Relay device, control method, and computer program

Abstract

To provide a relay device, a control method, and a computer program for suppressing power consumption of an on-vehicle system by stopping a second on-vehicle control device belonging to a cluster whose abnormality is determined.SOLUTION: An on-vehicle system 1 comprises a relay device for relaying communication among on-vehicle control devices 3a to 3f mutually communicable through a communication bus. The relay device comprises: a monitoring unit for monitoring a reception situation of a first cluster frame transmitted to a second on-vehicle control device by a first on-vehicle control device for executing a first function belonging to a first cluster to acquire an occurence situation; a determination unit for determining whether or not the first cluster is normal on the basis of the occurence situation and a determination criterion on frame occurence situations; and a start control unit that transmits the first cluster frame transmitted from the first on-vehicle control device to the second on-vehicle control device when it is determined that the first cluster is normal and does not transmit the first cluster frame transmitted from the first on-vehicle control device to the second on-vehicle control device when it is determined that the first cluster is abnormal.SELECTED DRAWING: Figure 8

Description

[Technical field]

[0001] The present disclosure relates to a relay device, a control method, and a computer program. [Background technology]

[0002] A vehicle is equipped with various in-vehicle devices, such as control system ECUs (Electronic Control Units) that control the engine, transmission, etc., vehicle body ECUs that control headlights, power windows, etc., and information system ECUs for navigation devices, multimedia devices, etc. In recent years, in an in-vehicle system in which each in-vehicle device is connected via a bus network, a partial network function has been developed that divides the in-vehicle devices into clusters called PNCs (Partial Network Clusters) for each function (service), wakes up the in-vehicle devices of the PNCs used to execute the service, and puts the other in-vehicle devices of the PNCs into sleep mode. The partial network function is standardized in ISO (International Organization for Standardization) 11898-6.

[0003] Non-Patent Document 1 discloses a technique for communicating PNC request and release information between ECUs using a network management message (NM message).

[0004] Patent Document 1 discloses a monitoring system that includes a control device that controls power supply from a main battery to a sub-battery, and a comparator that compares the battery voltage of the sub-battery with a reference voltage and starts the control device when the battery voltage falls below the reference voltage, and when the control device starts, starts power supply control. The monitoring system prevents the battery from being excessively discharged, for example, causing the terminal voltage of the battery to drop to a level where electronic equipment connected to the battery cannot operate (hereinafter referred to as excessive discharge). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-146462 A [Non-patent literature]

[0006] [Non-Patent Document 1] AUTOSAR Layered Software Architecture,[online],[Retrieved February 23, 2023],Internet <https: / / www.autosar.org / fileadmin / standards / classic / 22-11 / AUTOSAR_EXP_LayeredSoftwareArchitecture.pdf> p.182-p.186 Summary of the Invention [Problem to be solved by the invention]

[0007] There is a demand for further reduction in power consumption in in-vehicle systems. [Means for solving the problem]

[0008] A relay device according to one embodiment of the present disclosure is a relay device that relays communications between vehicle-mounted control devices that can communicate with each other via a communication bus, and includes: a receiving unit that receives a first cluster frame transmitted by a first vehicle-mounted control device belonging to a first cluster that executes a first function to a second vehicle-mounted control device belonging to the first cluster; a monitoring unit that monitors the reception status of frames by the receiving unit and acquires an occurrence status of the first cluster frame transmitted from the first vehicle-mounted control device to the second vehicle-mounted control device; a determination unit that determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit and a determination criterion related to the frame occurrence status; and a start-up control unit that transmits the first cluster frame transmitted from the first vehicle-mounted control device to the second vehicle-mounted control device when the determination unit determines that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first vehicle-mounted control device to the second vehicle-mounted control device when the determination unit determines that the first cluster is abnormal.

[0009] The present disclosure can be realized not only as a relay device having the above-described characteristic configuration, a control method in which characteristic processing in the relay device is performed as steps, and a control program for causing the relay device to execute the characteristic processing, but also as a part or all of the relay device as a semiconductor integrated circuit. Effect of the Invention

[0010] According to the present disclosure, it is possible to suppress power consumption of the in-vehicle system by shutting down the second in-vehicle control device that belongs to a cluster that has been determined to be abnormal. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an example of a configuration of an in-vehicle system including a relay device according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a configuration of a relay device according to the first embodiment. [Diagram 3]FIG. 3 is a block diagram illustrating an example of the configuration of the on-board control device according to the first embodiment. [Figure 4] FIG. 4 is an example of a cluster table showing the in-vehicle control devices belonging to each cluster. [Diagram 5] FIG. 5 is a functional block diagram illustrating an example of functions of the relay device according to the first embodiment. [Figure 6] FIG. 6 is a diagram showing an example of a criterion for determining whether a cluster is normal or abnormal. [Figure 7] FIG. 7 is a schematic diagram showing the data flow when the cluster frame generation situation is normal. [Figure 8] FIG. 8 is a schematic diagram showing the data flow when the occurrence of cluster frames is abnormal. [Figure 9] FIG. 9 is a schematic diagram showing the data flow when the occurrence of cluster frames is abnormal. [Figure 10] FIG. 10 is a flowchart illustrating an example of the operation of the relay device according to the first embodiment. [Figure 11] FIG. 11 is a functional block diagram illustrating an example of functions of the relay device according to the second embodiment. [Figure 12] FIG. 12 is a flowchart illustrating an example of the operation of the relay device according to the second embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of a determination criterion in a modified example of a relay device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] <Overview of the embodiment of the present disclosure> Below, an overview of the embodiments of the present disclosure will be listed and described.

[0013] (1) A relay device according to the present embodiment is a relay device that relays communication between in-vehicle control devices that can communicate with each other via a communication bus, and includes a receiving unit that receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster, a monitoring unit that monitors a reception status of the frame by the receiving unit and acquires an occurrence status of the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device, a determining unit that determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit and a determination criterion related to the occurrence status of the frame, and a start control unit that transmits the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determining unit determines that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determining unit determines that the first cluster is abnormal. This stops the second in-vehicle control device belonging to the cluster that is determined to be abnormal, thereby reducing power consumption of the in-vehicle system.

[0014] (2) In the above (1), when the determination unit determines that the first cluster is abnormal, the start control unit may transmit a stop frame for stopping the second in-vehicle control device to the second in-vehicle control device, whereby the relay device can actively stop the second in-vehicle control device.

[0015] (3) In the above (1), the occurrence status of the first cluster frame may include at least one of a duration during which the plurality of first cluster frames are periodically transmitted or a number of occurrences of the first cluster frames. This makes it possible to determine whether the first cluster executing the first function is normal or abnormal based on the duration or number of occurrences of an abnormal frame.

[0016] (4) In the above (1), the determination unit may determine whether the first cluster is normal or abnormal based on a first determination criterion when a power storage device that supplies power to the on-board control device is not being charged, and may determine whether the first cluster is normal or abnormal based on a second determination criterion that is more relaxed than the first determination criterion when the power storage device is being charged. This makes it possible to appropriately determine whether the cluster is normal or abnormal in accordance with cases in which the cluster must be determined to be abnormal when the power storage device is not being charged, and in which the cluster cannot be deemed to be abnormal when the power storage device is being charged.

[0017] (5) In the above (1), the receiving unit may receive a second cluster frame transmitted by a third in-vehicle control device belonging to a second cluster executing a second function to a fourth in-vehicle control device belonging to the second cluster, the monitoring unit acquires an occurrence status of the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device, the determining unit judges whether the second cluster is normal or abnormal based on the occurrence status of the second cluster frame acquired by the monitoring unit and the judgment criterion, and the start control unit may transmit the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device when the determining unit judges that the second cluster is normal and when the determining unit judges that the second cluster is abnormal. Thereby, even when the determining unit judges that a cluster is abnormal, when it is necessary to execute a function of the cluster, the function can be executed.

[0018] (6) In the above (5), the first function may be a function executed when a remaining amount of stored power of a power storage device that supplies power to the on-board control device is equal to or greater than a certain value, and the second function may be a function executed even when the remaining amount of stored power is less than a certain value. In this way, when the determination unit determines that a cluster is abnormal and it is necessary to execute a function of the cluster even if the remaining amount of stored power of the power storage device is less than a certain value, the function can be executed.

[0019] (7) In the above (1), a notification unit may be further provided that notifies a user that the first cluster is abnormal when the determination unit determines that the first cluster is abnormal. This allows the user to know that the cluster is abnormal. The notification can then be used as a trigger for the user to take action.

[0020] (8) In the above (7), when the notification unit notifies the relay device that the first cluster is abnormal, and the relay device receives a command from the user to continue executing the first function, the start control unit may transmit the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device. In this way, even if the cluster is determined to be abnormal, the cluster can execute the function based on the user's instruction when the user intends.

[0021] (9) In the above (1), the first vehicle control device may further belong to a second cluster that executes a second function different from the first function, and the determination unit may determine whether the first cluster is normal or abnormal based on a first determination criterion when the first function is executed alone, and may determine whether the first cluster is normal or abnormal based on a second determination criterion that is looser than the first determination criterion when the first function and the second function are executed simultaneously. This makes it possible to avoid a situation in which a load is placed on the first vehicle control device that belongs to both clusters when the first function and the second function are executed simultaneously, and a false determination that an abnormality is occurring when in fact not occurring is made based on the determination criterion of the first cluster or the determination criterion of the second cluster.

[0022] (10) In the above (1), the determination criterion may be determined based on a storage capacity of a power storage device that supplies power to the on-board control device and an amount of power consumed by the first cluster. In this way, the determination criterion is determined so that the cluster does not use up all the power of the power storage device, and excessive discharge of the power storage device can be avoided.

[0023] (11) A control method according to the present embodiment is a control method for controlling a relay device that relays communication between in-vehicle control devices that can communicate with each other via a communication bus, the control method including the steps of: receiving a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster; monitoring a reception status of the received frame and acquiring an occurrence status of the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device; judging whether the first cluster is normal or abnormal based on the acquired occurrence status of the first cluster frame and a judgment criterion for the occurrence status of the frame; transmitting the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when it is judged that the first cluster is normal, and not transmitting the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when it is judged that the first cluster is abnormal. This stops the second in-vehicle control device belonging to the cluster judged to be abnormal, thereby reducing power consumption of the in-vehicle system.

[0024] (11) A computer program according to the present embodiment is a computer program used by a relay device that relays communication between in-vehicle control devices that can communicate with each other via a communication bus, and executes the following steps: receiving a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster; monitoring a reception status of the received frame and acquiring an occurrence status of the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device; determining whether the first cluster is normal or abnormal based on the acquired occurrence status of the first cluster frame and a determination criterion for the occurrence status of the frame; transmitting the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when it is determined that the first cluster is normal, and not transmitting the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when it is determined that the first cluster is abnormal. As a result, the second in-vehicle control device belonging to the cluster determined to be abnormal can be stopped, and power consumption of the in-vehicle system can be reduced.

[0025] <Embodiment 1> [1. Details of the First Embodiment of the Present Disclosure] Hereinafter, the details of the embodiments of the present disclosure will be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any combination.

[0026] [1-1. In-vehicle systems] 1 is a block diagram showing an example of a configuration of an in-vehicle system including a relay device according to embodiment 1. The in-vehicle system 1 is mounted on a vehicle. The relay device may be called an integrated ECU or a gateway.

[0027] The in-vehicle system 1 according to the first embodiment includes a relay device 2, and an in-vehicle control device 3a, an in-vehicle control device 3b, an in-vehicle control device 3c, an in-vehicle control device 3d, an in-vehicle control device 3e, and an in-vehicle control device 3f. The in-vehicle control device may be called an ECU, and may be referred to as an ECU hereinafter. The in-vehicle system 1 is an in-vehicle network configured by the relay device 2, the ECU3a, the ECU3b, the ECU3c, the ECU3d, the ECU3e, and the ECU3f, and a communication cable (communication bus) connecting them. The ECU3a, the ECU3b, the ECU3c, the ECU3d, the ECU3e, and the ECU3f may be collectively referred to as "ECU3" hereinafter.

[0028] A plurality of ECUs 3 are arranged in various parts of the vehicle. The ECUs 3 individually control the hardware of each part of the vehicle and monitor the state of the hardware of each part of the vehicle. For example, the ECUs 3 are ECUs for a control system, a vehicle body, and an information system.

[0029] The relay device 2 is connected to each of the ECUs 3 via communication buses 12a, 12b, and 12c such as a CAN (Controller Area Network) bus. Specifically, the relay device 2 includes communication interfaces (communication I / F) 11a, 11b, and 11c. The communication I / F 11a is connected to the communication bus 12a. The ECUs 3a and 3d are connected to the communication bus 12a. The communication I / F 11b is connected to the communication bus 12b. The ECUs 3b and 3e are connected to the communication bus 12b. The ECUs 3c and 3f are connected to the communication bus 12c. The relay device 2 can communicate with each of the ECUs 3 mutually.

[0030] Each of the ECUs 3 includes communication I / Fs 13a, 13d, 13b, 13e, 13c, and 13f connected to the communication bus. The communication I / Fs 13a, 13d, 13b, 13e, 13c, and 13f are corresponding I / Fs corresponding to the partial network function. The ECUs 3 use a communication protocol corresponding to the partial network function. The communication protocol is, for example, CAN, CAN FD (CAN with Flexible Data Rate), or CAN PN (CAN with Partial Networking).

[0031] The relay device 2 has a function as a gateway that relays communication between ECUs 3. The ECUs 3 can transmit frames. The relay device 2 relays frames between ECUs connected to different buses. For example, the relay device 2 can relay frames between an ECU 3a connected to the communication bus 12a, an ECU 3b connected to the communication bus 12b, and an ECU 3f connected to the communication bus 12c. This allows frames to be transmitted and received between, for example, the ECUs 3a and 3d connected to the communication bus 12a, the ECUs 3b and 3e connected to the communication bus 12b, and the ECUs 3c and 3f connected to the communication bus 12c.

[0032] [2. Configuration of relay device] In the first embodiment, a partial network function is available in the relay device 2 and the ECU 3. The hardware configuration of the relay device 2 will be described below.

[0033] 2 is a block diagram showing an example of the configuration of a relay device according to embodiment 1. The relay device 2 has a microcontroller unit 21 (hereinafter referred to as "microcomputer 21") including a control unit 22 and a memory 23, and a plurality of communication I / Fs 11a, 11b, and 11c. The control unit 22, the memory 23, and the communication I / Fs 11a, 11b, and 11c are electrically connected by an internal bus 24.

[0034] The control unit 22 includes a circuit configuration such as a processor. Specifically, the control unit 22 includes one or more CPUs (Central Processing Units). The processor included in the control unit 22 may be a GPU (Graphics Processing Unit). In this case, the control unit 22 reads out a computer program stored in the memory 23 and executes various calculations and controls.

[0035] The control unit 22 may include a processor in which a predetermined program is written in advance. For example, the control unit 22 may be an integrated circuit such as a Complex Programmable Logic Device (CPLD), a Field Programmable Gate Array (FPGA), or an Application Specific Integrated Circuit (ASIC). In this case, the control unit 22 executes various calculations and controls based on the program written in advance.

[0036] The memory 23 has a volatile memory and a non-volatile memory, and stores various data. The volatile memory includes, for example, a RAM (Random Access Memory). The non-volatile memory includes, for example, a flash memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a ROM (Read Only Memory). A part of the non-volatile memory may be provided outside the microcomputer 21.

[0037] The memory 23 stores, for example, a computer program, cluster information (described later), and various parameters in a non-volatile memory. The memory 23 may store a computer program downloaded from an external device (not shown) via a network (not shown) and a communication device (not shown).

[0038] The communication I / Fs 11a, 11b, and 11c receive signals passing through the communication buses 12a, 12b, and 12c via ports (not shown), and convert them into signals that can be read by the microcomputer 21. The communication I / Fs 11a, 11b, and 11c are connected to the communication buses 12a, 12b, and 12c, respectively. [1-3.ECU configuration] The hardware configuration of the ECU 3 will be described below.

[0039] 3 is a block diagram showing an example of the configuration of an ECU according to embodiment 1. The ECU 3a includes a microcontroller unit 31, a communication I / F 11a, and a peripheral circuit 34. The configurations of the ECUs 3b, 3c, 3d, 3e, and 3f are similar to that of the ECU 3a.

[0040] The microcontroller unit 31 (hereinafter referred to as "microcomputer 31") has the same configuration as the microcomputer 21 of the relay device 2 described above. That is, the microcomputer 31 includes a control unit (processor) 32 and a memory 33 including a non-volatile memory and a volatile memory. The microcomputer 31 may also include a peripheral circuit 34 and a communication I / F 11a.

[0041] The memory 33 stores a control program, which is a computer program, and data used to execute the control program. The control program can be stored in a recording medium such as a flash memory, a ROM, or a CD-ROM. The processor 32 enables the ECU 3a to use the partial network function by the control program.

[0042] The peripheral circuit 34 includes a serial communication circuit conforming to a standard such as UART, I2C, or SPI. The serial communication circuit of the peripheral circuit 34 is connected to a device or sensor that is the control target of the ECU 3a, and can receive a signal output from the sensor and transmit a control signal to the control target.

[0043] The communication I / F 11a is a communication interface that complies with the above-mentioned communication protocol for the in-vehicle network and is an I / F that supports the partial network function.

[0044] The ECU 3 receives power from the power storage device and operates using the received power. Since the power stored in the power storage device is limited, it is desirable for the ECU to transition to a sleep mode that consumes less power than the normal mode after a predetermined process is completed in order to reduce power consumption as much as possible. If the ECU operates for a long period of time, the power stored in the power storage device gradually decreases, and the terminal voltage of the power storage device drops to such an extent that the ECU connected to the power storage device will not operate, resulting in an over-discharge state, so it is desirable for the ECU to transition to the sleep mode appropriately.

[0045] [1-4. Cluster] 4 is an example of a cluster table showing ECUs belonging to each cluster. Clusters will be described below. Each ECU 3 belongs to at least one cluster. The memory 23 of the relay device 2 stores a cluster table 41 that links the ECUs 3 with the clusters to which the ECUs 3 belong. The cluster table 41 may be stored in each ECU 3.

[0046] A cluster may be defined, for example, for each function provided to a user, the function being executed by one or more ECUs.

[0047] Examples of functions executed by multiple ECUs include automatic sliding doors, perimeter monitoring using image sensors, and charging the traction battery (high-voltage battery) in an electric vehicle.

[0048] The function of the automatic sliding door is executed by, for example, a body ECU that controls movable parts of the vehicle body (door lock, power windows, door mirrors, etc.) and an input ECU that accepts switch inputs from the user. For this reason, the body ECU and the input ECU belong to the same cluster.

[0049] Surroundings monitoring using an image sensor is performed by a sensor ECU to which a human presence sensor that detects people around the vehicle is connected, and an image ECU that acquires images from the image sensor. For this reason, the sensor ECU and the image ECU belong to the same cluster.

[0050] Charging of the driving battery is performed, for example, by a charging ECU that controls charging of the driving battery and a detection ECU that detects whether a plug that transmits charging power from a charging station is connected to a receptacle of a vehicle that receives the charging power. For this reason, the charging ECU and the detection ECU belong to the same cluster.

[0051] Some functions are performed by a single ECU. Therefore, it is possible to have a cluster that contains only one ECU. Examples of functions performed by a single ECU are automatic adjustment of the steering wheel, automatic adjustment of the seats, etc.

[0052] The automatic adjustment of the steering is performed by the steering ECU that controls the power steering, so only the steering ECU belongs to one cluster.

[0053] Automatic seat adjustment is performed by the seat ECU that controls the power seat, so only the seat ECU belongs to one cluster.

[0054] Cluster table 41 shown in Fig. 4 indicates which ECUs belong to each of three clusters PNC1 to PNC3. Note that the number of clusters in Fig. 4 is an example, and three or more clusters may be prepared. Fewer than three clusters may also be prepared. In the table, "1" indicates that the ECU belongs to the cluster in that row, and "0" indicates that the ECU does not belong to the cluster in that row.

[0055] For example, ECUs 3a and 3d belong to cluster PNC1. ECUs 3d and 3e belong to cluster PNC2. ECUs 3c and 3f belong to cluster PNC3. In the following description, "waking up ECUs 3a and 3b belonging to cluster PNC1" is also simply expressed as "waking up cluster PNC1." Similar expressions are used for the other clusters PNC2 to PNC3.

[0056] [1-5. Operation mode] The operation mode and wake-up operation of the ECU 3 corresponding to the partial network function will be described.

[0057] The operation modes of the ECU 3 include a normal mode and a sleep mode. In the normal mode, the ECU 3 is in operation, and is capable of controlling a control target and communicating with other ECUs 3. In the sleep mode, the ECU 3 is in a stopped state except for some functions of the communication I / Fs 13a, 13b, 13c, 13d, 13e, and 13f. The communication I / Fs 13a, 13b, 13c, 13d, 13e, and 13f may be hereinafter referred to as "communication I / F 13."

[0058] In CAN, when some clusters are woken up by the partial network function, a cluster frame specifying the cluster to be woken up is transmitted onto the communication buses 12a, 12b, and 12c. The wake-up request, i.e., the cluster frame specifying the cluster to be woken up, is transmitted by, for example, the ECU 3a. In the case of the ECU 3a, the cluster frame is created using the cluster table 41. However, the source of the cluster frame is not limited to the ECU 3a, and the cluster frame may be transmitted by the ECUs 3b, 3c, 3d, 3e, and 3f.

[0059] The communication I / F 13 of the ECU 3 in the sleep mode receives a cluster frame and determines whether or not the cluster to which the ECU 3 belongs is specified in the cluster frame. If the cluster to which the ECU 3 belongs is not specified, the ECU 3 maintains the sleep mode. If the cluster to which the ECU 3 belongs is specified, the communication I / F 13 interrupts the control unit (processor) and instructs it to switch from the sleep mode to the normal mode. This wakes up the ECU 3 that belongs to the specified cluster.

[0060] On the other hand, the ECU 3 transitions from the normal mode to the sleep mode when the processing related to the function of the ECU 3 is completed. That is, the ECU 3 that has transitioned from the sleep mode to the normal mode upon receiving a cluster frame is configured to transition to the sleep mode after the series of processing is completed. Therefore, the ECU 3 transitions to the sleep mode when the cluster frame is no longer received, and maintains the sleep mode. The ECU 3 may be configured to transition to the sleep mode a predetermined period of time after the series of processing is completed.

[0061] The ECU 3 does not necessarily transition to the sleep mode when the cluster frame is no longer received. For example, the ECU 3 may be configured to transition to the sleep mode when a frame for transitioning the ECU 3 to the sleep mode is received.

[0062] When the sleep mode is switched to the normal mode, the ECU 3 operates at a high clock rate. In the sleep mode, the ECU 3 is stopped.

[0063] In the normal mode, the communication I / F 13 operates. In the sleep mode, the communication I / F 13 stops some of its functions.

[0064] In the normal mode, the peripheral circuit 34 operates. That is, in the normal mode, the ECU 3 can receive signals output from sensors and control objects to be controlled. In the sleep mode, the peripheral circuit 34 is also stopped. That is, in the sleep mode, the ECU 3 cannot receive signals output from sensors and control objects to be controlled.

[0065] In the normal mode described above, the power consumption by the ECU 3 is large. In the sleep mode, the power consumption by the ECU 3 is small.

[0066] [1-6. Functions of relay device] FIG. 5 is a functional block diagram illustrating an example of functions of the relay device according to the first embodiment. FIG. 6 is a diagram showing an example of a criterion for determining whether a cluster is normal or abnormal.

[0067] The relay device 2 has the functions of a receiving unit 51, a monitoring unit 52, a determination unit 53, and a start-up control unit 54. The receiving unit 51, the monitoring unit 52, the determination unit 53, and the start-up control unit 54 are functions of the microcomputer 21. The functions of the receiving unit 51, the monitoring unit 52, the determination unit 53, and the start-up control unit 54 are realized by the microcomputer 21 executing a control program.

[0068] [1-6-1. Receiving section] The receiving unit 51 receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function, to a second in-vehicle control device belonging to the first cluster.

[0069] Specifically, the communication I / Fs 11a, 11b, and 11c of the relay device 2 receive signals flowing through the communication buses 12a, 12b, and 12c via ports (not shown), respectively, and convert the signals into signals readable by the microcomputer 21. The communication I / Fs 11a, 11b, and 11c are connected to the communication buses 12a, 12b, and 12c, respectively.

[0070] For example, ECU3a and ECU3b belong to a cluster PNC1 that executes the function of an automatic sliding door. ECU3a is an input ECU that accepts a switch input from a user. ECU3b is a vehicle body ECU that controls the sliding door. When a user switches a switch for opening the door to the "open" side, the input ECU3a transmits a cluster frame indicating that the sliding door is to be opened to the communication I / F 11a of the relay device 2 via the communication bus 12a.

[0071] The cluster frame transmitted to the communication I / F 11a of the relay device 2 is received by the communication I / F 11a and converted into a signal that can be read by the microcomputer 21. When the control unit 22 receives the converted signal, the receiving unit 51 receives the cluster frame transmitted from the ECU 3a to the ECU 3b.

[0072] [1-6-2. Monitoring Department] The monitoring unit monitors the reception status of the frames of the receiving unit, and acquires the occurrence status of the first cluster frame transmitted from the first vehicle control device to the second vehicle control device. The occurrence status of the first cluster frame may include at least one of the duration during which a plurality of first cluster frames are periodically transmitted or the number of occurrences of the first cluster frame. The first cluster frame is a cluster frame indicating the detection of a person transmitted to the ECU3e by the ECU3d belonging to the cluster PNC2, which executes the function of periphery monitoring by an image sensor, for example. For example, in a CAN bus, the cluster frame is periodically transmitted. The monitoring unit 52 monitors the cluster frame periodically transmitted to the ECU3e by the ECU3d belonging to the cluster PNC2, for example, and acquires the duration. Specifically, for example, in the case of a periphery monitoring system by an image sensor, it is the time during which a person is detected. In addition, the monitoring unit 52 monitors the cluster frame transmitted to the ECU3e by the ECU3d belonging to the cluster PNC2, for example, and acquires the number of occurrences of the first cluster frame. Specifically, for example, in the case of a periphery monitoring system, the number of occurrences is the number of times a person is detected. The number of occurrences of the cluster frame may be the number of occurrences in a certain period of time.

[0073] When there are multiple clusters, the monitoring unit 52 obtains the occurrence status of cluster frames for each cluster, i.e., the duration and occurrence count of cluster frames. When there are three clusters as shown in Fig. 6, the monitoring unit 52 obtains the occurrence status of cluster frames for clusters PNC1 to PNC3.

[0074] [1-6-3. Judgment section] The determination unit determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit and a determination criterion related to the occurrence status of the frame. The determination criterion for determining whether the first cluster is normal or abnormal is set as a threshold value of the occurrence status of the cluster frame for each cluster. The determination criterion includes, for example, the duration and occurrence count of the cluster frame. The determination unit 53 may determine that the cluster is abnormal when either one of the duration and occurrence count of the cluster frame acquired by the monitoring unit 52 exceeds the determination criterion, or may determine that the cluster is abnormal when both the duration and occurrence time exceed the determination criterion.

[0075] The judgment criteria are determined in consideration of the function of each cluster, and are, for example, information in a table format as shown in FIG. 6. The judgment criteria include information indicating the duration and occurrence count threshold of the cluster frame, which are the judgment criteria for each cluster, associated with an identifier that identifies the cluster. The occurrence count is specified as 50 times, for example. The judgment criteria may further include information indicating a response action when it is determined that an abnormality has occurred. The response action will be described later. The judgment criteria are stored, for example, in a non-volatile memory of the memory 23 of the relay device 2. The control unit 22 reads out the judgment criteria stored in the memory 23. The judgment unit 53 refers to the read judgment criteria, and judges whether or not each cluster is abnormal based on the judgment criteria and the occurrence status of the data acquired by the monitoring unit 52.

[0076] The criteria for the duration may be determined for each cluster, taking into consideration the function of each cluster. For example, in the case of a cluster with an automatic sliding door function, if the door is open for more than 5 minutes, it is considered that the user has forgotten to close the door, and it may be determined as an abnormality. In the case of a cluster with a function of monitoring the surroundings by an image sensor, it is unlikely that a person is continuously detected around the vehicle for more than 15 minutes, and it may be determined as an abnormality. In the case of a cluster with a function of charging the driving battery, it is considered that the user has forgotten to remove the plug, and it may be determined as an abnormality. In addition, from the viewpoint of preventing excessive discharge of the battery, it may be determined based on the storage capacity of the power storage device that supplies power to the on-board control device and the amount of power consumed by the first cluster. For example, it is determined taking into consideration the battery capacity and the power consumed by the sensor ECU 3d and the image ECU 3e. Assuming that the battery capacity is 50 AH (ampere hours), the limit of the battery capacity that can be consumed by the image sensor for peripheral monitoring is 0.3 percent of the battery capacity, and the sensor ECU and image ECU consume a total of 0.6 A (amperes), the allowable operating time is 15 minutes.

[0077] The criteria for the number of occurrences may be determined for each cluster, taking into consideration the function of each cluster. For example, in a cluster with an automatic sliding door function, the number of occurrences is not considered to be related to an abnormality in the cluster, so no criteria for the number of occurrences are set. In a cluster with a function of monitoring the surroundings using an image sensor, an event in which the human presence sensor detects people 50 or more times around the vehicle at one time is considered to be an abnormality. In a cluster with a function of charging the driving battery, the plug remains inserted in the receptacle for a long time after charging begins, so even if the number of occurrences is one, it may be determined to be an abnormality if the duration exceeds the criteria.

[0078] Whether to judge an abnormality when either the duration criterion or the occurrence count criterion exceeds the criterion or to judge an abnormality when both the criterion are exceeded can be determined for each cluster, taking into consideration the function of each cluster. In the case of the automatic sliding door function cluster, since no criterion is set for the occurrence count, the cluster is judged to be abnormal when the duration exceeds the criterion. In the case of the function of monitoring the surroundings by an image sensor, since either the duration or the occurrence count exceeds the criterion, the cluster is judged to be abnormal when either the duration or the occurrence count exceeds the criterion. In the case of the cluster of the function of charging the driving battery, since the plug continues to be inserted into the receptacle after charging starts, if the occurrence count is one or more and the duration is 480 minutes or more, it is considered to be abnormal. Therefore, if both the duration and the occurrence count exceed the criterion, the cluster is judged to be abnormal.

[0079] Figure 6 shows clusters PNC1 to PNC3 as examples of clusters. Cluster PNC1 is an example of an automatic sliding door function. Cluster PNC2 is an example of a function of monitoring the surroundings using an image sensor. Cluster PNC3 is an example of a function of charging the driving battery.

[0080] In the example of the automatic sliding door function, when the user sets the door switch to "open," the door opens. Specifically, the input ECU 3a accepts the user's switch input, and the vehicle body ECU 3b controls the door drive system to open and close the door.

[0081] In an example of the function of monitoring the surroundings by an image sensor, for example, when a person is detected around the vehicle, the image sensor records an image of the surroundings. When the human presence sensor detects a person, the sensor ECU 3d to which the human presence sensor is connected transmits a cluster frame indicating that a person has been detected to the image ECU 3e. The image ECU 3e, which receives the cluster frame indicating that a person has been detected, records an image of the surroundings of the vehicle.

[0082] An example of the function of charging the driving battery is executed by, for example, a charging ECU 3f that controls charging of the driving battery and a detection ECU 3c that detects a receptacle of a vehicle that receives charging power. For example, the detection ECU 3c detects that a plug of a charging station that transmits charging power is connected to a receptacle of a vehicle that receives charging power, and transmits a cluster frame indicating that the plug has been connected to the receptacle to the charging ECU 3f. The charging ECU 3f, which receives the cluster frame indicating that the plug has been connected to the receptacle, starts charging the driving battery.

[0083] [1-6-4. Start control section] The start control unit transmits the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determination unit determines that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determination unit determines that the first cluster is abnormal. Alternatively, the start control unit may transmit a stop frame to the second in-vehicle control device to stop the second in-vehicle control device when the determination unit determines that the first cluster is abnormal.

[0084] 7 is a schematic diagram showing the flow of cluster frames when the occurrence status of the cluster frames is normal. When the determination unit 53 determines that the occurrence status of the cluster frame transmitted by the ECU 3a to the ECU 3b is normal, the relay device 2 transmits the received cluster frame to the ECU 3b. The relay device 2 receives the cluster frame transmitted by the ECU 3a from the communication I / F 13a via the communication I / F 11a. Since the determination unit 53 determines that the occurrence status is normal, the relay device 2 transmits the received cluster frame. The relay device 2 may acquire the destination of the cluster frame by, for example, referring to the cluster table 41, or may acquire it from the cluster frame.

[0085] For example, Fig. 4 shows an example of a cluster table. ECUs 3a and 3b belong to cluster PNC1, which is a function of automatic sliding doors. ECUs 3d and 3e belong to cluster PNC2, which is a function of monitoring the surroundings using an image sensor. ECUs 3c and 3f belong to cluster PNC3, which is a function of charging the driving battery.

[0086] The relay device 2 refers to the cluster table 41 to obtain the destination of the cluster frame. Since ECU3a and ECU3b belong to cluster PNC1, which is the automatic sliding door function, the destination ECU is ECU3b. The relay device 2 relays the cluster frame transmitted by ECU3a and transmits it to ECU3b via communication I / F 11b and communication bus 12b. ECU3b, which receives the cluster frame, executes the automatic sliding door function, which is the function of cluster PNC1.

[0087] 8 is a schematic diagram showing the flow of cluster frames when the data generation status is abnormal, and is an example of stopping the destination ECU without transmitting the received cluster frame to the destination ECU. When the determination unit 53 determines that the generation status of the cluster frame transmitted from ECU 3a to ECU 3b is abnormal, the relay device 2 does not transmit the cluster frame to ECU 3b. As described above, ECU 3b is configured to transition to sleep mode after a series of processes are completed, so that when cluster frames are no longer received, ECU 3b transitions to sleep mode and maintains the sleep mode.

[0088] Fig. 9 is a schematic diagram showing the flow of data when the data generation situation is abnormal. Unlike the example of Fig. 8, this is an example in which a stop frame for stopping the ECU is transmitted to the destination ECU to stop the destination ECU. When ECU3b receives the stop frame instructing its own device to transition to a sleep mode, it transitions to the sleep mode.

[0089] [1-7. ECU operation] The operation of the relay device according to the first embodiment will be described below.

[0090] FIG. 10 is a flowchart illustrating an example of the operation of the relay device according to the first embodiment. [1-7-1. Step S001] The receiving unit 51 receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster (step S001).

[0091] Specifically, the communication I / Fs 11a, 11b, and 11c of the relay device 2 receive signals flowing through the communication buses 12a, 12b, and 12c via ports (not shown), respectively, and convert the signals into signals readable by the microcomputer 21. The communication I / Fs 11a, 11b, and 11c are connected to the communication buses 12a, 12b, and 12c, respectively.

[0092] For example, in the case of cluster PNC1 that executes the function of an automatic sliding door, when a user switches the switch for opening the door to the "open" side, switch ECU3a transmits a cluster frame indicating that the sliding door is to be opened to communication I / F 11a of relay device 2 via communication bus 12a (see Figs. 4, 6, and 7). Then, the cluster frame transmitted to communication I / F 11a of relay device 2 is received by communication I / F 11a and converted into a signal readable by microcomputer 21. When control unit 22 receives the converted signal, receiver 51 receives the data transmitted from ECU 3a to ECU 3b. When receiver 51 receives the data, the process proceeds to step S002.

[0093] [1-7-2. Step S002] The monitoring unit 52 monitors the reception status of the frames at the receiving unit, and acquires the occurrence status of the first cluster frames transmitted from the first vehicle control device to the second vehicle control device (step S002). The occurrence status of the first cluster frames may include at least one of the duration during which the multiple first cluster frames are periodically transmitted or the occurrence count of the first cluster frames.

[0094] The monitoring unit 52 monitors cluster frames that, for example, the ECU 3a belonging to cluster PNC1 periodically transmits to the ECU 3b, and obtains their duration. The monitoring unit 52 also monitors cluster frames that, for example, the ECU 3a belonging to cluster PNC1 transmits to the ECU 3b, and obtains the number of occurrences of the first cluster frame. The number of occurrences of data may be the number of occurrences in a certain period of time. When there are three clusters as shown in Fig. 6, the monitoring unit 52 obtains the occurrence status of cluster frames from PNC1 to PNC3. When the monitoring unit 52 obtains the occurrence status of cluster frames, the process proceeds to step S003.

[0095] [1-7-3. Step S003] The determination unit 53 determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit 52 and a determination criterion related to the occurrence status of the frame (step S003). The determination unit 53 may determine that the cluster is abnormal when either the duration or the occurrence count of the cluster frame acquired by the monitoring unit 52 exceeds the determination criterion, or may determine that the cluster is abnormal when both the duration and the occurrence time exceed the determination criterion.

[0096] The judgment criteria include, for example, a threshold value for the duration and number of occurrences of cluster frames, and are, for example, information in a table format as shown in Fig. 6. The judgment criteria are stored, for example, in a non-volatile memory of the memory 23 of the relay device 2. The control unit 22 reads out the judgment criteria stored in the memory 23. The judgment unit 53 refers to the read judgment criteria, and judges for each cluster whether or not the cluster is abnormal based on the judgment criteria and the occurrence status of the data acquired by the monitoring unit.

[0097] For example, assume that the threshold duration of the judgment criteria is 15 minutes and the threshold occurrence count is 50 times. If the duration of the occurrence status of cluster frames acquired by the monitoring unit 52 is 10 minutes and the occurrence count is 12 times, the judgment unit 53 judges that the cluster is not abnormal. If the duration of the occurrence status of cluster frames is 16 minutes and the occurrence count is 12 times, the judgment unit 53 judges that the cluster is abnormal. If the duration of the occurrence status of data is 10 minutes and the occurrence count is 60 times, the judgment unit 53 also judges that the cluster is abnormal. If the judgment unit 53 judges that the cluster is normal, the process proceeds to step S004, and if the judgment unit 53 judges that the cluster is abnormal, the process proceeds to step S005.

[0098] [1-7-4. Step S004, Step S005] When the judgment unit 53 judges that the first cluster is normal, the start-up control unit 54 transmits the first cluster frame transmitted from the first vehicle control device to the second vehicle control device (step S004), and when the judgment unit 52 judges that the first cluster is abnormal, the start-up control unit 54 does not transmit the first cluster frame transmitted from the first vehicle control device to the second vehicle control device (step S005).

[0099] For example, if the determination unit 53 determines that the occurrence status of the cluster frame transmitted from the ECU 3a to the ECU 3b is normal, the relay device 2 transmits the cluster frame to the ECU 3b. The relay device 2 acquires the destination of the cluster frame by referring to a cluster table such as that shown in FIG. 4. Alternatively, the relay device 2 may acquire information indicating the destination contained in the cluster frame. The ECU 3b that receives the cluster frame executes the automatic sliding door function, which is a function of the cluster PNC1. After transmitting the cluster frame, the relay device 2 returns to step S001 again to receive the cluster frame.

[0100] On the other hand, if the determination unit 53 determines that the occurrence status of the cluster frame transmitted by the ECU 3a to the relay device 2 is abnormal, the relay device 2 does not transmit the received cluster frame to the ECU 3b. The ECU 3b is configured to transition to a sleep mode after a series of processes are completed, so that when the cluster frame is no longer received, the ECU 3b transitions to the sleep mode and maintains the sleep mode. If the relay device 2 does not transmit a cluster frame, the process returns to step S001 again to receive cluster frames of clusters other than the cluster determined to be abnormal.

[0101] Alternatively, when the determination unit 53 determines that the first cluster is abnormal, the start control unit 54 may transmit a stop frame to the second in-vehicle control device to stop the second in-vehicle control device (step S005). The ECU 3b that receives the stop frame to stop the ECU transitions to a sleep mode. Even when the relay device 2 transmits the stop frame, it returns to step S001 again to receive cluster frames of clusters other than the cluster determined to be abnormal.

[0102] [1-8 Summary] As a result, the cluster frame is not transmitted to the ECU belonging to the cluster determined to be abnormal. The ECU that has stopped receiving the cluster frame transitions to sleep mode. Alternatively, a stop frame is transmitted to the ECU belonging to the cluster determined to be abnormal, and the ECU that receives the stop frame transitions to sleep mode. This makes it possible to stop the second in-vehicle control device belonging to the cluster determined to be abnormal, and reduce the power consumption of the in-vehicle system.

[0103] <Embodiment 2> [2. Details of the Second Embodiment of the Present Disclosure] Hereinafter, the second embodiment of the present disclosure will be described in detail with reference to the drawings. In the second embodiment, the relay device 2 further includes a notification unit as a functional block, but other parts are the same as those in the first embodiment. Also, some of the functions of the start-up control unit 54 are different. The same components as those in the first embodiment are denoted by the same reference numerals, and descriptions of the same components, functions, and operations will be omitted.

[0104] [2-1 Relay device configuration] The configuration of the relay device of the second embodiment is the same as that of the first embodiment.

[0105] [2-2 Problems to be solved by this embodiment] In the first embodiment, when it is determined that a cluster is abnormal, the start control unit 54 does not transmit a cluster frame to the ECU belonging to the cluster determined to be abnormal, thereby stopping the ECU. In such a case, it is desirable to notify the user that the cluster is abnormal. Also, a user who knows that a cluster is abnormal may wish to execute a function of the cluster. Alternatively, if the function of the cluster is important, it may be desirable to execute the function of the cluster even if the cluster is determined to be abnormal. The second embodiment is intended to meet these demands.

[0106] [2-3 Functions of relay device] 11 is a functional block diagram showing an example of functions of a relay device according to embodiment 2. In embodiment 2, the relay device 2 further includes a notification unit 111 as a functional block.

[0107] [2-3-1 Notification Department] A notification unit notifies a user that the first cluster is abnormal when the determination unit determines that an abnormality has occurred.

[0108] The case where the determination unit 53 determines that there is an abnormality is, for example, when the door is continuously open for more than five minutes in the function of the automatic sliding door, exceeding the determination criterion of five minutes. When the determination unit 53 determines that there is an abnormality, it notifies the user that the cluster is abnormal. Specifically, for example, when the vehicle has a voice notification device (not shown) and the notification device is controlled by a notification ECU (not shown), the relay device 2 transmits a cluster frame to the notification ECU to notify that the cluster PNC1 of the function of the automatic sliding door is abnormal. Then, the notification device controlled by the notification ECU announces a message in the vehicle by voice, for example, "The door is left open. Please check." Alternatively, the notification may be sent to the user's smartphone.

[0109] This allows the user to know that the cluster is abnormal, for example, that the door is left open, and the user can take action such as closing the door.

[0110] [2-3-2 Start control section] The start control unit 54 transmits the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device when the determination unit 53 determines that the second cluster is normal and when the determination unit 53 determines that the second cluster is abnormal. Here, the receiving unit 51 receives the second cluster frame transmitted by the third in-vehicle control device belonging to the second cluster executing the second function to the fourth in-vehicle control device belonging to the second cluster, the monitoring unit 53 acquires the occurrence status of the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device, and the determination unit 53 judges whether the second cluster is normal or abnormal based on the occurrence status of the second cluster frame acquired by the monitoring unit 52 and a judgment criterion. In addition, the first function may be a function that is executed when the remaining amount of stored power in the power storage device that supplies power to the vehicle control device is equal to or greater than a certain value, and the second function may be a function that is executed even when the remaining amount of stored power is less than the certain value.

[0111] In the first embodiment, when the start control unit 54 determines that the cluster is normal, it transmits the cluster frame to the destination ECU, and when the start control unit 54 determines that the cluster is abnormal, it does not transmit the cluster frame to the destination ECU. On the other hand, in the second embodiment, when the start control unit 54 determines that the cluster is normal, it transmits the cluster frame to the destination ECU, and even when the start control unit 54 determines that the cluster is abnormal, it transmits the cluster frame to the destination ECU.

[0112] That is, even if the cluster is determined to be abnormal, the cluster frame is transmitted to the destination ECU, and the ECU that receives the cluster frame executes the cluster function. The ECU executes the cluster function even when it is determined to be abnormal when, for example, the remaining charge in the power storage device is less than a certain value, but the function is an important function that must be executed, or when there is an abnormality but the power consumption of the ECU is small and the impact on the power storage device is minor.

[0113] When the determination unit 53 determines that an abnormality exists, whether the cluster is executed is determined for each cluster. The column of the abnormality response action in FIG. 6 is an example. The start control unit 54 refers to the cluster table in FIG. 6, reads out the information of the abnormality response action associated with the cluster, and when the information indicates "stop", stops the function of the cluster. That is, the cluster is a cluster that executes the first function. In this case, the start control unit 54 does not transmit a cluster frame, or transmits a stop frame. On the other hand, when the information of the abnormality response action indicates "continue", the function of the cluster is executed. That is, the cluster is a cluster that executes the second function. In this case, the start control unit 54 transmits a cluster frame to the ECU that belongs to the cluster. The ECU that receives the transmitted cluster frame executes the function of the cluster.

[0114] As a result, even if a cluster is determined to be abnormal, the functions of the cluster that should be executed even if the remaining amount of electricity stored in the storage device is less than a certain value, and the functions of the cluster that will have only a minor effect on the storage device even if executed, are executed.

[0115] Furthermore, when the notification unit 111 notifies that the first cluster is abnormal, and the relay device 2 receives a command from the user to continue executing the first function, the start-up control unit 54 transmits the first cluster frame transmitted from the first vehicle control device to the second vehicle control device.

[0116] When the determination unit 53 determines that there is an abnormality and the information on the response action in the abnormality in the cluster table indicates "stop", the start control unit 54 does not transmit a cluster frame or transmits a stop frame. In this case, the notification unit 111 has already notified the user that the cluster is abnormal. For example, a message is announced in the vehicle by voice saying, "The periphery monitoring system has already been recording for more than 15 minutes." If the user who heard this intends to continue the function of periphery monitoring by the image sensor for some reason, he or she operates, for example, a smartphone to instruct the execution of the function. The start control unit 54 of the relay device 2 that has received the command indicating the instruction transmits a cluster frame to the ECU belonging to the cluster of the function.

[0117] This allows the function to be executed based on the user's instructions when the user so desires, even if, for example, the perimeter monitoring system has already recorded for 15 minutes or more and the judgment unit 53 judges that the cluster is abnormal.

[0118] [2-4 Relay device operation] 12 is a flowchart showing an example of the operation of the relay device according to the second embodiment. The operation of the relay device according to the second embodiment will be described below. The operations from step S001 to step S005 are the same as those in the first embodiment, and therefore will not be described. The second embodiment differs from the first embodiment in the operations after the determination unit 53 determines that the cluster is abnormal in step S003. The operations after the determination unit 53 determines that the cluster is abnormal will be described below. In the second embodiment, when the determination unit 53 determines that the cluster is abnormal, the process proceeds to step S006 instead of step S005.

[0119] [2-4-1. Step S006] If the determining unit 53 determines that there is an abnormality, the notifying unit 111 notifies the user that the first cluster is abnormal (step S006).

[0120] Specifically, for example, if the vehicle has a voice notification device (not shown) and this notification device is controlled by a notification ECU (not shown), the relay device 2 transmits a command to the notification ECU to notify that the cluster PNC1 of the automatic sliding door function is abnormal. After notifying the user, the relay device 2 proceeds to step S007.

[0121] [2-4-2 Step S007] The start-up control unit 54 transmits the second cluster frame transmitted from the third vehicle control device to the fourth vehicle control device when the judgment unit 53 determines that the second cluster is normal and when the judgment unit 53 determines that the second cluster is abnormal.

[0122] When the determination unit 53 determines that there is an abnormality, whether or not to execute the function of that cluster is determined for each cluster. The column for "Response Action in Abnormal Event" in FIG. 6 is an example. The start-up control unit 54 refers to the cluster table in FIG. 6, reads out information on the response action in abnormal event linked to the cluster, and if the information indicates "stop", the process proceeds to step S008. On the other hand, if the information on the response action in abnormal event indicates "continue", the process proceeds to step S004. When proceeding to step S004, the start-up control unit 54 transmits a cluster frame to the ECUs belonging to the cluster.

[0123] [2-4-3 Step S008] When the notification unit 111 notifies that the first cluster is abnormal, and the relay device 2 receives a command from the user to continue executing the first function, the start-up control unit 54 transmits the first cluster frame transmitted from the first vehicle control device to the second vehicle control device (step S008).

[0124] When the determination unit 53 determines that there is an abnormality and the information on the response action in the abnormality in the cluster table indicates "stop", the start control unit 54 does not transmit a cluster frame or transmits a stop frame. In this case, the notification unit 111 has already notified the user that the cluster is abnormal. If the user intends to continue the function of the cluster for some reason, the user, for example, operates a smartphone to instruct the relay device 2 to execute the function. The relay device 2 that receives the command indicating the instruction proceeds to step S004, and the start control unit 54 transmits a cluster frame to the ECU that belongs to the cluster of the function. The ECU that receives the cluster frame executes the function of the cluster.

[0125] On the other hand, if the user does not intend to execute the function of the cluster, the user does not instruct execution of the function. Therefore, the relay device 2 that does not receive the command indicating the instruction proceeds to step S005, and the start-up control unit 54 does not transmit a cluster frame to the ECU belonging to the cluster of the function, or transmits a stop frame. Then, the ECU that does not receive the cluster frame or receives the stop frame transitions to the sleep mode.

[0126] [2-5 Summary] By using the notification unit 111, the user can know that the cluster is abnormal, for example, that the door is left open. The user can then take action such as closing the door. By performing its function, the start-up control unit 54 can execute the functions that should be executed even if the remaining amount of stored electricity in the electricity storage device is less than a certain value. Also, even if the determination unit 53 determines that the cluster is abnormal, the cluster can execute the function based on the user's instruction when the user intends to do so.

[0127] [3-1 Variation 1] 13 is a diagram showing an example of the judgment criteria of the first modification of the relay device 2. The function and configuration are the same as those of the first embodiment, but the function of the judgment unit 53 is partially different. When a power storage device that supplies power to an on-board control device is not being charged, the judgment unit judges whether the first cluster is normal or abnormal based on a first judgment criterion, and when the power storage device is being charged, the judgment unit judges whether the first cluster is normal or abnormal based on a second judgment criterion that is more relaxed than the first judgment criterion.

[0128] The ECU obtains the power required for operation from a power storage device mounted on the vehicle. If the vehicle is a gasoline engine vehicle, the power storage device is charged by the power generated by a generator driven by the engine mounted on the vehicle. Therefore, when the engine is rotating and the vehicle is capable of running, that is, in an IG state, the power storage device is charged, and there is little risk that the power storage device will be excessively discharged and enter an over-discharged state. For this reason, the criteria for referring to the power storage device when it is not being charged may be relaxed.

[0129] In this modification, in the first power supply state in which the power storage device is not charged, the determination unit 53 refers to the determination criteria in the upper row shown in Fig. 13 in the case of, for example, a function of monitoring the surroundings using an image sensor. Then, the determination unit 53 determines whether the cluster is abnormal or normal using the determination criteria of a duration threshold of 15 minutes and a threshold of the number of occurrences of 50 times. On the other hand, in the second power supply state in which the power storage device is charged, the determination unit 53 refers to the determination criteria in the lower row in Fig. 13. Then, the determination criteria of a duration threshold of 60 minutes and a threshold of the number of occurrences of 200 times are used.

[0130] This makes it possible to appropriately determine whether the cluster is normal or abnormal, in accordance with cases where the cluster must be determined to be abnormal when the storage device is not being charged, and where the cluster cannot be deemed abnormal when the storage device is being charged.

[0131] [3-2 Variation 2] There are cases where multiple clusters are executed simultaneously. In such a case, for example, two clusters may be executed by the same ECU. An ECU that must execute the functions of two clusters will transmit cluster frames corresponding to the functions of each cluster for each function. Therefore, the duration and occurrence frequency of cluster frames of the ECU may be longer than when executing one cluster. In such a situation, if a cluster is judged to be abnormal or normal based on the cluster judgment criteria of each function, there is a risk that each cluster may be erroneously judged to be abnormal even though it is normal.

[0132] Therefore, when the first function is executed alone, the judgment unit 53 judges whether the first cluster is normal or abnormal based on a first judgment criterion, and when the first function and the second function are executed simultaneously, the judgment unit 53 judges whether the first cluster is normal or abnormal based on a second judgment criterion that is more relaxed than the first judgment criterion. Note that the first vehicle control device further belongs to a second cluster that executes a second function different from the first function.

[0133] For example, in the example of the cluster table shown in Fig. 4, ECUs 3d and 3e belong to cluster PNC2, and ECUs 3c and 3f belong to cluster PNC3, with ECU 3d also belonging to cluster PNC3. When clusters PNC2 and PNC3 are executed simultaneously, ECU 3d may generate many cluster frames to execute the functions of clusters PNC2 and PNC3. In such a situation, when the determination unit 53 determines whether a cluster is normal or abnormal by referring to the determination criteria shown in Fig. 6, since the upper limit of the occurrence count of the determination criteria for cluster PNC3 is one time, there is a risk that the upper limit of the determination criteria will be exceeded quickly and cluster PNC3 will be determined to be abnormal.

[0134] In order to avoid such erroneous determination, the determination criteria are corrected based on the determination criteria of cluster PNC2 and the determination criteria of cluster PNC3. For example, the number of occurrences of the determination criteria of cluster PNC2 and the number of occurrences of the determination criteria of cluster PNC3 are added together, but the present invention is not limited to this.

[0135] As a result, when clusters PNC2 and PNC3 are executed simultaneously, a load is placed on the ECUs 3d belonging to both clusters, and even if an abnormality is not actually present, it may be judged as abnormal based on the judgment criteria of cluster PNC2 or cluster PNC3. By correcting the judgment criteria, it is possible to avoid a judgment of an abnormality and the functions of cluster PNC2 and cluster PNC3 being stopped.

[0136] [4-1 Supplementary Note 1] The present disclosure includes the following vehicle control system. An in-vehicle control system comprising a relay device that relays data communication between in-vehicle control devices that can communicate with each other via a communication bus, and the in-vehicle devices connected to the communication bus, wherein the relay device comprises a receiving unit that receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster, a monitoring unit that monitors the reception status of the frames by the receiving unit and acquires an occurrence status of the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device, a determination unit that determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit and a determination criterion related to the occurrence status of the frame, and a start-up control unit that transmits the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determination unit determines that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the determination unit determines that the first cluster is abnormal. This makes it possible to shut down the second in-vehicle control device that belongs to the cluster determined to be abnormal in the vehicle control system, thereby reducing the power consumption of the in-vehicle system.

[0137] [4-2 Supplementary Note 2] The present disclosure includes the following vehicles. A vehicle including a relay device that relays data communication between in-vehicle control devices that can communicate with each other via a communication bus and the in-vehicle devices connected to the communication bus, the relay device including a receiver that receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster, a monitor that monitors a reception status of the frame by the receiver and acquires an occurrence status of the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device, a judgement unit that judges whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitor and a judgement criterion related to the occurrence status of the frame, and a start-up control unit that transmits the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the judgement unit judges that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first in-vehicle control device to the second in-vehicle control device when the judgement unit judges that the first cluster is abnormal. This makes it possible to stop the second in-vehicle control device belonging to the cluster that is judged to be abnormal in the vehicle, thereby reducing power consumption of the in-vehicle system.

[0138] [4-3 Supplementary Note 3] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is defined by the claims rather than the above-described embodiments, and includes the meaning equivalent to the claims and all modifications within the scope thereof. [Explanation of symbols]

[0139] 1. In-vehicle systems 2. Relay Device 3, 3a, 3b, 3c, 3d, 3e, 3f ECU (vehicle control unit) 11a, 11b, 11c Communication I / F (Communication Interface) 12a, 12b, 12c communication buses 13, 13a, 13b, 13c, 13d, 13e, 13f Communication I / F (communication interface) 21 Microcontroller (Microcontroller Unit) 22 Control section 23 Memory 24 Internal Bus 31 Microcontroller (Microcontroller Unit) 32 Control unit (processor) 33 Memory 34 Peripheral circuits 41 Cluster Table 51 Receiving section 52 Monitoring Department 53 Judgment section 54 Start control section 111 Notification Department

Claims

1. A relay device that relays communication between on-board control devices that can communicate with each other via a communication bus, a receiving unit that receives a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster; a monitoring unit that monitors a reception status of frames by the receiving unit and acquires a generation status of the first cluster frame transmitted from the first vehicle control device to the second vehicle control device; a determination unit that determines whether the first cluster is normal or abnormal based on the occurrence status of the first cluster frame acquired by the monitoring unit and a determination criterion related to the occurrence status of the frame; a start-up control unit that transmits the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when the determination unit determines that the first cluster is normal, and does not transmit the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when the determination unit determines that the first cluster is abnormal. Relay device.

2. the start-up control unit transmits a stop frame to the second in-vehicle control unit to stop the second in-vehicle control unit when the determination unit determines that the first cluster is abnormal. The relay device according to claim 1 .

3. The relay device according to claim 1 , wherein the occurrence status of the first cluster frames includes at least one of a duration during which the plurality of first cluster frames are periodically transmitted and a number of occurrences of the first cluster frames.

4. the determination unit, when a power storage device that supplies power to the on-board control device is not being charged, determines whether the first cluster is normal or abnormal based on a first determination criterion, and, when the power storage device is being charged, determines whether the first cluster is normal or abnormal based on a second determination criterion that is less stringent than the first determination criterion. The relay device according to claim 1 .

5. the receiving unit receives a second cluster frame transmitted by a third in-vehicle control device belonging to a second cluster that executes a second function to a fourth in-vehicle control device belonging to the second cluster, the monitoring unit acquires an occurrence status of the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device, the determination unit determines whether the second cluster is normal or abnormal based on the occurrence status of the second cluster frame acquired by the monitoring unit and the determination criterion; the start-up control unit transmits the second cluster frame transmitted from the third in-vehicle control device to the fourth in-vehicle control device when the determination unit determines that the second cluster is normal and when the determination unit determines that the second cluster is abnormal. The relay device according to claim 1 .

6. the first function is a function that is executed when a remaining amount of stored power of a power storage device that supplies power to the in-vehicle control device is equal to or greater than a certain value; The second function is a function that is executed even when the remaining amount of stored electricity is less than a certain value. The relay device according to claim 5 .

7. a notification unit that notifies a user that the first cluster is abnormal when the determination unit determines that the first cluster is abnormal; The relay device according to claim 1 .

8. The relay device according to claim 7, wherein when the notification unit notifies that the first cluster is abnormal and the relay device receives an instruction from the user to continue executing the first function, the start-up control unit transmits the first cluster frame transmitted from the first vehicle control device to the second vehicle control device.

9. The first in-vehicle control device further belongs to a second cluster that executes a second function different from the first function, the determination unit determines whether the first cluster is normal or abnormal based on a first determination criterion when the first function is executed alone, and determines whether the first cluster is normal or abnormal based on a second determination criterion that is less stringent than the first determination criterion when the first function and the second function are executed simultaneously. The relay device according to claim 1 .

10. The relay device according to claim 1 , wherein the determination criterion is determined based on a power storage capacity of a power storage device that supplies power to the in-vehicle control device and an amount of power consumed by the first cluster.

11. A control method for controlling a relay device that relays communication between in-vehicle control devices that can communicate with each other via a communication bus, comprising: receiving a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster; a step of monitoring a reception status of a received frame and acquiring a generation status of the first cluster frame transmitted from the first vehicle control device to the second vehicle control device; determining whether the first cluster is normal or abnormal based on the acquired occurrence status of the first cluster frame and a determination criterion related to the occurrence status of frames; a step of transmitting the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when it is determined that the first cluster is normal, and a step of not transmitting the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when it is determined that the first cluster is abnormal. Control methods.

12. A computer program used by a relay device that relays communication between on-board control devices that can communicate with each other via a communication bus, comprising: receiving a first cluster frame transmitted by a first in-vehicle control device belonging to a first cluster that executes a first function to a second in-vehicle control device belonging to the first cluster; a step of monitoring a reception status of a received frame and acquiring a generation status of the first cluster frame transmitted from the first vehicle control device to the second vehicle control device; determining whether the first cluster is normal or abnormal based on the acquired occurrence status of the first cluster frame and a determination criterion related to the occurrence status of frames; a step of transmitting the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when it is determined that the first cluster is normal, and not transmitting the first cluster frame transmitted from the first vehicle control device to the second vehicle control device when it is determined that the first cluster is abnormal; In order to execute Computer program.

Images