Vehicle-mounted device and time synchronization method

Abstract

An in-vehicle device used in an in-vehicle network, the in-vehicle device being provided with: a time synchronization unit that calculates a time difference between the in-vehicle device and another in-vehicle device by transmitting and receiving time synchronization information, which is information for time synchronization, between the in-vehicle device and the other in-vehicle device; a time synchronization unit that performs time synchronization with the other in-vehicle device on the basis of the calculated time difference; a detection unit that monitors first transmission information, which is information transmitted from the other in-vehicle device to the local device, and detects an abnormality related to the content of the first transmission information; and an abnormality processing unit that, when an abnormality is detected by the detection unit, performs a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device.

Description

Technical Field

[0001] The present disclosure relates to a vehicle-mounted device and a time synchronization method.

[0002] This application claims the benefit of priority based on Japanese patent application No. 2022-98041, filed on June 17, 2022, the disclosure of which is incorporated herein in its entirety. Background Art

[0003] The following time synchronization system is disclosed in Japanese Patent Gazette No. 2020-167616 (Patent Document 1). That is, for the time synchronization system, in the time synchronization system that synchronizes the time on the slave side with the advanced master clock, a device that functions as an advanced host, one or more devices that function as adjacent repeaters, and one or more devices that function as terminals are connected via a network. The advanced host sends a signal containing a clock to the network, and the terminal corrects the time based on the clock, and accumulates the correction amount of the time to the correction cumulative value α possessed by the terminal. When α exceeds a specified threshold, an advanced host abnormality notification message is sent to the network. The adjacent repeater corrects the time of its own device based on the clock, and accumulates the correction amount of the time to α possessed by its own device. When α exceeds a specified threshold and receives an advanced host abnormality notification message from one or more devices under its control, a message indicating that the advanced host should be re-determined is sent to the network.

[0004] Prior art literature

[0005] Patent Literature

[0006] Patent Document 1: Japanese Patent Application Publication No. 2020-167616

[0007] Patent Document 2: Japanese Patent Application Publication No. 2020-129778

[0008] Patent Document 3: Japanese Patent Application Publication No. 2020-126317

[0009] Patent Document 4: Japanese Patent Application Publication No. 2018-112425

[0010] Patent Document 5: Japanese Patent Application Publication No. 2016-5214

[0011] Patent Document 6: Japanese Patent Application Publication No. 2018-196038 Summary of the invention

[0012] The vehicle-mounted device disclosed in the present invention is a vehicle-mounted device used in a vehicle-mounted network, and comprises: a time synchronization unit, which calculates a time difference with the other vehicle-mounted devices by sending and receiving information for time synchronization, i.e., the vehicle-mounted device, i.e., the device, and other vehicle-mounted devices, i.e., time synchronization information, and performs time synchronization with the other vehicle-mounted devices based on the calculated time difference; a detection unit, which monitors information sent from the other vehicle-mounted devices to the device, i.e., first transmission information, and detects anomalies related to the content of the first transmission information; and an abnormality processing unit, which, when an abnormality is detected by the detection unit, performs a stop process for stopping the time synchronization in the vehicle-mounted network that uses the time synchronization information sent from the other vehicle-mounted devices.

[0013] One aspect of the present disclosure can be implemented not only as a vehicle-mounted device having such a characteristic processing unit, but also as a program for causing a computer to execute the above-mentioned characteristic processing. In addition, one aspect of the present disclosure can be implemented as a semiconductor integrated circuit that implements part or all of the vehicle-mounted device, or can be implemented as a system including the vehicle-mounted device. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a diagram showing the configuration of the vehicle-mounted communication system according to the first embodiment of the present disclosure.

[0015] Figure 2 This is a diagram showing the configuration of a switch device according to the first embodiment of the present disclosure.

[0016] Figure 3 It is a diagram showing the configuration of a main functional unit according to the first embodiment of the present disclosure.

[0017] Figure 4 This is a diagram for explaining a method of updating the propagation delay time of the switching device according to the first embodiment of the present disclosure.

[0018] Figure 5 It is a diagram showing the structure of the terminal functional portion according to the first embodiment of the present disclosure.

[0019] Figure 6 It is a diagram for explaining a method of updating the propagation delay time of the terminal functional unit according to the first embodiment of the present disclosure.

[0020] Figure 7 This is a diagram showing an example of a stop process of a switch device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0021] Figure 8This is a diagram showing an example of a sequence of monitoring of time synchronization information and stop processing of time synchronization by a switch device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0022] Fig. 9 This is a diagram showing another example of the sequence of monitoring of the time source information and stopping processing of the time synchronization by the switch device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0023] Fig.10 It is a diagram showing a configuration of an in-vehicle communication system according to a second embodiment of the present disclosure.

[0024] Fig.11 It is a diagram showing a configuration of a switch device according to a second embodiment of the present disclosure.

[0025] Fig.12 It is a diagram showing the configuration of a main functional unit according to a second embodiment of the present disclosure.

[0026] Fig.13 This is a diagram showing an example of stop processing of a main function unit and a switch device in the in-vehicle communication system according to the second embodiment of the present disclosure.

[0027] Fig.14 This is a diagram showing an example of a sequence of monitoring of time synchronization information and switching processing of time synchronization information by a main functional unit in the in-vehicle communication system according to the second embodiment of the present disclosure.

[0028] Fig.15 This is a diagram showing another example of the sequence of the monitoring of the time synchronization information and the switching process of the time synchronization information by the main functional unit in the in-vehicle communication system according to the second embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Conventionally, a technology has been developed in which the time stored in a certain on-vehicle device in the on-vehicle network is used as a reference time, and each on-vehicle device in the on-vehicle network performs time synchronization using the reference time.

[0030] [Problems to be Solved by the Present Disclosure]

[0031] However, if an advanced host computer is subjected to an unauthorized attack via the network, a problem may arise in which time synchronization in the in-vehicle network is not performed normally.

[0032] The present disclosure has been made to solve the above-mentioned problems, and an object of the present disclosure is to provide an in-vehicle device and a time synchronization method that can suppress the occurrence of abnormality in time synchronization in an in-vehicle network.

[0033] [Effects of the present disclosure]

[0034] According to the present disclosure, it is possible to suppress the occurrence of abnormality in time synchronization in the in-vehicle network.

[0035] [Description of Embodiments of the Present Disclosure]

[0036] First, the contents of the embodiments of the present disclosure will be listed and described.

[0037] (1) The vehicle-mounted device involved in the embodiment of the present disclosure is a vehicle-mounted device used in a vehicle-mounted network, wherein the device comprises: a time synchronization unit, which calculates the time difference with the other vehicle-mounted devices by sending and receiving information for time synchronization, i.e., time synchronization information, between the vehicle-mounted device, i.e., the device, and other vehicle-mounted devices, and performs time synchronization with the other vehicle-mounted devices based on the calculated time difference; a detection unit, which monitors information, i.e., first transmission information, sent from the other vehicle-mounted devices to the device, and detects anomalies related to the content of the first transmission information; and an abnormality processing unit, which, when an abnormality is detected by the detection unit, performs a stop process for stopping the time synchronization in the vehicle-mounted network using the time synchronization information sent from the other vehicle-mounted devices.

[0038] With such a configuration, an abnormality related to another vehicle-mounted device can be detected, and time synchronization using time synchronization information transmitted from the other vehicle-mounted device can be stopped in advance, for example. Therefore, the occurrence of an abnormality in time synchronization in the vehicle-mounted network can be suppressed.

[0039] (2) In the above (1), the first transmitted information may be the time synchronization information.

[0040] In this way, by understanding whether or not an abnormality has occurred in the content of the time synchronization information, it is possible to more efficiently stop the time synchronization with the other onboard device.

[0041] (3) In the above (1), the first transmission information may indicate a source of reference information serving as a basis for the timing of the other vehicle-mounted device.

[0042] In this way, by understanding whether an abnormality has occurred in the source of the reference information that is the basis of the time of other on-board devices, it is possible to more effectively stop the time synchronization with the other on-board devices. In addition, when the above abnormality is detected, it is possible to take measures such as switching the source of the information in the on-board network.

[0043] (4) In any of the above (1) to (3), the abnormality processing unit may perform the stop processing to notify other vehicle-mounted devices that use the time synchronization information sent by the own device to calculate the time difference with the own device of the detection of the abnormality.

[0044] In this way, by sharing the meaning of detecting an abnormality with other vehicle-mounted devices in the vehicle-mounted network, it is possible to suppress the occurrence of abnormalities in the time synchronization between the other vehicle-mounted devices and this device, thereby more reliably suppressing the occurrence of abnormalities in the time synchronization in the vehicle-mounted network.

[0045] (5) In any one of the above (1) to (4), the abnormality processing unit may perform the stop processing of stopping the time synchronization of the time synchronization unit.

[0046] With such a configuration, time synchronization can be stopped in the device that is likely to be affected by abnormal transmission information, thereby more reliably suppressing the occurrence of abnormality in time synchronization in the in-vehicle network.

[0047] (6) In any one of the above (1) to (5), the abnormality processing unit may perform the stop processing of stopping the transmission of the time synchronization information to other vehicle-mounted devices that use the time synchronization information sent by the own device to calculate the time difference with the own device.

[0048] In this way, by stopping the transmission of time synchronization information to other vehicle-mounted devices that are time-synchronized with this device, it is possible to suppress the occurrence of time synchronization anomalies between the other vehicle-mounted devices and this device, thereby more reliably suppressing the occurrence of time synchronization anomalies in the vehicle network.

[0049] (7) In any one of the above (1) to (6), it may be that the first reference device and the second reference device are arranged in the vehicle network, the first reference device is the other vehicle-mounted device that performs time synchronization with the own device, the second reference device monitors the information sent from the first reference device to the second reference device, i.e., the second transmission information, and detects an abnormality related to the content of the second transmission information. When the second reference device detects an abnormality, the time synchronization unit replaces the first reference device and sends and receives information for time synchronization, i.e., the time synchronization information, with the second reference device, thereby calculating the time difference with the second reference device, and performs time synchronization with the second reference device based on the calculated time difference.

[0050] In this way, by switching the time synchronization destination from the first reference device to the second reference device when an abnormality related to the first reference device is detected, this device can synchronize time with the second reference device, thereby achieving more stable time synchronization in the in-vehicle network.

[0051] (8) In any one of the above (1) to (6), the first reference device and the second reference device may be arranged in the vehicle-mounted network, the first reference device is the other vehicle-mounted device, and when the detection unit detects an abnormality, the time synchronization unit replaces the first reference device and sends and receives information for time synchronization, i.e., time synchronization information, with the second reference device, thereby calculating the time difference with the second reference device, and performing time synchronization with the second reference device based on the calculated time difference.

[0052] In this way, by switching the time synchronization destination from the first reference device to the second reference device when an abnormality related to the first reference device is detected, this device can synchronize time with the second reference device, thereby achieving more stable time synchronization in the in-vehicle network.

[0053] (9) In the above (2), the time synchronization information may be at least one of a Sync message and a Follow message used for time synchronization.

[0054] In this way, by monitoring at least one of the Sync message and the Follow message generally used for time synchronization, the presence or absence of abnormality can be easily determined by checking information indicating an ID or a time stamp stored in a received Ethernet frame, for example.

[0055] (10) The embodiment of the present disclosure involves a time synchronization method in a vehicle-mounted device, which includes: a step of calculating a time difference with the other vehicle-mounted device by sending and receiving information for time synchronization, i.e., time synchronization information, between the vehicle-mounted device, i.e., the present device, and other vehicle-mounted devices, and performing time synchronization with the other vehicle-mounted devices based on the calculated time difference; a step of monitoring information, i.e., first transmission information, sent from the other vehicle-mounted device to the present device, and detecting an abnormality related to the content of the first transmission information; and a step of performing a stop process for stopping the time synchronization in the vehicle network that uses the time synchronization information sent from the other vehicle-mounted device when an abnormality is detected.

[0056] This method can detect abnormalities related to other in-vehicle devices and, for example, stop time synchronization using time synchronization information transmitted from the other in-vehicle devices in advance. Therefore, it is possible to suppress the occurrence of abnormalities in time synchronization in the in-vehicle network.

[0057] The following is an explanation of the embodiments of the present disclosure using the accompanying drawings. It should be noted that the same or corresponding parts in the drawings are marked with the same reference numerals, and their description is not repeated. In addition, at least a part of the embodiments described below can be arbitrarily combined.

[0058] <First Embodiment>

[0059] [In-vehicle communication system]

[0060] Figure 1 It is a diagram showing the configuration of the vehicle-mounted communication system according to the first embodiment of the present disclosure.

[0061] Reference Figure 1 The in-vehicle communication system 301 includes, for example, a plurality of switch devices 111 , one main function unit 121 , and a plurality of terminal function units 131 .

[0062] exist Figure 1 , two switch devices 111A and 111B and two terminal function units 131A and 131B are shown as an example of the plurality of switch devices 111 and the plurality of terminal function units 131. The vehicle communication system 301 is mounted on the vehicle 1. The switch devices 111, the main function unit 121, and the terminal function unit 131 constitute the vehicle network 101.

[0063] The switch device 111 , the main function unit 121 , and the terminal function unit 131 are examples of vehicle-mounted devices, such as an ECU (Electronic Control Unit).

[0064] The switch device 111 is connected to a plurality of in-vehicle devices via, for example, an Ethernet (registered trademark) cable 10 , and can communicate with the plurality of in-vehicle devices connected thereto.

[0065] More specifically, the switch device 111 performs a relay process of relaying information from the main function unit 121 or the terminal function unit 131 to other terminal function units 131. For example, the switch device 111 receives information for time synchronization (hereinafter also referred to as "time synchronization information T") sent from the main function unit 121, and sends the received time synchronization information T to other switch devices 111 or terminal function units 131.

[0066] Information is exchanged between the switch device 111 and the main function unit 121 and between the switch device 111 and the terminal function unit 131 using, for example, Ethernet frames (hereinafter also simply referred to as “frames”) storing IP (Internet Protocol) packets.

[0067] The main function unit 121 and the terminal function unit 131 may also be an external vehicle communication ECU, a sensor, a vehicle-mounted camera, a navigation device, an automatic driving processing ECU, an engine control device, an AT (Automatic Transmission) control device, an HEV (Hybrid Electric Vehicle) control device, a braking control device, a chassis control device, a steering control device, and an instrument display control device, etc.

[0068] The main function unit 121 (hereinafter, also referred to as "GM (Grand Master)") maintains the reference time in the vehicle network 101. Here, the reference time is, for example, the time generated by the main function unit 121 using a VCXO (Voltage Controlled XtalOscillator) and a counter not shown in the figure. It should be noted that, as described later, the reference time can also be a time synchronized with the time notified from other devices to the main function unit 121. The main function unit 121 sends the time synchronization information T to other vehicle-mounted devices periodically or irregularly. The main function unit 121 sends the time synchronization information T, for example, with a sending period of 125 milliseconds. Here, the time synchronization information T is, for example, the Sync message and follow-up message described later.

[0069] Each in-vehicle device in the in-vehicle communication system 301 receives the time synchronization information T which is an example of transmission information (hereinafter also referred to as “first transmission information”) transmitted from the main function unit 121 .

[0070] More specifically, the switching device 111A directly receives the time synchronization information T from the main function unit 121. The switching device 111B receives the time synchronization information T via the switching device 111A.

[0071] The terminal functional unit 131A receives the time synchronization information T via the switching device 111A. The terminal functional unit 131B receives the time synchronization information T via the switching devices 111A and 111B.

[0072] The switch device 111 synchronizes time with the main function unit 121 based on the time synchronization information T. More specifically, the switch device 111 calculates a time difference with the main function unit 121 using the time synchronization information T transmitted by the main function unit 121. The switch device 111 corrects its own time using the calculated time difference.

[0073] The terminal functional unit 131 synchronizes time with the switching device 111 based on the time synchronization information T. More specifically, the terminal functional unit 131 calculates a time difference with the switching device 111 using the time synchronization information T transmitted by the switching device 111. The terminal functional unit 131 corrects its own time using the calculated time difference.

[0074] [Switch device and main function unit]

[0075] (Structure of a switch device)

[0076] Figure 2 1 is a diagram showing the configuration of a switch device according to the first embodiment of the present disclosure. Figure 2 , the structure of the switch device 111A is shown.

[0077] Reference Figure 2 The switch device 111A includes a relay unit 21 , a processing unit 22 , a storage unit 23 , and a plurality of communication ports 24 .

[0078] One or both of the relay unit 21 and the processing unit 22 are implemented, for example, by a processing circuit (Circuitry) including one or more processors. The storage unit 23 is, for example, a non-volatile memory included in the above-mentioned processing circuit. The relay unit 21 includes a switch unit 31 and an information processing unit 32. The processing unit 22 includes a time synchronization unit 41, a detection unit 42 and an abnormality processing unit 43.

[0079] (Relay processing of the switching device)

[0080] The communication port 24 is, for example, a terminal to which the Ethernet cable 10 can be connected. It should be noted that the communication port 24 may also be a terminal of an integrated circuit. The plurality of communication ports 24 are connected to any one of the plurality of vehicle-mounted devices in the vehicle-mounted network 101 via the Ethernet cable 10. In this example, the communication port 24A is connected to the main function unit 121, the communication port 24B is connected to the switch device 111B, and the communication port 24C is connected to the terminal function unit 131A.

[0081] The storage unit 23 stores an address table indicating the correspondence between the port number of the communication port 24 and the MAC (Media Access Control) address of the connection destination device.

[0082] The relay unit 21 relays data between other vehicle-mounted devices by communicating with other vehicle-mounted devices. That is, if the relay unit 21 receives an Ethernet frame sent from the main function unit 121 or the terminal function unit 131 via the corresponding communication port 24, the relay unit 21 relays the received Ethernet frame.

[0083] More specifically, the switch unit 31 in the relay unit 21 determines the port number corresponding to the destination MAC address included in the received Ethernet frame by referring to the address table stored in the storage unit 23. Then, the switch unit 31 transmits the received Ethernet frame from the communication port 24 of the determined port number.

[0084] The time synchronization unit 41 performs time synchronization between its own vehicle-mounted device (hereinafter, also referred to as "this device"), namely, the switch device 111, and the main function unit 121 which is another vehicle-mounted device. In more detail, the time synchronization unit 41 sends and receives time synchronization information T between the switch device 111 and the main function unit 121. In addition, the time synchronization unit 41 calculates the time difference between the time of the switch device 111 and the time of the main function unit 121, and performs time synchronization with the main function unit 121 based on the calculated time difference. It should be noted that the respective functions of the detection unit 42 and the exception processing unit 43 will be described later. In addition, in Figure 2 In the above description, the configuration of the switch device 111A is described as an example, but the configuration of the switch device 111B is the same as that of the switch device 111A. It should be noted that the switch device 111B can be realized even without the detection unit 42 and the abnormality processing unit 43 described later.

[0085] (Structure of the main functional unit)

[0086] Figure 3 It is a diagram showing the configuration of a main functional unit according to the first embodiment of the present disclosure.

[0087] Reference Figure 3 The main function unit 121 includes a communication unit 51, a time synchronization unit 52, a storage unit 53, and a communication port 54. One or both of the communication unit 51 and the time synchronization unit 52 are implemented by, for example, a processing circuit including one or more processors. The storage unit 53 is, for example, a non-volatile memory included in the above-mentioned processing circuit. The communication port 54 is, for example, a terminal that can be connected to the Ethernet cable 10. It should be noted that the communication port 54 can also be a terminal of an integrated circuit, etc. The communication port 54 is connected to the switch device 111A via the Ethernet cable 10.

[0088] Figure 4 It is a diagram for explaining a method of updating the propagation delay time of the switching device according to the first embodiment of the present disclosure.

[0089] Reference Figures 2~4The switch device 111A transmits and receives time synchronization information T with the main function unit 121, for example, in accordance with the IEEE (registered trademark) 802.1 standard, thereby updating the propagation delay time Td1 of data between the main function unit 121 and the switch device 111A. More specifically, the time synchronization unit 41 transmits request information (Pdelay_Req) ​​for requesting the time information used for updating the propagation delay time Td1 to the main function unit 121 via the relay unit 21 and the communication port 24A. Hereinafter, the request information is also referred to as a "request message".

[0090] The communication unit 51 in the main function unit 121 receives the request message transmitted from the switching device 111A via the communication port 54 , and outputs the received request message to the time synchronization unit 52 .

[0091] The time synchronization unit 52 receives the request message from the communication unit 51, and outputs the time information (Pdelay_Resp) as an example of the time synchronization information T corresponding to the request message to the communication unit 51. The communication unit 51 transmits the time information received from the time synchronization unit 52 to the switch device 111A via the communication port 54. At this time, the time synchronization unit 52 transmits the time information including the reception time t2 of the request message. Hereinafter, the time information is also referred to as a "response message".

[0092] After sending the response message, the time synchronization unit 52 outputs a follow message (Pdelay_Resp_Follow_Up) including the sending time t3 of the response message to the communication unit 51. The communication unit 51 sends the follow message received from the time synchronization unit 52 to the switching device 111A via the communication port 54.

[0093] The information processing unit 32 in the switch device 111A receives the response message and the follow-up message sent from the main function unit 121 through the communication port 24A, and notifies the time synchronization unit 41 of the time t2 included in the response message and the time t3 included in the follow-up message.

[0094] In addition, the information processing unit 32 notifies the time synchronization unit 41 of the transmission time t1 of the request message and the reception time t4 of the response message. More specifically, the switch device 111A includes a counter (not shown). The information processing unit 32 notifies the time synchronization unit 41 of the count value of the counter at the transmission timing of the request message as the transmission time t1. In addition, the information processing unit 32 notifies the time synchronization unit 41 of the count value of the counter at the reception timing of the response message as the reception time t4.

[0095] The time synchronization unit 41 calculates the propagation delay time Td1 of the data between the main function unit 121 and the switch device 111A based on the times t1, t2, t3, and t4 notified from the information processing unit 32. Specifically, the time synchronization unit 41 calculates the propagation delay time Td1=((t4-t1)-(t3-t2)) / 2. In addition, the time synchronization unit 41 updates the propagation delay time Td1 stored in the storage unit 23 to the newly calculated propagation delay time Td1.

[0096] (Correction of time in the switching device)

[0097] The time synchronization unit 52 of the main function unit 121 periodically or irregularly outputs a Sync message as an example of the time synchronization information T to the communication unit 51. The communication unit 51 transmits the Sync message received from the time synchronization unit 52 to the switching device 111A via the communication port 54. The main function unit 121 transmits the Sync message at a transmission cycle of 125 milliseconds, for example.

[0098] After transmitting the Sync message, the time synchronization unit 52 in the main function unit 121 outputs a follow-up message (Follow_Up) including the transmission time tm of the Sync message to the communication unit 51. The communication unit 51 transmits the follow-up message received from the time synchronization unit 52 to the switching device 111A via the communication port 54.

[0099] The time synchronization unit 41 in the switching device 111A receives the frame storing the Sync message and the frame storing the follow message transmitted from the main function unit 121 through the communication port 24A. The time synchronization unit 41 stores the Sync message stored in the received frame in the storage unit 23 , for example.

[0100] In addition, the information processing unit 32 refers to, for example, the domain ID included in the message header portion of the received frame to confirm the transmission source of the frame.

[0101] When confirming reception of a frame storing a Sync message from the main function unit 121 as GM, the information processing unit 32 notifies the time synchronization unit 52 of the count value of the counter at the reception timing of the frame as the reception time tx of the Sync message.

[0102] The time synchronization unit 41 performs time synchronization with the main function unit 121 based on the time tm and tx notified from the information processing unit 32 and the propagation delay time Td1 stored in the storage unit 23. More specifically, the time synchronization unit 41 calculates the time difference Tx1=tm-Td1-tx between the time of the main function unit 121 and the time of the switch device 111A based on the time tm, tx and the propagation delay time Td1.

[0103] Then, the time synchronization unit 52 corrects the time in its own switching device 111A using the calculated time difference Tx1. Thus, the time synchronization between the main function unit 121 as the GM and the switching device 111A is established.

[0104] [Terminal Function Section]

[0105] (Structure of the terminal functional part)

[0106] Figure 5 1 is a diagram showing the structure of the terminal functional unit according to the first embodiment of the present disclosure. Figure 5 , the structure of the terminal functional portion 131A is shown. The structure of the terminal functional portion 131B is the same as that of the terminal functional portion 131A.

[0107] Reference Figure 5 The terminal function unit 131A includes a communication unit 61, a time synchronization unit 62, a storage unit 63, and a communication port 64. One or both of the communication unit 61 and the time synchronization unit 62 are implemented by, for example, a processing circuit including one or more processors. The storage unit 63 is, for example, a non-volatile memory included in the above-mentioned processing circuit. The communication port 64 is, for example, a terminal that can be connected to the Ethernet cable 10. It should be noted that the communication port 64 can also be a terminal of an integrated circuit, etc. The communication port 64 is connected to the switch device 111A via the Ethernet cable 10.

[0108] (Update of the data propagation delay time between the switch device and the terminal functional unit)

[0109] The terminal functional unit 131A updates the propagation delay time Td2 of the data between the switching device 111A and the terminal functional unit 131A.

[0110] Figure 6 It is a diagram for explaining a method of updating the propagation delay time of the terminal functional unit according to the first embodiment of the present disclosure.

[0111] For details, refer to Figure 5 and Figure 6 The timing synchronization unit 62 in the terminal functional unit 131A and Figure 2 Similarly, the time synchronization unit 41 in the switch device 111A shown in the figure periodically or irregularly updates the propagation delay time Td2 of the data between the switch device 111A and the terminal function unit 131A. More specifically, the time synchronization unit 62 sends a request message for requesting the time information used for updating the propagation delay time Td2 to the switch device 111A via the communication unit 61 and the communication port 64.

[0112] Upon receiving the request message transmitted from the terminal functional unit 131A via the communication port 24C, the information processing unit 32 in the switch device 111A outputs the request message to the time synchronization unit 41 .

[0113] When receiving the request message from the information processing unit 32, the time synchronization unit 41 transmits a response message to the request message to the terminal function unit 131A via the relay unit 21 and the communication port 24C. At this time, the time synchronization unit 41 transmits the response message including the reception time t12 of the request message.

[0114] Furthermore, after sending the response message, the time synchronization unit 41 sends a follow-up message including the sending time t13 of the response message to the terminal function unit 131A via the relay unit 21 and the communication port 24C.

[0115] The communication unit 61 in the terminal function unit 131A receives the response message and the follow-up message sent from the switch device 111A via the communication port 64. The communication unit 61 notifies the time synchronization unit 62 of the time t12 included in the response message and the time t13 included in the follow-up message.

[0116] In addition, the communication unit 61 notifies the time synchronization unit 62 of the transmission time t11 of the request message and the reception time t14 of the response message. More specifically, the terminal function unit 131A includes a counter (not shown). The communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the transmission timing of the request message as the transmission time t11. In addition, the communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the reception timing of the response message as the reception time t14.

[0117] The time synchronization unit 62 calculates the propagation delay time Td2 of the data between the switch device 111A and the terminal function unit 131A based on the times t11, t12, t13, and t14 notified from the communication unit 61. Specifically, the time synchronization unit 62 calculates the propagation delay time Td2=((t14-t11)-(t13-t12)) / 2. In addition, the time synchronization unit 62 updates the propagation delay time Td2 stored in the storage unit 63 to the newly calculated propagation delay time Td2.

[0118] (Timing Correction in the Terminal Function Unit)

[0119] The time synchronization unit 41 in the switching device 111A transmits a Sync message to the terminal function unit 131A periodically or irregularly. After transmitting the Sync message, the time synchronization unit 41 transmits a follow-up message including the transmission time ty of the Sync message to the terminal function unit 131A.

[0120] The terminal function unit 131A performs time synchronization based on the Sync message and the follow-up message sent from the switch device 111A. More specifically, the communication unit 61 in the terminal function unit 131A receives the frame storing the Sync message and the frame storing the follow-up message sent from the switch device 111A via the communication port 64. The communication unit 61 confirms the transmission source of the frame by referring to the domain ID included in the message header of the received frame storing the Sync message, for example.

[0121] When confirming that a frame storing a Sync message is received from the main function unit 121 as the GM, the communication unit 61 notifies the time synchronization unit 62 of, for example, the time ty included in the follow-up message received immediately after the frame. In addition, the communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the reception timing of the Sync message stored in the frame as the reception time ts of the Sync message.

[0122] The time synchronization unit 62 performs time synchronization with the switch device 111A based on the time ty and ts notified from the communication unit 61 and the propagation delay time Td2 stored in the storage unit 63. More specifically, the time synchronization unit 62 calculates the difference between the time of the switch device 111A and the time of the terminal function unit 131A, that is, the time difference Tx2=ty-Td2-ts. Then, the time synchronization unit 62 corrects the time in its own terminal function unit 131A using the calculated time difference Tx2.

[0123] Here, when the time synchronization between the main function unit 121 and the switch device 111A has been established, the time ty included in the follow-up message sent from the switch device 111A to the terminal function unit 131A is the time synchronized with the main function unit 121. Therefore, the time synchronization unit 62 in the terminal function unit 131A performs time correction, and the time synchronization between the terminal function unit 131A and the switch device 111A is established, and as a result, the time synchronization between the terminal function unit 131A and the main function unit 121 is established.

[0124] The switching device 111B and the terminal functional unit 131B establish time synchronization with the main functional unit 121 as the GM, similarly to the switching device 111A and the terminal functional unit 131A.

[0125] [Explanation of the topic]

[0126] The following possibilities exist: Figure 1 The main function unit 121 shown cannot recognize the reference time due to an unauthorized attack from inside or outside the vehicle 1 , and the time synchronization among the plurality of vehicle-mounted devices is not performed normally.

[0127] In addition, if the reference time stored in the main function unit 121 is tampered with by an unauthorized attack, the vehicle-mounted communication system 301 may not operate normally. Figure 1 When the two terminal function parts 131A and 131B shown are vehicle-mounted cameras mounted on the front and rear of the vehicle 1 , there is a possibility that an image misalignment may occur between the terminal function parts 131A and 131B due to tampering of the reference time.

[0128] Furthermore, if an abnormality occurs in the content of the time synchronization information T due to the main function unit 121 being subjected to an unfair attack, the absolute value of the time difference between the plurality of vehicle-mounted devices increases, and the vehicle-mounted communication system 301 may operate abnormally.

[0129] On the other hand, the switch device 111 in the in-vehicle network 101 according to the first embodiment of the present disclosure solves such a problem by the following configuration and operation.

[0130] [Detection of abnormality related to the contents of time synchronization information]

[0131] Figure 2 The detection unit 42 in the switch device 111A shown monitors the transmission information sent from the main function unit 121 to its own switch device 111A, and detects an abnormality (hereinafter, also referred to as "abnormality E1") related to the content of the transmission information. Abnormality E1 is an abnormality related to the content of the time synchronization information T as an example of transmission information. For example, the time synchronization information T is at least one of a Sync message and a follow-up message used in time synchronization. It should be noted that the time synchronization information T is not limited to the Sync message and the follow-up message, and may also be other messages used in time synchronization. The detection unit 42 outputs information indicating the detection result to the abnormality processing unit 43.

[0132] When the abnormality E1 is detected by the detection unit 42 , the abnormality processing unit 43 performs a stop process for stopping the time synchronization using the time synchronization information T transmitted from the main function unit 121 .

[0133] Figure 7 This is a diagram showing an example of a stop process of a switch device in the in-vehicle network according to the first embodiment of the present disclosure.

[0134] Reference Figure 2 , Figure 5 and Figure 7, when the abnormality E1 is detected by the detection unit 42, the abnormality processing unit 43 in the switch device 111A performs a stop process P1 to notify the terminal function unit 131 that is synchronized with its own switch device 111A of the detection of the abnormality E1. More specifically, when the abnormality processing unit 43 detects the abnormality E1, for example, it sends a notification indicating that the abnormality E1 is detected (hereinafter, also referred to as "abnormality notification N1") to the terminal function unit 131 via the relay unit 21 and the communication port 24. Here, the abnormality processing unit 43 sends the abnormality notification N1 to the terminal function unit 131B via the switch device 111B. It should be noted that the abnormality processing unit 43 may also send the abnormality notification N1 to the terminal function unit 131A.

[0135] For example, after receiving the abnormality notification N1, the communication unit 61 in the terminal function unit 131 discards the time synchronization information T received from the switch device 111A and does not store the time synchronization information T in the storage unit 63. As a result, the time synchronization information T is not output from the communication unit 61 to the time synchronization unit 62, and the time synchronization between the terminal function unit 131 and the switch device 111A is stopped.

[0136] It should be noted that the abnormality processing unit 43 in the switch device 111A may also send the abnormality notification N1 to the main function unit 121. After receiving the abnormality notification N1, the main function unit 121 stops sending the time synchronization information T to the switch device 111A. As a result, the time synchronization between the switch device 111A and the main function unit 121 stops.

[0137] In addition, when the abnormality processing unit 43 in the switch device 111A detects the abnormality E1, it can also perform a stop process P2 of the time synchronization unit 41, that is, stop the time synchronization with the main function unit 121. More specifically, when the abnormality processing unit 43 detects the abnormality E1, it outputs the abnormality notification N1 to the relay unit 21. After receiving the abnormality notification N1, the relay unit 21 discards the time synchronization information T received from the main function unit 121 via the communication port 24A, and does not store the time synchronization information T in the storage unit 23. As a result, the time synchronization information T is not output from the relay unit 21 to the time synchronization unit 41, and the time synchronization between the switch device 111A and the main function unit 121 is stopped.

[0138] Furthermore, when the abnormality processing unit 43 in the switch device 111A detects the abnormality E1, it may perform a stop process P3 to stop the transmission of the time synchronization information T to the terminal function unit 131. More specifically, as described above, after receiving the abnormality notification N1 from the abnormality processing unit 43, the relay unit 21 discards the time synchronization information T received from the main function unit 121 via the communication port 24A, and does not store the time synchronization information T in the storage unit 23. As a result, the time synchronization information T is not transmitted from the relay unit 21 to the terminal function unit 131 via the communication port 24C, and the time synchronization between the terminal function unit 131 and the switch device 111A is stopped.

[0139] [Flow of Action]

[0140] Figure 8 This is a diagram showing an example of a sequence of monitoring of time synchronization information and stop processing of time synchronization by a switch device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0141] Reference Figure 8 First, the main function unit 121 transmits a Sync message to the switching device 111A (step S101 ).

[0142] Next, the main function unit 121 transmits a follow-up message including the transmission time tm of the Sync message as a time stamp (step S102 ).

[0143] Next, the detection unit 42 in the switching device 111A performs a detection process for detecting the abnormality E1.

[0144] In more detail, the detection unit 42 determines, for example, whether the sequence ID included in the header part of the frame storing the Sync message in the column of the sequentially received Sync messages is continuous. When the sequence ID is not continuous, the detection unit 42 detects the abnormality of the Sync message as abnormality E1. It should be noted that the detection unit 42 can also detect abnormality E1 based on other information included in the frame storing the Sync message, such as the continuity of the domain ID, without being limited to the sequence ID. In addition, the detection unit 42 can also detect, for example, an abnormality in the order of the moments following the timestamp included in the message as abnormality E1 (step S103).

[0145] Next, when the abnormality E1 is detected by the detection unit 42 ("Yes" in step S103), the abnormality processing unit 43 in the switch device 111A sends an abnormality notification N1 to the terminal function unit 131. The abnormality notification N1 is sent, for example, independently of the Sync message and the follow-up message sent from the switch device 111 to the terminal function unit 131. It should be noted that the abnormality notification N1 may also be included in the frame storing the Sync message or the frame storing the follow-up message (step S104).

[0146] Next, the terminal functional unit 131 performs a process of stopping the time synchronization with the switching device 111A, that is, a process of stopping the time synchronization of the time synchronizer 62 (step S105 ).

[0147] On the other hand, when the detection unit 42 does not detect the abnormality E1 (No in step S103), the information processing unit 32 in the switch device 111A receives the Sync message and the follow-up message from the main function unit 121 via the communication port 24A, and sends the time tm (see Figure 4 ) and the reception time tx of the Sync message are notified to the time synchronization unit 41 (step S106).

[0148] Next, the time synchronization unit 41 calculates the above-mentioned time difference Tx1 based on the times tm and tx notified from the information processing unit 32 and the propagation delay time Td1 stored in the storage unit 23 .

[0149] Then, the time synchronization unit 41 corrects the time in its own switching device 111A using the calculated time difference Tx1. As a result, the switching device 111A can synchronize the time with the main function unit 121 (step S107).

[0150] In this way, the switch device 111 can detect the abnormality E1 related to the main function unit 121 and stop the time synchronization using the time synchronization information T transmitted from the main function unit 121. Therefore, the occurrence of abnormality in the time synchronization in the in-vehicle network 101 can be suppressed.

[0151] [Other examples of the structure of the terminal functional part]

[0152] The vehicle communication system 301 is not limited to the configuration in which the detection unit 42 and the abnormality processing unit 43 are provided in the switch device 111, but may be provided in the terminal function unit 131. That is, the terminal function unit 131 may have a function of monitoring the time synchronization information T.

[0153] [Other examples of abnormal E1]

[0154] In the above example, the switch device 111 detects an abnormality related to the content of the time synchronization information T as an example of the transmission information as an abnormality E1. In the following example, the main function unit 121 holds the time notified regularly or irregularly from other devices as a reference time. More specifically, the main function unit 121 holds the time synchronized with the time notified from the GPS (Global Positioning System) and the navigation device as the reference time, and sends the transmission information indicating the source of the reference information that is the basis of the time of the main function unit 121 (hereinafter also referred to as "time source information") to the switch device 111. In this case, the detection unit 42 in the switch device 111 can also detect the abnormality related to the content of the time source information as an abnormality E1 by monitoring the time source information. It should be noted that in the following description, the device that notifies the time to the main function unit 121 is also referred to as a "time notification device".

[0155] Refer again Figure 2 The storage unit 23 in the switch device 111 stores the MAC address or IP address (hereinafter also referred to as "reference address") of the time notification device in advance. In addition, for example, the reference address of the time notification device is also included in the time providing source information sent from the main function unit 121. The detection unit 42 compares the reference address included in the time providing source information received from the main function unit 121 with the reference address stored in the storage unit 23. When the reference address included in the time providing source information and the reference address stored in the storage unit 23 are different, the detection unit 42 determines that the abnormality E1 has occurred.

[0156] Fig. 9 This is a diagram showing another example of the sequence of monitoring of the time source information and stopping processing of the time synchronization by the switch device in the in-vehicle communication system according to the first embodiment of the present disclosure.

[0157] Reference Fig. 9 First, the time notification device transmits time information indicating the current time of its own device, that is, reference information serving as a basis for the time of the main function unit 121, to the main function unit 121 (step S111).

[0158] Next, the main function unit 121 updates the value of the counter described above based on, for example, the reference information. Thus, the main function unit 121 can obtain the time of its own device based on the reference information provided from the time notification device (step S112).

[0159] Next, the main function unit 121 transmits the time providing source information to the switch device 111 (step S113 ).

[0160] Next, the detection unit 42 in the switching device 111 performs a detection process for detecting the abnormality E1 (step S114 ).

[0161] Next, when the detection unit 42 detects the abnormality E1 (Yes in step S114 ), the abnormality processing unit 43 in the switching device 111A transmits an abnormality notification N1 for stopping the time synchronization to the terminal function unit 131 (step S115 ).

[0162] Next, the terminal functional unit 131 performs a process of stopping the time synchronization with the switching device 111A, that is, a process of stopping the time synchronization of the time synchronizer 62 (step S116 ).

[0163] On the other hand, when the detection unit 42 has not detected the abnormality E1 (No in step S114 ), the abnormality processing unit 43 does not transmit the abnormality notification N1 to the terminal function unit 131 .

[0164] Next, other embodiments of the present disclosure will be described using the drawings. It should be noted that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their description will not be repeated.

[0165] <Second Embodiment>

[0166] This embodiment relates to an in-vehicle communication system 401 that includes a plurality of main function units 221A and 221B that monitor mutual time synchronization information Ta and Tb, compared to the in-vehicle communication system 301 of the first embodiment. Except for the following description, the in-vehicle communication system 401 is the same as the in-vehicle communication system 301 of the first embodiment.

[0167] [In-vehicle communication system]

[0168] Fig.10 It is a diagram showing a configuration of an in-vehicle communication system according to a second embodiment of the present disclosure.

[0169] Reference Fig.10 The in-vehicle communication system 401 includes, for example, a plurality of switch devices 211 , a plurality of main function units 221 , and a plurality of terminal function units 131 .

[0170] exist Fig.10 , two main function units 221A and 221B provided in the vehicle network 201 are shown as an example of the plurality of main function units 221. The vehicle communication system 401 is mounted on the vehicle 1. The switch device 111, the main function unit 221, and the terminal function unit 131 constitute the vehicle network 201.

[0171] The two main function units 221A and 221B are connected to each other, for example, by an Ethernet cable 10, and can communicate with the other main function unit connected thereto. The main function unit 221A is an example of a "first reference device", and the main function unit 221B is an example of a "second reference device".

[0172] Hereinafter, the time synchronization information sent from the main function unit 221A is also referred to as "time synchronization information Ta", and the time synchronization information sent from the main function unit 221B is also referred to as "time synchronization information Tb". In addition, a Sync message and a follow-up message as an example of the time synchronization information Ta are respectively referred to as a "first Sync message" and a "first follow-up message". In addition, a Sync message and a follow-up message as an example of the time synchronization information Tb are respectively referred to as a "second Sync message" and a "second follow-up message".

[0173] The main function units 221A and 221B each maintain a reference time in the in-vehicle network 201. The main function unit 221A sends time synchronization information Ta to the main function unit 221B and the switch device 111 regularly or irregularly. The main function unit 221B sends time synchronization information Tb to the main function unit 221A and the switch device 111 regularly or irregularly.

[0174] The switch device 111 receives both the time synchronization information Ta from the main function unit 221A and the time synchronization information Tb from the main function unit 221B. More specifically, the switch device 111A receives the time synchronization information Ta directly from the main function unit 221A and receives the time synchronization information Tb via the switch device 111B. The switch device 111B receives the time synchronization information Tb directly from the main function unit 221B and receives the time synchronization information Ta via the switch device 111A.

[0175] The terminal functional unit 131A directly receives the time synchronization information Ta from the switching device 111A. The terminal functional unit 131B receives the time synchronization information Ta via the switching device 111A and the switching device 111B.

[0176] Thus, in this embodiment, the second transmission information, which is information transmitted from the main function unit 221A to the main function unit 221B, is, for example, the time synchronization information Ta which is the same as the first transmission information transmitted from the main function unit 221A to the switch devices 111A and 111B. It should be noted that the second transmission information may be information different from the first transmission information. For example, the second transmission information may be time source information indicating the source of the time of the main function unit 221.

[0177] Fig.11 It is a diagram showing a configuration of a switch device according to a twelfth embodiment of the present disclosure. Fig.11 The switch device 111A shown is Figure 2 The switch device 111A shown further includes a communication port 24D.

[0178] exist Fig.11 In the embodiment, the communication port 24A is connected to the main function unit 221A, the communication port 24B is connected to the main function unit 221B, the communication port 24C is connected to the switch device 111B, and the communication port 24D is connected to the terminal function unit 131A.

[0179] The switch device 111 identifies the time synchronization information that should be used in the normal time synchronization of the vehicle network 201. The switch device 111, for example, confirms the domain ID assigned to the header portion of each of the frame storing the first follow-up message and the frame storing the second follow-up message. Here, the storage unit 23 in the switch device 111 pre-stores the domain ID of the time synchronization information used in the normal time synchronization of the vehicle network 201 (hereinafter also referred to as the "normal domain ID"). The switch device 111 confirms the domain ID of the two confirmed domain IDs that is consistent with the normal domain ID. Thus, the switch device 111 can determine the time synchronization information used in the normal time synchronization of the vehicle network 201. Here, it is assumed that the normal time synchronization is performed based on the time synchronization information Ta. Fig.10 In the process, the switching device 111 transmits the time synchronization information Ta to the terminal function unit 131 .

[0180] Fig.12 2 is a diagram showing the structure of the main functional unit according to the second embodiment of the present disclosure. Fig.12 , the structure of the main function section 221B is shown. The structure of the main function section 221A is the same as the structure of the main function section 221B.

[0181] In more detail, the main function unit 221B synchronizes time with the main function unit 221A. In this case, the main function unit 221B, which is the second reference device, synchronizes time with the main function unit 221A in order to function as a backup system in case a failure occurs in the main function unit 221A, which is the first reference device.

[0182] Reference Fig.12 , main function unit 221B and Figure 3Compared with the main function unit 121 shown in the figure, a processing unit 252 is provided in place of the time synchronization unit 52, and a plurality of communication ports 54 are provided. One or both of the communication unit 51 and the processing unit 252 are implemented, for example, by a processing circuit including one or more processors. The storage unit 23 is, for example, a non-volatile memory included in the above-mentioned processing circuit. The communication port 54A is connected to the main function unit 221A, and the communication port 54B is connected to the switch device 111B. The processing unit 252 includes a time synchronization unit 71, a detection unit 72, and an abnormality processing unit 73.

[0183] The time synchronization unit 71 performs time synchronization between its main function unit 221B and the main function unit 221A. More specifically, the time synchronization unit 71 sends and receives time synchronization information Ta between the main function unit 221A and the main function unit 221B. In addition, the time synchronization unit 71 calculates the time difference between the time of the main function unit 221A and the time of the main function unit 221B, and performs time synchronization with the main function unit 221A based on the calculated time difference.

[0184] The detection unit 72 in the main function unit 221B monitors, for example, the second transmission information transmitted from the main function unit 221A, and detects an abnormality (hereinafter, also referred to as "abnormality E2") related to the content of the second transmission information. Abnormality E2 is an abnormality related to the content of the time synchronization information Ta as an example of the second transmission information. The time synchronization information Ta is at least one of the Sync message and the follow-up message used in the time synchronization. It should be noted that the time synchronization information Ta is not limited to the Sync message and the follow-up message, and may also be other messages used in the time synchronization. The detection unit 72 sends information indicating the detection result to the abnormality processing unit 73.

[0185] When the abnormality processing unit 73 detects the abnormality E2, it performs a stop process for stopping the time synchronization in the in-vehicle network 201 using the time synchronization information Ta received from the main function unit 221A.

[0186] Fig.13 This is a diagram showing an example of stop processing of a main function unit and a switch device in the in-vehicle communication system according to the second embodiment of the present disclosure.

[0187] Reference Fig.12 and 13 In the in-vehicle network 201 , when the main function unit 221B detects the abnormality E2 , for example, sends a notification (hereinafter also referred to as “abnormality notification N2 ”) to the switch device 111 indicating that the abnormality E2 has been detected by its own device.

[0188] More specifically, the exception processing unit 73 in the main function unit 221B transmits the exception notification N2 by, for example, multicasting.

[0189] The switching device 111B transmits the abnormality notification N2 received from the main function unit 221B to the switching device 111A and the terminal function unit 131B. The switching device 111A transmits the abnormality notification N2 received from the switching device 111B to the terminal function unit 131A.

[0190] In this way, the main function unit 221B performs processing P21 of notifying other in-vehicle devices in the in-vehicle network 201 that the abnormality E2 has been detected.

[0191] Reference Fig.11 , Fig.12 , Fig.13 , when the main function unit 221B detects the abnormality E2, the switch device 111A performs a stop process of the time synchronization unit 41, that is, a stop process P2 of stopping the time synchronization with the main function unit 221A. More specifically, after receiving the abnormality notification N2 from the main function unit 221B, the relay unit 21 in the switch device 111A discards the time synchronization information Ta received from the main function unit 221A via the communication port 24A, and does not store the time synchronization information Ta in the storage unit 23. As a result, the time synchronization information Ta is not output from the relay unit 21 to the time synchronization unit 41, and the time synchronization between the switch device 111A and the main function unit 221A is stopped.

[0192] When the abnormality E2 is detected, the time synchronization unit 41 in the switch device 111A replaces the main function unit 221A and transmits and receives the time synchronization information Tb with the main function unit 221B. In addition, the time synchronization unit 41 calculates the time difference between the time of its own switch device 111A and the time of the main function unit 221B, and performs time synchronization with the main function unit 221B based on the calculated time difference. It should be noted that the time synchronization unit 41 may also replace the main function unit 221A and transmit and receive the time synchronization information Tb with the main function unit 221B when the detection unit 42 in its own switch device 111A detects the abnormality E2.

[0193] In addition, when the switch device 111A detects the abnormality E2, it may perform the stop processing P3 of stopping the transmission of the time synchronization information Ta to the terminal function unit 131. More specifically, as described above, after receiving the abnormality notification N2, the relay unit 21 discards the time synchronization information Ta received from the main function unit 221A via the communication port 24A, and does not store the time synchronization information Ta in the storage unit 23. As a result, the time synchronization information Ta is not transmitted from the relay unit 21 to the terminal function unit 131 via the communication port 24D, and the time synchronization between the terminal function unit 131 and the switch device 111A is stopped.

[0194] [Flow of Action]

[0195] Fig.14 This is a diagram showing an example of a sequence of monitoring of time synchronization information and switching processing of time synchronization information by a main functional unit in the in-vehicle communication system according to the second embodiment of the present disclosure.

[0196] Reference Fig.14 First, the main function unit 221A sends a first Sync message to the switching device 111A (step S201 ).

[0197] Next, the main function unit 221A transmits the first follow message including the transmission time of the first Sync message to the switching device 111A (step S202 ).

[0198] Next, the main function unit 221B transmits the second Sync message to the switching device 111A via the switching device 111B (step S203 ).

[0199] Next, the main function unit 221B transmits the second follow message including the transmission time of the second Sync message to the switching device 111A via the switching device 111B (step S204 ).

[0200] Next, the switch device 111A confirms the domain ID assigned to the header of each frame storing the first follow-up message and the frame storing the second follow-up message. Then, the switch device 111A determines the Sync message and the follow-up message used for time synchronization in normal time by confirming that the domain ID of the two confirmed domain IDs is consistent with the normal domain ID. Fig.14 In the example shown, the Sync message and the Follow-up message used for time synchronization in normal times are the first Sync message and the first Follow-up message (step S205).

[0201] Next, the switching device 111A performs time synchronization with the main function unit 221A based on the first Sync message and the first Follow message (step S206 ).

[0202] Next, the switch device 111A transmits the first Sync message received from the main function unit 221A to the main function unit 221B via the switch device 111B (step S207 ).

[0203] Next, the switching device 111A further includes the reception time of the first Sync message in the first follow message received from the main function unit 221A, and transmits the message to the main function unit 221B (step S208 ).

[0204] Next, the switch device 111A transmits the second Sync message received from the main function unit 221B to the main function unit 221A (step S209 ).

[0205] Next, the switching device 111A further includes the reception time of the second Sync message in the second follow message received from the main function unit 221B, and transmits it to the main function unit 221A (step S210 ).

[0206] Next, the switching device 111A transmits the first Sync message received from the main function unit 221A to the terminal function unit 131 (step S211 ).

[0207] Next, the switching device 111A further includes the reception time of the first Sync message in the first follow message received from the main function unit 221A, and transmits the message to the terminal function unit 131 (step S212 ).

[0208] Next, the terminal function unit 131 performs time synchronization with the switching device 111A based on the first Sync message and the first Follow message received from the switching device 111A (step S213 ).

[0209] Next, the main function unit 221B performs a detection process for detecting the abnormality E2. The detection process for the abnormality E2 is similar to the above-mentioned Figure 8 The detection process of the abnormality E1 in step S103 shown is the same (step S214).

[0210] Next, when the abnormality E2 is detected (YES in step S214 ), the main function unit 221B transmits the abnormality notification N2 to the switching device 111A via the switching device 111B (step S215 ).

[0211] Next, the switching device 111A receives the abnormality notification N2 from the main function unit 221B, and switches the time synchronization destination from the main function unit 221A to the main function unit 221B (step S216 ).

[0212] Next, the main function unit 221B transmits the second Sync message to the switching device 111A via the switching device 111B (step S217 ).

[0213] Next, the main function unit 221B transmits the second follow message including the transmission time of the second Sync message to the switching device 111A via the switching device 111B (step S218 ).

[0214] Next, the switching device 111A performs time synchronization with the main function unit 221B based on the second Sync message and the second Follow message received from the main function unit 221B (step S219 ).

[0215] Next, the switching device 111A transmits the abnormality notification N2 received from the main function unit 221B to the terminal function unit 131 (step S220 ).

[0216] Next, the terminal function unit 131 receives the abnormality notification N2 from the switching device 111A, and switches the time synchronization destination from the main function unit 221A to the main function unit 221B (step S221 ).

[0217] Next, the switching device 111A transmits the second Sync message received from the main function unit 221B to the terminal function unit 131 (step S222 ).

[0218] Next, the switch device 111A transmits the second follow message received from the main function unit 221B to the terminal function unit 131 (step S223 ).

[0219] Next, the terminal function unit 131 performs time synchronization with the main function unit 221B based on the second Sync message and the second Follow message received from the switching device 111A (step S224 ).

[0220] On the other hand, when the main function unit 221B has not detected the abnormality E2 (No in step S214), it does not transmit the above-mentioned abnormality notification N2.

[0221] Thus, when the switch device 111A detects the abnormality E2 related to the main function unit 221A, it switches the time synchronization destination from the main function unit 221A to the main function unit 221B. This enables time synchronization with the main function unit 221B, thereby achieving more stable time synchronization in the in-vehicle network 201.

[0222] [Other Examples of Switching Processing of Time Synchronization Information]

[0223] In the above example, when the switch device 111A is in normal operation, the main function units 221A and 221B respectively send the time synchronization information to the switch device 111A. In the following example, when the switch device 111A is in normal operation, one of the main function units 221A and 221B sends the time synchronization information to the switch device 111, and when an abnormality occurs, the other of the main function units 221A and 221B sends the time synchronization information to the switch device 111.

[0224] Fig.15 This is a diagram showing another example of the sequence of the monitoring of the time synchronization information and the switching process of the time synchronization information by the main functional unit in the in-vehicle communication system according to the second embodiment of the present disclosure.

[0225] Reference Fig.15First, the main function unit 221A sends a first Sync message to the switching device 111A (step S301 ).

[0226] Next, the main function unit 221A transmits the first follow message including the transmission time of the first Sync message to the switching device 111A (step S302 ).

[0227] Next, the switch device 111A performs time synchronization with the main function unit 221A based on the first Sync message and the first Follow message (step 303 ).

[0228] Next, the switch device 111A transmits the first Sync message received from the main function unit 221A to the main function unit 221B (step S304 ).

[0229] Next, the switching device 111A further includes the reception time of the first Sync message in the first follow message and transmits it to the main function unit 221B (step S305 ).

[0230] Next, the switching device 111A transmits the first Sync message received from the main function unit 221A to the terminal function unit 131 (step S306 ).

[0231] Next, the switching device 111A further includes the reception time of the first Sync message in the first follow message received from the main function unit 221A, and transmits the message to the terminal function unit 131 (step S307 ).

[0232] Next, the terminal function unit 131 performs time synchronization with the switching device 111A based on the first Sync message and the first Follow message received from the switching device 111A (step S308 ).

[0233] Next, the main function unit 221B and the above Fig.14 The process of step S214 shown is similarly performed to the detection process of abnormality E2 (step S309).

[0234] Next, when the abnormality E2 is detected (YES in step S309 ), the main function unit 221B transmits the abnormality notification N2 to the switching device 111A via the switching device 111B (step S310 ).

[0235] Next, the switching device 111A receives the abnormality notification N2 from the main function unit 221B, and switches the time synchronization destination from the main function unit 221A to the main function unit 221B (step S311 ).

[0236] Next, the main function unit 221B transmits the second Sync message to the switching device 111A via the switching device 111B (step S312 ).

[0237] Next, the main function unit 221B transmits the second follow message including the transmission time of the second Sync message to the switching device 111A via the switching device 111B (step S313 ).

[0238] Next, the switching device 111A performs time synchronization with the main function unit 221B based on the second Sync message and the second Follow message received from the main function unit 221B (step S314 ).

[0239] On the other hand, when the main function unit 221B has not detected the abnormality E2 (No in step S309), it does not transmit the above-mentioned abnormality notification N2.

[0240] Fig.15 The processing of steps S315 to S319 shown in FIG. Fig.14 Steps S220 to S224 shown are respectively the same.

[0241] Each process (function) of the above-mentioned embodiment is implemented by a processing circuit (Circuitry) including one or more processors. The above-mentioned processing circuit can also be composed of an integrated circuit that combines one or more memories, various analog circuits, and various digital circuits in addition to the above-mentioned one or more processors. The above-mentioned one or more memories store programs (commands) that enable the above-mentioned one or more processors to perform the above-mentioned processes. The above-mentioned one or more processors can perform the above-mentioned processes according to the above-mentioned programs read from the above-mentioned one or more memories, or according to the logic circuits pre-designed to perform the above-mentioned processes. The above-mentioned processor can be a CPU (Central Processing Unit: Central Processing Unit), GPU (Graphics Processing Unit: Graphics Processing Unit), DSP (Digital Signal Processor: Digital Signal Processor), FPGA (Field Programmable Gate Array: Field Programmable Gate Array) and ASIC (Application Specific Integrated Circuit: Application Specific Integrated Circuit) and other various processors suitable for computer control. It should be noted that it is also possible that the above-mentioned multiple processors separated physically cooperate with each other to perform the above-mentioned processes. For example, the processors mounted on physically separated computers may cooperate with each other to execute the above-mentioned processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet. The above-mentioned program may be installed into the above-mentioned memory from an external server device or the like via the above-mentioned network, or may be circulated in a state stored in a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor memory, and installed into the above-mentioned memory from the above-mentioned recording medium.

[0242] The above embodiments should be considered as illustrative in all aspects and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0243] Description of Reference Numerals

[0244] 1 Vehicle

[0245] 10 Ethernet cable

[0246] 21 Relay Department

[0247] 22, 252 Processing Department

[0248] 23, 53, 63 Storage

[0249] 24, 24A, 24B, 24C, 24D, 54, 64 communication ports

[0250] 31 Switch Department

[0251] 32 Information Processing Department

[0252] 41, 52, 62, 71 Time synchronization unit

[0253] 42, 72 Inspection Department

[0254] 43, 73 Exception handling department

[0255] 51, 61, 71 Ministry of Communications

[0256] 101, 201 In-vehicle network

[0257] 111, 111A, 111B, 211, 211A, 211B switch units

[0258] 121, 221, 221A, 221B Main function unit

[0259] 131, 131A, 131B terminal functional part

[0260] 301, 401 Vehicle communication system.

Claims

1. A vehicle-mounted device is a vehicle-mounted device used in a vehicle-mounted network, wherein: have: a time synchronization unit that calculates a time difference with the other onboard device by sending and receiving time synchronization information between the onboard device, i.e., the device, and the other onboard device, and performs time synchronization with the other onboard device based on the calculated time difference; a detection unit that monitors first transmission information, which is information transmitted from the other vehicle-mounted device to the own device, and detects an abnormality related to the content of the first transmission information; and The abnormality processing unit performs a stop process for stopping the time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device when the abnormality is detected by the detection unit.

2. The vehicle-mounted device according to claim 1, The first transmitted information is the time synchronization information.

3. The vehicle-mounted device according to claim 1, The first transmission information indicates a source of providing reference information serving as a basis for the timing of the other vehicle-mounted device.

4. The vehicle-mounted device according to any one of claims 1 to 3, The abnormality processing unit performs the stop processing of notifying another vehicle-mounted device that uses the time synchronization information transmitted by the own device to calculate the time difference with the own device, that the abnormality has been detected.

5. The vehicle-mounted device according to any one of claims 1 to 4, The abnormality processing unit performs the stop processing of stopping the time synchronization of the time synchronization unit.

6. The vehicle-mounted device according to any one of claims 1 to 5, The abnormality processing unit performs the stop processing of stopping the transmission of the time synchronization information to another vehicle-mounted device that uses the time synchronization information transmitted by the own device to calculate the time difference with the own device.

7. The vehicle-mounted device according to any one of claims 1 to 6, The first reference device and the second reference device are installed in the vehicle network, the first reference device is the other vehicle device that performs time synchronization with the own device, The second reference device monitors second transmission information, which is information transmitted from the first reference device to the second reference device, and detects an abnormality related to the content of the second transmission information. When an abnormality is detected by the second reference device, the time synchronization unit calculates a time difference with the second reference device by replacing the first reference device and transmitting and receiving time synchronization information, which is information for time synchronization, with the second reference device, and performs time synchronization with the second reference device based on the calculated time difference.

8. The vehicle-mounted device according to any one of claims 1 to 6, A first reference device and a second reference device are arranged in the vehicle network, the first reference device is the other vehicle device, When the detection unit detects an abnormality, the time synchronization unit calculates a time difference with the second reference device by replacing the first reference device and transmitting and receiving time synchronization information, which is information for time synchronization, with the second reference device, and performs time synchronization with the second reference device based on the calculated time difference.

9. The vehicle-mounted device according to claim 2, The time synchronization information is at least one of a Sync message and a Follow message used for time synchronization.

10. A time synchronization method is a time synchronization method in a vehicle-mounted device, wherein: include: The step of calculating a time difference with the other on-board device by sending and receiving information for time synchronization, i.e., time synchronization information, between the on-board device, i.e., the own device, and the other on-board device, and performing time synchronization with the other on-board device based on the calculated time difference; A step of monitoring first transmission information, which is information transmitted from the other vehicle-mounted device to the own device, and detecting an abnormality related to the content of the first transmission information; and When an abnormality is detected, a step of performing a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device is performed.

Images