In-vehicle control device, control method, and control program

Abstract

An in-vehicle control device connected to an in-vehicle device via a network, the in-vehicle device being capable of switching between an operating state and a dormant state, the in-vehicle control device being provided with: an abnormality detection unit for detecting an abnormality of the in-vehicle device; a determination unit that determines whether or not the in-vehicle device is in a dormant state on the basis of the state of the cluster to which the in-vehicle device belongs; and a control unit that, when the in-vehicle device is in the dormant state, invalidates the detection of the abnormality by the abnormality detection unit.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to an in-vehicle control device, a control method, and a control program. This application claims priority based on Japanese Application No. 2023-091042 filed on June 1, 2023, and the entire contents described in the Japanese application are incorporated by reference. BACKGROUND

[0002] Various in-vehicle devices are mounted on a vehicle, such as a control system ECU (Electronic Control Unit) that controls an engine, a transmission, and the like, a body system ECU that controls a headlamp, a power window, and the like, an information system ECU that controls a navigation device, a multimedia device, and the like, and the like.

[0003] In the past, in an in-vehicle system in which various in-vehicle devices are connected via a network, an abnormality of an in-vehicle device is detected (for example, refer to Patent Literature 1).

[0004] However, in recent years, in an in-vehicle system, for example, in-vehicle devices are divided into clusters called PNCs (Partial Network Clusters) by each function (service), an in-vehicle device of a PNC for executing a service is awakened, and an in-vehicle device of another PNC is put to sleep, and a partial network function has been developed. The partial network function has been standardized in ISO (International Organization for Standardization) 11898-6.

[0005] A request and release information of a PNC are exchanged between ECUs using a network management message (NM message). The NM message includes PN (Partial Network) information indicating a state of a request or release of each PNC. An in-vehicle device corresponding to a PNC that has been requested is awakened, and an in-vehicle device corresponding to a PNC that has been released is put to sleep. PRIOR ART DOCUMENT PATENT LITERATURE

[0006] Patent Literature 1: Japanese Patent Application Publication No. 2003-276527 SUMMARY

[0007] An in-vehicle control device according to an embodiment of the present disclosure is connected to an in-vehicle device via a network, the in-vehicle device being capable of switching between an operation state and a sleep state, the in-vehicle control device including: an abnormality detection section that detects an abnormality of the in-vehicle device; a determination section that determines whether the in-vehicle device is in the sleep state based on a state of a cluster to which the in-vehicle device belongs; and a control section that deactivates the abnormality detection section when the in-vehicle device is in the sleep state. Attached Figure Description

[0008] Figure 1 This is a block diagram illustrating an example of the structure of the vehicle-mounted system according to the first embodiment. Figure 2 This is a block diagram illustrating an example of the hardware structure of the relay ECU according to the first embodiment. Figure 3 This is a block diagram illustrating an example of the hardware structure of the ECU according to the first embodiment. Figure 4 This is a diagram showing an example of a cluster table. Figure 5 This is a diagram illustrating an example of PN information in an NM message. Figure 6 This diagram illustrates an example of NM message transmission in an in-vehicle system. Figure 7 This is the state transition diagram of the ECU. Figure 8 This is a functional block diagram illustrating an example of the function of the relay ECU according to the first embodiment. Figure 9 This diagram illustrates the failure of the anomaly detection function. Figure 10 This is a flowchart illustrating an example of abnormal detection failure handling of the relay ECU according to the first embodiment. Figure 11 This is a flowchart illustrating an example of the abnormal detection activation process of the relay ECU according to the first embodiment. Figure 12 This is a timing diagram illustrating a first example of the process of anomaly detection failure in the vehicle system according to the first embodiment. Figure 13 This is a timing diagram illustrating a second example of the process of anomaly detection failure in the vehicle system according to the first embodiment. Figure 14 This is a block diagram illustrating an example of the structure of the vehicle-mounted system according to the second embodiment. Detailed Implementation

[0009] <The problems this disclosure aims to solve> Vehicle-mounted devices in sleep mode cannot communicate. Therefore, it is possible to mistakenly detect a vehicle-mounted device in sleep mode as abnormal.

[0010] <The Effects of This Disclosure> According to this disclosure, it is possible to avoid misdetecting dormant vehicle devices as abnormal.

[0011] <Summary of Embodiments of this Disclosure> The following outlines and explains the summary of the embodiments of the present disclosure.

[0012] (1) The vehicle-mounted control device according to the present embodiment is connected to a vehicle-mounted device via a network, the vehicle-mounted device being capable of switching between an operation state and a sleep state, the vehicle-mounted control device including: an abnormality detection section that detects an abnormality of the vehicle-mounted device; a determination section that determines whether the vehicle-mounted device is in the sleep state based on a state of a cluster to which the vehicle-mounted device belongs; and a control section that deactivates the abnormality detection section when the vehicle-mounted device is in the sleep state. Thus, it is possible to avoid false detection of the vehicle-mounted device in the sleep state as an abnormality.

[0013] (2) In the above (1), the determination section can determine whether the vehicle-mounted device is in the sleep state based on a state of the cluster held by the vehicle-mounted control device when the vehicle-mounted control device belongs to the cluster. Thus, when the vehicle-mounted control device and the vehicle-mounted device belong to the same cluster, it is possible to determine whether the vehicle-mounted device is in the operation state or in the sleep state.

[0014] (3) In the above (1), the determination section can determine whether the vehicle-mounted device is in the sleep state based on a state of the cluster specified in a control message transmitted on the network for controlling the cluster when the vehicle-mounted control device does not belong to the cluster. Thus, when the vehicle-mounted control device and the vehicle-mounted device do not belong to the same cluster, it is possible to determine whether the vehicle-mounted device is in the operation state or in the sleep state.

[0015] (4) In any one of the above (1) to (3), the determination section can determine whether the vehicle-mounted device is in the sleep state based on a state of a first cluster and a state of a second cluster when the vehicle-mounted device belongs to the first cluster and the second cluster. Thus, when the vehicle-mounted device belongs to the first cluster and the second cluster, it is possible to determine whether the vehicle-mounted device is in the operation state or in the sleep state.

[0016] (5) In any one of the above (1) to (4), the determination section can determine the cluster to which the vehicle-mounted device belongs using a table indicating a correspondence relationship between the clusters and the vehicle-mounted devices, and determine whether the vehicle-mounted device is in the sleep state based on a state of the determined cluster. Thus, it is possible to easily determine which cluster the vehicle-mounted device belongs to using the table.

[0017] (6) In any one of the above (1) to (5), the state of the cluster can include an active state and a stopped state, and the determination section can determine that the vehicle-mounted device is in the sleep state when the state of the cluster is the stopped state. Thus, it is possible to accurately determine that the vehicle-mounted device is in the sleep state according to the state of the cluster.

[0018] (7) In any one of (1) to (6) described above, it can be that the abnormality detection section detects an abnormality of the in-vehicle device based on a communication state of the in-vehicle device through the network. Thus, when the in-vehicle device is in the dormant state, by disabling the abnormality detection section, it is possible to avoid false detection of an abnormality of the in-vehicle device based on the communication state.

[0019] (8) In any one of (1) to (7) described above, it can be that, when the in-vehicle control device belongs to the cluster and the cluster is in the stopped state, the in-vehicle control device maintains the operating state. Thus, it is possible to avoid failure to detect an abnormality of the in-vehicle device due to the in-vehicle control device becoming the dormant state.

[0020] (9) A control method according to the present embodiment is used by an in-vehicle control device connected to an in-vehicle device via a network, the in-vehicle device being capable of switching between an operating state and a dormant state, the control method including the steps of determining whether the in-vehicle device is in the dormant state based on a state of a cluster to which the in-vehicle device belongs, and disabling an abnormality detection function that detects an abnormality of the in-vehicle device when the in-vehicle device is in the dormant state. Thus, it is possible to avoid false detection of the in-vehicle device in the dormant state as an abnormality.

[0021] (10) A control program according to the present embodiment is executed by an in-vehicle control device connected to an in-vehicle device via a network, the in-vehicle device being capable of switching between an operating state and a dormant state, the control program being for causing a computer to execute the steps of determining whether the in-vehicle device is in the dormant state based on a state of a cluster to which the in-vehicle device belongs, and disabling an abnormality detection function that detects an abnormality of the in-vehicle device when the in-vehicle device is in the dormant state. Thus, it is possible to avoid false detection of the in-vehicle device in the dormant state as an abnormality.

[0022] The present disclosure can be realized not only as an in-vehicle control device having the above-described characteristic configuration, a control method in which the characteristic processing in the in-vehicle control device is taken as a step, and a control program for causing the in-vehicle control device to execute the characteristic processing, but also as an in-vehicle system including the in-vehicle control device, and a semiconductor integrated circuit in which part or all of the in-vehicle control device is implemented.

[0023] <Details of Embodiments of the Present Disclosure> Hereinafter, details of the embodiments of the present disclosure will be described with reference to the accompanying drawings. Furthermore, at least a part of the embodiments described below can be arbitrarily combined.

[0024] [1st Embodiment] [1-1. In-vehicle System] Figure 1is a block diagram showing an example of a configuration of a vehicle-mounted system according to the first embodiment. The vehicle-mounted system 10 is mounted on a vehicle.

[0025] The vehicle-mounted system 10 according to the first embodiment includes a relay ECU 100 and ECUs 200A, 200B, 200C, 200D. The vehicle-mounted system 10 is a vehicle-mounted network constituted by the relay ECU 100, the ECUs 200A, 200B, 200C, 200D, and communication lines 11A, 11B, 11C, 11D, 12 connecting them. In the following description, the communication lines 11A, 11B, 11C, 11D are sometimes collectively referred to as "communication lines 11".

[0026] The ECUs 200A, 200B, 200C, 200D are disposed at respective parts of the vehicle. The ECUs 200A, 200B, 200C, 200D individually control hardware of the respective parts of the vehicle and monitor the hardware states of the respective parts of the vehicle. For example, the ECUs 200A, 200B, 200C, 200D are ECUs of a control system, a body system, and an information system. In the following description, the ECUs 200A, 200B, 200C, 200D are sometimes collectively referred to as "ECUs 200".

[0027] The relay ECU 100 is connected to the ECUs 200A, 200B, 200C, 200D and the communication lines 11A, 11B, 11C, 11D. That is, the relay ECU 100 is connected to the ECU 200A through the communication line 11A. The relay ECU 100 is connected to the ECU 200B through the communication line 11B. The relay ECU 100 is connected to the ECU 200C through the communication line 11C. The relay ECU 100 is connected to the ECU 200D through the communication line 11D.

[0028] The communication line 12 extends from the relay ECU 100. The relay ECU 100 is connected to a not-shown vehicle-mounted device (for example, a relay ECU or an ECU) via the communication line 12.

[0029] The communication lines 11A, 11B, 11C, 11D, 12 are each an Ethernet cable. The relay ECU 100 and the ECUs 200A, 200B, 200C, 200D each have an Ethernet communication function.

[0030] The relay ECU 100 relays communication between the ECUs 200A, 200B, 200C, 200D (and other ECUs). That is, the relay ECU 100 relays Ethernet frames (messages) among the ECUs 200A, 200B, 200C, 200D. For example, the relay ECU 100 functions as an Ethernet switch of at least one of a layer-2 switch and a layer-3 switch. Thereby, the ECUs 200A, 200B, 200C, 200D can communicate with each other.

[0031] The ECUs 200A, 200B, 200C, 200D each have a communication I / F 210 connected to the communication line 11A, 11B, 11C, 11D. The communication I / F 210 is an I / F corresponding to the partial network function. The relay ECU 100 has a communication I / F 110A connected to the communication line 11A, a communication I / F 110B connected to the communication line 11B, a communication I / F 110C connected to the communication line 11C, a communication I / F 110D connected to the communication line 11D, and a communication I / F 110E connected to the communication line 12. The communication I / Fs 110A, 110B, 110C, 110D are I / Fs corresponding to the partial network function.

[0032] The relay ECU 100, the ECUs 200A, 200B, 200C, 200D use a communication protocol corresponding to the partial network function. In the first embodiment, the communication protocol is Ethernet.

[0033] The relay ECU 100, the ECUs 200A, 200B, 200C, 200D can transmit and receive NM messages for the partial network. The NM message is a message of a request or release of a PNC. The NM message is a UDP (User Datagram Protocol) packet transmitted periodically. In the NM message, a node (ECU 200) to which a requested PNC belongs is specified to be woken up. In the NM message, a node to which a released PNC belongs is specified to be put to sleep. Here, the sleep means that the ECU 200 temporarily stops functions other than the partial function and stands by in a power saving state. The wake up means that the ECU 200 in the sleep state shifts to a running state. The running state means that all functions of the ECU 200 are in operation.

[0034] [1-2. Structure of Relay ECU] Hereinafter, the hardware structure of the relay ECU 100 will be described. The relay ECU 100 is an example of an "in-vehicle control device".

[0035] Figure 2is a block diagram showing an example of a hardware structure of a relay ECU according to the first embodiment. The relay ECU 100 includes a microcontroller 115 and communication I / Fs 110A, 110B, 110C, and 110D.

[0036] The microcontroller 115 is, for example, a single-chip semiconductor integrated circuit including a processor 101, a nonvolatile memory 102, a volatile memory 103, a peripheral circuit 104, and an input / output interface (I / O) 105.

[0037] The volatile memory 103 is, for example, a semiconductor memory such as an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), or the like. The nonvolatile memory 102 is, for example, a semiconductor memory such as a flash memory, a ROM (Read Only Memory), an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), or the like.

[0038] The processor 101 is, for example, a CPU (Central Processing Unit). However, the processor 101 is not limited to the CPU, and can be a GPU (Graphics Processing Unit). The processor 101 is configured to be able to execute a computer program. However, the processor 101 can include, for example, in part, an ASIC (Application Specific Integrated Circuit), and can include, for example, in part, a programmable logic device such as an FPGA (Field Programmable Gate Array).

[0039] The nonvolatile memory 102 stores therein an abnormality detection program 106, a control program 107, and data used by the abnormality detection program 106 and the control program 107, respectively, as computer programs. The abnormality detection program 106 and the control program 107 can be stored in a recording medium such as a flash memory, a ROM, a CD-ROM, or the like. The processor 101 is able to detect an abnormality occurring in the ECU 200 by the abnormality detection program 106. The processor 101 is able to avoid a false detection of an abnormality by the abnormality detection program 106 by the control program 107.

[0040] A cluster table 108 is stored in the nonvolatile memory 102. The cluster table 108 will be described later.

[0041] The peripheral circuit 104 is a circuit for enabling the microcontroller 115 to implement various functions. For example, the peripheral circuit 104 includes a general-purpose input / output port (GPIO), an analog-digital converter, a timer, a serial communication, and the like. The serial communication circuit conforms to standards such as UART (Universal Asynchronous Receiver / Transmitter), I2C (Inter-Integrated Circuit), SPI (serial peripheral interface), and the like, for example.

[0042] The I / O 105 is connected to the communication I / F 110A, 110B, 110C, 110D. The I / O 105 is a port for inputting and outputting to the communication I / F 110A, 110B, 110C, 110D.

[0043] The communication I / F 110A, 110B, 110C, 110D is a communication interface conforming to the Ethernet standard. As described above, the communication I / F 110A, 110B, 110C, 110D is an I / F corresponding to a partial network function.

[0044] The communication I / F 110A includes a PHY 111A. The communication I / F 110B includes a PHY 111B. The communication I / F 110C includes a PHY 111C. The communication I / F 110D includes a PHY 111D.

[0045] The PHY 111A is connected to the communication line 11A. The PHY 111B is connected to the communication line 11B. The PHY 111C is connected to the communication line 11C. The PHY 111D is connected to the communication line 11D.

[0046] The PHY 111A, 111B, 111C, 111D converts an analog signal received from the communication line 11A, 11B, 11C, 11D into a digital signal. The PHY 111A, 111B, 111C, 111D converts a digital signal into an analog signal and transmits the converted analog signal to the communication line 11A, 11B, 11C, 11D.

[0047] The PHY 111A, 111B, 111C, 111D corresponds to a partial network function, and is capable of analyzing a PNC that has been designated as a wake-up object and a PNC that has been designated as a sleep object in an NM message.

[0048] The communication I / F 110A, 110B, 110C, 110D includes a processing circuit not shown for performing processing of frames (messages) transmitted and received.

[0049] [1-3. Structure of ECU] Hereinafter, the hardware structure of the ECU 200 will be described. The ECU 200 is an example of "in-vehicle device".

[0050] Figure 3 is a block diagram showing an example of the hardware structure of the ECU according to the first embodiment. The ECU 200 includes a microcontroller 220 and a communication I / F 210.

[0051] The microcontroller 220 has the same structure as the microcontroller 115 of the relay ECU 100 described above. That is, the microcontroller 220 includes a processor 201, a nonvolatile memory 202, a volatile memory 203, a peripheral circuit 204, and an I / O 205.

[0052] The nonvolatile memory 202 stores therein an application program (hereinafter also referred to as "APP") 206 as a computer program and data used for executing the APP 206. The APP 206 can be stored in a recording medium such as a flash memory, a ROM, a CD-ROM, or the like. The processor 201 is capable of executing a function for providing a service as an ECU by the APP 206.

[0053] The peripheral circuit 204 includes a serial communication circuit conforming to a standard such as UART, I2C, SPI, or the like, for example. The serial communication circuit of the peripheral circuit 204 is connected to a device or a sensor that is a control target of the ECU 200, and is capable of receiving a signal output from the sensor and transmitting a control signal to the control target.

[0054] The I / O 205 is connected to the communication I / F 210. The I / O 205 is a port for inputting and outputting to the communication I / F 210.

[0055] The communication I / F 210 is a communication interface conforming to an Ethernet standard. As described above, the communication I / F 210 is an I / F corresponding to a partial network function.

[0056] The communication I / F 210 includes a PHY 211.

[0057] The PHY 211 is connected to the communication line 11. That is, the PHY 211 of the ECU 200A is connected to the communication line 11A. The PHY 211 of the ECU 200B is connected to the communication line 11B. The PHY 211 of the ECU 200C is connected to the communication line 11C. The PHY 211 of the ECU 200D is connected to the communication line 11D.

[0058] The PHY 211 converts an analog signal received from the communication line 11 into a digital signal. The PHY 211 converts a digital signal into an analog signal and transmits the converted analog signal to the communication line 11.

[0059] The communication I / F 210 includes a processing circuit, not shown, for performing processing of transmitted and received frames (messages).

[0060] The communication I / F 210 corresponds to a partial network function. The above-described processing circuit or the processor 201 can analyze a PNC that has been designated as a wake-up object in an NM message and a PNC that has been designated as a sleep object.

[0061] [1-4. PNC] The PNC is described. The relay ECU 100, the ECUs 200A, 200B, 200C, 200D (and other ECUs) each belong to at least one PNC. The nonvolatile memory 102 of the relay ECU 100 stores a cluster table 108 (refer to FIG. 1) that associates the relay ECU 100, the ECUs 200A, 200B, 200C, 200D with the PNCs to which the relay ECU 100, the ECUs 200A, 200B, 200C, 200D each belong. Figure 2 ).

[0062] The PNC can be set, for example, for each service provided to the user. The service is executed by one or more ECUs.

[0063] As examples of the service executed by the plurality of ECUs, there are automatic high beam control of a headlamp, automatic cruise traveling, door unlocking, air conditioning remote control, theft alarm notification, charging of a traveling battery (high-voltage battery) in an electric vehicle, charging from the traveling battery to an auxiliary battery (low-voltage battery), and the like.

[0064] The automatic high beam control of the headlamp is executed by a headlamp ECU that controls the headlamp and an ECU for vehicle traveling (engine ECU, brake ECU, and the like). Therefore, the headlamp ECU and the ECU for vehicle traveling belong to the same PNC.

[0065] The automatic cruise traveling is executed by an ADAS (Advanced Driver-Assistance Systems) ECU, a radar ECU that processes a detection result of a radar and detects an object outside the vehicle, and an ECU for vehicle traveling. Therefore, the ADAS ECU, the radar ECU, and the ECU for vehicle traveling belong to the same PNC.

[0066] The door unlocking is performed by, for example, a body ECU that controls movable parts of the vehicle body (door lock, power window, door mirror, etc.) and an authentication ECU that authenticates a code transmitted from a smart key (remote control key). Therefore, the body ECU and the authentication ECU belong to the same PNC.

[0067] The air conditioning remote control is performed by, for example, an air conditioning ECU that controls an air conditioner and an engine ECU that controls an engine. Therefore, the air conditioning ECU and the engine ECU belong to the same PNC.

[0068] The burglar alarm notification is performed by, for example, an alarm ECU that issues an alarm and a vehicle exterior communication ECU that communicates with a device outside the vehicle (for example, a server of a security company). Therefore, the alarm ECU and the vehicle exterior communication ECU belong to the same PNC.

[0069] The charging of the travel battery is performed by, for example, a charging ECU that controls charging of the travel battery and an auxiliary battery and a battery management ECU that manages the travel battery. Therefore, the charging ECU and the battery management ECU belong to the same PNC.

[0070] The charging of the auxiliary battery is performed by the charging ECU, the battery management ECU, and a power conversion ECU that controls a DC / DC converter that converts a direct current voltage output from the travel battery. Therefore, the charging ECU, the battery management ECU, and the power conversion ECU belong to the same PNC.

[0071] There are also services performed by one ECU. Therefore, it is also possible to set a PNC that contains only one ECU. As examples of the services performed by one ECU, there are a wiper drive, a steering automatic adjustment, a seat automatic adjustment, etc.

[0072] The wiper drive is performed by a wiper ECU that controls a wiper. Therefore, only the wiper ECU belongs to one PNC.

[0073] The steering automatic adjustment is performed by a power steering ECU that controls a power steering. Therefore, only the power steering ECU belongs to one PNC.

[0074] The seat automatic adjustment is performed by a seat ECU that controls an electric seat. Therefore, only the seat ECU belongs to one PNC.

[0075] Figure 4 Fig. 1 is a diagram showing an example of a cluster table. Figure 4 In the cluster table 108 shown, which of the relay ECU 100, the ECUs 200A, 200B, 200C, 200D belongs in the two PNCs 1 and 2 is shown. Further, Figure 4The number of PNCs in Table 1 is an example, and three or more PNCs can be prepared. One PNC can also be prepared. In the table, "1" indicates that the corresponding ECU among the relay ECU 100, the ECUs 200A, 200B, 200C, and 200D belongs to the PNC of the row, and "0" indicates that the corresponding ECU among the relay ECU 100, the ECUs 200A, 200B, 200C, and 200D does not belong to the PNC of the row.

[0076] For example, the relay ECU 100, the ECUs 200A, 200B, and 200C belong to PNC1. The relay ECU 100 and the ECUs 200A and 200D belong to PNC2.

[0077] The cluster table 108 is static information stored in the nonvolatile memory 102 in advance. However, the cluster table 108 can also be dynamically generated based on, for example, the relayed NM messages in the relay ECU 100.

[0078] [1-5. State of ECU] The state of the ECU 200 includes a running state and a sleep state. The running state is a state in which the ECU 200 is operating, and is a state in which the ECU 200 can control a control target and communicate with the relay ECU 100 and other ECUs 200. The sleep state is a state in which the ECU 200 is stopped except for a part of the functions of the communication I / F 210.

[0079] The PN information is included in the NM message. The PN information includes designation of a request (Requested) or a release (Released) for each PNC. The request corresponds to wake-up of the PNC. That is, the PNC designated with the request in the NM message is a PNC to be woken up. The release corresponds to sleep of the PNC. That is, the PNC designated with the release in the NM message is a PNC to be put to sleep.

[0080] Figure 5 Fig. 1 is a diagram showing an example of the PN information in the NM message. In the example of Fig. 1, "Request" is designated for PNC1, "Release" is designated for PNC2, "Release" is designated for PNC3, and "Request" is designated for PNC4. That is, the ECUs 200 belonging to PNC1 are woken up, the ECUs 200 belonging to PNC2 are put to sleep, the ECUs 200 belonging to PNC3 are put to sleep, and the ECUs 200 belonging to PNC4 are woken up. Figure 5

[0081] The ECU 200 of the transmission source of the NM message broadcasts the NM message. Thereby, the NM message is transmitted to all ECUs 200 connected on the network. However, the NM message can also be unicast or multicast to the ECUs 200 of the transmission targets.

[0082] Figure 6 ​is a diagram showing an example of NM message transmission in a vehicle-mounted system. In Figure 6 The rectangular frame surrounding the "PNC1" text indicates an NM message in which a "request" is specified for PNC1. The rectangular frame surrounding the "PNC2" text indicates an NM message in which a "request" is specified for PNC2.

[0083] The ECU 200C transmits an NM message in which a request is specified for PNC1 (hereinafter also referred to as "first message"). When the relay ECU 100 receives the first message, it sends out the first message from each port. As a result, the first message is transmitted to the ECUs 200A, 200B, and 200D. Note that the case in which the NM message is broadcast is described here. When the NM message is unicast or multicast, the first message is sent out only from the port connected to the ECU 200A belonging to PNC1.

[0084] The ECU 200D transmits an NM message in which a request is specified for PNC2 (hereinafter also referred to as "second message"). When the relay ECU 100 receives the second message, it sends out the second message from each port. As a result, the second message is transmitted to the ECUs 200A, 200B, and 200C. Note that when the NM message is unicast or multicast, the second message is sent out only from each port connected to the ECU 200A and the ECU 200B each belonging to PNC2.

[0085] Figure 7 is a state transition diagram of an ECU. The ECU 200 in the sleep state is capable of receiving an NM message. That is, the communication I / F 210 of the ECU 200 has a function of receiving an NM message even in the sleep state. When the communication I / F 210 receives an NM message, it refers to the PN information included in the NM message and determines whether a request is specified for the PNC to which the ECU 200 belongs (wakeup).

[0086] When a request for the PNC is specified in the NM message, the ECU 200 is woken up. As a result, the state of the ECU 200 is transitioned from the sleep state to the running state.

[0087] When the ECU 200 in the running state receives an NM message in which a request for the PNC to which the ECU 200 belongs is specified, the ECU 200 maintains the running state.

[0088] When the ECU 200 in the running state does not receive an NM message in which a request for the PNC to which the ECU 200 belongs is specified for a certain period, the ECU 200 is transitioned from the running state to the sleep state. That is, when the ECU 200 in the running state receives only an NM message in which a release for the PNC to which the ECU 200 belongs is specified, or does not receive an NM message for a certain period, the ECU 200 is transitioned from the running state to the sleep state.

[0089] Returning to Figure 6, it is assumed that the ECUs 200A and 200B are in the sleep state. Further, the ECUs 200C and 200D as the NM message transmission source are in the running state, and the relay ECU 100 that relays the NM message is also in the running state.

[0090] As shown in FIG. 6, it is assumed that the relay ECU 100, the ECUs 200A and 200C belong to the PNC 1, and the relay ECU 100, the ECUs 200A, 200B and 200D belong to the PNC 2. Figure 4

[0091] The ECU 200A is awakened when it receives the first message in which "request" is designated to the PNC 1. Thereby, the state of the ECU 200A is changed from the sleep state to the running state. When the ECU 200A receives the first message, it judges that the state of the PNC 1 is "working state", and saves information indicating that the PNC 1 is in the working state (for example, stored in the nonvolatile memory 202). At this time, the ECU 200A also saves information indicating that the PNC 2 is in the stop state.

[0092] On the other hand, the ECU 200B which does not belong to the PNC 1 maintains the sleep state even when it receives the first message.

[0093] The ECU 200A maintains the running state when it receives the second message in which "request" is designated to the PNC 2, since it is already in the running state. When the ECU 200A receives the second message, it judges that the state of the PNC 2 is "working state", and saves information indicating that the PNC 2 is in the working state. That is, the ECU 200A overwrites information indicating that the PNC 2 is in the stop state, for example, stored in the nonvolatile memory 202, to information indicating that the PNC 2 is in the working state.

[0094] On the other hand, the ECU 200B which belongs to the PNC 2 is awakened when it receives the second message. Thereby, the state of the ECU 200B is changed from the sleep state to the running state. When the ECU 200B receives the second message, it judges that the state of the PNC 2 is "working state", and saves information indicating that the PNC 2 is in the working state.

[0095] For example, when the ECU 200C does not transmit the first message, the ECU 200A measures the elapsed time from when the first message has not been received by a built-in timer, and determines whether the measured elapsed time reaches a certain period. When the ECU 200A does not receive the first message for a certain period, it judges that the PNC 1 is in the stop state, and saves information indicating that the PNC 1 is in the stop state. That is, the ECU 200A overwrites information indicating that the PNC 1 is in the working state, for example, stored in the nonvolatile memory 202, to information indicating that the PNC 1 is in the stop state.

[0096] ​On the other hand, the ECU 200B not belonging to the PNC 1 maintains the operating state even if the first message is not received for a certain period.

[0097] When the ECU 200D does not transmit the second message, the ECU 200A measures the elapsed time from when the second message is not received by the built-in timer, and determines whether the measured elapsed time reaches a certain period. The ECU 200A determines that the PNC 2 is in the stopped state when the second message is not received for a certain period, and saves information indicating that the PNC 2 is in the stopped state. That is, the ECU 200A rewrites information indicating that the PNC 2 is in the operating state, for example, stored in the nonvolatile memory 202, to information indicating that the PNC 2 is in the stopped state.

[0098] Since both the PNC 1 and the PNC 2 to which the ECU 200A belongs are in the stopped state, the ECU 200A sleeps.

[0099] The ECU 200B measures the elapsed time from when the second message is not received by the built-in timer, and determines whether the measured elapsed time reaches a certain period. The ECU 200B determines that the PNC 2 is in the stopped state when the second message is not received for a certain period, and saves information indicating that the PNC 2 is in the stopped state.

[0100] The PNC to which the ECU 200B belongs is only the PNC 2, and since the PNC 2 is in the stopped state, the ECU 200B sleeps.

[0101] [1-6. Function of Relay ECU] Figure 8 is a functional block diagram illustrating an example of the function of the relay ECU according to the first embodiment.

[0102] The relay ECU 100 has each function of the abnormality detection section 120, the determination section 121, and the control section 122. The abnormality detection section 120 is implemented by the processor 101 executing the abnormality detection program 106. The determination section 121 and the control section 122 are implemented by the processor 101 executing the control program 107.

[0103] The abnormality detection section 120 detects an abnormality of the ECU 200. For example, the abnormality detection section 120 detects an abnormality of the ECU 200 based on a communication state of the ECU 200 through the network.

[0104] In a specific example, the abnormality detection section 120 monitors the link state of each of the communication I / Fs 110A, 110B, 110C, and 110D. The abnormality detection section 120 determines that the ECU 200 corresponding to the communication I / F in the link-up state is normal in the communication I / Fs 110A, 110B, 110C, and 110D. The abnormality detection section 120 detects the abnormality of the ECU 200 corresponding to the communication I / F that has become in the link-down state in the communication I / Fs 110A, 110B, 110C, and 110D. For example, when the communication I / F 110A is in the link-down state, the abnormality detection section 120 detects the abnormality of the ECU 200A.

[0105] In other examples, the abnormality detection section 120 sends out a specific message (hereinafter also referred to as "abnormality detection message") from each of the communication I / Fs 110A, 110B, 110C, and 110D. When the ECU 200 receives the abnormality detection message, the ECU 200 returns a response message (Ack). When the abnormality detection section 120 receives the Ack, the abnormality detection section 120 determines that the ECU 200 corresponding to the port (communication I / F) that has received the Ack is normal. The abnormality detection section 120 detects the abnormality of the ECU 200 corresponding to the communication I / F that has not received the Ack in the communication I / Fs 110A, 110B, 110C, and 110D. For example, when the communication I / F 110A has not received the Ack, the abnormality detection section 120 detects the abnormality of the ECU 200A.

[0106] The above abnormality detection message can be an ICMP (Internet Control Message Protocol) echo request, and the response message can be an echo reply.

[0107] The determination section 121 determines whether the ECU 200 is in the sleep state based on the state of the PNC to which the ECU 200 belongs. That is, the determination section 121 determines whether the ECU 200 is in the sleep state depending on whether the PNC is in the active state or the stopped state. More specifically, the determination section 121 determines that the ECU 200 belonging to a specific PNC is in the running state when the specific PNC is in the active state. The determination section 121 determines that the ECU 200 belonging to a specific PNC is in the sleep state when the specific PNC is in the stopped state.

[0108] In a specific example, when the relay ECU 100 belongs to a specific PNC, the determination section 121 determines whether the ECU 200 is in the sleep state based on the state information of the PNC held by the relay ECU 100.

[0109] In Figure 4In the example, relay ECU 100 belongs to PNC1. Therefore, as mentioned above, relay ECU 100 stores status information indicating the state (operating state or stopped state) of PNC1. The determination unit 121 determines the state of ECUs 200A and 200C belonging to PNC1 based on the status information stored in relay ECU 100. That is, when PNC1 is in the operating state, the determination unit 121 determines that ECUs 200A and 200C are in the running state. When PNC1 is in the stopped state, the determination unit 121 determines that ECUs 200A and 200C are in the dormant state.

[0110] Back Figure 8 In another specific example, when the relay ECU 100 does not belong to a specific PNC, the determination unit 121 determines whether the ECU 200 is in a dormant state based on the status of the PNC specified in the NM message. That is, the determination unit 121 determines whether the ECU 200 belonging to that PNC is in a running state or a dormant state based on whether the NM message specifies "request (working state)" or "release (stop state)" for that specific PNC.

[0111] More specifically, when an NM message specifies a "request" for a particular PNC, the determination unit 121 determines that the ECU 200 belonging to that PNC is in an operating state. If no NM message specifying a "request" for a particular PNC is received for a certain period of time, the determination unit 121 determines that the ECU 200 belonging to that PNC is in a sleep state.

[0112] exist Figure 4 In this example, relay ECU 100 does not belong to PNC2. The determination unit 121 refers to the state specified for PNC2 in the NM message and determines the state of ECUs 200A, 200B, and 200D belonging to PNC2 based on that state. That is, when the NM message specifies a "request" for PNC2, the determination unit 121 determines that ECUs 200A, 200B, and 200D are in an operating state. If no NM message specifying a "request" for PNC2 is received for a certain period, the determination unit 121 determines that ECUs 200A, 200B, and 200D are in a dormant state.

[0113] Back Figure 8When ECU 200 belongs to both the first PNC and the second PNC, for example, the determination unit 121 determines whether ECU 200 is in a sleep state based on the state of the first PNC and the state of the second PNC. Specifically, when at least one of the first PNC and the second PNC is in an operating state, the determination unit 121 determines that ECU 200 belonging to both the first PNC and the second PNC is in an operating state. When both the first PNC and the second PNC are in a stopped state, the determination unit 121 determines that ECU 200 belonging to both the first PNC and the second PNC is in a sleep state.

[0114] exist Figure 4 In the example, ECU200A belongs to both PNC1 and PNC2. When at least one of PNC1 and PNC2 is in an operating state, the determination unit 121 determines that ECU200A is in an operating state. When both PNC1 and PNC2 are in a stopped state, the determination unit 121 determines that ECU200A is in a dormant state.

[0115] Back Figure 8 For example, the determination unit 121 uses the cluster table 108 to determine the PNC to which the ECU 200 belongs. Based on the determined PNC's state, the determination unit 121 determines whether the ECU 200 is in a sleep state. Specifically, the determination unit 121 refers to... Figure 4 The cluster table 108 shown determines whether ECU200A belongs to PNC1 or PNC2. Similarly, the determination unit 121 determines whether ECU200B belongs to PNC2 by referring to cluster table 108. The determination unit 121 determines whether ECU200C belongs to PNC1 by referring to cluster table 108. The determination unit 121 determines whether ECU200D belongs to PNC2 by referring to cluster table 108.

[0116] Here, relay ECU100 belongs to PNC1. ECU200C, belonging to PNC1, enters a sleep state when PNC1 is in a stopped state, i.e., when no NM message specifying a "request" to PNC1 is received for a certain period. On the other hand, relay ECU100 does not enter a sleep state even when PNC1 is in a stopped state, but remains operational. Therefore, it is possible to avoid the inability to detect ECU200 anomalies due to relay ECU100 entering a sleep state.

[0117] When the ECU 200 is in the sleep state, the control section 122 deactivates the detection of abnormalities by the abnormality detection section 120. Specifically, in a case where the abnormality detection function related to one ECU 200 (hereinafter, the ECU of interest will be referred to as "target ECU") is active, when the target ECU 200 is in the sleep state, the control section 122 deactivates the abnormality detection function related to the target ECU 200. In a case where the abnormality detection function related to the target ECU 200 is inactive, when the target ECU 200 is in the active state, the control section 122 activates the abnormality detection function related to the target ECU 200.

[0118] Figure 9 is a diagram for explaining deactivation of the abnormality detection function. For example, consider a case where the abnormality detection function related to each of the ECUs 200A, 200B, 200C, and 200D is active. Here, when the PNC 2 is in the stop state, the ECUs 200B and 200D belonging to the PNC 2 are in the sleep state. Therefore, the determination section 121 determines that the ECUs 200B and 200D are in the sleep state.

[0119] The control section 122 deactivates the abnormality detection function related to the ECU 200B. Likewise, the control section 122 deactivates the abnormality detection function related to the ECU 200D. Thereby, it is possible to avoid false detection of abnormalities in the ECUs 200B and 200D.

[0120] Here, when the PNC 2 is in the active state, the ECUs 200B and 200D belonging to the PNC 2 are awakened. Therefore, the determination section 121 determines that the ECUs 200B and 200D are in the active state.

[0121] The control section 122 activates the abnormality detection function related to the ECU 200B. Likewise, the control section 122 activates the abnormality detection function related to the ECU 200D. Thereby, the detection of abnormalities in the ECUs 200B and 200D is started again.

[0122] [1-7. Action of relay ECU] Next, the action of the relay ECU 100 according to the first embodiment will be described.

[0123] The processor 101 can execute the following abnormality detection deactivation process and abnormality detection activation process by the control program 107.

[0124] Figure 10 is a flowchart showing an example of the abnormality detection deactivation process of the relay ECU according to the first embodiment.

[0125] The processor 101 determines each ECU 200 as a target ECU. The abnormality detection disable processing is executed for each target ECU. More specifically, the abnormality detection disable processing is executed for the target ECU in which the abnormality detection function is active. That is, the abnormality detection disable processing of each target ECU in which the abnormality detection function is active is executed in parallel.

[0126] The processor 101 refers to the cluster table 108, and determines the PNC to which the target ECU 200 belongs (step S101).

[0127] Next, the processor 101 determines whether the relay ECU 100 belongs to the determined PNC (step S102).

[0128] When the relay ECU 100 belongs to the determined PNC (YES in step S102), the processor 101 judges the state of the target ECU 200 based on the state of the PNC held by the relay ECU 100 (step S103). That is, when the state of the PNC held by the relay ECU 100 is the active state, the processor 101 judges that the target ECU 200 is in the running state. On the other hand, when the state of the PNC held by the relay ECU 100 is the inactive state, the processor 101 judges that the target ECU 200 is in the dormant state.

[0129] When the relay ECU 100 does not belong to the determined PNC (NO in step S102), the processor 101 refers to the NM message received by the relay ECU 100. The processor 101 judges the state of the target ECU 200 based on the state of the PNC specified in the NM message (step S104). That is, when the determined PNC is specified as "request" in the NM message received by the relay ECU 100, the processor 101 judges that the target ECU 200 is in the running state. On the other hand, when the relay ECU 100 has not received the NM message in which the determined PNC is specified as "request" for a certain period or more, the processor 101 judges that the target ECU 200 is in the dormant state.

[0130] The processor 101 determines whether the target ECU 200 is judged to be in the dormant state or in the running state in step S103 or S104 (step S105).

[0131] When the target ECU 200 is judged to be in the running state (NO in step S105), the abnormality detection disable processing ends. That is, in this case, the active state of the abnormality detection function with respect to the target ECU 200 is maintained.

[0132] When the subject ECU 200 is judged to be in the dormant state (YES in step S105), the processor 101 invalidates the abnormality detection function related to the subject ECU 200 (step S106). Thus far, the abnormality detection invalidation processing ends.

[0133] Figure 11 Fig. 10 is a flowchart showing an example of abnormality detection validation processing of the relay ECU according to the first embodiment.

[0134] The abnormality detection validation processing is executed for each subject ECU. More specifically, the abnormality detection validation processing is executed for the subject ECUs for which the abnormality detection function is invalidated. That is, the abnormality detection validation processing of the subject ECUs for which the abnormality detection function is invalidated is executed in parallel.

[0135] The processor 101 refers to the cluster table 108 to determine the PNC to which the subject ECU 200 belongs (step S201).

[0136] Next, the processor 101 determines whether the relay ECU 100 belongs to the determined PNC (step S202).

[0137] When the relay ECU 100 belongs to the determined PNC (YES in step S202), the processor 101 judges the state of the subject ECU 200 based on the state of the PNC held by the relay ECU 100 (step S203). Step S203 is the same processing as step S103.

[0138] When the relay ECU 100 does not belong to the determined PNC (NO in step S202), the processor 101 refers to the NM message received by the relay ECU 100. The processor 101 judges the state of the subject ECU 200 based on the state of the PNC specified in the NM message (step S204). Step S204 is the same processing as step S104.

[0139] The processor 101 determines whether the subject ECU 200 is judged to be in the dormant state or in the running state in step S203 or S204 (step S205).

[0140] When the subject ECU 200 is judged to be in the dormant state (NO in step S205), the abnormality detection validation processing ends. That is, in this case, the invalidation state of the abnormality detection function related to the subject ECU 200 is maintained.

[0141] When the subject ECU 200 is judged to be in the running state (YES in step S205), the processor 101 validates the abnormality detection function related to the subject ECU 200 (step S206). Thus far, the abnormality detection validation processing ends.

[0142] Figure 12 Fig. 1 is a time chart showing a first example of a procedure of abnormality detection disablement in the vehicle-mounted system according to the first embodiment.

[0143] Figure 12 An example in which the ECU 200D transmits an NM message in which "request" is specified for PNC2 is shown in a case where the ECU 200A, 200B, 200C, 200D are in the running state. In this example, no NM message in which "request" is specified for PNC1 is transmitted from any of the ECU 200.

[0144] The ECU 200D transmits an NM message in which "request" is specified for PNC2 (step Sll). This NM message is a broadcast message, and is transmitted to each of the relay ECU 100, the ECU 200A, 200B, 200C.

[0145] The ECU 200A, 200B belonging to PNC2 maintain the running state because "request" is specified for PNC2 in the received NM message. The ECU 200D as the source of the NM message also maintains the running state.

[0146] In the NM message transmitted from the ECU 200D, "release" is specified for PNC1. The ECU 200C belonging to PNC1 has not received the NM message in which "request" is specified for PNC1 for a certain period or more. Therefore, the ECU 200C sleeps (step S12).

[0147] The relay ECU 100 also belongs to PNC1, and is originally a target of sleep. However, since the relay ECU 100 needs to perform abnormality detection disablement processing, the relay ECU 100 maintains the running state regardless of the PN information in the NM message.

[0148] The relay ECU 100 has not received the NM message in which "request" is specified for PNC1 for a certain period or more. Therefore, the processor 101 of the relay ECU 100 determines that the state of PNC1 is "stop state", and changes the saved state information of PNC1 from "running state" to "stop state" (step S13).

[0149] The processor 101 refers to the cluster table 108, and determines that the ECU belonging to PNC1 is the ECU 200C. The processor 101 determines that the state of the determined ECU 200C is "sleep state" (step S14).

[0150] The processor 101 disables the abnormality detection function with respect to the ECU 200C determined to be in the sleep state (step S15).

[0151] The abnormality detection function with respect to the ECU 200A, 200B, 200D in the running state is effective. Therefore, the relay ECU 100 transmits an abnormality detection message to the ECU 200A, 200B, 200D (steps S16, S17, S18). The ECU 200A, 200B, 200D transmit a response to the abnormality detection message to the relay ECU 100 (steps S19, S20, S21).

[0152] On the other hand, the relay ECU 100 does not transmit an abnormality detection message to the ECU 200C for which the abnormality detection function is not effective. Thereby, it is possible to avoid false detection of an abnormality of the ECU 200C.

[0153] Figure 13 Fig. 9 is a timing chart showing a second example of the process of abnormality detection invalidation in the vehicle-mounted system according to the first embodiment.

[0154] Figure 13 An example in which the ECU 200C transmits an NM message in which "request" is specified for PNC1 is shown in a case where the ECU 200A, 200B, 200C, 200D are in the running state. In this example, none of the ECU 200 transmits an NM message in which "request" is specified for PNC2.

[0155] The ECU 200C transmits an NM message in which "request" is specified for PNC1 (step S21). This NM message is a broadcast message, and is transmitted to each of the relay ECU 100, the ECU 200A, 200B, 200C.

[0156] The ECU 200A belonging to PNC1 maintains the running state because "request" is specified for PNC1 in the received NM message. The ECU 200C as the transmission source of the NM message also maintains the running state.

[0157] The relay ECU 100 also belongs to PNC1. However, since the relay ECU 100 needs to perform abnormality detection invalidation processing, it maintains the running state regardless of the PN information in the NM message.

[0158] In the NM message transmitted from the ECU 200C, "release" is specified for PNC2. The ECU 200B, 200D belonging to PNC2 do not receive an NM message in which "request" is specified for PNC2 for a certain period or more. Therefore, the ECU 200B, 200D sleep (steps S22, S23).

[0159] The relay ECU 100 does not receive an NM message in which "request" is specified for PNC2 for a certain period or more. Therefore, the processor 101 of the relay ECU 100 determines that the state of PNC2 is "stop state" (step S24).

[0160] The processor 101 refers to the cluster table 108, and determines that the ECUs belonging to the PNC 2 are the ECUs 200B, 200D. The processor 101 determines that the states of the determined ECUs 200B, 200D are "dormant states" (step S25).

[0161] The processor 101 deactivates the abnormality detection function with respect to the ECUs 200B, 200D determined to be in the dormant states (step S26).

[0162] The abnormality detection function with respect to the ECUs 200A, 200C in the running states is active. Therefore, the relay ECU 100 transmits an abnormality detection message to the ECUs 200A, 200C (steps S27, S28). The ECUs 200A, 200C transmit responses to the abnormality detection message to the relay ECU 100 (steps S29, S30).

[0163] On the other hand, the relay ECU 100 does not transmit the abnormality detection message to the ECUs 200B, 200D for which the abnormality detection function is deactivated. Thereby, it is possible to avoid false detection of the abnormality of the ECUs 200B, 200D.

[0164] [2. Second Embodiment] In the above-described first embodiment, the relay ECU 100 is an Ethernet switch. However, the relay ECU is not limited to the Ethernet switch. For example, the relay ECU can be a relay device that relays CAN (Controller Area Network) messages.

[0165] Figure 14 is a block diagram showing an example of the configuration of a vehicle-mounted system according to the second embodiment.

[0166] The vehicle-mounted system 20 includes a relay ECU 300 and ECUs 400A, 400B, 400C, 400D. The vehicle-mounted system 20 is a vehicle-mounted network constituted by the relay ECU 300, the ECUs 400A, 400B, 400C, 400D, and communication buses 21A, 21B connecting them. That is, the vehicle-mounted system 20 is a CAN network having a bus-type network topology.

[0167] Specifically, the ECUs 400A, 400B are connected to the communication bus 21A, and the ECUs 400C, 400D are connected to the communication bus 21B. The relay ECU 300 is connected to each of the communication buses 21A, 21B. A communication bus 22 extends from the relay ECU 300. The relay ECU 300 is connected to a vehicle-mounted device (for example, a relay ECU or an ECU) not shown via the communication bus 22.

[0168] The relay ECU 300 and the ECUs 400A, 400B, 400C, 400D each have a communication I / F conforming to the CAN standard. The relay ECU 300 relays communication between the ECUs 400A, 400B and the ECUs 400C, 400D. That is, the relay ECU 300 relays CAN frames (messages) between the ECUs 200A, 200B and the ECUs 200C, 200D.

[0169] The relay ECU 300, the ECUs 400A, 400B, 400C, 400D are capable of transmitting and receiving NM messages for a partial network. The NM message is a CAN frame transmitted periodically.

[0170] In this modification, the relay ECU 300 transmits a CAN message as an abnormality detection message to each of the communication buses 21A, 21B. When the ECUs 400A, 400B, 400C, 400D receive the abnormality detection message, they transmit a response message to the communication buses 21A, 21B. For example, the response message contains a CAN ID of the ECU 400A, 40B, 400C, 400D that is the transmission source. The relay ECU 300 determines the ECUs 400A, 40B, 400C, 400D that are the transmission sources by the CAN ID as normal by receiving the response message. When there is an ECU that does not transmit a response message among the ECUs 400A, 40B, 400C, 400D, the relay ECU 300 detects an abnormality of the ECU that does not transmit a response message.

[0171] The relay ECU 300 determines whether each of the ECUs 400A, 400B, 400C, 400D is in a sleep state. The relay ECU 300 deactivates the abnormality detection function with respect to the ECU determined to be in a sleep state. As for the deactivation and activation of the abnormality detection function, it is the same as in the above-described first embodiment.

[0172] [3. Modification] In the above-described first and second embodiments, the relay ECUs 100, 300 that relay communication between ECUs have an abnormality detection function, and deactivate the abnormality detection function with respect to an ECU in a sleep state, but are not limited to this. For example, an ECU connected to one communication bus can have an abnormality detection function with respect to an ECU connected to the same communication bus, and deactivate the abnormality detection function with respect to the ECU in a sleep state.

[0173] For example, consider the case where the ECU 200B is a device (an in-vehicle control device) having an abnormality detection function. The ECU 200B is capable of detecting an abnormality of the ECU 200A connected to the same communication bus 400A. Here, refer to Figure 4, the ECU 200B belongs to the PNC 2 and does not belong to the PNC 1. The ECU 200D also belongs to the PNC 2 and does not belong to the PNC 1. The ECU 200D is in a sleep state when the PNC 2 is in a stop state, i.e., when a NM message in which "request" is designated to the PNC 2 is not received for a certain period or more. On the other hand, the ECU 200B does not sleep even when the PNC 2 is in a stop state, but maintains a running state. Thus, it is possible to avoid that the ECU 200B cannot detect an abnormality of the ECU 200A because the ECU 200B sleeps. Further, not only the ECU 200B but also the ECUs 200A, 200C, and 200D can be the in-vehicle control device having the abnormality detection function. When the ECUs 200A, 200B, 200C, and 200D are the in-vehicle control devices, the relay ECU 300 can be the in-vehicle device not having the abnormality detection function.

[0174] The abnormality detection and the failure handling in the in-vehicle network conforming to the Ethernet standard are explained in the first embodiment, and the abnormality detection and the failure handling in the in-vehicle network conforming to the CAN standard are explained in the second embodiment, but are not limited thereto. As long as the communication protocol corresponds to a part of the network, a communication protocol other than the Ethernet and the CAN can be used. For example, in an in-vehicle network conforming to the FlexRay standard, the abnormality detection and the failure handling of the ECUs can be realized.

[0175] [4. SUPPLEMENTARY NOTES] The embodiments disclosed this time are examples in all aspects and are not limited thereto. The scope of the invention is not represented by the above-described embodiments, but is represented by the claims, and includes all modifications within the meaning and the scope equivalent to the claims. SYMBOL EXPLANATION

[0176] 10, 20 in-vehicle system

[0177] 11A, 11B, 11C, 11D, 12 communication line

[0178] 100, 300 relay ECU (in-vehicle control device, in-vehicle device)

[0179] 101 processor

[0180] 102 nonvolatile memory

[0181] 103 volatile memory

[0182] 104 peripheral circuit

[0183] 105 input / output interface (I / O)

[0184] 106 abnormality detection program

[0185] 107 control program

[0186] 108 cluster table

[0187] 110A, 110B, 110C, 110D communication interface (communication I / F)

[0188] 111A, 111B, 111C, 111D PHY

[0189] 115 microcontroller

[0190] 120 abnormality detection section

[0191] 121 determination section

[0192] 122 control section

[0193] 200, 200A, 200B, 200C, 200D ECU (on-vehicle device)

[0194] 201 processor

[0195] 202 non-volatile memory

[0196] 203 volatile memory

[0197] 204 peripheral circuit

[0198] 205 input / output interface (I / O)

[0199] 206 application program (APP)

[0200] 220 microcontroller

[0201] 21A, 21B, 22 communication bus

[0202] 400A, 400B, 400C, 400D ECU (on-vehicle device, on-vehicle control device)

Claims

1. A vehicle-mounted control device, connected to a vehicle-mounted device via a network, the vehicle-mounted device being able to switch between an operating state and a sleep state. The vehicle-mounted control device includes: The anomaly detection unit detects anomalies in the vehicle-mounted device; The determination unit determines whether the vehicle device is in a dormant state based on the state of the cluster to which the vehicle device belongs; as well as The control unit disables the anomaly detection unit's anomaly detection when the vehicle-mounted device is in a dormant state.

2. The vehicle control device according to claim 1, wherein, When the vehicle control device belongs to the cluster, the determination unit determines whether the vehicle device is in a dormant state based on the state of the cluster stored in the vehicle control device.

3. The vehicle control device according to claim 1, wherein, When the vehicle control device does not belong to the cluster, the determination unit determines whether the vehicle device is in a dormant state based on the state of the cluster specified in the control message transmitted on the network for controlling the cluster.

4. The vehicle control device according to any one of claims 1 to 3, wherein, When the vehicle-mounted device belongs to the first cluster and the second cluster, the determination unit determines whether the vehicle-mounted device is in a dormant state based on the state of the first cluster and the state of the second cluster.

5. The vehicle control device according to any one of claims 1 to 4, wherein, The determination unit uses a table representing the correspondence between clusters and vehicle-mounted devices to determine the cluster to which the vehicle-mounted device belongs, and determines whether the vehicle-mounted device is in a dormant state based on the state of the determined cluster.

6. The vehicle control device according to any one of claims 1 to 5, wherein, The cluster's state includes a working state and a stopped state. When the cluster is in a stopped state, the determination unit determines that the vehicle-mounted device is in a dormant state.

7. The vehicle control device according to any one of claims 1 to 6, wherein, The anomaly detection unit detects anomalies in the vehicle-mounted device based on the communication status of the device through the network.

8. The vehicle control device according to any one of claims 1 to 7, wherein, When the vehicle control device belongs to the cluster and the cluster is in the stopped state, the vehicle control device maintains the operating state.

9. A control method used by an on-board control device, the on-board control device being connected to an on-board device via a network, the on-board device being able to switch between an operating state and a sleep state. The control method includes the following steps: The status of the cluster to which the vehicle device belongs is used to determine whether the vehicle device is in a dormant state. as well as When the vehicle-mounted device is in a dormant state, the anomaly detection function that detects abnormalities in the vehicle-mounted device is disabled.

10. A control program executed by an on-board control device, the on-board control device being connected to an on-board device via a network, the on-board device being capable of switching between an operating state and a sleep state. The control program is used to cause the computer to perform the following steps: The state of the cluster to which the vehicle-mounted device belongs is used to determine whether the vehicle-mounted device is in a dormant state; and When the vehicle-mounted device is in a dormant state, the anomaly detection function that detects abnormalities in the vehicle-mounted device is disabled.

Images