COMMUNICATION SYSTEM, COMMUNICATION DEVICE, FORWARDING DEVICE, COMMUNICATION IC, CONTROL IC AND COMMUNICATION METHOD

Abstract

Communication system in which several communication devices (1, 301, 401, 510) are interconnected via a two-wire bus (10), wherein the communication devices (1, 301, 401, 510) are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via their respective first resistors (R21, R22), each of the communication devices (1, 301, 401, 510) has: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message; and a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential that is greater than the common potential and by connecting the second line (10b) to a second potential that is less than the common potential, at least one communication device (1, 301, 401, 510) has an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), and characterized by the fact that at least two communication devices (1, 301, 401, 510) including at least one communication device (1, 301, 401, 510): a switching control unit (4) for switching, if the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41).

Description

TECHNICAL AREA

[0001] The present invention relates to a communication system, a communication device, a forwarding device, an integrated communication circuit (communication IC), a control IC and a communication method that enable communication via a two-wire bus according to a differential communication scheme. TECHNICAL BACKGROUND

[0002] Vehicles are known to contain multiple communication devices, such as electronic control units (ECUs), which are interconnected via a vehicle-integrated network, such as a CAN bus. The ECUs send and receive messages to and from each other via this network, thereby coordinating their operation to perform various functions, such as controlling the vehicle's driving. Such a vehicle-integrated network carries the risk that, for example, an unauthorized message could be sent to it if an unauthorized device is connected to it.JP 2013 - 098 719 A discloses a communication system in which ECUs each count how often a message of individual CAN-IDs is sent; an ECU that sends a message generates a message authentication code (MAC) based on the data field, CAN-ID and the count value of the message and sends the generated MAC as a MAC message, and an ECU that has received the message compares a generated MAC based on the data field, CAN-ID and count value of the received message with the MAC contained in the MAC message and determines the permissibility or validity of the message.

[0003] JP 2014 - 187 445 A discloses a network monitoring device that monitors a communication state of a communication bus, and if a time period of receiving a monitored message is shorter than a regular reception period, the network monitoring device determines that the communication state of the monitored message is abnormal, and if the time period is longer than the regular reception period, the network monitoring device determines that the communication state of a message that is not the monitored message is abnormal.

[0004] US Patent 2003 / 158983 A1 discloses a method and a device for monitoring a bus system with at least two users, at least one of whom is structured as an authorized user and monitors data transmission on the bus system. For each data transmission on the bus system, an identifier is transmitted, and the identifier is uniquely assignable to a user. The at least one authorized user advantageously compares the identifier with a predefined identifier and, if both identifiers match, initiates measures to prevent the execution of the data to be transmitted if the data transmission is initiated by someone other than the at least one authorized user. These measures include, for example, grounding a bus of the bus system.US Patent 2013 / 0104231 A1 discloses the prevention of spoofing in a motor vehicle network, comprising monitoring data packets on a bus in the motor vehicle network by an electronic control unit (ECU). After determining, in response to the monitoring, that a data packet originates from a source other than the ECU, the prevention of spoofing in the motor vehicle network includes generating and sending a diagnostic message to at least one module in the motor vehicle network via the bus, the diagnostic message instructing the at least one module not to take any action regarding the data packet. A dominant

[0005] Overwriting (dominant override) data fields or causing a network error for each message on the bus with the identifier. DE 11 2014 003 345 T5 discloses an ECU with a function for discarding data if, during data reception, a continuous dominant is received that is equal to or greater than 6 bits. A data exclusion device is connected to a bus to which the ECU is connected. If an ID of data received through the bus matches an ID of an unauthorized ECU detected by a theft sensor, the data exclusion device 5 outputs a continuous 7-bit dominant to bus 3 and then stops outputting the dominant.

[0006] US patent 2015 / 0172298 A1 discloses a network device connected via a bus to a plurality of network devices and comprises: an authentication unit that performs authentication based on message authentication information contained in data transmitted over the bus by one of the plurality of network devices acting as the sending device; and a processing unit that invalidates the data if it is determined that unauthorized data has been transmitted by the sending device, impersonating another network device among the plurality of network devices, should authentication fail.

[0007] German patent application DE 11 2015 006 541 T5 discloses an attack detection device that detects an attack against a communication network between facilities. The attack detection device comprises a CAN (Controller Area Network) that transmits a signal to a multitude of nodes via a differential voltage between two signal lines, and a short-circuit detector that monitors the signal transmitted through the two signal lines of the CAN and detects a short circuit between the two signal lines based on a change in the signal that indicates a characteristic of a short-circuit attack by an unauthorized node. OVERVIEW OF THE INVENTION TASKS TO BE SOLVED BY THE INVENTION

[0008] The inventions disclosed in JP 2013-098719A and JP 2014-187445A are designed to detect when an abnormal message has been sent. However, these inventions have the problem that even if they detect the sending of an abnormal message, they cannot stop the sending of that message. For example, the inventions disclosed in JP 2013-098719A and JP 2014-187445A cannot block an attack by sending a massive number of abnormal messages to disrupt normal message transmission, a type of attack known as a Denial of Service (DoS) attack.

[0009] The present invention was made in light of these circumstances and is based on the objective of providing a communication system, a communication device, a forwarding device, a communication IC, a control IC and a communication method that can block the sending of an abnormal message to a network while allowing the sending and receiving of a normal message without interfering with it. MEANS OF SOLVING THE TASK

[0010] The present invention relates to a communication system in which several communication devices are interconnected via a two-wire bus, wherein the communication devices are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors, each of the communication devices comprising: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message; and a first switch that is configuredto be switched between a closed and an open state based on the binary information output by the communication processing unit, and to bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; at least one communication device has an anomaly detection unit for detecting an anomaly in a message sent on the bus; and at least two communication devices, including at least one communication device: a switching control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential.which brings the bus into the first state; and a second switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line and the second line via a second resistor. Furthermore, in the communication system according to the present invention, the first switch connects the first line to the first potential, which is greater than the common potential, and the second line to the second potential, which is less than the common potential, if a value of the binary information output by the communication processing unit is a first value.and the first switch disconnects the first line from the first potential and disconnects the second line from the second potential if the value of the binary information output by the communication processing unit is a second value; and the second switch disconnects the first line and the second line from each other if the anomaly detection unit has not detected an anomaly; the second switch connects the first line and the second line via the second resistor if the anomaly detection unit has detected an anomaly and the value of a message to be sent is the first value; and the second switch disconnects the first line and the second line from each other if the anomaly detection unit has detected an anomaly and the value of the message to be sent is the second value.

[0011] Furthermore, in the communication system according to the present invention, the at least two communication devices have an output target switching unit for switching the output target of the binary information output by the communication processing unit to the first switch if the anomaly detection unit has not detected an anomaly, and to the second switch if the anomaly detection unit has detected an anomaly.Furthermore, in the communication system according to the present invention, each of the communication devices has a comparator for comparing the potential of the first line with the potential of the second line and for outputting a value corresponding to the potential difference, wherein the communication device that receives a message from the communication processing unit receives the value output from the comparator, and the at least two communication devices have an inverter for inverting the logic of the value output from the comparator and for receiving a message from the communication processing unit that receives a value output from the inverter if the anomaly detection unit has detected an anomaly.

[0012] Furthermore, in the communication system according to the present invention, the at least one communication device, which includes the anomaly detection unit, has an anomaly notification unit for notifying another communication device of the anomaly if the anomaly detection unit has detected an anomaly.

[0013] Furthermore, in the communication system according to the present invention, the at least two communication devices have a communication IC comprising the first switch, the second switch and the switching control unit.

[0014] Furthermore, in the communication system according to the present invention, the at least two communication devices have a control IC comprising the communication processing unit, the second switch and the switching control unit.

[0015] Furthermore, in the communication system according to the present invention, several buses are connected to the at least one communication device, and the at least one communication device includes a forwarding device for forwarding a message between the buses. The present invention also relates to a communication system in which several communication devices are connected to one another via a two-wire bus, wherein the communication devices are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message.wherein the first line and the second line are connected to a common potential via respective first resistors, each of the communication devices comprises: a communication processing unit for generating a message to be transmitted and for sequentially outputting binary information constituting the generated message; and a first switch configured to be switched between a closed and an open state based on the binary information output by the communication processing unit and to bring the bus to the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential, at least one communication device comprising an anomaly detection unit for detecting an anomaly in a message transmitted on the bus,and comprising at least two communication devices, including at least one communication device: a switching control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state; and a second switch configured to switch between a closed and an open state, based on the binary information output by the communication processing unit, if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line to the second potential and the second line to the first potential.

[0016] Furthermore, in the communication system according to the present invention, the at least two communication devices comprise a first communication IC comprising the first switch and a second communication IC comprising the second switch.

[0017] Furthermore, in the communication system according to the present invention, each of the communication devices has at least one comparator for comparing the potential of the first line with the potential of the second line and for outputting a value corresponding to the potential difference, wherein the communication device that receives a message from the communication processing unit receives the value output from the comparator, and the first communication IC and the second communication IC have the respective comparators, the at least two communication devices have an inverter for inverting the logic of the value output from the comparator of the second communication IC, and the at least two communication devices are configured to: receive a message from the communication processing unit that receives a value output from the comparator of the first communication IC,if the anomaly detection unit has not detected an anomaly, and receiving a message from the communication processing unit that receives a value output by the inverter if the anomaly detection unit has detected an anomaly.

[0018] Furthermore, the present invention relates to a communication system in which several communication devices are interconnected via a two-wire bus, wherein the communication devices are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors, each of the communication devices comprises: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message; and a first switch that is configuredto be switched between a closed and an open state based on the binary information output by the communication processing unit, and to bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; at least one communication device has an anomaly detection unit for detecting an anomaly in a message sent on the bus; and at least two communication devices, including at least one communication device: a switching control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential.which brings the bus into the first state; and a second switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state.

[0019] Furthermore, the present invention relates to a communication device to which a two-wire bus is connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors and the communication device comprises: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit, and to bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message transmitted on the bus; a switching control unit for toggling, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line and the second line via a second resistor.

[0020] Furthermore, the present invention relates to a communication device to which a two-wire bus is connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors and the communication device comprises: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit, and to bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message transmitted on the bus; a switching control unit for toggling, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line to the second potential and the second line to the first potential.

[0021] Furthermore, the present invention relates to a communication device to which a two-wire bus is connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors and the communication device comprises: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit, and to bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message transmitted on the bus; a switching control unit for toggling, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the communication processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state.

[0022] Furthermore, the present invention relates to a forwarding device to which several two-wire buses are connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and for forwarding the message between the buses, wherein the first line and the second line are connected to a common potential via respective first resistors, and the forwarding device comprises: a forwarding processing unit for receiving a message and forwarding the received message by generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit, and to bring the corresponding bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message sent on the bus; a toggling control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line and the second line via a second resistor.

[0023] Furthermore, the present invention relates to a forwarding device to which several two-wire buses are connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and for forwarding the message between the buses, wherein the first line and the second line are connected to a common potential via respective first resistors, and the forwarding device comprises: a forwarding processing unit for receiving a message and forwarding the received message by generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit, and to bring the corresponding bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message sent on the bus; a toggling control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state by connecting the first line to the second potential and the second line to the first potential.

[0024] Furthermore, the present invention relates to a forwarding device to which several two-wire buses are connected and which is configured for sending and receiving a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and for forwarding the message between the buses, wherein the first line and the second line are connected to a common potential via respective first resistors, and the forwarding device comprises: a forwarding processing unit for receiving a message and forwarding the received message by generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit, and to bring the corresponding bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; an anomaly detection unit for detecting an anomaly in a message sent on the bus; a toggling control unit for switching, if the anomaly detection unit has detected an anomaly, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, thereby bringing the bus into the first state;and a second switch configured to toggle between a closed and an open state based on the binary information output by the forwarding processing unit if the anomaly detection unit has detected an anomaly, and to bring the bus into the second state.

[0025] Furthermore, the present invention relates to a communication IC to which a two-wire bus is connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of the bus is large, and a second state, in which the potential difference is small, to binary information that forms the message, wherein the first line and the second line are connected to a common potential via respective first resistors and the communication IC comprises: a first switch which is configured to bring the bus into the first state by connecting the first line to a first potential that is greater than the common potential and by connecting the second line to a second potential that is less than the common potential;a second switch configured to put the bus into the second state by connecting the first and second lines via a second resistor; a switching control unit for switching the first switch, if an anomaly is detected in a message sent on the bus, such that the first line is connected to the first potential and the second line is connected to the second potential, thereby putting the bus into the first state; and an output destination switching unit into which binary information, forming a send message, is input, and which is configured to switch an output destination of the input binary information to the first switch if no anomaly has been detected, and to the second switch if such an anomaly has been detected.

[0026] Furthermore, the present invention relates to a control IC that sends a message to a communication IC having a first switch by outputting a signal to control the first switch so that it is in a closed state or an open state, wherein the first switch is configured to connect a first line of a two-wire bus to a first potential that is greater than the common potential and to connect a second line of the two-wire bus to a second potential that is less than the common potential, wherein the first line and the second line of the two-wire bus are connected to a common potential via respective first resistors, wherein the control IC comprises: a communication processing unit for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a second switch for connecting the first line and the second line via a second resistor; a switching control unit for switching, if an anomaly is detected in a message sent on the bus, the first switch such that the first line is connected to the first potential and the second line is connected to the second potential; and an output destination switching unit for switching an output destination of the binary information from the communication processing unit to the first switch if no anomaly has been detected, and to the second switch if such an anomaly has been detected.

[0027] Furthermore, the present invention relates to a communication method for several communication devices that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of a bus is large, and a second state, in which the potential difference is small, to binary information forming the message, wherein the first line and the second line are connected to a common potential via respective first resistors, each communication device switches a first switch between a closed and an open state based on binary information forming a message to be sent, and transmits the message, wherein the first switch is configured to connect the bus to a first potential greater than the common potential.and by connecting the second line to a second potential smaller than the common potential to bring it into the first state, at least one communication device detects an anomaly in a message sent on the bus, and if the anomaly has been detected, at least two communication devices, including the at least one communication device, based on binary information forming the message to be sent, switch the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, and switch a second switch between a closed state and an open state and send the message, the second switch being configured to bring the bus into the second state by connecting the first line and the second line via a second resistor.

[0028] Furthermore, the present invention relates to a communication method for several communication devices that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of a bus is large, and a second state, in which the potential difference is small, to binary information forming the message, wherein the first line and the second line are connected to a common potential via respective first resistors, each communication device switches a first switch between a closed and an open state based on binary information forming a message to be sent, and transmits the message, wherein the first switch is configured to connect the bus to a first potential greater than the common potential.and by connecting the second line to a second potential smaller than the common potential to bring it into the first state, at least one communication device detects an anomaly in a message sent on the bus, and if the anomaly has been detected, at least two communication devices, including the at least one communication device, based on binary information forming the message to be sent, switch the first switch such that the first line is connected to the first potential and the second line is connected to the second potential, and switch a second switch between a closed state and an open state and send the message, the second switch being configured to bring the bus into the second state.by connecting the first line to the second potential and the second line to the first potential. Furthermore, the present invention relates to a communication method for several communication devices that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line and a second line of a bus is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line and the second line are connected to a common potential via respective first resistors, each communication device switches a first switch between a closed and an open state based on binary information that constitutes a message to be sent, and transmits the message, wherein the first switch is configuredto bring the bus into the first state by connecting the first line to a first potential greater than the common potential and by connecting the second line to a second potential less than the common potential; at least one communication device detects an anomaly in a message sent on the bus; and if the anomaly has been detected, at least two communication devices, including at least one communication device, based on binary information forming the message to be sent, toggle the first switch such that the first line is connected to the first potential and the second line is connected to the second potential; and toggle a second switch between a closed state and an open state and send the message, the second switch being configured to bring the bus into the second state.

[0029] In the communication system according to the present invention, several communication devices are interconnected via a two-wire bus and send and receive a message using a differential communication scheme. In this scheme, they assign the first state, in which the first and second wires of the bus have a large potential difference, and the second state, in which they have a small potential difference, to the first and second values ​​of the binary information that constitute the message, respectively. For example, in a CAN communication scheme, a message is sent or received by assigning a "0" to the first state of the bus and a "1" to the second state of the bus.

[0030] The second state, in which the potential difference is small, is realized because the first and second lines of the bus are connected to the common potential via the first resistors. This second state corresponds to a "recessive value" in the CAN communication scheme and is assigned a "1" in the message. When a "0" is sent to the bus, a communication device connected to the bus controls the opening / closing of the first switch such that the first line of the bus is connected to the first potential (> common potential) and the second line is connected to the second potential (< common potential), thus bringing the bus into the first state, in which the potential difference is large. This first state corresponds to a "dominant value" in the CAN communication scheme and is assigned a "0" in the message.

[0031] According to this configuration, if all communication devices connected to the bus output a "1" message, the bus will enter the second state, and if at least one communication device outputs a "0" message, the bus will enter the first state. This is why a "0" message and the first bus state correspond to the "dominant value," and arbitration and decision-making procedures of the CAN communication scheme are performed using the characteristics of the "dominant value" and "recessive value."

[0032] The communication system according to the present invention includes an anomaly detection unit for detecting an anomaly in a message transmitted on the bus. A configuration is also possible in which, for example, all communication devices connected to the bus have the anomaly detection unit. Alternatively, a configuration is also possible in which, for example, at least one of the communication devices connected to the bus has the anomaly detection unit, and the communication device that has detected an anomaly notifies another communication device that does not have the anomaly detection function of this fact.

[0033] It should be noted that the anomaly detection unit should be able to perform any anomaly detection procedure. For example, a configuration is possible in which a message is sent and received with a MAC address, and the anomaly detection unit determines whether the message is anomalous or not based on an analysis of whether this MAC address is correct or not. Another configuration is possible in which the anomaly detection unit determines whether a message is anomalous or not by determining, for example, whether a transmission period of the message is a valid period or not.

[0034] If the anomaly detection unit detects an anomaly in a message, the communication system according to the present invention connects the first line of the bus to the first potential and connects the second line to the second potential. Accordingly, the bus is fixed in the first state, in which the potential difference is large, and therefore the communication device connected to the bus cannot send any information from the message corresponding to the second state of the bus, and therefore cannot proceed to transmit the anomalous message.

[0035] However, it should be noted that there is a risk that even authorized message transmission, performed by an authorized communication device, may be blocked because the bus is stuck in the first state. Accordingly, the communication device of the present invention has the function of enabling message transmission even when the bus is stuck in the first state as a result of an anomaly detection. It should be noted that not all communication devices of the communication system need to have this function, and it is sufficient that at least two communication devices, which must be able to perform communication even when an anomaly has occurred, have this function.

[0036] The communication device according to the present invention controls the second switch, which connects and disconnects the first and second lines of the bus via the second resistor. It brings the bus, fixed in the first state, into the second state by closing this second switch, thus bringing the bus into the second state, in which the potential difference is small, and transmits information corresponding to the second state. It should be noted that, in contrast to the CAN communication scheme, here the first state, in which the potential difference of the bus is large, corresponds to "recessive," and the second state, in which the potential difference is small, corresponds to "dominant."

[0037] Accordingly, the communication system of the present embodiment can send a message to the bus fixed in the first state by controlling the second switch, even after an anomaly has been detected.

[0038] Furthermore, according to the present invention, in a state where no anomaly has been detected, the closing / opening of the first switch is controlled such that the bus assumes the first state if the value of a transmitted message is a first value (for example, "0"), and the bus assumes the second state if the value is a second value (for example, "1"). The second switch is set to the open state.

[0039] In contrast, if an anomaly is detected, the closing / opening of the second switch is controlled such that the bus enters the second state if the value of the transmitted message is a first value (for example, "0"), and the bus enters the first state if the value is a second value (for example, "1"). The first switch is set to the closed state.

[0040] With these measures, the communication device can send a message by assigning the first value of the transmitted message to the dominant state of the bus and the second value to the recessive state. Furthermore, according to the present invention, the communication processing unit of the communication device performs a control such that binary information constituting a transmitted message is output sequentially, and the output destination of the binary information is switched between the first switch and the second switch based on whether an anomaly has been detected or not. Accordingly, it is possible to switch the control of the bus state in a simple and reliable manner based on the binary information constituting the transmitted message, depending on whether an anomaly has been detected or not.

[0041] Furthermore, according to the present invention, depending on whether an anomaly has been detected or not, the relationship between the dominant and recessive states of the first and second states of the bus is inverted, and the correspondence relationship between the first and second values ​​of the binary information forming a transmitted message and the first and second states of the bus is also inverted. Accordingly, when the bus potentials are compared using the comparator and a message is received, the logic of a value output from the comparator is inverted using the inverter, depending on whether an anomaly has been detected or not, thus making it possible to receive a message regardless of whether an anomaly has been detected or not.

[0042] Furthermore, according to the present invention, a communication device comprising an anomaly detection unit notifies another communication device, which does not have an anomaly detection unit, of the fact that an anomaly has been detected. Any notification method can be used, but it is also possible to configure, for example, the closing / opening of the second switch and the sending of a suitable message, or notification can be effected, for example, by moving the first switch to the closed state, thus fixing the bus in the first state. Accordingly, not all communication devices of the communication system need to perform anomaly detection.

[0043] Furthermore, according to the present invention, a communication IC is used to form a communication device, comprising: the first switch, second switch, and switching control unit for closing the first switch such that the bus is fixed in the first state if an anomaly has been detected. For example, a CAN controller IC that performs communication according to a CAN communication scheme has the first switch, and thus the communication IC described above can be realized by adding the second switch and the switching control unit to this communication IC. Accordingly, if, for example, a microcomputer of a communication device has the anomaly detection function, the communication system according to the present invention can be easily implemented by replacing a communication IC with the one described above.

[0044] Furthermore, according to the present invention, a control IC is used to form a communication device, comprising the second switch described above, the switching control unit, and a communication processing unit for generating a transmitted message. The communication system according to the present invention can be implemented simply by, for example, using a communication device conforming to a CAN communication scheme, wherein a microcomputer or the like, which performs the communication using a CAN controller, is replaced by this control IC.

[0045] Furthermore, according to the present invention, at least two communication devices, which have an anomaly detection function and send a message using the second switch when an anomaly is detected, include a forwarding device. The forwarding device is a device to which several buses are connected, and it performs processing to forward a message between the buses. According to this configuration, the forwarding device can perform anomaly detection and send messages using the second switch for each bus. In other words, the forwarding device can detect for each of the buses connected to it whether an anomaly has occurred or not, and it can send a message using the second switch only for the bus for which an anomaly has been detected.

[0046] Furthermore, instead of the second switch described above, which connects and disconnects the first and second lines of the bus via the second resistor, the present invention uses a second switch configured to connect the first line of the bus to the second potential and the second line to the first potential. If, in a state where the first line of the bus is connected to the first potential and the second line is connected to the second potential due to the detection of an anomaly by the first switch, and the second switch connects the first line to the second potential and the second line to the first potential, then the first and second lines of the bus will both have a potential that is substantially midway between the first and second potentials.In other words, the bus, which was fixed in the first state, where the potential difference is large, by the first switch, can be switched to the second state, where the potential difference is small, by the second switch.

[0047] Accordingly, the communication system according to the present invention can send a message to the bus fixed in the first state even after an anomaly has been detected, by actuating the second switch.

[0048] Furthermore, according to the present invention, at least two communication devices, which send a message using the second switch when an anomaly is detected, are provided with the first communication IC comprising the first switch and the second communication IC comprising the second switch. The first communication IC and the second communication IC have nearly the same configuration, and two substantially identical communication ICs are incorporated into the communication device, one of which can be designated as the first communication IC and the other as the second communication IC.

[0049] Existing CAN controller ICs or the like can be used as the two communication ICs, and sending messages using the second switch when an anomaly is detected can be achieved by using the existing communication ICs.

[0050] Furthermore, according to the present invention, the first communication IC and the second communication IC each have a comparator for receiving a message. If no anomaly has been detected, a message can be received by the comparator of the first communication IC. According to the invention, depending on whether an anomaly has been detected or not, the relationship between the dominant and recessive values ​​of the first and second states of the binary information forming a transmitted message on the bus is inverted, and the correspondence relationship between the first and second values ​​and the first and second states of the bus is also inverted.Accordingly, the logic of a value output by the comparator of the second communication IC is inverted using the inverter, and by performing message reception using an output by the inverter if an anomaly has been detected, it is possible to receive a message regardless of whether an anomaly has been detected or not.

[0051] Furthermore, according to the present invention, after the bus has been fixed in the first state by the first switch following the detection of an anomaly, message transmission is carried out using the second switch, which toggles the bus between the first state and the second state. This second switch can be a second switch that connects and disconnects the first and second lines of the bus via the second resistor, or a second switch that connects the first line of the bus to the second potential and the second line to the first potential, and the second switch is not limited to these.The second switch for sending a message after an anomaly has been detected can have any configuration, provided that, when the bus has been fixed in the first state by the first switch, it can switch between the second state and the first state by toggling between conduction and open circuit. ADVANTAGEOUS EFFECTS OF THE INVENTION

[0052] The present invention comprises an embodiment in which message transmission is carried out by closing a first switch, if an anomaly is detected in a message transmitted on a bus, so that the bus is fixed in a first state in which the potential difference of the bus is large, and by controlling the closing / opening of a second switch that connects a first line and a second line of the bus to bring the bus into a second state. The present invention further comprises an embodiment in which message transmission is carried out by using the first switch, if an anomaly is detected, to bring the bus into the first state and to control the closing / opening of the second switch that connects the first line of the bus to the second potential and the second line to the first potential.These measures make it possible to block the abnormal sending of a message to a bus, while allowing the sending and receiving of an authorized message without interference. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 1. Fig. Figure 2 is a circuit diagram that schematically represents the switching state of a switch when an anomaly has been detected. Fig. Figure 3 is a flowchart representing a processing procedure performed by an ECU incorporating an anomaly detection unit according to embodiment 2. Fig. Figure 4 is a flowchart representing a processing procedure performed by an ECU according to embodiment 2, which does not have an anomaly detection unit. Fig. Figure 5 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 3. Fig. Figure 6 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 4. Fig. Figure 7 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 5. Fig. Figure 8 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 6 and shows a switching state of the switches when no anomaly has been detected. Fig. Figure 9 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 6 and shows a switching state of the switches when an anomaly has been detected. EXECUTIONS OF THE INVENTION Execution form 1

[0053] Fig. Figure 1 is a circuit diagram schematically representing a configuration of a communication system according to embodiment 1. The communication system according to embodiment 1 is a system in which several ECUs 1, for example, installed in a vehicle (not shown), send and receive messages according to a CAN communication scheme and operate in a coordinated manner to perform the vehicle's driving control and the like. The several ECUs 1 are connected by a communication cable to perform wired communication according to the CAN communication scheme, the communication cable being referred to as the CAN bus 10. The CAN bus 10 is a two-line bus using a twisted pair of conductors and is configured to have a first line 10a and a second line 10b.

[0054] The first line 10a and the second line 10b of the CAN bus 10 are connected at their ends via terminating resistors R11 and R12. The resistance values ​​of the terminating resistors R11 and R12 can be set to, for example, 120 Ω. Furthermore, the first line 10a and the second line 10b of the CAN bus 10 are connected to a common potential (for example, 2.5 V) via resistors R21 and R22, respectively. Accordingly, the electrical potentials of the first line 10a and the second line 10b are equal to this common potential when the connected ECUs 1 are not outputting a signal to the CAN bus 10. Each of the ECUs 1 connected to the CAN bus 10 is configured to include a control IC 2, a communication IC 3, a transmit switching circuit 4, a switching circuit 5, a receive switching circuit 6, and the like. It should be noted that in Fig. Figure 1 shows only function blocks for executing communication that are common to all ECUs 1, but no function blocks for executing control processing or the like that are individual to each ECU 1 are shown. Furthermore, in the present embodiment, since the ECUs 1 connected to the CAN bus 10 have the same configuration with respect to the communication function, the configuration of a single ECU 1 is shown, while the configurations of the remaining ECUs 1 are not shown.

[0055] The control IC 2 of the ECU 1 is an integrated circuit such as a microcomputer or a central processing unit (CPU). By reading a program stored in a read-only memory (ROM) or the like (not shown) and executing the program, the control IC 2 performs arithmetic processing to implement control functions, such as those required for driving the vehicle. Furthermore, according to the present embodiment, the control IC 2 of the ECU 1 is equipped with a communication processing unit 21, an anomaly detection unit 22, and the like as functional blocks for performing communication-related processing. The communication processing unit 21, the anomaly detection unit 22, and the like can be software functional blocks implemented by the program-executing control IC 2, or they can be hardware functional blocks implemented as circuits.

[0056] The communication processing unit 21 of the control IC 2 performs processing to generate messages to be sent to the other ECUs 1, send the generated messages, and receive messages received from other ECUs 1. The communication processing unit 21 generates a transmit message containing information to be sent to other ECUs 1, such as a result detected by a sensor in that ECU 1. Messages sent and received by the ECU 1 consist of a sequence of several bits (binary information), and a bit sequence of the transmit message generated by the communication processing unit 21 is output sequentially from the output terminal of the control IC 2 as an output signal TXD, starting with the header.Furthermore, a message sent by another ECU 1 is received by the communication IC 3, and a bit sequence of the received message is sequentially input as an input signal RXD into the control IC 2. The communication processing unit 21 of the control IC 2 receives the message by repeatedly sampling and recording the input signal RXD.

[0057] The anomaly detection unit 22 of the control IC 2 determines whether a message received from another ECU 1 and processed by the communication processing unit 21 is anomalous or not. In the present embodiment, the anomaly detection unit 22 of the control IC 2 can perform any anomaly detection procedure. For example, if the communication processing unit 21 is configured to send a message with a MAC, the anomaly detection unit 22 can be configured to perform anomaly detection based on whether a MAC contained in the received message is correct or not.Furthermore, if, for example, each ECU 1 is configured to periodically send a message, the anomaly detection unit 22 can be configured to store the transmission period for each CAN ID contained in a message and to perform an anomaly detection based on whether a received message meets a condition of that transmission period. The control IC 2 outputs a result of the detection performed by the anomaly detection unit 22 as an anomaly detection signal, and the output anomaly signal is fed into the transmit switching circuit 4 and the receive switching circuit 6. The communication IC 3 is connected to the first line 10a and the second line 10b, which form the CAN bus 10.The communication IC 3 has a switch SW1 that connects the first line 10a of the CAN bus 10 via a resistor R31 to a first potential (e.g., 3.5 V) that is higher than a reference potential (2.5 V), and the second line 10b via resistor R32 to a second potential (e.g., 1.5 V) that is lower than the reference potential. Switch SW1 is switched between a closed and an open state based on whether the input data of a transmit message is a "0" or a "1", thereby transmitting the message. The communication IC 3 also has a comparator 31 that compares the potential of the first line 10a with the potential of the second line 10b, determines whether the potential difference exceeds a threshold value, and outputs the result.If the input data is "0", the communication IC 3 closes the switch SW1, so that the first line 10a of the CAN bus 10 is, for example, at 3.5 V and the second line 10b is, for example, at 1.5 V, and therefore the potential difference between the first line 10a and the second line 10b is 2.0 V. If, for example, the threshold for the determination performed by the comparator 31 of each ECU 1 is set to, for example, 1.0 V, the comparator 31 determines that the potential difference of 2.0 V is greater than the threshold of 1.0 V and outputs a signal indicating that the potential difference exceeds the threshold, i.e., a signal of the potential corresponding to a "0".If, in contrast, the input data is "1", the communication IC 3 sets switch SW1 to the open state, so that the first line 10a and the second line 10b of CAN bus 10 are each isolated from the potentials of 3.5 V and 1.5 V, respectively. Accordingly, the first line 10a and the second line 10b, which are connected to the common potential (2.5 V) via their respective resistors R21 and R22, both have a potential of 2.5 V, except when any other ECU 1 sends a message of "0", in which case the potential difference is 0 V. The comparator 31 of ECU 1 determines that the potential difference of 0 V is less than the threshold of 1.0 V and outputs a signal indicating that the potential difference does not exceed the threshold, i.e., a signal of the potential corresponding to a "1".

[0058] In a conventional ECU, output signals TXD of a control IC 2 are directly fed into a communication IC 3, thus switching the open / closed position of a switch SW1. Output signals from the communication IC 3 are directly fed into the control IC 2 as input signals RXD and received as a message. In contrast, each ECU 1 of the present embodiment has a transmit switching circuit 4 and a receive switching circuit 6 between the control IC 2 and the communication IC 3. In other words, output signals TXD of the control IC 2 are fed into the communication IC 3 via the transmit switching circuit 4, and output signals from the communication IC 3 are fed into the control IC 2 as input signals RXD via the transmit switching circuit 6.

[0059] The transmit switching circuit 4 is a circuit for switching a signal input to the communication IC 3 based on an anomaly detection signal output by the control IC 2. If no anomaly has been detected, the transmit switching circuit 4 inputs output signals TXD from the control IC 2 to the communication IC 3 to send a transmit message to the communication IC 3, and causes the communication IC 3 to send the message to another ECU 1. If, on the other hand, an anomaly has been detected, as shown in Fig. As shown in Figure 2, the transmit switching circuit 4 applies a ground potential (meaning the potential corresponding to a "0" in the transmitted message) to the communication IC 3. If the input signal is fixed to ground potential by the transmit switching circuit 4, the switch SW1 of the communication IC 3 is held in the closed state, and the CAN bus 10 is held in a state where the potential difference between the first line 10a and the second line 10b is equal to 2.0 V.

[0060] If the transmit switching circuit 4 fixes the input to the communication IC 3 at ground potential after an anomaly has been detected, output signals TXD from the control IC 2 are also fed into the switching circuit 5. The switching circuit 5 is connected in series between the first line 10a and the second line 10b of the CAN bus 10 and includes a resistor R41 and a switch SW2. When a potential corresponding to "0" is input from the transmit switching circuit 4, the switching circuit 5 switches the switch SW2 to the closed position and connects the first line 10a and the second line 10b of the CAN bus 10 via resistor R41. It is important to note that the resistance value of resistor R41 must be sufficiently lower than the resistance values ​​of resistors R31 and R32.Accordingly, if switch SW2 is in the closed position, the first line 10a and the second line 10b will be in a short-circuited state, and the potential difference will be approximately 0 V. Furthermore, when a potential corresponding to a "1" is input as an input signal from the transmit switching circuit 4, the switching circuit 5 switches switch SW2 to the open position. Consequently, the first line 10a and the second line 10b are not connected via resistor R41, but are in a separate state. It should be noted that if no anomaly has been detected, the transmit switching circuit 4 inputs, for example, a power supply potential (i.e., the potential corresponding to a "1" in the transmitted message) into the switching circuit 5, and therefore switch SW2 of the switching circuit 5 is held in the open position.

[0061] The receive switching circuit 6 is configured to include an inverter 61 and a switch SW3. A signal output from the comparator 31 of the communication IC 3, meaning a signal corresponding to a message received by the communication IC 3, is input into the receive switching circuit 6. The inverter 61 of the receive switching circuit 6 is an inverter for inverting the logic of an input signal and outputting the logic-inverted signal. The inverter 61 inverts the signal from the communication IC 3 and outputs the inverted signal. Based on an anomaly detection signal output by the control IC 2, the switch SW3 selects either an input signal from the communication IC 3 or a signal obtained by inverting this input signal using the inverter 61, and outputs the selected signal.If no anomaly is detected, the receive switching circuit 6 inputs a signal from the communication IC 3 as input signal RXD to the control IC 2. If an anomaly is detected, the receive switching circuit 6 inputs a signal as input signal RXD to the control IC 2, which is obtained by the inverter 61 inverting the logic of the signal from the communication IC 3.

[0062] If the anomaly detection unit 22 has not detected an anomaly in a message on the CAN bus 10, the ECU 1 of the present embodiment switches the switch of the transmit switching circuit 4, the switch SW2 of the switching circuit 5 and the switch SW3 of the receive switching circuit 6 to the position shown in the Fig. The state shown in Figure 1 is as follows. In this state, the closing / opening of switch SW1 of communication IC 3 is controlled based on an output signal TXD from control IC 2, and a message is sent to CAN bus 10. In other words, switch SW1 is switched to the closed state based on a "0" in the transmitted message, and CAN bus 10 is in a state where the potential difference is large; and switch SW1 is switched to the open state based on a "1" in the transmitted message, and CAN bus 10 is in a state where the potential difference is small. Furthermore, in this state, the output of comparator 31, which compares the potential of the first line 10a of CAN bus 10 with the potential of the second line 10b, is directly input as signal RXD into control IC 2, and a received message is received by control IC 2.The operation of ECU 1 in this state is the same as the operation of a conventional ECU, which performs the sending and receiving of a message according to a CAN communication scheme.

[0063] Fig. Figure 2 is a circuit diagram that schematically represents the switched state of the switches when an anomaly has been detected. If the anomaly detection unit 22 has detected an anomaly in a message, the ECU 1 of the present embodiment switches the switch of the transmit switching circuit 4, the switch SW1 of the communication IC 3, and the switch SW3 of the receive switching circuit 6 to the positions shown in Figure 2. Fig. The state shown in Figure 2 is as follows. In this state, the first line 10a of the CAN bus 10 is connected to a potential of 3.5 V via resistor R31, and the second line 10b is connected to a potential of 1.5 V via resistor R32, so that the CAN bus 10 is fixed in a state with a large potential difference. Because the CAN bus 10 is fixed in a so-called dominant state, a device that only performs communication according to a regular CAN communication scheme, such as a device improperly connected to the CAN bus 10, cannot perform recessive transmission, which leads to message transmission failures. Furthermore, in the state where an anomaly has been detected in a message, the closing / opening of switch SW2 of the switching circuit 5 is controlled based on output signals TXD of the control IC 2, and a message is sent to the CAN bus 10.In other words, switch SW2 is switched to the closed state based on a "0" in a transmitted message, and CAN bus 10 enters a state where the potential difference is small, and switch SW2 is switched to the open state based on the transmitted message data "1", and CAN bus 10 enters a state where the potential difference is large.

[0064] It should be noted, however, that the relationship between a "0" and a "1" of a message and the magnitude of the potential difference of the CAN bus 10 is inverted in the state in which a message anomaly has been detected, compared to the state in which no message anomaly has been detected. Accordingly, in the state in which a message anomaly has been detected, a signal obtained by the inverter 61 of the receive switching circuit 6 inverting an output of the comparator 31 is input as an input signal RXD into the control IC 2, and a received message is received by the control IC 2.

[0065] As a consequence of all authorized ECUs 1 connected to the CAN bus 10 performing such a method of switching the sending and receiving of messages based on an anomaly detection, it is possible to block the unauthorized sending of a message performed by a device improperly connected to the CAN bus 10, and to continue sending and receiving messages to / from the authorized ECUs 1 even after an anomaly has been detected.

[0066] The communication system according to embodiment 1, which has the configuration described above, connects the multiple ECUs 1 via the two-wire CAN bus 10, and the ECUs 1 send and receive messages using a differential communication scheme by assigning a first state, in which the first line 10a and the second line 10b of the CAN bus 10 have a large potential difference, to a first value (a “0”) of the message, and by assigning a second state, in which the first line 10a and the second line 10b have a small potential difference, to a second value (a “1”) of the message.

[0067] The second state, in which the potential difference is small, is achieved because the first line 10a and the second line 10b of the CAN bus 10 are connected to the common potential (2.5 V) via resistors R21 and R22. This second state corresponds to a "recessive value" of the CAN communication scheme and is assigned to the "1" of the message. When a "0" of the message is sent, an ECU 1 connected to the CAN bus 10 closes switch SW1 of the communication IC 3 to connect the first line 10a of the CAN bus 10 to the first potential (3.5 V), which is higher than the common potential, and to connect the second line 10b to the second potential (1.5 V), which is lower than the common potential, thus bringing the CAN bus 10 into the first state, in which the potential difference is large.This first state corresponds to a “dominant value” of the CAN communication scheme and is assigned to the “0” of the message.

[0068] In the communication system according to the present embodiment, the ECUs 1 include the anomaly detection unit 22, which is configured to detect an anomaly in a message sent to the CAN bus 10. It should be noted that the anomaly detection unit 22 can perform any anomaly detection method. An anomaly detection signal, indicating whether or not an anomaly has been detected by the anomaly detection unit 22, is sent by the control IC 2 to the transmit switching circuit 4 and the receive switching circuit 6.

[0069] Furthermore, the ECU 1 controls switch SW2, which connects and disconnects the first line 10a and the second line 10b of the CAN bus 10 via resistor R41. By closing switch SW2, the ECU 1 switches the CAN bus 10, which is fixed in the first state, to the second state, in which the potential difference is small, and sends a "0" of the message corresponding to the second state. It should be noted that, unlike the CAN communication scheme, here the first state, in which the potential difference of the CAN bus 10 is large, corresponds to "recessive," and the second state, in which the potential difference is small, corresponds to "dominant." Accordingly, the communication system of the present embodiment can send a message to the CAN bus 10, which is fixed in the first state, even after an anomaly has been detected, by controlling switch SW2.

[0070] Furthermore, in a state where no anomaly has been detected by the anomaly detection unit 22, the ECU 1 of the present embodiment controls the closing / opening of switch SW1 such that the CAN bus 10 assumes the first state, in which the potential difference is large if the data of a transmitted message is "0", and the CAN bus 10 assumes the second state, in which the potential difference is small if the transmitted message data is "1". Switch SW2 is set to the open state. Conversely, if an anomaly has been detected by the anomaly detection unit 22, the ECU 1 controls the closing / opening of switch SW2 such that the CAN bus 10 assumes the second state, in which the potential difference is small if the data of a transmitted message is "0", and the CAN bus 10 assumes the first state, in which the potential difference is large if the transmitted message data is "1".Switch SW1 is fixed in the closed position. With these measures, ECU 1 can send a message by assigning a "0" in the message to the dominant state of CAN bus 10, and a "1" to the recessive state.

[0071] Furthermore, in the ECU 1 of the present embodiment, the communication processing unit 21 of the control IC 2 sequentially outputs data forming a transmit message as output signals TXD, and the transmit switching circuit 4 switches the output destination of the TXD signals between switch SW1 and switch SW2 based on whether an anomaly has been detected by the anomaly detection unit 22 or not. Accordingly, it is possible to switch the control of the CAN bus 10 state in a simple and reliable manner based on the value of the data forming a transmit message, depending on whether an anomaly has been detected by the anomaly detection unit 22 or not.Furthermore, in the communication system of the present embodiment, depending on whether an anomaly has been detected by the anomaly detection unit 22, the relationship between the dominant and recessive states of the first and second states of the CAN bus 10 is inverted, and the correspondence relationship between a "0" and a "1", which form a transmitted message, and the first and second states of the CAN bus 10 is also inverted. Accordingly, when the potentials of the CAN bus 10 are compared using the comparator 31 and a message is received, the ECU 1, using the inverter 61, inverts the logic of a value output from the comparator 31 depending on whether an anomaly has been detected. Consequently, the control IC 2 of the ECU 1 can receive messages of the same logic regardless of whether an anomaly has been detected.

[0072] It should be noted that in the present embodiment, the ECUs 1 are used as communication devices connected to the CAN bus 10, and the present invention is not limited to them. The communication devices connected to the CAN bus 10, which send and receive messages, can be of various other types besides the ECUs 1. Furthermore, the numerical values, such as the voltage and resistance values, used in the present embodiment are given as examples, and the present invention is not limited to them. Moreover, the values ​​described in the Fig. 1 and Fig. The circuit configurations shown in Figure 2 are schematic, and the circuit configuration of the ECU 1 is not limited to that shown in the drawings. Any circuit configuration can be used, provided it performs the same functions, and these same functions can also be implemented by software. Furthermore, the control IC 2 and the communication IC 3 do not necessarily have to be implemented as ICs, and circuits with the same functions can also be configured on a printed circuit board. Moreover, all of the authorized ECUs 1 connected to the CAN bus 10 are configured to have the anomaly detection function and the switching control function, although the present invention is not limited to this. It is sufficient that at least two of the ECUs 1 connected to the CAN bus 10 are configured to have the functions described above.

[0073] Furthermore, the ECU 1 can return to its original state, for example, at any time and under any condition, after the anomaly detection unit 22 has detected an anomaly and the transmit switching circuit 4 and the receive switching circuit 6 have been switched. For example, a configuration is possible in which the ECU 1 returns to its original state when the vehicle's ignition switch (IG switch) is switched from an on state to an off state, or a configuration is also possible in which the ECU 1 returns to its original state after a predetermined period of time has elapsed. Another configuration is possible in which the ECU 1 does not return to its original state and only returns to it after confirmation that a specific action has been taken at a vehicle dealership or similar location.In this configuration, the fact that the anomaly detection unit 22 has detected an anomaly is preferably stored in non-volatile memory or the like. Design 2

[0074] In the embodiment described above, all of the ECUs 1 connected to the CAN bus 10 are configured to perform anomaly detection, however, the present invention is not limited to this.

[0075] In a communication system according to embodiment 2, only one of the ECUs 1 has an anomaly detection unit 22 for performing anomaly detection and, if it has detected an anomaly, processes the notification of the other ECUs 1. Any anomaly notification method can be used. For example, if an anomaly has been detected, the ECU 1 that has the anomaly detection unit 22 switches the transmit switching circuit 4 and the receive switching circuit 6, thereby fixing the CAN bus 10 in the first state in which the potential difference is large. In this state, other ECUs 1 cannot send a message, and therefore this state, if maintained for a predetermined period of time, can also be defined as an anomaly notification to the other ECUs 1.Furthermore, a configuration is also possible in which, for example, the ECU 1, which has the anomaly detection unit 22, fixes the CAN bus 10 in the first state in which the potential difference is large if an anomaly is detected, and then activates the switch SW2 to execute a predetermined sending of a message, thereby notifying the other ECUs 1 of the anomaly.

[0076] Fig. Figure 3 is a flowchart representing a processing procedure performed by the ECU 1, which includes the anomaly detection unit 22, according to embodiment 2. The communication processing unit 21 of the control IC 2 of the ECU 1, which includes the anomaly detection unit 22, determines, based on input signals RXD from the communication IC 3, whether a message has been received or not (step S1). If no message has been received (NO in step S1), the communication processing unit 21 of the control IC 2 remains ready until a message is received. If a message has been received (YES in step S1), the anomaly detection unit 22 of the control IC 2 determines whether the received message is anomalous or not (step S2). If the received message is not anomalous (NO in step S2), the control IC 2 returns to the processing in step S1.If the received message is abnormal (YES in step S2), the control IC 2 controls the switching of the transmit switching circuit 4 and the receive switching circuit 6 using an anomaly detection signal (step S3). Then the control IC 2 notifies the other ECUs 1 that do not have an anomaly detection unit 22 of the fact that an anomaly has been detected (step S4).

[0077] Once the other ECUs 1 have been notified of the anomaly, they control the switching process and send a notification of the switchover completion. The control IC 2 determines whether such switchover completion notifications have been received from all other ECUs 1 from which such notifications are expected (step S5). If no switchover completion notification has been received from at least one other ECU 1 (NO in step S5), the control IC 2 remains ready until switchover completion notifications have been received from all other ECUs 1. If switchover completion notifications have been received from all other ECUs 1 (YES in step S5), the communication processing unit 21 of the control IC 2 starts sending / receiving a message to / from the other ECUs 1 (step S6), and the processing is complete.

[0078] Fig. Figure 4 is a flowchart depicting a processing procedure performed by an ECU 1 according to embodiment 2 that does not have an anomaly detection unit 22. The control IC 2 of the ECU 1 without anomaly detection unit 22 determines whether or not an anomaly notification has been received from the ECU 1 that does have anomaly detection unit 22 (step S11). If no anomaly notification has been received (NO in step S11), the control IC 2 remains ready until an anomaly notification is received. If an anomaly notification has been received (YES in step S11), the control IC 2 controls the switching of the transmit switching circuit 4 and the receive switching circuit 6 using an anomaly detection signal (step S12). Once the switching control has been completed, the control IC 2 sends a notification to the other ECUs 1 that the switching control is complete (step S13).

[0079] The control IC 2 then determines whether such switchover completion notifications, each sent by a different ECU 1 that does not have an anomaly detection unit 22, have been received by all the other ECUs 1 from which such notifications are expected (step S14). If no switchover completion notification has been received from at least one other ECU 1 (NO in step S14), the control IC 2 remains ready until switchover completion notifications are received from all other ECUs 1. If switchover completion notifications have been received from all other ECUs 1 (YES in step S14), the communication processing unit 21 of the control IC 2 starts sending and receiving messages to the other ECUs 1 (step S15), and the processing is complete.

[0080] The communication system according to embodiment 2 with the configuration described above has a configuration in which an ECU 1, which has an anomaly detection unit 22, notifies the other ECUs 1, which do not have an anomaly detection unit 22, of the fact that an anomaly has been detected. Accordingly, it is not necessary to perform anomaly detection on all ECUs 1 connected to the CAN bus 10, and thus it is possible to reduce the cost of the ECUs 1 that do not have an anomaly detection unit 22 and to reduce the cost of the communication system as a whole. It should be noted that the present embodiment has a configuration in which ECUs 1 that have been notified of an anomaly send a switchover completion notification, and the present invention is not limited to this.It is also possible to configure ECUs 1, after completing the switchover, to start sending and receiving messages without sending a switchover completion notification.

[0081] Furthermore, the remaining configurations of the communication system according to embodiment 2 are the same as in the communication system according to embodiment 1, and therefore the same reference numerals are assigned to the same components, and their detailed descriptions are omitted. embodiment 3

[0082] Fig. Figure 5 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 3. An ECU 301 of the communication system according to embodiment 3 is provided with a communication IC 303, which, in addition to resistors R31 and R32, includes a switch SW1 and a comparator 31, the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6, wherein the communication IC 303 is implemented as a single IC. An output signal TXD and an anomaly detection signal, which are output from the control IC 2, are input to the communication IC 303, and a signal output from the communication IC 303 is input to the control IC 2 as an input signal RXD. The operation of the circuits within the communication IC 303 is the same as that described with regard to embodiment 1.In this way, by providing the communication IC 303, which includes the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6, it is possible to easily implement the function that the ECU 301 of the communication system of the present embodiment should have, provided that the communication system includes a means for detecting a message anomaly. It should be noted that embodiment 3 has a configuration in which the communication IC 303 includes the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6; however, the communication IC 303 can also be configured to include at least one of these circuits instead of all of them. Furthermore, the communication system can also be configured to include, in a mixed manner, at least one ECU 1 according to embodiment 1 and at least one ECU 301 according to embodiment 3.

[0083] Furthermore, the remaining configurations of the communication system according to embodiment 3 are the same as in the communication system according to embodiment 1, and therefore the same reference numerals are assigned to the same components, and their detailed descriptions are omitted. Design 4

[0084] Fig. Figure 6 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 4. An ECU 401 of the communication system according to embodiment 4 is provided with a control IC 402, which includes a control circuit 420 that performs the function corresponding to the control IC 2 of the ECU 1 according to embodiment 1, the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6, wherein the control IC 402 is implemented as a single IC. A signal for controlling the closing / opening of a switch SW1 is input from the control IC 402 into the communication IC 3, and an output signal of the comparator 31 is input from the communication IC 3 into the control IC 402. Furthermore, the control IC 402 is also connected to the first line 10a and the second line 10b of the CAN bus 10, and the first line 10a and the second line 10b are connected and disconnected from each other by the switching circuit 5.

[0085] As described above, by providing the control IC 402, which includes the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6, it is possible to combine the communication IC 3, such as a CAN controller that performs communication using CAN communication, with the control IC 402, thereby easily realizing the ECU 401 of the communication system according to the present embodiment. It should be noted that embodiment 4 has a configuration in which the control IC 402 includes the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6; however, the control IC 402 can also be configured to include at least one of these circuits instead of all of them. Furthermore, the communication system can also be configured to include, in a mixed configuration, at least one ECU 1 according to embodiment 1 and at least one ECU 401 according to embodiment 4.

[0086] Furthermore, the remaining configurations of the communication system according to embodiment 4 are the same as those of the communication system according to embodiment 1, and therefore the same reference numerals are assigned to identical components, and their detailed descriptions are omitted. Embodiment 5

[0087] Fig. Figure 7 is a circuit diagram that schematically represents a configuration of a communication system according to embodiment 5. The communication system according to embodiment 5 is provided with a gateway 510 (example of a forwarding device), to which three CAN buses 10 are connected, and the gateway 510 forwards the sending and receiving of messages between the CAN buses 10. The gateway 510 is configured to include a control IC 502 and three communication ICs 303. It should be noted that each of the communication ICs 303 provided in the gateway 510 corresponds to the communication IC 303 provided in the ECU 1 according to embodiment 3 described above and includes the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6. This simplifies the description of Fig. 7, and the gateway 510 can also be configured using the communication IC 3 according to embodiment 1.

[0088] Each of the three communication ICs 303 of the gateway 510 is connected to a CAN bus 10, and each communication IC 303 sends or receives messages to or from an ECU 1 via the connected CAN bus 10. Output signals TXD and anomaly detection signals are input from the control IC 502 to the communication ICs 303, and the communication ICs 303 send input signals RXD, corresponding to a received message, to the control IC 502. The sending and receiving of the three types of signals between the communication ICs 303 and the control IC 502 is executed individually.

[0089] The control IC 502 includes a forwarding processing unit 521 and anomaly detection units 22. The forwarding processing unit 521 performs processing to forward messages between the CAN buses 10 by sending messages received by one communication IC 303 from another communication IC 303. The forwarding processing unit 521 performs processing to generate transmit messages and route output signals TXD to a communication IC 303, as well as processing to receive input signals RXD from a communication IC 303 and to receive messages.

[0090] Furthermore, the control IC 502 is equipped with anomaly detection units 22 for the respective communication ICs 303, and each anomaly detection unit 22 determines for the corresponding CAN bus 10 whether a message is anomalous or not. If it detects a message anomaly, the anomaly detection unit 22 notifies the corresponding communication IC 303 with an anomaly detection signal. Based on the anomaly detection signal output by the control IC 502, the communication IC 303 controls the switching of the transmit switching circuit 4, the switching circuit 5, and the receive switching circuit 6 integrated within it.

[0091] In the communication system of embodiment 5, if an anomaly is detected in any of the CAN buses 10, regular communication according to the CAN communication scheme is blocked with respect to that CAN bus 10, and regular communication according to the CAN communication scheme is continuously executed with respect to those CAN buses 10 in which no anomaly has been detected. However, it should be noted that a configuration is also possible in which a common signal is input as an anomaly detection signal into the three communication ICs 303 in the gateway 510, and if an anomaly is detected in any of the CAN buses 10, regular communication according to the CAN communication scheme is blocked with respect to all of the CAN buses 10.It should be noted, however, that in this case, ECUs 1 connected to the CAN buses 10, with the exception of the CAN bus 10 where an anomaly has been detected, cannot detect an anomaly. Therefore, the gateway 510 must notify them of the anomaly detection, as with the ECU 1 according to embodiment 2. In any case, in the communication system of embodiment 5, the advantageous configuration is that in which the gateway 510, instead of the ECUs 1, has the anomaly detection function and notifies the ECUs 1 of the anomaly detection. This is the same configuration as in embodiment 2. Furthermore, the remaining configurations of the communication system according to embodiment 5 are the same as in the communication system according to embodiment 1. Therefore, the same reference numerals are assigned to the same components, and their detailed descriptions are omitted. Design 6

[0092] The Fig. 8 and Fig. Figure 9 are circuit diagrams that schematically represent a configuration of a communication system according to embodiment 6. It should be noted that Fig. 8 shows a switching state of the switches when no anomaly has been detected, and Fig. 9 shows the switching state of the switches when an anomaly has been detected. Furthermore, the Fig. 8 and Fig. 9 the others, for example in the Fig. 1 and Fig. The ECUs shown in the diagram, as well as the resistors R11, R12, R21, R22 and the like, which are connected to the CAN bus 10, are not shown.

[0093] The communication system according to embodiment 6 differs from embodiments 1 to 5 in its configuration for sending messages after an anomaly has been detected. An ECU 601 of the communication system of embodiment 6 has two communication ICs 3 and 603. The first communication IC 3 is identical to the communication IC 3 of the ECU 1 according to embodiment 1, which is, for example, in the Fig. 1 and Fig. The first communication IC 3 is shown in Figure 2 and is configured to send and receive messages over CAN bus 10 if no anomaly has been detected. In contrast, the second communication IC 603 is configured to send and receive messages over CAN bus 10 after an anomaly has been detected. It should be noted, however, that the first communication IC 3 and the second communication IC 603 can be the same ICs. In other words, the second communication IC 603, like the first communication IC 3, is configured to include resistors R31 and R32, a switch SW4 (which can be the same as the switch SW1 of communication IC 3, but distinguished by the addition of the reference number "SW4" for simplicity), and a comparator 31.

[0094] The first communication IC 3 and the second communication IC 603 are connected to the first line 10a and the second line 10b, which form the CAN bus 10, in a manner inverted relative to each other; in other words, the first communication IC 3 is configured so that, if the switch SW1 is switched to a conducting state, it connects the first line 10a of the CAN bus 10 via resistor R31 to a first potential (3.5 V) that is higher than a reference potential (2.5 V), and connects the second line 10b via resistor R32 to a second potential (1.5 V) that is lower than the reference potential.In contrast, the second communication IC 603 is configured so that, if switch SW4 is switched to a conducting state, it connects the second line 10b of the CAN bus 10 via resistor R31 to the first potential (3.5 V) which is higher than the reference potential (2.5 V), and connects the first line 10a via resistor R32 to the second potential (1.5 V) which is lower than the reference potential.

[0095] The switch SW1 of the first communication IC 3 and the switch SW4 of the second communication IC 603 are switched between the open and closed states based on the value of input data.

[0096] In the present embodiment, switches SW1 and SW4 are switched to the closed state if a “0” is entered, and they are switched to the open state if a “1” is entered.

[0097] The comparators 31 of the first communication IC 3 and the second communication IC 603 each compare the potential of the first line 10a of the CAN bus 10 with the potential of the second line 10b, determine whether the potential difference exceeds a threshold value, and output the result of this determination. In the present embodiment, the comparators 31 output a "0" if the potential difference of the CAN bus 10 is large, and they output a "1" if the potential difference is small. Furthermore, the ECU 601 of embodiment 6 includes a transmit switching circuit 604 and a receive switching circuit 606. The transmit switching circuit 604 is a circuit for switching an input signal between the first communication IC 3 and the second communication IC 603 based on an anomaly detection signal output by the control IC 2. If no anomaly has been detected, as described in Fig. As shown in Figure 8, the transmit switching circuit 604 inputs output signals TXD from the control IC 2 to the first communication IC 3 to send a message to the first communication IC 3, and causes the first communication IC 3 to send the message to another ECU. In this case, the transmit switching circuit 604 inputs the potential corresponding to a "1" to the second communication IC 603 and sets the switch SW4 in the second communication IC 603 to the open state.

[0098] In contrast, if an anomaly has been detected, as in Fig. As shown in Figure 9, the transmit switching circuit 604 inputs the potential corresponding to a "0" into the first communication IC 3 and closes the switch SW1 in the first communication IC 3. As a result of the switch SW1 being held in the closed state, the first line 10a of the CAN bus 10 has a potential of 3.5 V, and the second line 10b has a potential of 1.5 V. Accordingly, the CAN bus 10 is held in the state where the potential difference between the first line 10a and the second line 10b is 2.0 V, i.e., in the first state where the potential difference is large.

[0099] Furthermore, if an anomaly is detected, the transmit switching circuit 604 sends output signals TXD from the control IC 2 to the second communication IC 603 to send a transmit message to the second communication IC 603, and causes the second communication IC 603 to send the message to another ECU. If the value of the transmit message is a "1", the switch SW4 of the second communication IC 603 is in the open state, and the CAN bus 10 is held by the first communication IC 3 in the initial state in which the potential difference is large, as described above.

[0100] If the value of the transmitted message is "0", switch SW4 of the second communication IC 603 is in the conducting state. Accordingly, the first line 10a of the CAN bus 10 is connected to the first communication IC 3 via resistor R31 at a potential of 3.5 V and to the second communication IC 603 via resistor R32 at a potential of 1.5 V. It is assumed here that the resistance values ​​of resistor R31 and resistor R32 are nearly equal and that the potential of the first line 10a of the CAN bus 10 is approximately 2.5 V. Similarly, the second line 10b of the CAN bus 10 is connected to the first communication IC 3 via resistor R32 at a potential of 1.5 V and to the second communication IC 603 via resistor R31 at a potential of 3.5 V, and thus its potential is approximately 2.5 V.Accordingly, the first line 10a and the second line 10b of the CAN bus 10 both have a potential of approximately 2.5 V, and the CAN bus 10 is in the second state in which the potential difference is small.

[0101] The receive switching circuit 606 is configured to include an inverter 61 and a switch SW3. Input to the receive switching circuit 606 are a signal output from the comparator 31 of the first communication IC 3 (i.e., a signal output in response to a message received by the first communication IC 3) and a signal output from the comparator 31 of the second communication IC 603 (i.e., a signal output in response to a message received by the second communication IC 603).

[0102] The SW3 switch of the receive switching circuit 606 selects, based on an anomaly detection signal output by the control IC 2, an input signal from the first communication IC 3 or a signal obtained by the inverter 61 inverting an input signal from the second communication IC 603, and outputs the selected signal. If no anomaly has been detected, as in Fig. As shown in Figure 8, the receive switching circuit 606 inputs a signal from the first communication IC 3 as input signal RXD into the control IC 2. If an anomaly has been detected, as shown in Figure 8, the control IC 2 receives a signal from the first communication IC 3 as input signal RXD. Fig. As shown in Figure 9, the receive switching circuit 606 inputs a signal RXD into the control IC 2, which is obtained by the inverter 61 inverting the logic of the signal from the second communication IC 603.

[0103] If the anomaly detection unit 22 has not detected an anomaly in a message on the CAN bus 10, the ECU 601 of embodiment 6 switches the switch of the transmit switching circuit 604 and the switch SW3 of the receive switching circuit 606 to the position shown in Fig. Figure 8 shows the state. In this state, the closing / opening of switch SW1 of the first communication IC 3 is controlled by control IC 2 based on an output signal TXD, and a message is sent to the CAN bus 10. In other words, for a "0" in a transmitted message, switch SW1 is switched to the closed state, resulting in a large potential difference on the CAN bus 10. For a "1" in a transmitted message, switch SW1 is switched to the open state, resulting in a small potential difference on the CAN bus 10. Furthermore, in this state, the output of comparator 31, which compares the potential of the first line 10a of the CAN bus 10 with the potential of the second line 10b, of the first communication IC 3 is input as RXD signals to control IC 2, and a received message is received by control IC 2.The operation of the ECU 601 in this state is the same as the operation of a conventional ECU, which performs the sending and receiving of messages according to a CAN communication scheme.

[0104] In contrast, if the anomaly detection unit 22 has detected a message anomaly, the ECU 601 switches the transmit switching circuit 604 and the receive switching circuit 606 switch SW3 to the position shown in the text. Fig.Figure 9 shows the state. In this state, the first line 10a of the CAN bus 10 is connected to a potential of 3.5 V via resistor R31 of the first communication IC 3, and the second line 10b is connected to a potential of 1.5 V via resistor R32 of the first communication IC 3. Therefore, the CAN bus 10 is fixed in the state where the potential difference is large. Because the CAN bus 10 is fixed in the so-called dominant state, a device that only performs communication according to a regular CAN communication scheme, such as a device improperly connected to the CAN bus 10, cannot perform recessive transmission, which leads to message transmission failures.

[0105] Furthermore, in a state where a message anomaly has been detected, the closing / opening of switch SW4 of the second communication IC 603 is controlled based on the output signal TXD of control IC 2, and a message is sent to CAN bus 10. In other words, switch SW4 is switched to the closed state based on a "0" in a transmitted message, and CAN bus 10 enters a state where the potential difference is small; and switch SW4 is switched to the open state based on a "1" in the transmitted message, and CAN bus 10 enters a state where the potential difference is large.

[0106] It should be noted, however, that the relationship between a "0" and a "1" of a message and the magnitudes of the potential difference of the CAN bus 10 is inverted in the state in which a message anomaly has been detected, compared to the state in which no message anomaly has been detected. Accordingly, in the state in which a message anomaly has been detected, a signal obtained by inverting an output of comparator 31 of the second communication IC 603 by inverter 61 of the receive switching circuit 6 is input as signal RXD into control IC 2, and a received message is received by control IC 2.

[0107] As a consequence of all authorized ECUs 601 connected to the CAN bus 10 performing such a method of switching the sending and receiving of messages based on anomaly detection, it is possible to block the sending of unauthorized messages performed by a device improperly connected to the CAN bus 10, but to continue sending and receiving messages to / from the authorized ECUs 601 even after an anomaly has been detected.The communication system according to embodiment 6 with the configuration described above uses, instead of the switch SW2 of the switching circuit 5 of the communication system according to embodiment 1, the switch SW4 of the second communication IC 603, which is configured to connect the first line 10a of the CAN bus 10 to the potential 1.5 V via the resistor R32 and the second line 10b of the CAN bus 10 to the potential 3.5 V via the resistor R31.If, in a state where, due to the detection of an anomaly by the anomaly detection unit 22, the first line 10a of the CAN bus 10 is connected via resistor R31 to a potential of 3.5 V and the second line 10b is connected to a potential of 1.5 V by switch SW1 of the first communication IC 3, and the switch SW4 of the second communication IC 603 connects the first line 10a of the CAN bus 10 via resistor R32 to a potential of 1.5 V and the second line 10b via resistor R31 to a potential of 3.5 V, then the first line 10a and the second line 10b of the CAN bus 10 both have a potential that is essentially between 3.5 V and 1.5 V, which means a potential of 2.5 V.In other words, the CAN bus 10, which was fixed in the first state, in which the potential difference is large, by the switch SW1 of the first communication IC 3, can be switched to the second state, in which the potential difference is small, by the switch SW4 of the second communication IC 603.

[0108] Accordingly, the communication system according to embodiment 6 can send a message to the CAN bus 10, which is fixed in the first state, even after an anomaly has been detected, by activating the switch SW4 of the second communication IC 603.

[0109] Furthermore, according to embodiment 6, the ECU 601 is equipped with two communication ICs: the first communication IC 3, comprising the first switch SW1, and the second communication IC 603, comprising the second communication IC 603. The first communication IC 3 and the second communication IC 603 have nearly identical configurations, and two substantially identical communication ICs are installed in the ECU 601. One can be identified as the first communication IC 3, and the other as the second communication IC 603. Existing CAN controller ICs or the like can be used as the two communication ICs, and sending messages using switch SW4 when an anomaly is detected can be implemented using these existing communication ICs.

[0110] Furthermore, in the ECU 601, the first communication IC 3 and the second communication IC 603 each have a comparator 31 for receiving a message. If no anomaly has been detected, a message can be received by the comparator 31 of the first communication IC 3. In the communication system according to embodiment 6, depending on whether an anomaly has been detected by the anomaly detection unit 22 or not, the relationship between the dominant and recessive states of the first and second states of the CAN bus 10 is inverted, and the correspondence relationship between a "0" and a "1", which form a transmit message, and the first and second states of the CAN bus 10, respectively, is also inverted.Accordingly, the ECU 601, using the inverter 61, inverts the logic of a value output by the comparator 31 of the second communication IC 603, and by performing message reception using a signal output by the inverter 61 if an anomaly has been detected, the ECU 601 can receive a message regardless of whether an anomaly has been detected or not.

[0111] It should be noted that embodiment 6 has a configuration in which, after the CAN bus 10 has been fixed in the first state (where the potential difference is large) by switch SW1 of the first communication IC 3 following the detection of an anomaly by the anomaly detection unit 22, message transmission is performed using switch SW4 of the second communication IC 603. Furthermore, embodiments 1 to 5 have a configuration in which, after the CAN bus 10 has been fixed in the first state (where the potential difference is large) by switch SW1 of the communication IC 3 following the detection of an anomaly by the anomaly detection unit 22, switch SW2, which is configured to connect the first line 10a and the second line 10b of the CAN bus 10 via resistor R41, is used to perform message transmission.The procedure for executing message transmission after the CAN bus 10 has been locked in the first state upon anomaly detection is not limited to this. The switch for executing message transmission after anomaly detection can have any configuration, provided that, by switching the line and the interruption, it can switch the CAN bus 10 between the second state and the first state when it has been locked in the first state by switch SW1 of the first communication IC 3.

[0112] Furthermore, the communication system according to embodiment 6 can also employ a configuration for executing a notification of the fact that an anomaly has been detected, as in the communication system according to embodiment 2. In addition, the communication system according to embodiment 6 can also include a configuration for forwarding a message between multiple CAN buses 10, as in the gateway 510 according to embodiment 5.

[0113] Furthermore, the remaining configurations of the communication system according to embodiment 6 are the same as those of the communication system according to embodiment 1, and therefore the same reference numerals are assigned to the same components, and their detailed descriptions are omitted. REFERENCE MARK LIST 1 ECU (communication device) 2 Control ICs (Anomaly Notification Units) 3 Communication ICs 4. Transmit switching circuit (switching control unit, output destination switching unit) 5 switching circuit 6. Receive switching circuit 10 CAN bus (bus) 10a First line 10b Second line 21 Communication processing unit 22 Anomaly Detection Unit 31 Comparator 61 Inverter 301 ECU (communication device) 303 Communication IC 401 ECU (Communication Device) 402 Control IC 420 Control circuit 502 Control IC 510 Gateway (communication device, forwarding device) 521 Forwarding processing unit 601 ECU 603 Communication IC 604 Transmit switching circuit 606 Receive switching switch R11, R12 Termination resistor R21, R22 resistor (first resistor) R31, R31 resistor R41 resistor SW1 switch (first switch) SW2 switch (second switch) SW3 switch SW4 switch (second switch)

Claims

Communication system in which several communication devices (1, 301, 401, 510) are interconnected via a two-wire bus (10), wherein the communication devices (1, 301, 401, 510) are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each of the communication devices (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information,which form the generated message; and a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential, at least one communication device (1, 301, 401, 510) comprising an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), and characterized in that at least two communication devices (1, 301, 401, 510), including the at least one communication device (1, 301, 401, 510), comprise: a switching control unit (4) for switching,If the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) is configured such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) is configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41). Communication system according to claim 1, wherein the first switch (SW1) connects the first line (10a) to the first potential, which is greater than the common potential, and connects the second line (10b) to the second potential, which is less than the common potential, if a value of the binary information output by the communication processing unit (21) is a first value, and the first switch (SW1) disconnects the first line (10a) from the first potential and disconnects the second line (10b) from the second potential if the value of the binary information output by the communication processing unit (21) is a second value, and the second switch (SW2) disconnects the first line (10a) and the second line (10b) from each other if the anomaly detection unit (22) has not detected an anomaly, and the second switch (SW2) connects the first line (10a) and the second line (10b) via the second resistor (R41).if the anomaly detection unit (22) has detected an anomaly and the value of a message to be sent is the first value, and the second switch (SW2) disconnects the first line (10a) and the second line (10b) from each other, if the anomaly detection unit (22) has detected an anomaly and the value of the message to be sent is the second value. Communication system according to claim 1 or 2, wherein the at least two communication devices (1, 301, 401, 510) have an output target switching unit (4) for switching the output target of the binary information output by the communication processing unit (21) to the first switch (SW1) if the anomaly detection unit (22) has not detected an anomaly, and to the second switch (SW2) if the anomaly detection unit (22) has detected an anomaly. Communication system according to any one of claims 1 to 3, wherein each of the communication devices (1, 301, 401, 510) has a comparator (31) for comparing the potential of the first line (10a) with the potential of the second line (10b) and for outputting a value corresponding to the potential difference, wherein the communication device (1, 301, 401, 510) that receives a message from the communication processing unit (21) receives the value output from the comparator (31), and the at least two communication devices (1, 301, 401, 510) have an inverter (61) for inverting the logic of the value output from the comparator (31) and for receiving a message from the communication processing unit (21) that receives a value output from the inverter (61) if the anomaly detection unit (22) has detected an anomaly. Communication system according to one of claims 1 to 4, wherein the at least one communication device (1, 301, 401, 510) comprising the anomaly detection unit (22) comprises an anomaly notification unit for notifying another communication device (1, 301, 401, 510) of the anomaly if the anomaly detection unit (22) has detected an anomaly. Communication system according to one of claims 1 to 5, wherein the at least two communication devices (1, 301, 401, 510) comprise a communication IC (3, 303, 603) comprising the first switch (SW1), the second switch (SW2) and the switching control unit (4). Communication system according to one of claims 1 to 5, wherein the at least two communication devices (1, 301, 401, 510) comprise a control IC (2, 402, 502) comprising the communication processing unit (21), the second switch (SW2) and the switching control unit (4). Communication system according to one of claims 1 to 7, wherein several buses (10) are connected to the at least one communication device (1, 301, 401, 510) and the at least one communication device (1, 301, 401, 510) has a forwarding device (510) for forwarding a message between the buses (10). Communication system in which several communication devices (1, 301, 401, 510) are interconnected via a two-wire bus (10), wherein the communication devices (1, 301, 401, 510) are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each of the communication devices (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information,forming the generated message; and a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential, comprising at least one communication device (1, 301, 401, 510) an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), and characterized in that at least two communication devices (1, 301, 401, 510) including the at least one communication device (1, 301, 401, 510) comprise: a switching control unit (4) for switching,If the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) is configured such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) is configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) to the second potential and the second line (10b) to the first potential. Communication system according to claim 9, wherein the at least two communication devices (1, 301, 401, 510) comprise a first communication IC (3) comprising the first switch (SW1) and a second communication IC (603) comprising the second switch (SW2). Communication system according to claim 10, wherein each of the communication devices (1, 301, 401, 510) has at least one comparator (31) for comparing the potential of the first line (10a) with the potential of the second line (10b) and for outputting a value corresponding to the potential difference, wherein the communication device (1, 301, 401, 510) that receives a message from the communication processing unit (21) receives the value output from the comparator (31), and the first communication IC (3) and the second communication IC (603) have the respective comparators (31), the at least two communication devices (1, 301, 401, 510) have an inverter (61) for inverting the logic of the value output from the comparator (31) of the second communication IC (603), and the at least two communication devices (1, 301, 401,510) are configured to: receive a message from the communication processing unit (21) that receives a value output by the comparator (31) of the first communication IC (3) if the anomaly detection unit (22) has not detected an anomaly, and receive a message from the communication processing unit (21) that receives a value output by the inverter (61) if the anomaly detection unit (22) has detected an anomaly. Communication system in which several communication devices (1, 301, 401, 510) are interconnected via a two-wire bus (10), wherein the communication devices (1, 301, 401, 510) are configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each of the communication devices (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information,which form the generated message; and a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential, at least one communication device (1, 301, 401, 510) comprising an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), and characterized in that at least two communication devices (1, 301, 401, 510), including the at least one communication device (1, 301, 401, 510), comprise: a switching control unit (4) for switching,If the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) is configured such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) is configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state. Communication device (1, 301, 401, 510) to which a two-wire bus (10) is connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22) and the communication device (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential;and an anomaly detection unit (22) for detecting an anomaly in a message transmitted on the bus (10), characterized in that the communication device (1, 301, 401, 510) further comprises: a switching control unit (4) for switching, if the anomaly detection unit (22) has detected an anomaly, the first switch (SW2) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state;and a second switch (SW2) configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41). Communication device (1, 301, 401, 510) to which a two-wire bus (10) is connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22) and the communication device (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message; and a first switch (SW1) that is configuredto be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential that is greater than the common potential and by connecting the second line (10b) to a second potential that is less than the common potential, an anomaly detection unit (22) for detecting an anomaly in a message transmitted on the bus (10), characterized in that the communication device (1, 301, 401, 510) further comprises a switching control unit (4) for switching, if the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential,which brings the bus (10) into the first state; and a second switch (SW2) configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) to the second potential and the second line (10b) to the first potential. Communication device (1, 301, 401, 510) to which a two-wire bus (10) is connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22) and the communication device (1, 301, 401, 510) comprises: a communication processing unit (21) for generating a message to be sent and for sequentially outputting binary information that constitutes the generated message;a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the communication processing unit (21) and to bring the bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential;and an anomaly detection unit (22) for detecting an anomaly in a message transmitted on the bus (10), characterized in that the communication device (1, 301, 401, 510) further comprises: a switching control unit (4) for switching, if the anomaly detection unit (22) has detected an anomaly, the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) configured to switch between a closed and an open state based on the binary information output by the communication processing unit (21) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state. A forwarding device (510) to which several two-wire buses (10) are connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and to forward the message between the buses (10), wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), and the forwarding device (510) comprises: a forwarding processing unit (521) for receiving a message and forwarding the received message by generating a message to be sent and sequentially outputting binary information,forming the generated message; a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the forwarding processing unit (521) and to bring the corresponding bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential; and an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), characterized in that the forwarding device (510) further comprises: a switching control unit (4) for switching the first switch (SW1) if the anomaly detection unit (22) has detected an anomaly, such thatthat the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) configured to be switched between a closed and an open state based on the binary information output by the forwarding processing unit (521) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41). A forwarding device (510) to which several two-wire buses (10) are connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and to forward the message between the buses (10), wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R41), and the forwarding device (510) comprises: a forwarding processing unit (521) for receiving a message and forwarding the received message by generating a message to be sent and sequentially outputting binary information,forming the generated message; a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the forwarding processing unit (521) and to bring the corresponding bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential; and an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), characterized in that the forwarding device (510) further comprises: a switching control unit (4) for switching the first switch (SW1) if the anomaly detection unit (22) has detected an anomaly, such thatthat the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) configured to be switched between a closed and an open state based on the binary information output by the forwarding processing unit (521) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state by connecting the first line (10a) to the second potential and the second line (10b) to the first potential. A forwarding device (510) to which several two-wire buses (10) are connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that constitutes the message, and to forward the message between the buses (10), wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), and the forwarding device (510) comprises: a forwarding processing unit (521) for receiving a message and forwarding the received message by generating a message to be sent and sequentially outputting binary information,forming the generated message; a first switch (SW1) configured to be switched between a closed and an open state based on the binary information output by the forwarding processing unit (521) and to bring the corresponding bus (10) into the first state by connecting the first line (10a) to a first potential greater than the common potential and by connecting the second line (10b) to a second potential less than the common potential; and an anomaly detection unit (22) for detecting an anomaly in a message sent on the bus (10), characterized in that the forwarding device (510) further comprises a switching control unit (4) for switching the first switch (SW1) if the anomaly detection unit (22) has detected an anomaly, such thatthat the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and a second switch (SW2) configured to switch between a closed and an open state based on the binary information output by the forwarding processing unit (521) if the anomaly detection unit (22) has detected an anomaly, and to bring the bus (10) into the second state. Communication IC (3, 303, 603), to which a two-wire bus (10) is connected and which is configured to send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of the bus (10) is large, and a second state, in which the potential difference is small, to binary information that forms the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R41), and the communication IC (3, 303, 603) comprises: a first switch (SW1) which is configured to connect the bus (10) by connecting the first line (10a) to a first potential that is greater than the common potential, and by connecting the second line (10b) to a second potential that is less than the common potential.to bring into the first state, characterized in that the communication IC (3, 303, 603) further comprises: a second switch (SW2) configured to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41); a switching control unit (4) for switching, if an anomaly has been detected in a message transmitted on the bus (10), the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, thereby bringing the bus (10) into the first state; and an output destination switching unit (4) into which binary information forming a transmit message is input, and which is configured to switch an output destination of the input binary information to the first switch (SW1) if no anomaly has been detected.and to the second switch (SW2) if such an anomaly has been detected. A control IC (2, 402, 502) that sends a message to a communication IC (3, 303, 603) having a first switch (SW1) by outputting a signal to control the first switch (SW1) to be in a closed or an open state, wherein the first switch (SW1) is configured to connect a first line (10a) of a two-wire bus (10) to a first potential greater than the common potential and to connect a second line (10b) of the two-wire bus (10) to a second potential less than the common potential, wherein the first line (10a) and the second line (10b) of the two-wire bus (10) are connected to a common potential via respective first resistors (R21, R22), wherein the control IC (2, 402, 502) comprises: a communication processing unit (21) for generating a message to be sent and for the sequential output of binary information,which form the generated message, characterized in that the control IC (2, 402, 502) further comprises: a second switch (SW2) for connecting the first line (10a) and the second line (10b) via a second resistor (R41); a switching control unit (4) for switching, if an anomaly has been detected in a message transmitted on the bus (10), the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential; and an output destination switching unit (4) for switching an output destination of the binary information from the communication processing unit (21) to the first switch (SW1) if no anomaly has been detected, and to the second switch (SW2) if such an anomaly has been detected. Communication method for multiple communication devices (1, 301, 401, 510) that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of a bus (10) is large, and a second state, in which the potential difference is small, to binary information forming the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each communication device (1, 301, 401, 510) switches a first switch (SW1) between a closed and an open state based on binary information forming a message to be sent, and transmits the message, wherein the first switch (SW1) is configured to connect the bus (10) to a first potential by connecting the first line (10a) to a first potential.that is greater than the common potential, and by connecting the second line (10b) to a second potential that is smaller than the common potential, to bring it into the first state, at least one communication device (1, 301, 401, 510) detects an anomaly in a message sent on the bus (10), and characterized in that, if the anomaly has been detected, at least two communication devices (1, 301, 401, 510) including the at least one communication device (1, 301, 401, 510) on the basis of binary information forming the message to be sent, switch the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, and switch a second switch (SW2) between a closed state and an open state and send the message, wherein the second switch (SW2) is configured,to bring the bus (10) into the second state by connecting the first line (10a) and the second line (10b) via a second resistor (R41). Communication method for multiple communication devices (1, 301, 401, 510) that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of a bus (10) is large, and a second state, in which the potential difference is small, to binary information forming the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each communication device (1, 301, 401, 510) switches a first switch (SW1) between a closed and an open state based on binary information forming a message to be sent, and transmits the message, wherein the first switch (SW1) is configured to connect the bus (10) to a first potential by connecting the first line (10a) to a first potential.that is greater than the common potential, and by connecting the second line (10b) to a second potential that is smaller than the common potential, to bring it into the first state, at least one communication device (1, 301, 401, 510) detects an anomaly in a message sent on the bus (10), and characterized in that, if the anomaly has been detected, at least two communication devices (1, 301, 401, 510) including the at least one communication device (1, 301, 401, 510) on the basis of binary information forming the message to be sent, switch the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, and switch a second switch (SW2) between a closed state and an open state and send the message, wherein the second switch (SW2) is configured,to bring the bus (10) into the second state by connecting the first line (10a) to the second potential and the second line (10b) to the first potential. Communication method for multiple communication devices (1, 301, 401, 510) that send and receive a message using a differential communication scheme by assigning a first state, in which a potential difference between a first line (10a) and a second line (10b) of a bus (10) is large, and a second state, in which the potential difference is small, to binary information forming the message, wherein the first line (10a) and the second line (10b) are connected to a common potential via respective first resistors (R21, R22), each communication device (1, 301, 401, 510) switches a first switch (SW1) between a closed and an open state based on binary information forming a message to be sent, and transmits the message, wherein the first switch (SW1) is configured to connect the bus (10) to a first potential by connecting the first line (10a) to a first potential.that is greater than the common potential, and by connecting the second line (10b) to a second potential that is smaller than the common potential, to bring it into the first state, at least one communication device (1, 301, 401, 510) detects an anomaly in a message sent on the bus (10), and characterized in that, if the anomaly has been detected, at least two communication devices (1, 301, 401, 510) including the at least one communication device (1, 301, 401, 510) on the basis of binary information forming the message to be sent, switch the first switch (SW1) such that the first line (10a) is connected to the first potential and the second line (10b) is connected to the second potential, and switch a second switch (SW2) between a closed state and an open state and send the message, wherein the second switch (SW2) is configured,to bring the bus (10) into the second state.

Images