In-vehicle network system and control procedures

Abstract

An in-vehicle network system comprises a plurality of control devices (10, 20, 30, 40, 50, 60, 70, 80, 90, 100) connected to a communication bus and configured to communicate with each other within the vehicle. The plurality of control devices includes a plurality of start-destination control devices (10, 20, 30, 50, 60, 70, 80, 90, 100), each of which stores cluster configuration information. The plurality of control devices further includes a management control device (40) configured to modify the cluster configuration information of the plurality of start-destination control devices. The plurality of start-destination control devices has cluster configuration information for normal operation and cluster configuration information for abnormal occurrences.At least one of the start-destination control devices that detects the occurrence of an abnormality in the management control device or an abnormality in communication with the management control device switches the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence.

Description

[0001] The present disclosure relates to an in-vehicle network system comprising several control devices connected to a communication bus and capable of mutual communication within a vehicle, and a control method for the in-vehicle network system.

[0002] For example, the JP7238650B2 discloses an in-vehicle network system equipped with an upper ECU, a middle ECU, and a lower ECU. In the JP7238650B2's in-vehicle network system, the middle ECU receives power from a power supply and supplies power to the lower ECU based on a message received from the upper ECU. In other words, the middle ECU keeps the lower ECU in a powered-off state until a message is received from the upper ECU. Upon receiving the message from the upper ECU, the middle ECU is powered on from the power supply. Due to this power supply, the lower ECU transitions from a powered-off state to a standby state and awaits instructions.

[0003] As described above, in the conventional in-vehicle network system disclosed in JP7238650B2, a specific ECU (e.g., a middle ECU) is configured to manage the state of other ECUs (e.g., lower ECUs).

[0004] However, if the relationship between other ECUs and the specific ECU that manages their state is fixed, managing the state of other ECUs in detail can be difficult. Therefore, it has become common practice, for example, to assign clusters to each ECU—groups of ECUs that are activated simultaneously to achieve desired functions—and to use network management messages to switch each ECU to a startup or sleep state via a cluster.

[0005] In recent years, it has become possible to update the software of ECUs installed in a vehicle after the vehicle has been sold and distributed on the market, for example, by the vehicle owner downloading any application. In this case, depending on the functions of the downloaded application, it may be necessary to activate the ECU with the updated software, not only under the conditions defined before the update, but also, or alternatively, upon fulfillment of different conditions.

[0006] Therefore, if it is necessary to change the startup conditions of an ECU with updated software, it is conceivable that a specific management ECU of the vehicle's internal network system receives cluster configuration information corresponding to the changed startup conditions from an external source (e.g., an application provider) and modifies the cluster configuration information that specifies the cluster to which the ECU with updated software belongs.

[0007] However, in this case, if an abnormality occurs in the management ECU or if there is an abnormality in communication with the management ECU, the management ECU may be unable to properly modify the cluster configuration information of each ECU. As a result, ECUs may be activated at unintended times, leading to unnecessary energy consumption and improper control of the ECU startup.

[0008] The present disclosure was made in consideration of the above points and aims to provide an in-vehicle network system and a control procedure for an in-vehicle network system that can adequately control the starting of start-destination control devices, even if an abnormality occurs in a management control device capable of making changes to the cluster configuration information of the start-destination control devices, or if an abnormality occurs in communication with the management control device.

[0009] According to one aspect of the present disclosure, an in-vehicle network system comprises a plurality of control devices connected to a communication bus and configured to communicate with each other within a vehicle. The plurality of control devices includes a plurality of start-destination control devices, each of which stores cluster configuration information specifying a cluster to which it belongs within a plurality of partitioned clusters. When a network management message transmitted by another control device includes start-cluster information specifying a cluster to be activated that matches the cluster in the cluster configuration information, each start-destination control device enters or maintains a start-up state.The multitude of control devices further includes a management control device configured to modify the cluster configuration information of the multitude of origin control target devices. The multitude of origin control target devices maintains cluster configuration information for normal operation and cluster configuration information for abnormal occurrence. At least one of the origin control target devices, upon detecting an abnormal occurrence in the management control device or an abnormality in communication with the management control device, switches the cluster configuration information from normal operation to abnormal occurrence.

[0010] Additionally, according to one aspect of the present disclosure, a method for controlling an in-vehicle network system is provided, comprising a plurality of control devices connected to a communication bus and configured to communicate with each other within a vehicle. The plurality of control devices includes a plurality of start-destination control devices, each of which stores cluster configuration information specifying a cluster to which it belongs from a plurality of partitioned clusters. When a network management message transmitted by another control device includes start-cluster information specifying a cluster to be activated that matches the cluster in the cluster configuration information, each start-destination control device enters or maintains a start-up state.The plurality of control devices further includes a management control device configured to modify the cluster configuration information of the plurality of origin control target devices. The plurality of origin control target devices has cluster configuration information for normal operation and cluster configuration information for abnormal occurrence as the cluster configuration information. The method comprises, by at least one of the origin control target devices, detecting the occurrence of an abnormality in the management control device or an abnormality in communication with the management control device, and, by the at least one of the origin control target devices that has detected the occurrence of the abnormality, switching the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence.

[0011] According to the vehicle-internal network system and the control procedure for a vehicle-internal network system of the present disclosure, the start-destination control devices have pre-defined cluster configuration information for normal operation and cluster configuration information for abnormal occurrence (also referred to as abnormal operation). When an abnormality occurs in the management control device or in communication with the management control device, at least one start-destination control device that detects the abnormality switches the cluster configuration information from normal operation to the cluster configuration information for abnormal occurrence. This activates the at least one start-destination control device according to the cluster configuration information for abnormal occurrence.This enables appropriate control of the starting of start control target control devices, even if an abnormality occurs in the management control device or in communication with the management control device.

[0012] The functions, features, and advantages of the present disclosure are clarified by the following detailed description with reference to the accompanying drawings. These show: Fig. 1 a configuration diagram showing an example of the configuration of an in-vehicle network system according to the first embodiment; Fig. 2. An explanatory diagram to illustrate an example of an NM message, PN (Partial Network) request information, and PNC configuration information; Fig. 3 a diagram showing an example of a PNC configuration table stored in the memory unit of the power / start management ECU; Fig. 4 a diagram showing an example of relay connection information stored in the memory unit of the power / start management ECU; Fig. 5 a flowchart showing an example of processing performed in the power / start management ECU and the lower ECU according to the first embodiment; Fig. 6. A flowchart detailing the start-up ECU identification process in the flowchart of Fig. 5 shows; Fig. 7 a flowchart showing an example of processing performed in the power / start management ECU according to the second embodiment; Fig. 8 a flowchart showing an example of processing performed in the power / start management ECU according to the third embodiment; Fig. 9 an explanatory diagram to illustrate the operation in the vehicle's internal network system according to the third embodiment; Fig. 10 a flowchart showing an example of processing performed in the power / start management ECU according to the fourth embodiment; and Fig. 11 a flowchart showing an example of processing performed in the power / start management ECU according to the fifth embodiment.

[0013] Embodiments of the vehicle-integrated network system and a control method for a vehicle-integrated network system according to the present disclosure are described with reference to the drawings. However, the present disclosure is not limited to the following embodiments, and various modifications described later are also included within the technical scope of the present disclosure. Furthermore, various changes within the scope may be made that do not deviate from the core of the present disclosure. The embodiments and various modifications may be appropriately combined and implemented as long as no technical contradictions arise. In the following description, identical or similar configurations may be assigned the same reference numerals across multiple drawings, and explanatory notes may be omitted.Furthermore, if reference is made only to a part of a configuration, the description provided elsewhere can be applied to other parts. (First embodiment)

[0014] Fig. Figure 1 is a configuration diagram showing an example of the configuration of the vehicle's in-vehicle network system 200 according to this embodiment. As shown in Fig. As shown in Figure 1, the vehicle's internal network system 200 comprises a power / start management ECU 10, a first upper ECU 40, a second upper ECU 80 as upper control units, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100 as lower control units. ECU stands for Electronic Control Unit. The power supply lines 6 for the first and second lower ECUs 20 and 30 are equipped with first and second relay circuits 17 and 18, which are switched on and off by the power / start management ECU 10. Conversely, the third through seventh lower ECUs 50, 60, 70, 90, and 100 receive power directly from the power circuit 4 without passing through relay circuits such as the first and second relay circuits 17 and 18. Additionally, the energy / start management ECU 10, the first upper ECU 40 and the second upper ECU 80 are supplied with energy from the energy circuit 4.

[0015] The energy / start management ECU 10, the first and second upper ECUs 40, 80, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, 100 can each be configured by a computer equipped with a processor, RAM, and data storage. These ECUs are also equipped with communication interfaces (IFs) 11, 21, 31, 41, 51, 61, 71, 81, 91, 101 for communicating with other ECUs via communication buses 19a, 19b, 19c, 43a, 43b, 82a, 82b.

[0016] Specifically, communication IF 11 of the power / start management ECU 10 is connected to communication IFs 41 and 81 of the first and second upper ECUs 40 and 80 via communication bus 19a. Communication IF 11 of the power / start management ECU 10 is also connected to communication IF 21 of the first lower ECU 20 via communication bus 19b. Furthermore, communication IF 11 of the power / start management ECU 10 is connected to communication IF 31 of the second lower ECU 30 via communication bus 19c. Communication IF 41 of the first upper ECU 40 is connected to communication IFs 51 and 61 of the third and fourth lower ECUs 50 and 60 via communication bus 43a. The communication IF 41 of the first upper ECU 40 is also connected to the communication IF 71 of the fifth lower ECU 70 via the communication bus 43b.The communication IF 81 of the second upper ECU 80 is connected to the communication IF 91 of the sixth lower ECU 90 via communication bus 82a. The communication IF 81 of the second upper ECU 80 is also connected to the communication IF 101 of the seventh lower ECU 100 via communication bus 82b. The communication IF 11 of the power / start management ECU 10 and the communication IFs 41 and 81 of the first and second upper ECUs 40 and 80 are configured to act as gateways when the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100, which are connected to different communication buses 19a, 19b, 19c, 43a, 43b, 82a, and 82b, communicate with each other.

[0017] The processor can be, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), or a DFP (Data Flow Processor), which performs predetermined processing according to a program. Random Access Memory (RAM) is a volatile storage medium that temporarily stores calculation results from the processor. Data storage is a non-volatile storage medium, such as Flash memory or ROM (Read Only Memory). Various programs and data executed by the processor are stored in the data storage.The functions of the energy / start management ECU 10, the first and second upper ECU 40, 80 and the first to seventh lower ECU 20, 30, 50, 60, 70, 90, 100 can be implemented by hardware, such as ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array), instead of software, such as programs.

[0018] The vehicle's internal network system 200 can use CAN (registered trademark) as the communication protocol for mutual communication between the energy / start management ECU 10, the first and second upper ECUs 40, 80, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, 100. CAN stands for Controller Area Network. The communication protocol is not limited to CAN. The vehicle's internal network system 200 can use another communication protocol, such as CAN-FD (flexible data rate CAN). In the vehicle's internal network system 200 according to this embodiment, the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, 100 are divided into several groups (referred to as clusters) that must be activated simultaneously to perform at least one desired function.Using the network management message (referred to as NM message) described later, each cluster switches between normal operating mode (activated state or also referred to as startup state) and power-saving mode (e.g., sleep state). The power-saving mode includes the off state of the first and second lower ECUs 20 and 30. Therefore, the communication protocol used by the vehicle's in-vehicle network system 200 must support the transmission and reception of NM messages.

[0019] The energy / start management ECU 10 and the first and second upper ECUs 40, 80 can each have domain controller functions, overseeing the control of the first and second lower ECUs 20, 30, the third through fifth lower ECUs 50, 60, 70, and the sixth and seventh lower ECUs 90, 100. A domain refers to a functional unit when a vehicle's functions are broadly subdivided, such as the powertrain domain, chassis domain, advanced driver assistance domain, body domain, and cockpit domain. The above is an example of a domain subdivision, and the domain subdivision may differ from the example given above.Additionally, the energy / start management ECU 10 and the first and second upper ECUs 40, 80 can each have functions as area controllers, monitoring the control of the first and second lower ECUs 20, 30, the third to fifth lower ECUs 50, 60, 70 and the sixth and seventh lower ECUs 90, 100, which are located in each area of ​​the vehicle.

[0020] The first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) can, for example, be control ECUs for controlling predetermined control targets in the vehicle or sensor ECUs that calculate predetermined physical quantities based on detection signals acquired by sensors. When there is a need to control a target or calculate a predetermined physical quantity based on sensor detection signals, the first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) enter an activated state in normal operating mode and perform normal operations. On the other hand, if there is no need to control a control target or to calculate a predetermined physical quantity, the first to seventh lower ECUs 20, 30, 50, 60, 70, 90, 100 enter a switched-off or sleep state in energy-saving mode.

[0021] To switch between such activated states and deactivated or sleep states, the first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) are each assigned to a cluster to which they belong among several distributed clusters. The assigned cluster is stored by each ECU as cluster configuration information (also known as PNC configuration information). PNC stands for Partial Networking Clustering. The PNC configuration information of the first and second lower ECUs (20, 30) is stored, as described later, in memory unit 14 of the power / start management ECU (10).Based on the start cluster information (also known as PN request information) contained in the NM message, the first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) are configured to switch from a powered-off or sleep state to an powered-on state in response to the request to activate the cluster to which each ECU belongs. Additionally, PNC configuration information can be defined for the power / start management ECU (10) and the first and second upper ECUs (40, 80).

[0022] When the first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) transition to normal operating mode after entering the startup state, they periodically transmit NM messages to other ECUs while performing their normal operations. Additionally, the power / start management ECU (10), along with the first and second upper ECUs (40, 80), also periodically transmit NM messages as long as control needs to continue. Once the necessary processing is complete and there is no longer a need to perform normal operations, the first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) cease periodically transmitting NM messages.The third through seventh lower ECUs (50, 60, 70, 90, 100) switch from normal operating mode to energy-saving mode and from the start state to sleep mode when a predetermined standby time is reached during which they do not receive NM messages from other ECUs belonging to the same cluster. With respect to the first and second lower ECUs (20, 30), the energy / start management ECU (10) monitors the NM messages addressed to these ECUs. When a predetermined standby time is reached during which no NM messages addressed to these ECUs are received, the energy / start management ECU (10) switches off the first and second relay circuits (17, 18) and stops the power supply to these ECUs.

[0023] The third through seventh lower ECUs (50, 60, 70, 90, 100) have communication interfaces (IFs) (51, 61, 71, 91, 101) capable of receiving NM messages while in sleep mode and switching from sleep to startup mode in response to receiving NM messages. When activated by communication interfaces (IFs) 51, 61, 71, 91, 101, the third through seventh lower ECUs (50, 60, 70, 90, 100) determine whether to request a startup based on the PN request information and PNC configuration information contained in the NM messages. If a startup request is determined, the third through seventh lower ECUs (50, 60, 70, 90, 100) proceed in the startup state. If, however, it is determined that a start is not requested, the third to seventh lower ECUs 50, 60, 70, 90, 100 return to sleep mode.The determination, based on the PN request information and PNC configuration information, can be executed by communication interfaces 51, 61, 71, 91, and 101. In this case, if communication interfaces 51, 61, 71, 91, and 101 determine, based on the PN request information and PNC configuration information, that a start is requested, the corresponding ECU switches from sleep to start mode. An example of an NM message, the PN request information, and the PNC configuration information is described in detail below.

[0024] The NM message includes, as in Fig. Figure 2 shows data from byte 0 to byte 7. Byte 0 contains the Node ID (NID). The Node ID is a unique identifier for each of the power / start management ECU 10, the first and second upper ECUs 40 and 80, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100. The Node ID allows identification of the sender of the NM message. Byte 1 contains the Control Bit Vector (CBV). The Control Bit Vector is data that indicates whether Partial Networking (PN) is used. If the Control Bit Vector indicates the use of Partial Networking, the user data area from byte 2 to byte 7 contains the PN request information, which is the start cluster information indicating that the cluster should be activated. Subnetwork operation means that only the ECUs belonging to certain clusters are activated, while the ECUs belonging to other clusters are kept in a switched-off or sleep state.By activating only the ECUs necessary for operation, the energy consumption of each ECU installed in the vehicle can be reduced.

[0025] In the Fig. In the example shown, the control bit vector indicates the use of subnetwork operation, and the PN request information is stored in bytes 6 and 7 of the user data area. The user data area from byte 2 to byte 5 can be used to transmit any information, such as ECU startup factors or information relating to normal or abnormal conditions. Fig. 2 is merely an example of the NM message format and the NM message may have other formats as long as it includes the information on the use of subnetwork operation and the PN request information.

[0026] The PN request information specifies the clusters to be activated and the clusters that do not require startup for each of the multiple split clusters. More specifically, the following are detailed in the... Fig. In the example shown, the clusters are pre-divided into 16 clusters. The PN request information comprises 16-bit data corresponding to the 16 divided clusters. This means that the 16-bit data of the PN request information is pre-assigned to the 16 divided clusters. If each data bit of the 16-bit PN request information is "0", it indicates that starting the assigned cluster is not necessary. Conversely, if each data bit of the 16-bit PN request information is "1", it indicates that starting the assigned cluster is necessary.

[0027] As described above, the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100 have PNC configuration information that specifies the cluster to which they belong among the multiple split clusters. An example of this PNC configuration information is shown in Fig. 2 shown. More specifically, it shows Fig. 2. An example of PNC configuration information contained in one of the first to seventh lower ECUs 20, 30, 50, 60, 70, 90, 100. In the Fig. The PNC configuration information shown in Figure 2 indicates that, if the clusters in the figure are classified from left to right as A to P, the ECU containing this information belongs to clusters D, H, and J. The first through seventh lower ECUs (20, 30, 50, 60, 70, 90, 100) can belong to one or more clusters, as they may have different functions through program execution and other means.

[0028] Upon receiving NM messages containing the PN request information via their respective communication interfaces 51, 61, 71, 91, 101, the third to seventh lower ECUs 50, 60, 70, 90, 100 compare the PN request information bit by bit with the PNC configuration information, as shown in Fig. 2 shown, and calculate, for example, a logical AND. That is, when NM messages are received by communication IFs 51, 61, 71, 91, 101, the third through seventh lower ECUs 50, 60, 70, 90, 100 temporarily enter the start state. They then determine whether the cluster requested for activation by the PN request information contained in the NM message matches the cluster specified by the PNC configuration information assigned to each of the third through seventh lower ECUs 50, 60, 70, 90, 100. For example, in the Fig. In example 2, the clusters requested for activation by the PN request information are clusters D, G, I, M, N, and O. The clusters specified by the PNC configuration information to which the ECU belongs are clusters D, H, and J. In this case, in cluster D, the cluster requested for activation by the PN request information contained in the NM message matches the cluster of the PNC configuration information. Therefore, as shown in Fig. 2 shows the result of the logical AND in cluster D “1”.

[0029] If one bit of the result of the logical AND is "1", the ECU determines the value using the values ​​in Fig. The PNC configuration information shown in section 2 indicates that its startup is requested. Based on this determination, the ECU remains with the settings shown. Fig. The PNC configuration information shown in section 2 switches the system from sleep to startup, and if it is already in startup, it retains that state. However, if none of the bits in the result of the logical AND operation are "1" and all are "0", the ECU uses the information shown in the diagram to determine the startup state. Fig. The PNC configuration information shown in section 2 indicates that its start is not requested. In this case, the ECU discards the information contained in the data. Fig. The PNC configuration information shown in section 2 displays the received NM message and returns to sleep mode.

[0030] Thus, the third through seventh lower ECUs (50, 60, 70, 90, 100) have the function to identify, based on the PNC configuration information, whether the NM message requests their startup. With this NM message identification function, only the third through seventh lower ECUs (50, 60, 70, 90, 100) with PNC configuration information encompassing the cluster requested for activation by the PN request information are activated by the NM message. ECUs equipped with the function to receive NM messages and switch from sleep to startup while in sleep mode are referred to as NM-compatible ECUs.

[0031] In the vehicle-internal network system 200 according to this embodiment, the first and second lower ECUs 20, 30 need not necessarily be NM-compatible ECUs. In other words, the first and second lower ECUs 20, 30 can each be NM-incompatible ECUs. NM-compatible ECUs have, as described above, communication interfaces that receive NM messages and switch the ECU from sleep to start-up. Therefore, NM-compatible ECUs are more expensive compared to NM-incompatible ECUs. The first and second lower ECUs 20, 30 can, as described above, be NM-incompatible ECUs. Consequently, using the first and second lower ECUs 20, 30 as NM-incompatible ECUs as lower control devices can reduce the overall cost of the vehicle-internal network system 200.

[0032] The vehicle-internal network system 200 according to this embodiment is configured such that it enables the energy / start management ECU 10 to allow the first and second lower ECUs 20 and 30, which are NM-incompatible ECUs, to be part of the sub-network operation according to NM messages. The energy / start management ECU 10 according to this embodiment is described in detail below.

[0033] As in Fig. As shown in Figure 1, the energy / start management ECU 10 comprises a communication interface 11, a start management unit 12, an energy management unit 13, a memory unit 14, an abnormality detection unit 15, a PNC switching unit 16, and a first and second relay circuit 17, 18. The start management unit 12, the energy management unit 13, the abnormality detection unit 15, and the PNC switching unit 16 are functional units implemented within the energy / start management ECU 10 by software and / or hardware. The memory unit 14 can be formed by the data storage of the energy / start management ECU 10.

[0034] The first relay circuit 17 is provided in power supply line 6 to supply power to the first lower ECU 20. In other words, the power line of the first lower ECU 20 is connected to the first power terminal 17a, which is connected to the first relay circuit 17. The second relay circuit 18 is provided in power supply line 6 to supply power to the second lower ECU 30. In other words, the power line of the second lower ECU 30 is connected to the second power terminal 18a, which is connected to the second relay circuit 18.

[0035] The number of relay circuits provided in the energy / start management ECU 10 is not limited to two and can be three or more. Additionally, the number of lower ECUs connected to each relay circuit is not limited to one; it can be two or more. Furthermore, in the vehicle's internal network system 200, the combination of upper and lower ECUs capable of switching the power supply to lower ECUs on and off can be provided in multiple sets, rather than just one.

[0036] The energy circuit 4 can convert the energy voltage of the vehicle's battery 2 into the operating voltage of the energy / start management ECU 10, the first and second upper ECUs 40 and 80, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100, as required. The power supply line 6 for the energy / start management ECU 10, the first and second upper ECUs 40 and 80, and the first through seventh lower ECUs 20, 30, 50, 60, 70, 90, and 100 is supplied with voltage by the energy circuit 4.

[0037] The first and second relay circuits 17, 18 can be formed by semiconductor switches such as MOSFETs or IGBTs. However, the first and second relay circuits 17, 18 can also be formed by conventional mechanical relays instead of semiconductor switches. Additionally, the first and second relay circuits 17, 18 can be configured as shown in Fig. 1 shown, provided within the power / start management ECU 10 or outside the power / start management ECU 10.

[0038] The power / start management ECU 10 is an NM-compatible ECU capable of receiving NM messages. The first and second lower ECUs 20, 30 can be NM-incompatible ECUs, as described above. In this embodiment, the first and second lower ECUs 20, 30 enter a powered-off state in power-saving mode when operation is not required. Therefore, the first and second lower ECUs 20, 30 cannot receive NM messages while in power-saving mode. Consequently, the communication interface 11 of the power / start management ECU 10 receives NM messages on behalf of the first and second lower ECUs 20, 30, selectively instructing the start of the first and second lower ECUs 20, 30. The NM messages received by the communication interface 11 are provided to the start management unit 12.

[0039] Here, in addition to programs executed by the processor of the power / start management ECU 10, memory unit 14 of the power / start management ECU 10 stores PNC configuration information specifying the clusters to which the first and second lower ECUs 20 and 30 each belong. Each of the first and second lower ECUs 20 and 30 is assigned to a cluster. This PNC configuration information includes PNC configuration information for normal operation and PNC configuration information for abnormal occurrences. Furthermore, memory unit 14 stores relay connection information specifying the correspondence between the first and second relay circuits 17 and 18 and the first and second lower ECUs 20 and 30. For example, memory unit 14 can use a PNC configuration table, as shown in Fig. Figure 3 shows how to store PNC configuration information that specifies the clusters assigned to the first and second lower ECUs 20 and 30, respectively. The information in Fig. Figure 3 illustrates the PNC configuration table as an example of the correspondence between the node ID, which is a unique identifier for multiple lower ECUs, including the first and second lower ECUs 20 and 30, and the PNC configuration information assigned to these multiple lower ECUs. Additionally, memory unit 14 stores relay connection information, as shown in Fig. Figure 4 illustrates the correspondence between the numbers or power connection numbers of several relay circuits, including the first and second relay circuit 17, 18, and the node ID, which specifies the unique identifiers of several lower ECUs, including the first and second lower ECU 20, 30.

[0040] The start management unit 12 of the power / start management ECU 10 can retrieve the PNC configuration information for the first and second lower ECUs 20 and 30, respectively, by referencing the information in Fig. The Start Management Unit 12 obtains the PNC configuration table shown in Figure 3. Then, based on the obtained PNC configuration information for the first and second lower ECUs 20 and 30 and the PN request information from the NM message, it can determine which of the lower ECUs 20 and 30 were instructed to activate by the NM message. Specifically, the Start Management Unit 12 compares the PN request information from the NM message bit by bit with the PNC configuration information for each of the first and second lower ECUs 20 and 30. If, based on the comparison, the Start Management Unit 12 determines that PNC configuration information exists that covers the cluster requested to activate by the PN request information, it determines that the lower ECUs 20 and 30 corresponding to this PNC configuration information have been instructed to start.In this case, the start management unit 12 provides the energy management unit 13 with the node ID that specifies the lower ECUs 20 and 30, which are instructed to activate by the NM message. However, if the start management unit 12 determines that there is no PNC configuration information encompassing the cluster requested to activate by the PN request information, the received NM message will not instruct any lower ECUs 20 and 30 to start, and the NM message will be discarded.

[0041] After receiving the node IDs of the lower ECUs 20 and 30, which are instructed to be activated by the start management unit 12, the energy management unit 13 of the energy / start management ECU 10 refers to the relay connection information stored in the memory unit 14, which specifies the correspondence between each relay circuit 17 and 18 and each lower ECU 20 and 30. The energy management unit 13 then identifies the relay circuits 17 and 18 that correspond to the node IDs of the lower ECUs 20 and 30 that are instructed to be activated and outputs a control signal to turn on the identified relay circuits 17 and 18. As a result, energy is supplied via the relay circuits 17, 18, which correspond to the lower ECUs 20, 30, which are instructed to be activated, and the corresponding lower ECUs 20, 30 enter the start state.

[0042] The first and second lower ECUs 20 and 30 control control devices installed in the vehicle that are only activated when specific conditions are met or under specific environments (e.g., door locking mechanisms, power window motors, headlights, wiper motors, AV equipment, etc.), or calculate predetermined physical quantities necessary for their control based on sensor signals. For example, the door locking mechanism is controlled by the door locking control ECU when the vehicle occupant attempts to enter or exit the vehicle. The power window motor is controlled by the power window control ECU when the window switch is operated by the user.

[0043] Thus, the first and second lower ECUs 20 and 30 control target devices that only operate when specific conditions are met or under specific environments, calculating predetermined physical quantities necessary for their control. Therefore, when the NM message instructs the first and second lower ECUs 20 and 30 to start, the power / start management ECU 10 activates the first and second relay circuits 17 and 18 corresponding to the first and second lower ECUs 20 and 30 to supply them with power. Conversely, when the NM message does not instruct the first and second lower ECUs 20 and 30 to start, the power / start management ECU 10 deactivates the first and second relay circuits 17 and 18 to stop the power supply to the first and second lower ECUs 20 and 30.This allows the dark current to be switched off when the operation of each lower ECU 20, 30 is not necessary, thereby enabling further energy savings for the entire in-vehicle system.

[0044] The NM message can be generated by the Power / Start Management ECU 10, the First Upper ECU 40, and / or the Second Upper ECU 80 as a function of a domain controller or area controller. In this case, the Power / Start Management ECU 10, the First Upper ECU 40, and / or the Second Upper ECU 80 determine the functions to be performed in the vehicle based on signals from various sensors and switches. If it is determined that the execution of a desired function is necessary, the Power / Start Management ECU 10, the First Upper ECU 40, and / or the Second Upper ECU 80 further determine the cluster to which the ECUs belong that must be activated simultaneously to perform the relevant function and generate an NM message containing the PN request information that determines the start cluster.The generated NM message is transmitted via communication buses 19a, 19b, 19c, 43a, 43b, 82a, 82b to the first to seventh lower ECUs 20, 30, 50, 60, 70, 90, 100, etc. Furthermore, when generated by the power / start management ECU 10, the NM message is also used to determine whether the lower ECUs 20, 30 of the power / start management ECU 10 itself should be switched to the start state. However, the function of determining the functions to be performed in the vehicle and of transmitting NM messages containing the PN request information can be taken over by other ECUs, such as the first to seventh lower ECUs 20, 30, 50, 60, 70, 90, 100, in addition to or instead of the power / start management ECU 10 and the first and second upper ECUs 40, 80.

[0045] Additionally, the energy / start management ECU 10, the first upper ECU 40 and / or the second upper ECU 80 can enter a sleep state when all ECUs belonging to the vehicle's internal network system 200 enter sleep or off mode and the time during which no NM messages are received reaches a predetermined duration.

[0046] Furthermore, each ECU belonging to the vehicle's internal network system 200, such as the power / start management ECU 10 or the first and second upper ECUs 40, 80, can implement a PNC configuration information change unit 42 to change the PNC configuration information assigned to each lower ECU 20, 30, 50, 60, 70, 90, 100. Fig. Figure 1 shows an example where the PNC configuration information change unit 42 is implemented in the first upper ECU 40.

[0047] The first upper ECU 40, equipped with the PNC configuration information change unit 42, has an external communication device capable of wireless communication with external servers, such as data centers. The first upper ECU 40 is configured to download application programs for implementing new functions in the vehicle or update programs for updating the version of programs already implemented in an ECU 10, 20, 30, 40, 50, 60, 70, 80, 90, or 100 via the external communication device. The downloaded programs are made available to the relevant ECUs 10, 20, 30, 40, 50, 60, 70, 80, 90, 100 via communication buses 19a, 19b, 19c, 43a, 43b, 82a, 82b and the installation of new application programs or the rewriting to update programs is carried out.The ECU that communicates with the data center via the external communication device and the ECU that implements the PNC configuration information change unit 42 can be separate ECUs.

[0048] For ECUs 10, 20, 30, 40, 50, 60, 70, 80, 90, and 100 with newly implemented application programs or update programs, it may be necessary to add or modify the startup conditions of the relevant ECUs, depending on the functions of the application programs or update programs. Therefore, if it is necessary to add or modify the startup conditions of an ECU with an implemented application program or update program, the data center downloads new PNC configuration information corresponding to the addition or modification of startup conditions, along with the application program or update program, to the first upper ECU 40.

[0049] When the PNC Configuration Information Change Unit 42 receives new PNC configuration information from the data center, it modifies (rewrites) the PNC configuration information contained in ECUs 10, 20, 30, 40, 50, 60, 70, 80, 90, and 100 with implemented application programs or update programs to the new PNC configuration information. As a result, ECUs 10, 20, 30, 40, 50, 60, 70, 80, 90, and 100 with implemented application programs or update programs are switched from sleep to startup state according to the cluster specified by the modified PNC configuration information. The rewriting of PNC configuration information can be performed by the relevant ECU upon receipt of a rewrite instruction along with the new PNC configuration information from the PNC configuration information change unit 42.Alternatively, the rewriting of PNC configuration information can be performed by the PNC configuration information change unit 42, which accesses the working memory of the relevant ECU.

[0050] The PNC configuration information change unit 42 can be located outside the vehicle's internal network system 200, such as in a data center, instead of in an ECU belonging to the vehicle's internal network system 200. However, if the PNC configuration information change unit 42 is implemented in an ECU belonging to the vehicle's internal network system 200, communication with the external environment can be terminated as soon as the data to change the ECU's PNC configuration information is obtained from the external environment. Conversely, if the PNC configuration information change unit 42 is located on an external server of the vehicle's internal network system 200, the ECU requesting a change to the PNC configuration information must communicate individually with the external server via an ECU equipped with an external communication device.This can lead to the disadvantage of increased communication volume with the external server.

[0051] If an abnormality occurs in the first upper ECU 40, in which the PNC configuration information change unit 42, corresponding to the management control device of this disclosure, is implemented, or if an abnormality occurs in communication with the first upper ECU 40, the first upper ECU 40 may not be able to properly change the PNC configuration information of each lower ECU. As a result, a situation may arise where, for example, at least one ECU could be activated at an unintended time in response to an NM message, leading to unnecessary energy consumption and improper control of the ECU startup.

[0052] Therefore, in the vehicle's internal network system 200 according to this embodiment, the energy / start management ECU 10 is equipped with an abnormality detection unit 15 to detect abnormalities in the first upper ECU 40 and / or abnormalities in communication with the first upper ECU 40. If the abnormality detection unit 15 detects abnormalities in the first upper ECU 40 and / or abnormalities in communication with the first upper ECU 40, a PNC switching unit 16 is also provided to switch the PNC configuration information of at least the first and second lower ECUs 20, 30 from PNC configuration information for normal operation to PNC configuration information for abnormal occurrence. The abnormality detection unit 15 and the PNC switching unit 16 are described in detail below.

[0053] The power / start management ECU 10 is configured to communicate periodically with the first upper ECU 40 via communication bus 19a. If this periodic communication is interrupted for more than a predetermined time, the abnormality detection unit 15 of the power / start management ECU 10 can detect that an abnormality has occurred in communication with the first upper ECU 40. Since a communication interruption also occurs in the first upper ECU 40, it can detect at that time that the abnormality occurred in communication with the power / start management ECU 10.

[0054] Additionally, if the power / start management ECU 10 and the first upper ECU 40 are communicating via CAN, the abnormality detection unit 15 can detect an abnormality in communication with the first upper ECU 40 if abnormalities, such as bit errors, format errors, ACK errors, CRC errors, and stuff errors, are detected in the communication frame (communication data) due to communication errors. The method for detecting communication errors can vary depending on the communication standard and communication method. It may be preferred that the power / start management ECU 10 notifies the first upper ECU 40 about the detection of abnormalities in communication data. This allows the first upper ECU 40 to also detect that an abnormality has occurred in communication with the power / start management ECU 10.

[0055] Furthermore, the energy / start management ECU 10 can have a function to monitor whether the first upper ECU 40 is operating normally, based on control-related data values ​​received from the first upper ECU 40. For example, the energy / start management ECU 10 can receive control command values ​​issued by the first upper ECU 40 to the third to fifth lower ECUs 50, 60, 70, sensor acquisition values ​​calculated by the first upper ECU 40 as the basis for calculating control command values, and / or self-diagnostic results from the first upper ECU 40 as control-related data values.

[0056] The abnormality detection unit 15 of the energy / start management ECU 10 can determine whether the first upper ECU 40 is normal based on whether each data value falls within a predetermined range that can be considered normal when control command values ​​and / or sensor acquisition values ​​are received as control-related data values. In other words, the abnormality detection unit 15 can detect an abnormality in the first upper ECU 40 if the received data values ​​deviate from the predetermined range. Additionally, if self-diagnostic results from the first upper ECU 40 are received as control-related data values, and the self-diagnostic results indicate that some abnormality has occurred in the first upper ECU 40, the abnormality detection unit 15 can detect an abnormality in the first upper ECU 40.The self-diagnostic results of the first upper ECU 40 are included in the data values ​​that affect the control, since the self-diagnostic results of the first upper ECU 40 affect the control of the first upper ECU 40 and other ECUs.

[0057] The above describes an example where the abnormality detection unit 15 of the power / start management ECU 10 detects abnormalities in the first upper ECU 40 and communication abnormalities with the first upper ECU 40. The abnormality detection unit for detecting abnormalities in the first upper ECU 40 and the abnormality detection unit for detecting communication abnormalities with the first upper ECU 40 can be provided in separate ECUs. For example, an abnormality detection unit for detecting communication abnormalities with the first upper ECU 40 can be provided in the power / start management ECU 10, and an abnormality detection unit for detecting abnormalities in the first upper ECU 40 can be provided in the third through fifth lower ECUs 50, 60, and 70, which are lower ECUs of the first upper ECU 40.While the example describes the abnormality detection unit 15, which is provided in the power / start management ECU 10, it can also be provided in an ECU other than the power / start management ECU 10. Furthermore, the abnormality detection unit 15 can be provided in multiple ECUs that include the power / start management ECU 10.

[0058] If the abnormality detection unit 15 detects abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40, the PNC switching unit 16 of the power / start management ECU 10 switches the PNC configuration information of at least the first and second lower ECUs 20, 30 from the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence. If PNC configuration information is also defined for the power / start management ECU 10, the PNC switching unit 16 can also switch the PNC configuration information of the power / start management ECU 10 to the PNC configuration information for abnormal occurrence.

[0059] To enable this switching, the memory unit 14 stores both the PNC configuration information for normal operation and the PNC configuration information for abnormal occurrence for at least each lower ECU 20, 30. If no abnormalities are detected in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40, the PNC configuration information for normal operation is used as the PNC configuration information for each lower ECU 20, 30. However, if abnormalities are detected in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40, as described above, the PNC switching unit 16 switches the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence.As a result, the power / start management ECU 10 can perform the switching between the start and off states of at least the lower ECUs 20 and 30 based on NM messages according to the PNC configuration information for abnormal occurrences. The power / start management ECU 10 can receive NM messages from the second upper ECU 80, the first or second lower ECU 20 or 30, and the sixth or seventh lower ECU 90 or 100, even if abnormalities occur in the first upper ECU 40 and / or communication abnormalities occur with the first upper ECU 40.

[0060] In the PNC configuration information for abnormal occurrence, clusters containing lower ECUs involved in vehicle operation and occupant safety control are set to be enabled. This ensures that even if abnormalities occur in the first upper ECU 40 and / or communication abnormalities with it, vehicle operation and occupant safety can be maintained. Therefore, the driver can, for example, safely drive the vehicle to a safe location or the nearest repair shop. Lower ECUs involved in vehicle operation control include, for example, ECUs involved in powertrain (internal combustion engine or electric motor) control, steering control, brake control, headlight control, and so on.Lower ECUs that perform control related to occupant safety include ECUs involved in performing airbag control, Advanced Driver Assistance Systems (ADAS) control, emergency call system control, etc.

[0061] However, in the PNC configuration information for abnormal occurrences, clusters containing lower ECUs that do not perform any control related to vehicle operation and occupant safety are set to be inactive. For example, lower ECUs that do not perform any control related to vehicle operation and occupant safety include ECUs involved in navigation control, audio control, interior lighting control, seat control, etc. By setting lower ECUs that do not perform any control related to vehicle operation and occupant safety to inactive, energy savings can be achieved and a sufficient evacuation driving distance can be ensured.It is not necessary to disable all clusters containing lower-level ECUs that do not control vehicle operation and occupant safety in the PNC configuration information for abnormal occurrences. For example, it may be sufficient to disable at least one cluster containing lower-level ECUs that do not control vehicle operation and occupant safety.

[0062] The PNC switching unit 16, like the abnormality detection unit 15, can be provided in multiple ECUs (upper and lower ECUs) that contain PNC configuration information. The ECU (e.g., the power / start management ECU 10) that first detects abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40 preferentially transmits information to other multiple ECUs containing PNC configuration information, switching the PNC configuration information from normal operation to abnormal occurrence. Upon receiving this information, each PNC switching unit 16 in the multiple ECUs containing PNC configuration information preferably switches the PNC configuration information from normal operation to abnormal occurrence.This allows ECUs in the entire vehicle that are involved in controlling vehicle driving and occupant safety to be set as activatable, and ECUs that are not involved in controlling vehicle driving and occupant safety to be set as non-activatable.

[0063] The transmission of information for switching from the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence may include notification that the ECU detecting abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40 has switched to the PNC configuration information for abnormal occurrence. Additionally, the transmission of information for switching from the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence may include the ECU detecting abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40 sending a switch instruction to the PNC configuration information for abnormal occurrence to multiple other ECUs.Furthermore, if the first upper ECU 40 detects that an abnormality has occurred in communication with at least one ECU, the first upper ECU 40 can also transmit information to switch the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence to several other ECUs that contain PNC configuration information.

[0064] Thus, in the vehicle's internal network system 200 according to this embodiment, when an abnormality occurs in the first upper ECU 40 or communication abnormalities occur with the first upper ECU 40, at least one ECU that detects the abnormality switches the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence. This activates at least one ECU according to the PNC configuration information for abnormal occurrence. This enables appropriate control of the startup of at least one ECU that detects abnormalities, even if abnormalities occur in the first upper ECU 40 or communication abnormalities occur with the first upper ECU 40.

[0065] Next, an example of the processing performed by the power / start management ECU 10 and the first and second lower ECUs 20, 30 will be shown, with reference to the flowcharts in Fig. 5 and Fig. 6 described. If the abnormality detection unit 15 and the PNC switching unit 16 are also provided in other ECUs, similar processing is performed, except for the control to switch the relay circuits on and off.

[0066] In step S100, the power / start management ECU 10 determines whether any abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40 have been detected. If it is determined that abnormalities have been detected, the power / start management ECU 10 proceeds to step S110. If, however, it is determined that no abnormalities have been detected, the power / start management ECU 10 proceeds to step S130.

[0067] In step S110, the power / start management ECU 10 switches the PNC configuration information of at least the first and second lower ECUs 20, 30 from the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence. In step S120, the power / start management ECU 10 then transmits information to switch the PNC configuration information from normal operation to abnormal occurrence to several other ECUs that contain PNC configuration information.

[0068] In step S130, the power / start management ECU 10 receives or generates an NM message. In step S140, the power / start management ECU 10 performs the start ECU identification process to identify the lower ECUs 20 and 30 that are instructed to activate by the NM message. The details of this start ECU identification process are shown in the flowchart of Fig. 6 shown. The following describes the start ECU identification process with reference to the flowchart in Fig. 6 described.

[0069] In step S300, the power / start management ECU 10 identifies the cluster that is requested to be activated based on the PN request information from the NM message. In step S310, the power / start management ECU 10 reads the PNC configuration information of several lower ECUs 20 and 30 from memory unit 14. If, at this point, the PNC configuration information has switched from normal operation to abnormal occurrence, the power / start management ECU 10 reads the abnormal occurrence PNC configuration information from memory unit 14. Then, in step S320, the power / start management ECU 10 identifies the PNC configuration information containing the cluster that matches the cluster requested to be activated by the PN request information (start request cluster).

[0070] In step S330, the power / start management ECU 10 determines whether, in step S320, at least one PNC configuration information was identified among the PNC configuration information of several lower ECUs 20 and 30 as a PNC configuration information containing a cluster that matches the start request cluster. If at least one PNC configuration information was identified, the power / start management ECU 10 proceeds to step S340. Conversely, if no PNC configuration information was identified, the power / start management ECU 10 proceeds to step S350.

[0071] In step S340, the power / start management ECU 10 configures the lower ECUs 20 and 30 as start ECUs according to the identified PNC configuration information and configures the other lower ECUs 20 and 30 as non-start ECUs. Conversely, in step S350, the power / start management ECU 10 configures all lower ECUs 20 and 30 as non-start ECUs. Afterward, the power / start management ECU 10 returns to the state shown in the flowchart of Fig. Return to the processing shown in section 5.

[0072] In step S150 of the flowchart in Fig. Step 5 determines whether there are any lower ECUs 20 or 30 configured as start ECUs. If there are lower ECUs 20 or 30 configured as start ECUs, the energy / start management ECU 10 proceeds to step S160. Conversely, if there are no lower ECUs 20 or 30 configured as start ECUs, the energy / start management ECU 10 terminates the process described in the flowchart. Fig. Processing shown in step 5. In this case, the NM message is discarded.

[0073] In step S160, the power / start management ECU 10 activates relay circuits 17 and 18 connected to lower ECUs 20 and 30, which are configured as start ECUs, based on the relay connection information stored in memory unit 14. This information specifies the correspondence between each relay circuit 17 and 18 and each lower ECU 20 and 30. Additionally, the power / start management ECU 10 deactivates relay circuits 17 and 18 connected to lower ECUs 20 and 30, which are configured as non-start ECUs.

[0074] As in step S200 of the flowchart in Fig. As shown in Figure 5, the power supply for the lower ECUs 20 and 30 is initiated with relay circuits 17 and 18 switched on. Consequently, in step S210, the lower ECUs 20 and 30, with relay circuits 17 and 18 switched on, undergo a predetermined starting process and enter the starting state.

[0075] As described above, the energy / start management ECU 10, according to the vehicle's internal network system 200 of this embodiment, receives NM messages on behalf of several lower ECUs 20, 30, which selectively instruct the start of several lower ECUs 20, 30 via the communication bus. The energy / start management ECU 10 then activates the relay circuits 17, 18, which are connected to the lower ECUs 20, 30 instructed to activate by the NM message. As a result, the lower ECUs 20, 30 instructed to activate enter the start state. Therefore, according to the vehicle's internal network system 200 of this embodiment, it is possible to precisely manage the power supply and stopping of the lower ECUs 20, 30 while the system is being configured to switch the power supply of the lower ECUs 20, 30 from the stopped state to the supply state in response to NM messages instructing the start. (Second embodiment)

[0076] The second embodiment of the in-vehicle network system and the control method for the in-vehicle network system according to the present disclosure are described. The in-vehicle network system according to this embodiment is configured similarly to the in-vehicle network system 200 of the first embodiment. Therefore, the description of the configuration is omitted.

[0077] Fig. Figure 7 is a flowchart that illustrates an example of the processing performed by the power / start management ECU 10 according to this embodiment. In the flowchart of Fig. These 7 steps involve the same processing as in Fig. Execute the 5 flowcharts shown, assigning the same step numbers and omitting their descriptions.

[0078] As shown in the flowchart of Fig. As shown in Figure 7, according to this embodiment, in step S120, the power / start management ECU 10 transmits information to other ECUs containing PNC configuration information to switch the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence. Subsequently, in step S122, the power / start management ECU 10 stops the abnormality determination based on communication interruption with other ECUs for a predetermined period.

[0079] As described above, each lower ECU (20, 30, 50, 60, 70, 90, 100) switches to normal operating mode (i.e., a startup state) when it becomes active and periodically transmits NM messages to other ECUs while performing its normal operation. Furthermore, the power / start management ECU (10), along with the first and second upper ECUs (40, 80), also periodically transmit NM messages as long as control must continue. Therefore, if communication is interrupted for a predetermined time or longer between each ECU (10, 20, 30, 40, 50, 60, 70, 80, 90, 100) and the ECUs with which periodic NM message transmission and reception should occur, it can be determined that some kind of abnormality, involving a communication abnormality, has occurred in the relevant ECU.

[0080] However, the switching of PNC configuration information for the lower ECUs 20 and 30 in the power / start management ECU 10 and the switching of PNC configuration information in several other ECUs based on information about switching from normal operation to abnormal occurrence do not necessarily occur simultaneously. Therefore, due to the time difference during the switchover, the clusters that should become active according to the PNC configuration information may differ among several ECUs. Consequently, if an abnormality determination based on communication interruptions between ECUs is performed, there is a possibility of an incorrect abnormality determination.

[0081] Therefore, in this embodiment, the processing in step S122 stops the abnormality determination based on communication interruption with other ECUs for a predetermined period, which corresponds to the duration required to complete the switching of PNC configuration information in multiple ECUs, including the power / start management ECU 10. This prevents an incorrect abnormality determination based on communication interruption with other ECUs. (Third embodiment)

[0082] The third embodiment of the in-vehicle network system and the control method for the in-vehicle network system according to the present disclosure are described. The in-vehicle network system according to this embodiment is configured similarly to the in-vehicle network system 200 of the first embodiment. Therefore, the description of the configuration is omitted.

[0083] Fig. Figure 8 is a flowchart that illustrates an example of the processing performed by the power / start management ECU 10 according to this embodiment. In the flowchart of Fig. There are 8 steps that involve the same processing as in Fig. Execute the 5 flowcharts shown, assigning the same step numbers and omitting their descriptions.

[0084] As shown in the flowchart of Fig. As shown in Figure 8, according to this embodiment, the energy / start management ECU 10 determines in step S124 whether the remaining capacity of battery 2 has fallen below a predetermined value. If this determination process shows that the remaining capacity of battery 2 has fallen below the predetermined value, the energy / start management ECU 10 proceeds to step S126.

[0085] In step S126, the power / start management ECU 10 modifies the PNC abnormal occurrence configuration information to reduce the number of clusters designated as activatable. By changing the number of clusters activated by the PNC abnormal occurrence configuration information according to the remaining capacity of battery 2, it becomes easier to secure power for evacuation maneuvers.

[0086] In this embodiment, the memory unit 14 stores several types of PNC configuration information as PNC configuration information for abnormal occurrence, with different numbers of clusters designated as activatable. The PNC configuration information for abnormal occurrence is prepared in multiple versions. For example, the multiple types of PNC configuration information may differ in the number of clusters designated as non-activatable among clusters that do not include ECUs involved in executing control related to vehicle driving and occupant safety. Furthermore, the multiple types of PNC configuration information may differ, for example, in the number of clusters designated as non-activatable among clusters that do not include ECUs involved in executing control related to vehicle driving and occupant safety.

[0087] For example, it shows Fig. 9 is an example where the number of clusters that are set as non-activatable among clusters to which ECUs belong that are involved in executing controls relating to vehicle driving and occupant safety is varied according to the remaining capacity of battery 2. Specifically, in the Fig. In example 9, the PNC configuration information for the case where the remaining capacity of battery 2 is relatively high, both clusters belonging to ECUs that perform control functions related to vehicle driving (driving, stopping, turning) and clusters belonging to ECUs that perform control functions related to occupant safety are set to be activatable. Conversely, in the PNC configuration information for the case where the remaining capacity of battery 2 is relatively low, clusters belonging to ECUs that perform control functions related to vehicle driving are set to be activatable, but clusters belonging to ECUs that perform control functions related to occupant safety are set to be inactivated.

[0088] Instead of or in addition to the remaining capacity of battery 2, the PNC configuration information for abnormal occurrence can be switched so that the number of clusters set as activatable is reduced according to the time elapsed since the detection of an abnormality exceeding a predetermined time, and / or the distance traveled since the detection of an abnormality exceeding a predetermined distance. Furthermore, by setting multiple thresholds for the remaining capacity of battery 2, the elapsed time, and / or the distance traveled, the switching of the PNC configuration information for abnormal occurrence can be performed multiple times, not just once. (Fourth embodiment)

[0089] The fourth embodiment of the vehicle-integrated network system and the control method for the vehicle-integrated network system according to the present disclosure are described. The vehicle-integrated network system according to this embodiment is configured similarly to the vehicle-integrated network system 200 of the first embodiment. Therefore, the description of the configuration is omitted.

[0090] Fig. Figure 10 is a flowchart that illustrates an example of the processing performed by the power / start management ECU 10 according to this embodiment. The flowchart of Fig. There are 10 steps that involve the same processing as in Fig. Execute the 5 flowcharts shown, assigning the same step numbers and omitting their descriptions.

[0091] As shown in the flowchart of Fig. As shown in Figure 10, if the Energy / Start Management ECU 10 determines in step S100 that abnormalities in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40 have been detected, it performs the processing in step S102. In step S102, the Energy / Start Management ECU 10 obtains environmental information such as time, weather, and / or outside temperature at the time the abnormality occurred. In step S112, the Energy / Start Management ECU 10 then switches the PNC configuration information of each lower ECU 20, 30 from the PNC configuration information for normal operation to the PNC configuration information for abnormal occurrence. The switched PNC configuration information for abnormal occurrence is selected according to the environmental information obtained in step S102.

[0092] In this embodiment, the memory unit 14 stores several types of PNC configuration information as abnormal occurrence PNC configuration information, which are set to correspond to the vehicle's environment at different times. For example, the several types of PNC configuration information may include PNC configuration information suitable for daytime conditions and PNC configuration information suitable for nighttime conditions, which differ in whether clusters to which ECUs pertaining to lighting control, such as headlights, belong are activated. Additionally, the several types of PNC configuration information may include PNC configuration information for clear weather and PNC configuration information for rainy weather, which differ in whether clusters to which ECUs pertaining to windshield wiper control belong are activated.Furthermore, the multiple types of PNC configuration information can include PNC configuration information for low and high temperatures and PNC configuration information for normal temperatures, which differ in whether clusters belonging to ECUs that concern an air conditioning system, which performs climate control for the vehicle interior, or a control for a device that performs temperature control for the traction battery are activated.

[0093] According to this embodiment, it becomes possible to use the PNC configuration information suitable for the vehicle's environment at the time of the abnormal occurrence as the PNC configuration information for abnormal occurrence.

[0094] This embodiment can be implemented in combination with the embodiments mentioned above. For example, when combined with the third embodiment, several types of PNC configuration information suitable for the vehicle's environment at the time of the abnormal occurrence can be defined, with varying numbers of clusters that can be activated according to the remaining battery capacity, the elapsed time, and / or the distance traveled. (Fifth embodiment)

[0095] The fifth embodiment of the in-vehicle network system and the control method for the in-vehicle network system according to the present disclosure are described. The in-vehicle network system according to this embodiment is configured similarly to the in-vehicle network system 200 of the first embodiment. Therefore, the description of the configuration is omitted.

[0096] Fig. Figure 11 is a flowchart illustrating an example of the processing performed by the power / start management ECU 10 according to this embodiment. The flowchart of Fig. 11 are steps that use the same processing as in Fig. Execute the 5 flowcharts shown, assigning the same step numbers and omitting their descriptions.

[0097] As shown in the flowchart of Fig.As shown in Figure 11, according to this embodiment, in step S128, the power / start management ECU 10 switches the first and second relay circuits 17, 18 on and off according to the abnormal occurrence PNC configuration information switched in step S110. In other words, the power / start management ECU 10 switches on the relay circuits of lower ECUs belonging to clusters that indicate start and switches off the relay circuits of lower ECUs belonging to clusters that do not indicate start, regardless of whether NM messages are received, based on the switched abnormal occurrence PNC configuration information.

[0098] According to this embodiment, if abnormalities occur in the first upper ECU 40 and / or communication abnormalities with the first upper ECU 40, it is possible to reliably activate at least the lower ECUs that are responsible for performing control with regard to vehicle driving and occupant safety.

[0099] In this embodiment, even if NM messages are received by the power / start management ECU 10, the control for switching the relay circuits 17, 18 on and off based on NM messages is not executed. The received NM messages are discarded. Additionally, this embodiment describes an example of switching the first and second relay circuits 17, 18 on and off according to the switched PNC configuration information for abnormal occurrence. Instead of using the PNC configuration information for abnormal occurrence, the relay circuits to be switched on and off can be predetermined by considering the functions of each lower ECU 20, 30, storing the on / off information, and switching the first and second relay circuits 17, 18 on and off based on the stored on / off information.

[0100] The systems and methods described in this disclosure can be implemented by a dedicated computer configured with a processor programmed to execute one or more functions embodied by a computer program. The systems and methods described in this disclosure can be implemented using dedicated hardware logic circuits. The systems and methods described in this disclosure can be implemented by one or more dedicated computers configured with a combination of a processor executing a computer program and one or more hardware logic circuits. For example, some or all of the functions provided by the power / start management ECU 10 can be implemented as hardware.The method of implementing certain functions as hardware can involve, among other approaches, the use of one or more integrated circuits (ICs). Some or all of the functions provided by the Power / Start Management ECU 10 can be implemented using a system-on-a-chip (SoC), an integrated circuit (IC), or a field-programmable gate array (FPGA). The IC concept encompasses an application-specific integrated circuit (ASIC). Additionally, the computer program, as instructions executable by a computer, can be stored on a non-volatile, tangible storage medium. Possible storage media for the program include hard disk drives (HDDs), solid-state drives (SSDs), flash memory, etc.Furthermore, the form of a program to make a computer function as the power / start management ECU 10, and non-volatile tangible storage media, such as semiconductor memory, that store this program, are also within the scope of this disclosure.

Claims

[1] In-vehicle network system, which includes: a large number of control devices (10, 20, 30, 40, 50, 60, 70, 80, 90, 100) connected to a communication bus and configured to communicate with each other in a vehicle, where The multitude of control devices includes a multitude of start target control devices (10, 20, 30, 50, 60, 70, 80, 90, 100), each of which stores cluster configuration information specifying a cluster to which it belongs within a multitude of partitioned clusters, and when a network management message transmitted by another control device includes start cluster information specifying a cluster to activate that matches the cluster in the cluster configuration information, each start target control device enters or maintains a start state. the plurality of control devices further includes a management control device (40) which is configured to modify the cluster configuration information of the plurality of start control target control devices, the multitude of start control target control devices has cluster configuration information for normal operation and cluster configuration information for abnormal occurrence as the cluster configuration information, and at least one of the start control target control devices that detects the occurrence of an abnormality in the management control device or an abnormality in communication with the management control device switches the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence. [2] In-vehicle network system according to claim 1, wherein in the cluster configuration information for abnormal occurrence a cluster can be activated to which a control device belongs which relates to the execution of a control with regard to vehicle driving and occupant safety. [3] In-vehicle network system according to claim 2, wherein in the cluster configuration information for abnormal occurrence a cluster to which a control device which relates to the execution of a control with regard to vehicle driving and occupant safety does not belong is specified as not activatable. [4] In-vehicle network system according to one of claims 1 to 3, wherein at least one of the start-destination control devices communicates periodically with the management control device, and at least one of the start-destination control devices detects an abnormality in communication with the management control device when periodic communication is interrupted for a predetermined time or longer, and / or when an abnormality is detected in a received communication file. [5] In-vehicle network system according to any one of claims 1 to 4, wherein at least one of the start-destination control devices receives a data value relating to the control from the management control device, and that at least one of the start control target control devices detects an abnormality in the management control device based on the received data value. [6] In-vehicle network system according to any one of claims 1 to 5, wherein the at least one of the start-destination control devices, which has detected an occurrence of an abnormality in the management control device or an abnormality in communication with the management control device, and / or the management control device transmits information to another start-destination control device in order to switch the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence. [7] In-vehicle network system according to claim 6, wherein when the cluster configuration information is switched based on the transmitted information, the plurality of start-control-target control devices subject an abnormality determination based on communication interruption with another start-control-target control device. [8] In-vehicle network system according to any one of claims 1 to 7, wherein The cluster configuration information is prepared for abnormal occurrence in multiple versions, and The start control target control devices switch the cluster configuration information for abnormal occurrence in order to decrease the number of clusters set as activatable according to (i) a time elapsed since the occurrence of the abnormality, (ii) a distance traveled since the occurrence of the abnormality and / or (iii) a decrease in the residual power of a battery that stores energy to drive the vehicle. [9] In-vehicle network system according to any one of claims 1 to 8, wherein The cluster configuration information is prepared for abnormal occurrence in multiple versions, and The start control target control devices select an abnormal occurrence cluster configuration information to use from a variety of abnormal occurrence cluster configuration information based on (i) time information, (ii) weather information and / or (iii) outside temperature information at a time when the abnormality occurs. [10] In-vehicle network system according to any one of claims 1 to 9, wherein the plurality of start control target control devices includes a combination of an upper control device (10) configured to switch a power supply to at least one lower control device (20, 30) using at least one relay circuit, and the lower control device The upper control device includes a storage unit (14) configured to store cluster configuration information specifying a cluster to which the lower control device belongs, and the upper control device receives the network management message on behalf of the lower control device, and If the cluster to be activated, specified by the startup cluster information in the network management message, matches the cluster in the cluster configuration information of the lower control device, the upper control device turns on the relay circuit to power the lower control device and put the lower control device into a startup state. [11] Vehicle-internal network system according to claim 10, wherein The storage unit stores cluster configuration information for normal operation and cluster configuration information for abnormal occurrences, as does the lower control device's cluster configuration information. The upper control device switches the cluster configuration information of the lower control device from the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence when an occurrence of an abnormality in the management control device or an abnormality in communication with the management control device is detected. [12] In-vehicle network system according to claim 10 or 11, wherein a variety of lower control devices are provided, a large number of relay circuits are provided according to the large number of lower control devices, and The storage unit stores relay connection information, which specifies a correspondence between the multitude of lower control devices and the multitude of relay circuits, in addition to the cluster configuration information of each of the multitude of lower control devices. [13] In-vehicle network system according to claim 12, wherein the upper control device switches on a relay circuit corresponding to the lower control device whose cluster configuration information matches a start cluster specified by the start cluster information contained in the network management message, based on the cluster configuration information and the relay connection information, and switches off a relay circuit corresponding to the lower control device whose cluster configuration information does not match. [14] In-vehicle network system according to one of claims 10 to 13, wherein, upon detection of an occurrence of an abnormality in the management control device or an abnormality in communication with the management control device, the upper control device switches on a relay circuit of the lower control device which relates to the execution of a control with regard to vehicle driving and occupant safety and switches off a relay circuit of the lower control device which does not relate to the execution of a control with regard to vehicle driving and occupant safety. [15] In-vehicle network system according to claim 14, wherein the upper control device determines, based on the cluster configuration information for abnormal occurrence, whether the lower control device concerns the execution of a control with regard to vehicle driving and occupant safety. [16] Method for controlling an in-vehicle network system comprising a plurality of control devices (10, 20, 30, 40, 50, 60, 70, 80, 90, 100) connected by a communication bus and configured to communicate with each other in a vehicle, wherein the plurality of control devices includes a plurality of start-destination control devices (10, 20, 30, 50, 60, 70, 80, 90, 100), each of which stores cluster configuration information specifying a cluster to which it belongs from a plurality of partitioned clusters, and when a network management message transmitted by another control device includes start cluster information specifying a cluster to be activated that matches the cluster in the cluster configuration information, each start-destination control device enters or maintains a start state,the plurality of control devices further includes a management control device (40) configured to modify the cluster configuration information of the plurality of start-target control devices, the plurality of start-target control devices having cluster configuration information for normal operation and cluster configuration information for abnormal occurrence as the cluster configuration information, the method comprising: by at least one of the start-destination control devices, detection of the occurrence of an abnormality in the management control device or an abnormality in communication with the management control device; and by switching the cluster configuration information for normal operation to the cluster configuration information for abnormal occurrence by at least one of the start control target control devices that has detected the occurrence of the abnormality.

Images