ECU1 to the survival confirmation signal.

[0165] The integrated ECU 4 determines that the first individual ECU 1 is abnormal and needs to be replaced (F47). The integrated ECU 4 outputs a signal (replacement indication signal) (F48) to the third individual ECU 3 as an indication for replacing the function of the first individual ECU 1.

[0166] Based on the replacement indication signal obtained from the integrated ECU 4, the third individual ECU 3 generates control data (F49) and outputs the generated control data to the actuator 61 (F50). Based on the control data output from the third individual ECU 3, the actuator 61 drives the device (F51).

[0167] Figure 15 This is an explanatory diagram illustrating one form of each process (when the first individual ECU 1 is abnormal 2) performed by the first individual ECU 1 and the like. In the illustration of the present embodiment, the process flow when the first individual ECU 1 is abnormal and the second individual ECU 2 and the third individual ECU 3 are normal is explained.

[0168] Similar to Embodiment 1, the switch 51 receives the input (K41) generated by the operation, and outputs the generated signal (SW input signal) to the first individual ECU 1 and the second individual ECU 2 via the signal line 8 (K42).

[0169] Similar to Embodiment 1, the first individual ECU 1 and the second individual ECU 2 detect the signal (SW input signal) output from the switch 51 (K43, K44). The first individual ECU 1 and the second individual ECU 2 generate a signal (detection signal) based on the signal (SW input signal) detected from the switch 51, and output the detection signal to the integrated ECU 4 (K45, K46). That is, at the time point when the first individual ECU 1 detects the signal (SW input signal) output from the switch 51, it functions normally and operates normally as the SW input main ECU.

[0170] The integrated ECU 4 performs input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2 (K47). Based on the input detection of the signals (detection signals) output from the first individual ECU 1 and the second individual ECU 2, the integrated ECU 4 determines that the first individual ECU 1 and the second individual ECU 2 are normal and the replacement of the first individual ECU 1 is not required (K48). That is, at the time point when the integrated ECU 4 detects the signal (SW input signal) output from the switch 51, it once determines that the first individual ECU 1 is normal.

[0171] The integrated ECU 4 generates an indication signal and outputs the generated indication signal to the first individual ECU 1 and the third individual ECU 3 (K49). However, based on the indication signal output from the integrated ECU 4, the first individual ECU 1 becomes abnormal at the time of generating control data. Therefore, the first individual ECU 1 cannot generate control data based on the indication signal output from the integrated ECU 4 and output it to the actuator 61.

[0172] The third individual ECU 3 outputs a notification (no response signal notification) indicating the content that the response signal that should be output from the actuator 61 cannot be obtained to the integrated ECU 4 (K50). The third individual ECU 3 outputs a notification (no response signal notification) indicating the content that the response signal cannot be obtained to the integrated ECU 4 when it cannot obtain the response signal within a specified period from the time point when it has obtained the indication signal output from the integrated ECU 4.

[0173] Based on the notification (no response signal notification) from the third individual ECU 3, the integrated ECU 4 outputs a signal (survival confirmation signal) for performing the survival confirmation of the first individual ECU 1 to the first individual ECU 1 and the third individual ECU 3 (K51). Since the first individual ECU 1 is abnormal, the integrated ECU 4 cannot obtain the response from the first individual ECU 1 to the survival confirmation signal.

[0174] The third individual ECU 3 can also output a notification (no response signal notification) indicating the content that the response signal cannot be obtained to the integrated ECU 4 again when it cannot obtain the response signal from the actuator 61 within a specified period from the time point when it has obtained the survival confirmation signal output from the integrated ECU 4 (K52).

[0175] Based on the situation that the response from the first individual ECU 1 to the survival confirmation signal cannot be obtained or the acquisition of the again no response signal notification from the third individual ECU 3, the integrated ECU 4 determines that the first individual ECU 1 is abnormal and needs to be replaced (K53). That is, the integrated ECU 4 finally determines that the first individual ECU 1 is abnormal and needs to be replaced based on the communication result with the first individual ECU 1 or the third individual ECU 3. The integrated ECU 4 outputs a signal (replacement indication signal) as an indication for replacing the function of the first individual ECU 1 to the third individual ECU 3 (K54).

[0176] Based on the replacement indication signal obtained from the integrated ECU 4, the third individual ECU 3 generates control data (K55) and outputs the generated control data to the actuator 61 (K56). The actuator 61 drives the device based on the control data output from the third individual ECU 3 (F57).

[0177] Figure 16This is a flowchart illustrating the processing of the control unit 41 of the integrated ECU 4. The control unit 41 of the integrated ECU 4 stably performs the following processing, for example, when the vehicle C is in the start state (ignition switch is on) or the stop state (ignition switch is off).

[0178] The control unit 41 of the integrated ECU 4 determines whether it has acquired each signal output from the first individual ECU 1 and the second individual ECU 2 (S301). When it has not acquired each signal output from the first individual ECU 1 and the second individual ECU 2 (S301: No), it outputs a survival confirmation signal for performing survival confirmation to the first individual ECU 1 (S302).

[0179] The control unit 41 of the integrated ECU 4 determines whether it has acquired a survival response signal from the first individual ECU 1 (S303). When it has acquired a survival response signal from the first individual ECU 1 (S303: Yes), the control unit 41 of the integrated ECU 4 determines that the first individual ECU 1 is normal (S310).

[0180] When it has not acquired a survival response signal from the first individual ECU 1 (S303: No), the control unit 41 of the integrated ECU 4 determines that the first individual ECU 1 is abnormal (S304). The control unit 41 of the integrated ECU 4 outputs an instruction signal related to the substitution instruction to the third individual ECU 3 (S305).

[0181] When it has acquired each signal output from the first individual ECU 1 and the second individual ECU 2 (S301: Yes), the control unit 41 of the integrated ECU 4 once determines that both the first individual ECU 1 and the second individual ECU 2 are normal (S306). The control unit 41 of the integrated ECU 4 outputs an instruction signal to the first individual ECU 1 and the third individual ECU 3 (S307).

[0182] The control unit 41 of the integrated ECU 4 determines whether it has acquired a non-response signal notification from the third individual ECU 3 (S308). When it has not acquired a non-response signal notification (S308: No), the control unit 41 of the integrated ECU 4 determines that the first individual ECU 1 is normal (S310).

[0183] When it has acquired a non-response signal notification (S308: Yes), the control unit 41 of the integrated ECU 4 outputs a survival confirmation signal for performing survival confirmation to the first individual ECU 1 and the third individual ECU 3 (S309).

[0184] The control unit 41 of the integrated ECU 4 determines whether a survival response signal has been obtained from the first separate ECU 1 (S303). When a survival response signal has been obtained from the first separate ECU 1 (S303: Yes), the control unit 41 of the integrated ECU 4 determines that the first separate ECU 1 is normal (S310).

[0185] When a survival response signal has not been obtained from the first separate ECU 1 (S303: No), the control unit 41 of the integrated ECU 4 determines that the first separate ECU 1 is abnormal (S304). The control unit 41 of the integrated ECU 4 may also finally determine that the first separate ECU 1 is abnormal when a no-response signal notification is obtained again from the third separate ECU 3. The third separate ECU 3 waits for a response signal output from the actuator 61, and when the response signal has not been obtained (received) within a specified period from the time point when the survival confirmation signal has been obtained from the control unit 41 of the integrated ECU 4, the third separate ECU 3 may also output a no-response signal notification again to the integrated ECU 4. In this case, the control unit 41 of the integrated ECU 4 obtains the no-response signal notification again from the third separate ECU 3, and based on this no-response signal notification again, the control unit 41 of the integrated ECU 4 may also determine that the first separate ECU 1 is abnormal. The control unit 41 of the integrated ECU 4 outputs an instruction signal related to the substitution instruction to the third separate ECU 3 (S305).

[0186] According to the present embodiment, the vehicle-mounted system S sets the first separate ECU 1 as the main separate ECU responsible for processing the first vehicle-mounted device 5 and the second vehicle-mounted device 6, and includes a second separate ECU 2 that substitutes for the processing of the first vehicle-mounted device 5 and a third separate ECU 3 that substitutes for the processing of the second vehicle-mounted device 6, thereby being able to further improve the reliability of the processing related to the first vehicle-mounted device 5 and the second vehicle-mounted device 6.

[0187] (Embodiment 4)

[0188] Figure 17 FIG. is a schematic diagram showing the structure of the vehicle-mounted system S according to Embodiment 4 (door lock). The vehicle-mounted system S includes a first separate ECU 1, a second separate ECU 2, a third separate ECU 3, and an integrated ECU 4 mounted on the vehicle C. In the present embodiment, as an example, the first vehicle-mounted device 5 is a door switch SW52, and the second vehicle-mounted device 6 is a door lock device 62.

[0189] The integrated ECU 4 is directly connected to the first separate ECU 1, the second separate ECU 2, and the third separate ECU 3 through three communication lines 7, and constitutes a vehicle-mounted network having a star-shaped topology with the integrated ECU 4 as the center.

[0190] The first individual ECU1 and the third individual ECU3 are directly connected to the door SW52 by the signal line 8. The second individual ECU2 and the third individual ECU3 are directly connected to the door lock device 62 by the signal line 8.

[0191] The first individual ECU1 functions as an SW input main ECU that mainly processes the signals received from the door SW52 as the first vehicle-mounted device 5, that is, processes corresponding to the input signals (SW input signals) from the door SW52.

[0192] The second individual ECU2 functions as an ACT output main ECU that mainly generates and outputs control data for the door lock device 62 as the second vehicle-mounted device 6, that is, processes corresponding to the control data output (ACT output) to the door lock device 62.

[0193] When the first individual ECU1 becomes abnormal, the third individual ECU3 functions as an SW input sub-ECU to replace the processing corresponding to the input signals (SW input signals) from the door SW52. When the second individual ECU2 becomes abnormal, the third individual ECU3 also functions as an ACT output sub-ECU to replace the processing corresponding to the control data output (ACT output) to the door lock device 62.

[0194] Similar to Embodiment 3, the integrated ECU4 determines whether the first individual ECU1 is normal or abnormal based on the communication results with the first individual ECU1 and the second individual ECU2, and based on this determination result, performs processing to instruct the third individual ECU3 to replace the first individual ECU1 or the second individual ECU2.

[0195] In this way, by dualizing the connection method of the signal line 8 connecting the first individual ECU1, the second individual ECU2, and the third individual ECU3 to the door SW52 and the door lock device 62, the connection method can be made into a redundant structure. By performing the abnormality determination of the above individual ECUs and the processing related to the replacement instruction, the integrated ECU4 can improve the reliability of the control processing associated with the door SW52 and the door lock device 62.

[0196] (Embodiment 5)

[0197] Figure 18 It is a schematic diagram showing the structure of the vehicle-mounted system S of Embodiment 5 (wiper). The vehicle-mounted system S includes the first individual ECU1, the second individual ECU2, the third individual ECU3, and the integrated ECU4 mounted on the vehicle C. In this embodiment, as an example, the first vehicle-mounted device 5 is a wiper SW53, and the second vehicle-mounted device 6 is a wiper device 63.

[0198] The integrated ECU 4 is directly connected to the first individual ECU 1, the second individual ECU 2, and the third individual ECU 3 through three communication lines 7, forming a vehicle-mounted network with a star-shaped topology centered on the integrated ECU 4. The first individual ECU 1 and the third individual ECU 3 are directly connected to the wiper SW 53 and the wiper device 63 through signal lines 8, respectively.

[0199] The first individual ECU 1 functions as an SW input main ECU that mainly processes the signals received from the wiper SW 53 as the first vehicle-mounted device 5, that is, processes corresponding to the input signal (SW input signal) from the wiper SW 53. The first individual ECU 1 also functions as an ACT output main ECU that mainly generates and outputs control data for the wiper device 63 as the second vehicle-mounted device 6, that is, processes corresponding to the control data output (ACT output) to the wiper device 63.

[0200] When the first individual ECU 1 becomes abnormal, the third individual ECU 3 functions as an SW input sub-ECU that substitutes for the processing corresponding to the input signal (SW input signal) from the wiper SW 53. When the first individual ECU 1 becomes abnormal, the third individual ECU 3 also functions as an ACT output sub-ECU that substitutes for the processing corresponding to the control data output (ACT output) to the wiper device 63.

[0201] Similar to Embodiment 3, the integrated ECU 4 determines whether the first individual ECU 1 or the third individual ECU 3 is normal or abnormal based on the communication results with the first individual ECU 1 and the third individual ECU 3, and based on this determination result, performs processing to instruct another individual ECU to substitute for the first individual ECU 1 or the third individual ECU 3.

[0202] In this way, by dualizing the connection method of the signal lines 8 connecting the first individual ECU 1 and the third individual ECU 3 to the wiper SW 53 and the wiper device 63, the connection method can be made into a redundant structure. By performing the abnormality determination of the above-mentioned individual ECU and the processing related to the substitution instruction, the integrated ECU 4 can improve the reliability of the control processing associated with the wiper SW 53 and the wiper device 63.

[0203] (Embodiment 6)

[0204] Figure 19It is a schematic diagram showing the structure of the in-vehicle system S of exemplary embodiment 6 (lamp). The in-vehicle system S includes a first individual ECU 1, a second individual ECU 2, a third individual ECU 3, and a comprehensive ECU 4 mounted on the vehicle C. In this embodiment, as an example, the first in-vehicle device 5 is the lamp SW54, and the second in-vehicle device 6 is the lamp devices 64 on the left and right in the front of the vehicle C.

[0205] The comprehensive ECU 4 is directly connected to the first individual ECU 1, the second individual ECU 2, and the third individual ECU 3 through three communication lines 7, forming an in-vehicle network with a star-shaped topology centered on the comprehensive ECU 4.

[0206] The first individual ECU 1 and the second individual ECU 2 are directly connected to the lamp SW54 through a signal line 8. The first individual ECU 1 and the third individual ECU 3 are directly connected to the lamp device 64 through a signal line 8.

[0207] The first individual ECU 1 functions as an SW input main ECU that mainly processes the signal received from the lamp SW54 as the first in-vehicle device 5, that is, processes corresponding to the input signal (SW input signal) from the lamp SW54. The first individual ECU 1 also functions as an ACT output main ECU that mainly generates and outputs control data for the lamp device 64 as the second in-vehicle device 6, that is, processes corresponding to the control data output (ACT output) to the lamp device 64.

[0208] When the first individual ECU 1 becomes abnormal, the second individual ECU 2 functions as an SW input sub-ECU that substitutes for the processing corresponding to the input signal (SW input signal) from the lamp SW54.

[0209] When the first individual ECU 1 becomes abnormal, the third individual ECU 3 functions as an ACT output sub-ECU that substitutes for the processing corresponding to the control data output (ACT output) to the lamp device 64.

[0210] Similar to Embodiment 3, the comprehensive ECU 4 determines whether the first individual ECU 1 is normal or abnormal based on the communication result with the first individual ECU 1, and based on this determination result, performs a process of instructing the second individual ECU 2 or the third individual ECU 3 to substitute for the first individual ECU 1.

[0211] By duplicating the connection method of the signal line 8 that connects the first separate ECU 1, the second separate ECU 2, and the third separate ECU 3 to the lamp SW 54 and the lamp device 64, the connection method can be made into a redundant structure. In addition, by performing abnormality determination on these separate ECUs and processing related to substitution instructions, the integrated ECU 4 can improve the reliability of the control processing associated with the lamp SW 54 and the lamp device 64.

[0212] It should be noted that the embodiments disclosed herein are illustrative in all respects and not restrictive. The scope of the present invention is defined not by the above description but by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0213] Reference Signs Explanation

[0214] S Vehicle-mounted system

[0215] C Vehicle

[0216] 1 First separate ECU (First vehicle-mounted ECU)

[0217] 11 Control unit

[0218] 12 Storage unit

[0219] 13 Communication unit

[0220] 14 Input / output I / F

[0221] 2 Second separate ECU (Second vehicle-mounted ECU)

[0222] 21 Control unit

[0223] 22 Storage unit

[0224] 23 Communication unit

[0225] 24 Input / output I / F

[0226] 3 Third separate ECU (First vehicle-mounted ECU)

[0227] 31 Control unit

[0228] 32 Storage unit

[0229] 33 Communication unit

[0230] 34 Input / output I / F

[0231] 4 Integrated ECU (Third vehicle-mounted ECU)

[0232] 41 Control unit

[0233] 42 Storage unit

[0234] 43 Communication Unit

[0235] 5 First Vehicle-mounted Device

[0236] 51 Switch (SW)

[0237] 52 Door SW

[0238] 53 Wiper SW

[0239] 54 Lamp SW

[0240] 6 Second Vehicle-mounted Device

[0241] 61 Actuator (ACT)

[0242] 62 Door Locking Device

[0243] 63 Wiper Device

[0244] 64 Lamp Device

[0245] 7 Communication Line

[0246] 8 Signal Line

Claims

1. A vehicle-mounted system, comprising: A first vehicle-mounted device mounted on a vehicle; A second vehicle-mounted device controlled according to a signal output from the first vehicle-mounted device; The first in-vehicle ECU is connected to the first in-vehicle device and the second in-vehicle device in a communicable manner via signal lines; And A second vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via the signal line, Wherein The first vehicle-mounted ECU and the second vehicle-mounted ECU are connected by a communication line of a type different from the signal line, The communication path from the first vehicle-mounted device to the second vehicle-mounted device includes a first path relayed by the first vehicle-mounted ECU and a second path relayed by the second vehicle-mounted ECU, The first vehicle-mounted ECU and the second vehicle-mounted ECU each include a control unit that obtains a signal from the first vehicle-mounted device via the signal line and generates control data for controlling the second vehicle-mounted device based on the signal output from the first vehicle-mounted device, Each of the control units of the first vehicle-mounted ECU and the second vehicle-mounted ECU determines whether the other vehicle-mounted ECU is normal or abnormal based on the communication result between the first vehicle-mounted ECU and the second vehicle-mounted ECU via the communication line; When it is determined that the first vehicle-mounted ECU is abnormal, the second vehicle-mounted ECU replaces the first vehicle-mounted ECU; When it is determined that the second vehicle-mounted ECU is abnormal, the first vehicle-mounted ECU replaces the second vehicle-mounted ECU, When it is determined that both the first vehicle-mounted ECU and the second vehicle-mounted ECU are normal, communication from the first vehicle-mounted device to the second vehicle-mounted device is performed via the first vehicle-mounted ECU and the second vehicle-mounted ECU.

2. A vehicle-mounted system, comprising: A first vehicle-mounted device mounted on a vehicle; A second vehicle-mounted device controlled according to a signal output from the first vehicle-mounted device; The first vehicle-mounted ECU is connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via signal lines; And A second vehicle-mounted ECU connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via the signal line, Wherein The first vehicle-mounted ECU and the second vehicle-mounted ECU are connected by a communication line of a type different from the signal line, The communication path from the first vehicle-mounted device to the second vehicle-mounted device includes a first path relayed by the first vehicle-mounted ECU and a second path relayed by the second vehicle-mounted ECU, The first vehicle-mounted ECU and the second vehicle-mounted ECU each include a control unit that obtains a signal from the first vehicle-mounted device via the signal line and generates control data for controlling the second vehicle-mounted device based on the signal output from the first vehicle-mounted device, Each of the control units of the first vehicle-mounted ECU and the second vehicle-mounted ECU determines whether the other vehicle-mounted ECU is normal or abnormal based on the communication result between the first vehicle-mounted ECU and the second vehicle-mounted ECU via the communication line; When it is determined that the first vehicle-mounted ECU is abnormal, the second vehicle-mounted ECU replaces the first vehicle-mounted ECU; When it is determined that the second vehicle-mounted ECU is abnormal, the first vehicle-mounted ECU replaces the second vehicle-mounted ECU, After the control unit of the second in-vehicle ECU has acquired a signal from the first in-vehicle device, if it fails to acquire a signal output from the first in-vehicle ECU within a specified period, it determines that the first in-vehicle ECU is abnormal, and if it acquires a signal output from the first in-vehicle ECU within a specified period, it determines that the first in-vehicle ECU is normal.

3. An in-vehicle system, comprising: A first in-vehicle device mounted on a vehicle; A second in-vehicle device controlled according to a signal output from the first in-vehicle device; The first vehicle-mounted ECU is connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via signal lines; and A second in-vehicle ECU connected to the first in-vehicle device and the second in-vehicle device via the signal line in a communicable manner, wherein the first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a different type from the signal line, the communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU, the first in-vehicle ECU and the second in-vehicle ECU each have a control unit that acquires a signal from the first in-vehicle device via the signal line and generates control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device, the respective control units of the first in-vehicle ECU and the second in-vehicle ECU determine whether the other in-vehicle ECU is normal or abnormal based on the communication result between the first in-vehicle ECU and the second in-vehicle ECU via the communication line; when it is determined that the first in-vehicle ECU is abnormal, the second in-vehicle ECU replaces the first in-vehicle ECU; when it is determined that the second in-vehicle ECU is abnormal, the first in-vehicle ECU replaces the second in-vehicle ECU, after the control unit of the first in-vehicle ECU has acquired a signal from the first in-vehicle device, if it fails to acquire a response from the second in-vehicle device within a specified period, it determines that the second in-vehicle ECU is abnormal, and if it acquires a response from the second in-vehicle device within a specified period, it determines that the second in-vehicle ECU is normal.

4. An in-vehicle system, comprising: A first in-vehicle device mounted on a vehicle; A second in-vehicle device controlled according to a signal output from the first in-vehicle device; The first vehicle-mounted ECU is connected to the first vehicle-mounted device and the second vehicle-mounted device in a communicable manner via signal lines; and A second in-vehicle ECU connected to the first in-vehicle device and the second in-vehicle device via the signal line in a communicable manner, wherein the first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a different type from the signal line, the communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU, the first in-vehicle ECU and the second in-vehicle ECU each have a control unit that acquires a signal from the first in-vehicle device via the signal line and generates control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device, The respective control units of the first in-vehicle ECU and the second in-vehicle ECU determine whether the other in-vehicle ECU is normal or abnormal based on the communication result between the first in-vehicle ECU and the second in-vehicle ECU via the communication line; When it is determined that the first in-vehicle ECU is abnormal, the second in-vehicle ECU replaces the first in-vehicle ECU; When it is determined that the second in-vehicle ECU is abnormal, the first in-vehicle ECU replaces the second in-vehicle ECU, When the control unit of the first in-vehicle ECU does not obtain a response to the signal from the second in-vehicle device within a specified period, the control unit of the first in-vehicle ECU also outputs a confirmation signal to the second in-vehicle ECU via the communication line, When the control unit of the first in-vehicle ECU does not obtain a response to the confirmation signal from the second in-vehicle ECU, it is determined that the second in-vehicle ECU is abnormal, When the control unit of the first in-vehicle ECU obtains a response to the confirmation signal from the second in-vehicle ECU, it is determined that the second in-vehicle ECU is normal.

5. The in-vehicle system according to any one of claims 1 to 4, wherein, When it is determined by the control unit of the second in-vehicle ECU that the first in-vehicle ECU is abnormal, the control unit of the second in-vehicle ECU outputs the control data to the second in-vehicle device using the second path, thereby replacing the first in-vehicle ECU, When it is determined by the control unit of the first in-vehicle ECU that the second in-vehicle ECU is abnormal, the control unit of the first in-vehicle ECU outputs the control data to the second in-vehicle device using the first path, thereby replacing the second in-vehicle ECU.

6. The in-vehicle system according to any one of claims 1 to 4, wherein, The in-vehicle system includes a third in-vehicle ECU, and the third in-vehicle ECU is connected to the first in-vehicle ECU and the second in-vehicle ECU via a communication line, The control unit of the third in-vehicle ECU determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the communication result between the third in-vehicle ECU and the first in-vehicle ECU and the second in-vehicle ECU via the communication line, When it is determined that the first in-vehicle ECU is abnormal, the second in-vehicle ECU replaces the first in-vehicle ECU, When it is determined that the second in-vehicle ECU is abnormal, the first in-vehicle ECU replaces the second in-vehicle ECU.

7. The in-vehicle system according to claim 6, wherein, The control unit of the third in-vehicle ECU determines whether the first in-vehicle ECU and the second in-vehicle ECU are normal or abnormal based on the acquisition result of the signal detection data output from the first in-vehicle ECU and the second in-vehicle ECU according to the signal output from the first in-vehicle device.

8. The in-vehicle system according to claim 6 or 7, wherein, The third in-vehicle ECU is not directly connected to the first in-vehicle device and the second in-vehicle device through the signal line, but is connected via the first in-vehicle ECU or the second in-vehicle ECU.

9. An in-vehicle ECU, the in-vehicle ECU being communicably connected to a first in-vehicle device and a second in-vehicle device mounted on a vehicle via a signal line, wherein, the in-vehicle ECU is connected to another in-vehicle ECU through a communication line of a type different from the signal line, and the other in-vehicle ECU is communicably connected to the first in-vehicle device and the second in-vehicle device via the signal line, the in-vehicle ECU includes a control unit that obtains a signal from the first in-vehicle device via the signal line and generates control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device, the control unit of the in-vehicle ECU determines whether the other in-vehicle ECU is normal or abnormal based on the communication result with the other in-vehicle ECU, the control unit of the in-vehicle ECU performs a process of replacing the other in-vehicle ECU when it is determined that the other in-vehicle ECU is abnormal, the control unit of the other in-vehicle ECU determines whether the in-vehicle ECU is normal or abnormal based on the communication result with the in-vehicle ECU, the control unit of the other in-vehicle ECU performs a process of replacing the in-vehicle ECU when it is determined that the in-vehicle ECU is abnormal, When it is determined that both the in-vehicle ECU and the other in-vehicle ECU are normal, communication from the first in-vehicle device to the second in-vehicle device is performed via the in-vehicle ECU and the other in-vehicle ECU.

Images