On-vehicle network system and electronic control device

Abstract

To provide an on-vehicle network system capable of suppressing erroneous determination for a fault by a second device.SOLUTION: An on-vehicle network system includes, as electronic control devices having a network management function, a first device 61, a second device 62, and a third device. The first device 61 transmits periodic messages. The second device 62 executes fault determination for determining that the first device 61 has failed when reception of the periodic messages from the first device 61 is interrupted. The third device has a partial network function. The first device 61 transmits a standby notification to the second device 62 when shifting from an active state to a standby state due to no-reception of an operation notification. The second device 62 stops the fault determination for the first device 61 when receiving the standby notification from the first device 61.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an in-vehicle network system and an electronic control unit. [Background technology]

[0002] Patent Document 1 describes an in-vehicle network system. This in-vehicle network system is composed of multiple electronic control units (ECUs). Hereinafter, an electronic control unit will be referred to as an ECU. The multiple ECUs include a mixture of ECUs that, when receiving a message from another ECU, check the destination of the message and ECUs that do not check the destination of the message. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2023-109566 Summary of the Invention [Problem to be solved by the invention]

[0004] An ECU has an operating state in which it can communicate with other ECUs, and a standby state in which it stops communication to reduce power consumption. An ECU has a network management function that transitions from the standby state to the operating state when it is requested to operate via a message. Hereinafter, the network management function will be referred to as the NM function. Among ECUs that have the NM function, there are ECUs that have the partial network function and ECUs that do not have the partial network function. Hereinafter, the partial network function will be referred to as the PN function.

[0005] An ECU with a PN function sends a PN message containing information indicating the destination. The PN message is sent to activate other ECUs with a PN function. When an ECU with a PN function receives a PN message, it checks the destination of the message. Then, the ECU with a PN function activates only if the message is addressed to the ECU itself.

[0006] An ECU without PN functionality sends an NM message. The NM message is sent to put other ECUs without PN functionality into operation. An ECU without PN functionality enters operation without checking the destination, regardless of whether the received message is an NM message or a PN message.

[0007] In an in-vehicle network system, both ECUs with PN functionality and ECUs without PN functionality may be connected to a single communication bus. ECUs without PN functionality connected to such a communication bus can enter an operating state by receiving a PN message, even if no NM message has been sent. At this time, ECUs without PN functionality connected to another communication bus may be in a standby state because no NM message has been sent.

[0008] In this way, an ECU without the PN function may be in an operating state even when other ECUs without the PN function are in a standby state. An ECU with the NM function has a function that determines that a monitored ECU has failed when periodic reception of messages from the monitored ECU is interrupted. Therefore, if only some ECUs are in an operating state, the operating ECU without the PN function may erroneously determine that the monitored ECU in a standby state has failed. [Means for solving the problem]

[0009] An in-vehicle network system for solving the above problems includes a first device, a second device, and a third device as electronic control devices having a network management function that transitions from a standby state in which communication is not performed to an operating state in which communication is possible upon receiving an operation notification, which is a message requesting operation. In this in-vehicle network system, the first device transmits periodic messages, which are messages transmitted periodically. In this in-vehicle network system, the second device performs a failure determination to determine that the first device has failed when reception of the periodic message from the first device is interrupted. In this in-vehicle network system, the third device (13) has a partial network function that, upon receiving the operation notification, does not transition from the standby state to the operating state if the operation notification is not addressed to the third device (13). The in-vehicle network system also includes a first communication bus connected to the first device, a second communication bus connected to the second device and the third device, and a relay device. In this in-vehicle network system, the relay device is connected to the first communication bus and the second communication bus and relays messages exchanged between the multiple communication buses. In this in-vehicle network system, when the first device transitions from the operating state to the standby state, the first device transmits a standby notification to the second device, which is a message indicating that the first device will transition to the standby state. In this in-vehicle network system, when the second device receives the standby notification from the first device, the second device stops the failure determination for the first device.

[0010] The electronic control device for solving the above problem is a transmitting electronic control device in an in-vehicle network system. The in-vehicle network system includes a transmitting electronic control device, a receiving electronic control device, and an electronic control device with a partial network function, as electronic control devices having a network management function that transitions from a standby state in which communication is not performed to an operating state in which communication is possible when an operation notification, which is a message requesting operation, is received. In the in-vehicle network system, the transmitting electronic control device transmits a periodic message, which is a message transmitted periodically. In the in-vehicle network system, the receiving electronic control device performs a failure determination to determine that the transmitting electronic control device has failed when reception of the periodic message from the transmitting electronic control device is interrupted. In the in-vehicle network system, an electronic control device with a partial network function does not transition from the standby state to the operating state when it receives the operation notification if the operation notification is not addressed to itself. The in-vehicle network system also includes a first communication bus connected to the transmitting electronic control device, a second communication bus connected to the receiving electronic control device and the electronic control device with the partial network function, and a relay device. In the in-vehicle network system, a relay device is connected to the first communication bus and the second communication bus, and relays messages exchanged between the plurality of communication buses. When the electronic control device according to the invention transitions from the operating state to the standby state, it transmits a standby notification, which is a message indicating that the electronic control device will transition to the standby state, to the receiving electronic control device. [Effects of the Invention]

[0011] The above-described in-vehicle network system and electronic control unit can suppress erroneous determination of a failure by the second device, which is the receiving electronic control unit. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a schematic diagram showing the configuration of an in-vehicle network system according to an embodiment. [Figure 2] FIG. 2 is a schematic diagram showing a state in which an electronic control unit in a first communication bus transitions to a standby state in the in-vehicle network system of FIG. [Figure 3] FIG. 3 is a sequence diagram showing a communication mode in the in-vehicle network system of FIG. DETAILED DESCRIPTION OF THE INVENTION

[0013] An embodiment of an in-vehicle network system will be described below with reference to FIGS. <Configuration of In-Vehicle Network System 100> As shown in Fig. 1, the in-vehicle network system 100 is configured with multiple electronic control units (ECUs). Hereinafter, the electronic control units will be referred to as ECUs. The ECUs provided in the in-vehicle network system 100 are divided into ECUs having a network management function and relay devices 10. Hereinafter, the network management function will be referred to as the NM function. In Fig. 1, each ECU is represented by a rectangle.

[0014] When an ECU with NM functionality receives an operation notification, it transitions from a standby state in which it does not communicate to an operating state in which it can communicate. An operation notification is a message that requests the operation of the ECU. Among ECUs with NM functionality, there are ECUs with partial network functionality and ECUs without partial network functionality. Hereinafter, the partial network functionality will be referred to as the PN functionality.

[0015] In the in-vehicle network system 100, the ECUs having the PN function are a first PN device 31, a second PN device 32, and a third PN device 33. In the in-vehicle network system 100, the ECUs that do not have the PN function are the first NM device 21, the second NM device 22, the third NM device 23, the fourth NM device 24, the fifth NM device 25, and the sixth NM device 26.

[0016] 1, the in-vehicle network system 100 includes a first communication bus 41, a second communication bus 42, and a third communication bus 43. The first communication bus 41 connects the first NM device 21, the second NM device 22, and the third NM device 23. The second communication bus 42 connects the fourth NM device 24, the fifth NM device 25, and the first PN device 31. The third communication bus 43 connects the second PN device 32, the third PN device 33, and the sixth NM device 26.

[0017] The ECUs in the in-vehicle network system 100 are connected to each other so as to be able to communicate by sending and receiving messages via a communication bus. In the in-vehicle network system 100, the first NM device 21, the second NM device 22, and the third NM device 23 send and receive messages via a first communication bus 41. In the in-vehicle network system 100, the fourth NM device 24, the fifth NM device 25, and the first PN device 31 send and receive messages via a second communication bus 42. In the in-vehicle network system 100, the second PN device 32, the third PN device 33, and the sixth NM device 26 send and receive messages via a third communication bus 43.

[0018] In the in-vehicle network system 100, the relay device 10 is connected to all of the first communication bus 41, the second communication bus 42, and the third communication bus 43. The relay device 10 relays messages exchanged among the first communication bus 41, the second communication bus 42, and the third communication bus 43. For example, the relay device 10 receives a message transmitted by the first NM device 21 via the first communication bus 41. The relay device 10 then transmits the message received from the first NM device 21 to the ECUs connected to the second communication bus 42 and the third communication bus 43.

[0019] An ECU in the in-vehicle network system 100 communicates with other ECUs to realize a specific function in the vehicle. At this time, the combination of ECUs that realize a specific function in the in-vehicle network system 100 varies depending on the function to be realized. Also, in the in-vehicle network system 100, an ECU with a PN function communicates with other ECUs that have the PN function to realize the specific function. On the other hand, in the in-vehicle network system 100, an ECU without a PN function communicates with other ECUs that do not have the PN function to realize the specific function.

[0020] When each ECU in the in-vehicle network system 100 performs a specific function, it transmits an operation notification to other ECUs that need to operate to perform the function. 1, an ECU having a PN function transmits a PN message 51 as an operation notification. The ECU having the PN function transmits the PN message 51 to request the operation of another ECU that also has the PN function. At this time, the ECU having the PN function transmits the PN message 51 together with identification information of the ECU that is the destination of the request to operate.

[0021] 1, an ECU without the PN function transmits an NM message 50 as an operation notification. An ECU without the PN function transmits the NM message 50 to request the operation of another ECU that also does not have the PN function. At this time, unlike an ECU with the PN function, an ECU without the PN function transmits the NM message 50 without attaching identification information of the ECU that is the destination of the request to operate.

[0022] Among the ECUs that have received the operation notification, an ECU with the PN function checks the destination of the received operation notification. If the operation notification is a PN message 51 with its own identification information attached as the destination, the ECU with the PN function transitions from the standby state to the operating state. On the other hand, if the operation notification is an NM message 50 or a PN message 51 without its own identification information attached as the destination, the ECU with the PN function does not transition to the operating state.

[0023] Among the ECUs that have received the operation notification, an ECU that does not have the PN function transitions from the standby state to the operating state without checking the destination of the received operation notification. In other words, when an ECU that does not have the PN function receives an operation notification, it transitions from the standby state to the operating state regardless of whether the operation notification is an NM message 50 or a PN message 51.

[0024] In this way, when an ECU with a PN function transmits a PN message 51, among the ECUs that receive the message, ECUs that do not have the PN function and ECUs that have the PN function and are the destinations of the PN message 51 transition to the operating state. On the other hand, when an ECU without a PN function transmits an NM message 50, among the ECUs that receive the message, only ECUs that do not have the PN function transition to the operating state.

[0025] As described above, the relay device 10 relays messages exchanged among multiple communication buses. The relay device 10 transmits a PN message 51 sent by an ECU having a PN function to a communication bus to which another ECU having a PN function is connected. For example, when the first PN device 31 transmits a PN message 51, the relay device 10 transmits the PN message 51 to the third communication bus 43, which is a communication bus to which the second PN device 32 and the third PN device 33 are connected.

[0026] Furthermore, the relay device 10 transmits an NM message 50 sent by an ECU that does not have the PN function to a communication bus to which another ECU that does not have the PN function is connected. For example, when the first NM device 21 sends an NM message 50, the relay device 10 transmits the NM message 50 to the second communication bus 42 to which the fourth NM device 24 and the fifth NM device 25 are connected and to the third communication bus 43 to which the sixth NM device 26 is connected.

[0027] The relay device 10 also transmits the NM message 50 and the PN message 51. While receiving the PN message 51 from another ECU, the relay device 10 relays the PN message 51 and also transmits the PN message 51 toward the communication bus to which the ECU having the PN function is connected. Therefore, as shown in FIG. 1 , while receiving the PN message 51 from another ECU, the relay device 10 transmits the PN message 51 toward the second communication bus 42 and the third communication bus 43.

[0028] While receiving an NM message 50 from another ECU, the relay device 10 relays the NM message 50 and also transmits the NM message 50 toward a communication bus to which an ECU that does not itself have a PN function is connected. Therefore, as shown in Fig. 1, while receiving an NM message 50 from another ECU, the relay device 10 transmits the NM message 50 toward the first communication bus 41, the second communication bus 42, and the third communication bus 43.

[0029] 1, each ECU in the in-vehicle network system 100 transmits a control message 52 in addition to a PN message 51 and an NM message 50. The control message 52 is a message transmitted by each ECU to exchange information required to realize a specific function. For example, each ECU transmits information such as the engine speed of the vehicle to other ECUs as the control message 52. In this embodiment, the control message 52 is a collective term for messages transmitted by each ECU in the in-vehicle network system 100, excluding operation notifications.

[0030] In the in-vehicle network system 100, the second NM device 22, the third NM device 23, and the sixth NM device 26 transmit periodic messages. The periodic messages are control messages 52 that are periodically transmitted by the second NM device 22, the third NM device 23, and the sixth NM device 26. In the in-vehicle network system 100, the fifth NM device 25 receives the periodic messages. When the reception of the periodic messages from the second NM device 22 is interrupted, the fifth NM device 25 determines that the second NM device 22 has failed. Furthermore, when the reception of the periodic messages from the third NM device 23 is interrupted, the fifth NM device 25 determines that the third NM device 23 has failed. Furthermore, when the reception of the periodic messages from the sixth NM device 26 is interrupted, the fifth NM device 25 determines that the sixth NM device 26 has failed. In this way, the fifth NM device 25 performs failure determination individually for the second NM device 22, the third NM device 23, and the sixth NM device 26.

[0031] Hereinafter, in the in-vehicle network system 100, the second NM device 22 will be referred to as the first device 61. Also, in the in-vehicle network system 100, the third NM device 23 will be referred to as the fourth device 64. And, in the in-vehicle network system 100, the sixth NM device 26 will be referred to as the fifth device 65. The first device 61, the fourth device 64, and the fifth device 65 are transmitting ECUs that transmit periodic messages.

[0032] Hereinafter, in the in-vehicle network system 100, the ECU that performs the failure determination is referred to as the second device 62. In the in-vehicle network system 100, the fifth NM device 25 is the second device 62. The second device 62 is a receiving-side ECU that performs the failure determination based on a periodic message received from a transmitting-side ECU.

[0033] Hereinafter, in the in-vehicle network system 100, an ECU having a PN function that is connected to the same communication bus as the second device 62 will be referred to as a third device 63. In the in-vehicle network system 100, the first PN device 31 is the third device 63.

[0034] <Aspects of Transitioning ECU to Standby State in In-Vehicle Network System 100> As described above, when each ECU realizes a specific function, it sends an operation notification to other ECUs that need to operate to realize that function. Each ECU periodically sends an operation notification until it has completed realizing the specific function. Once it has completed realizing the specific function, the ECU stops sending the operation notification.

[0035] Fig. 2 shows a state in which an ECU without a PN function has completed realizing a specific function in the in-vehicle network system 100 shown in Fig. 1. In other words, in Fig. 2, all ECUs without a PN function have stopped transmitting NM messages 50.

[0036] When all ECUs that do not have the PN function stop transmitting the NM message 50, the relay device 10 stops receiving the NM message 50 from the other ECUs. The relay device 10 that has stopped receiving the NM message 50 also stops transmitting the NM message 50 itself.

[0037] An ECU that has transitioned to an operating state continues to remain in the operating state for a certain period of time each time it receives an operating notification. When it no longer receives an operating notification from another ECU, it transitions from the operating state to a standby state.

[0038] In the example shown in FIG. 2, all ECUs that do not have the PN function have stopped transmitting the NM message 50, and therefore the ECUs connected to the first communication bus 41 no longer receive the NM message 50. Also, as described above, the relay device 10 does not relay the PN message 51 to the ECUs connected to the first communication bus 41. Thus, in the example shown in FIG. 2, the ECUs connected to the first communication bus 41 no longer receive the operation notification. Therefore, the ECUs included in the rectangular area in FIG. 2 transition from an operating state to a standby state. Thus, in the example shown in FIG. 2, the first device 61 and the fourth device 64 transition to a standby state.

[0039] On the other hand, in the example shown in FIG. 2 , the ECUs connected to the second communication bus 42 stop receiving the NM message 50, just like the ECUs connected to the first communication bus 41. However, as shown in FIG. 2 , the first PN device 31, which is an ECU with a PN function, is connected to the second communication bus 42. Therefore, the PN message 51 is transmitted to the ECUs connected to the second communication bus 42. Thus, in the example shown in FIG. 2 , the ECUs connected to the second communication bus 42 continue to receive the operation notification even after the NM message 50 is no longer transmitted. Therefore, in the example shown in FIG. 2 , the fourth NM device 24 and the fifth NM device 25, which are ECUs without a PN function, continue to operate even after the NM message 50 is no longer transmitted. Thus, in the example shown in FIG. 2 , the second device 62 connected to the second communication bus 42 remains operating even after the NM message 50 is no longer transmitted because the third device 63 is connected to the communication bus to which the second device 62 is connected.

[0040] 2, the ECUs connected to the third communication bus 43 stop receiving the NM message 50, just like the ECUs connected to the first communication bus 41. However, as shown in FIG. 2, the second PN device 32 and the third PN device 33, which are ECUs with PN functionality, are connected to the third communication bus 43. Therefore, the PN message 51 is transmitted to the ECUs connected to the third communication bus 43. Thus, in the example shown in FIG. 2, the ECUs connected to the third communication bus 43 continue to receive the operation notification even after the NM message 50 is no longer transmitted. Therefore, in the example shown in FIG. 2, the sixth NM device 26, which is an ECU without PN functionality, continues to operate even after the NM message 50 is no longer transmitted. Thus, in the example shown in FIG. 2, the fifth device 65 connected to the third communication bus 43, like the second device 62, remains operating even after the NM message 50 is no longer transmitted.

[0041] 2, the first device 61 and the fourth device 64 are in a standby state, while the second device 62 remains in an operating state. In such a case, the first device 61 and the fourth device 64, which have transitioned to a standby state, stop sending periodic messages. In this case, the second device 62, which has stopped receiving periodic messages, erroneously determines that the first device 61 and the fourth device 64 have failed.

[0042] 2, the fifth device 65 maintains an operating state, similar to the second device 62. Therefore, in FIG. 2, the fifth device 65 continues to send periodic messages, and the second device 62 does not determine that the fifth device 65 has failed.

[0043] <Communication flow for preventing erroneous determination in failure determination by the second device 62> 3 shows a mode of communication for failure determination by the second device 62, which is executed between the first device 61, the fourth device 64, or the fifth device 65 and the second device 62 in the in-vehicle network system 100. That is, the second device 62 executes communication with each of the ECUs of the first device 61, the fourth device 64, and the fifth device 65 in the mode shown in FIG.

[0044] As shown in the upper part of FIG. 3, the first device 61, the fourth device 64, and the fifth device 65 transmit periodic messages while in the operating state. At this time, the first device 61, the fourth device 64, and the fifth device 65 transmit periodic messages including an identifier that is information for identifying the ECU that sent the message. That is, the first device 61 transmits a periodic message including an identifier that indicates the first device 61. The fourth device 64 transmits a periodic message including an identifier that indicates the fourth device 64. The fifth device 65 transmits a periodic message including an identifier that indicates the fifth device 65.

[0045] 3, when the second device 62 receives a periodic message, it checks the identifier included in the periodic message. The second device 62 then performs a failure determination for the ECU identified by the identifier. For example, when the second device 62 receives a periodic message including an identifier identifying the first device 61, it determines that the first device 61 is not at fault.

[0046] 3, the first device 61, the fourth device 64, and the fifth device 65 prepare to transition to a standby state when they no longer receive an operation notification from another ECU. At this time, the first device 61, the fourth device 64, and the fifth device 65 determine that they have stopped receiving an operation notification from another ECU when they have not received an operation notification for a certain period of time.

[0047] As shown in the middle of FIG. 3, the first device 61, the fourth device 64, and the fifth device 65 prepare to transition to a standby state, and then transmit a standby notification to the second device 62. The standby notification is a message indicating that the device will transition to a standby state. The first device 61, the fourth device 64, and the fifth device 65 transmit the standby notification including an identifier. After transmitting the standby notification, the first device 61, the fourth device 64, and the fifth device 65 transition to a standby state.

[0048] 3, when the second device 62 receives the standby notification, it checks the identifier included in the standby notification. Then, the second device 62 stops the failure determination for the ECU indicated by the identifier. For example, when the second device 62 receives the standby notification including the identifier indicating the first device 61, it stops the failure determination for the first device 61.

[0049] As shown in the lower part of Fig. 3, the first device 61, the fourth device 64, and the fifth device 65 transition to an operating state when they receive an operating notification from another ECU. Then, the first device 61, the fourth device 64, and the fifth device 65 transmit a start-up notification to the second device 62. The start-up notification is a message indicating that the device has transitioned to an operating state. The first device 61, the fourth device 64, and the fifth device 65 transmit the start-up notification including an identifier.

[0050] 3, upon receiving the startup notification, the second device 62 checks the identifier included in the startup notification. The second device 62 then resumes failure determination for the ECU identified by the identifier. For example, when the second device 62 receives a startup notification including an identifier identifying the first device 61, the second device 62 resumes failure determination for the first device 61.

[0051] <Operation of this embodiment> In the in-vehicle network system 100, the first device 61 notifies the second device 62 of the transition to a standby state through a standby notification. Then, in the in-vehicle network system 100, the second device 62 stops the failure determination for the first device 61 when it receives the standby notification.

[0052] <Effects of this embodiment> (1) The in-vehicle network system 100 can prevent the second device 62 from erroneously determining that a failure has occurred.

[0053] (2) In the in-vehicle network system 100, after transmitting a standby notification, the first device 61, when transitioning from a standby state to an operating state, transmits a startup notification, which is a message indicating that the device has transitioned to an operating state, to the second device 62. In the in-vehicle network system 100, after suspending the fault determination for the first device 61, the second device 62 resumes the fault determination for the first device 61 when receiving the startup notification from the first device 61.

[0054] In the in-vehicle network system 100, the first device 61 notifies the second device 62 through a startup notification that it has transitioned to an operating state. Then, in the in-vehicle network system 100, when the second device 62 receives the startup notification, it resumes the failure determination for the first device 61. This allows the in-vehicle network system 100 to cause the second device 62 to resume the failure determination.

[0055] (3) The in-vehicle network system 100 includes a fourth device 64, which is an ECU equipped with an NM function and connected to the first communication bus 41, and which transmits a periodic message, a standby notification, and a startup notification to the second device 62. The first device 61 and the fourth device 64 transmit the periodic message, the standby notification, and the startup notification together with information for identifying the ECU that sent the periodic message. When the second device 62 receives a periodic message, it checks the ECU that sent the received periodic message and performs a fault determination on the ECU that sent the received periodic message. When the second device 62 receives a standby notification, it checks the ECU that sent the received standby notification and stops the fault determination on the ECU that sent the received standby notification. When the second device 62 receives a startup notification, it checks the ECU that sent the received startup notification and resumes the fault determination on the ECU that sent the received startup notification.

[0056] In the in-vehicle network system 100, the second device 62 individually performs failure determination for each of the ECUs connected to the same communication bus. In the in-vehicle network system 100, the second device 62 individually stops and resumes failure determination for each of the ECUs connected to the same communication bus. This allows the in-vehicle network system 100 to cause the second device 62 to individually perform failure determination for each of the ECUs connected to the same communication bus, while preventing erroneous failure determination in each of the ECUs.

[0057] (4) The in-vehicle network system 100 includes a fifth device 65 that is an ECU equipped with an NM function and that transmits a periodic message, a standby notification, and a startup notification to the second device 62, and a third communication bus 43 that is connected to the fifth device 65 and the relay device 10. The first device 61 and the fifth device 65 transmit the periodic message, the standby notification, and the startup notification together with information for identifying the ECU that sent the periodic message. When the second device 62 receives a periodic message, it checks the ECU that sent the received periodic message and performs a fault determination on the ECU that sent the received periodic message. When the second device 62 receives a standby notification, it checks the ECU that sent the received standby notification and stops the fault determination on the ECU that sent the received standby notification. When the second device 62 receives a startup notification, it checks the ECU that sent the received startup notification and resumes the fault determination on the ECU that sent the received startup notification.

[0058] In the in-vehicle network system 100, the second device 62 individually performs failure determination for a plurality of ECUs connected to different communication buses. In the in-vehicle network system 100, the second device 62 individually stops and resumes failure determination for a plurality of ECUs connected to different communication buses. This allows the in-vehicle network system 100 to cause the second device 62 to individually perform failure determination for a plurality of ECUs connected to different communication buses, while preventing erroneous failure determination in each ECU.

[0059] (5) When the first device 61, which is the transmitting ECU, transitions from an operating state to a standby state, it notifies the second device 62, which is the receiving ECU, of the transition to the standby state. This allows the first device 61, which is the transmitting ECU, to prevent the second device 62, which is the receiving ECU, from erroneously determining a failure.

[0060] <Example of change> This embodiment can be modified as follows: This embodiment and the following modifications can be combined and implemented within the scope of technical compatibility.

[0061] In the above-described in-vehicle network system 100, the relay device 10 transmits a PN message 51 sent by an ECU with a PN function to a communication bus to which other ECUs with a PN function are connected. Also, the relay device 10 transmits an NM message 50 sent by an ECU without a PN function to a communication bus to which other ECUs without a PN function are connected.

[0062] On the other hand, the relay device 10 may transmit an operation notification to all communication buses to which the relay device 10 is connected, and may not transmit an operation notification to some of the communication buses only when the ECUs connected to those communication buses are to be transitioned to a standby state.

[0063] The number of communication buses and the number of connected ECUs in the above-described in-vehicle network system 100 are not limited to those in the above-described embodiment, as long as the in-vehicle network system 100 includes the first communication bus 41 including the first device 61, the second communication bus 42 including the second device 62 and the third device 63, and the relay device 10. Furthermore, the topology of the in-vehicle network system 100 is not limited to those in the above-described embodiment.

[0064] In the above-described in-vehicle network system 100, no ECU having a PN function is connected to the first communication bus 41. On the other hand, in the in-vehicle network system 100, an ECU having a PN function may be connected to the first communication bus 41 to which the first device 61 is connected.

[0065] The relay device 10 may be configured to, when receiving a PN message 51 from another ECU, check the destination of the PN message 51 and transmit the PN message 51 only to the communication bus to which the destination ECU is connected. In this case, even if an ECU having a PN function is connected to the first communication bus 41, an operation notification may not be transmitted to the first communication bus 41 but may be transmitted to the second communication bus 42.

[0066] In the above-described in-vehicle network system 100, an ECU having a PN function is connected to the third communication bus 43. On the other hand, in the in-vehicle network system 100, an ECU having a PN function does not necessarily have to be connected to the third communication bus 43 to which the fifth device 65 is connected.

[0067] The above-described in-vehicle network system 100 includes a first device 61, a fourth device 64, and a fifth device 65 as ECUs that transmit periodic messages. The in-vehicle network system 100 does not necessarily have to include the fourth device 64. Moreover, the in-vehicle network system 100 does not necessarily have to include the fifth device 65.

[0068] In the above-described in-vehicle network system 100, the first device 61, the fourth device 64, and the fifth device 65 may transmit periodic messages, standby notifications, and startup notifications without including an identifier. In this case, the second device 62 performs a failure determination, stops, and resumes without checking the identifier included in the message.

[0069] In the above-described in-vehicle network system 100, the first device 61, the fourth device 64, and the fifth device 65 transmit a startup notification. On the other hand, the first device 61, the fourth device 64, and the fifth device 65 do not need to transmit a startup notification. In this case, for example, after the second device 62 stops the failure determination, the second device 62 does not resume the failure determination unless the second device 62 itself is restarted. [Explanation of symbols]

[0070] 10...relay device, 21...first NM device, 22...second NM device, 23...third NM device, 24...fourth NM device, 25...fifth NM device, 26...sixth NM device, 31...first PN device, 32...second PN device, 33...third PN device, 41...first communication bus, 42...second communication bus, 43...third communication bus, 50...NM message, 51...PN message, 52...control message, 61...first device, 62...second device, 63...third device, 64...fourth device, 65...fifth device, 100...in-vehicle network system

Claims

1. An electronic control device having a network management function that, when receiving an operation notification that is a message requesting operation, transitions from a standby state in which communication is not performed to an operation state in which the communication is possible, a first device that transmits a periodic message, the periodic message being a message that is transmitted periodically; a second device that executes a failure determination to determine that the first device has failed when reception of the periodic message from the first device is interrupted; a third device having a partial network function that, when receiving the operation notification, does not transition from the standby state to the operating state if the operation notification is not addressed to the third device; a first communication bus connecting the first device; a second communication bus connecting the second device and the third device; a relay device connected to the first communication bus and the second communication bus, and configured to relay messages exchanged among a plurality of communication buses; An in-vehicle network system comprising: The first device is When transitioning from the operating state to the standby state, transmitting a standby notification to the second device, the standby notification being a message indicating transition to the standby state; The second device is When the standby notification is received from the first device, the failure determination for the first device is stopped. In-vehicle network system.

2. The first device is after transmitting the standby notification, when the standby state is transitioned to the operating state, transmitting a startup notification to the second device, the startup notification being a message indicating that the second device has transitioned to the operating state; The second device is After the failure determination for the first device is stopped, the failure determination for the first device is resumed when the startup notification is received from the first device. The in-vehicle network system according to claim 1 .

3. a fourth device that is an electronic control device having the network management function, connected to the first communication bus, and that transmits the periodic message, the standby notification, and the startup notification to the second device; The first device and the fourth device are the periodic message, the standby notification, and the startup notification are transmitted together with information for identifying the electronic control device that is the transmission source; The second device is When the periodic message is received, the electronic control device that is the sender of the received periodic message is identified, and the fault determination is performed on the electronic control device that is the sender of the received periodic message. When the standby notification is received, the electronic control device that is the sender of the received standby notification is identified, and the failure determination for the electronic control device that is the sender of the received standby notification is stopped. When the startup notification is received, the electronic control device that is the sender of the received startup notification is identified, and the failure determination for the electronic control device that is the sender of the received startup notification is resumed. The in-vehicle network system according to claim 2 .

4. a fifth device that is an electronic control device having the network management function and that transmits the periodic message, the standby notification, and the startup notification to the second device; a third communication bus connected to the fifth device and the relay device; The first device and the fifth device are the periodic message, the standby notification, and the startup notification are transmitted together with information for identifying the electronic control device that is the transmission source; The second device is When the periodic message is received, the electronic control device that is the sender of the received periodic message is identified, and the fault determination is performed on the electronic control device that is the sender of the received periodic message. When the standby notification is received, the electronic control device that is the sender of the received standby notification is identified, and the failure determination for the electronic control device that is the sender of the received standby notification is stopped. When the startup notification is received, the electronic control device that is the sender of the received startup notification is identified, and the failure determination for the electronic control device that is the sender of the received startup notification is resumed.

4. The in-vehicle network system according to claim 2 or 3.

5. An electronic control device having a network management function that, when receiving an operation notification that is a message requesting operation, transitions from a standby state in which communication is not performed to an operation state in which the communication is possible, a transmitting electronic control device that transmits a periodic message, which is a message that is transmitted periodically; a receiving-side electronic control unit that executes a failure determination to determine that the transmitting-side electronic control unit has failed when reception of the periodic message from the transmitting-side electronic control unit is interrupted; an electronic control device having a partial network function that, when receiving the operation notification, does not transition from the standby state to the operating state if the operation notification is not addressed to the electronic control device itself; a first communication bus connected to the transmitting electronic control device; a second communication bus connecting the receiving electronic control device and the electronic control device having the partial network function; a relay device connected to the first communication bus and the second communication bus, and configured to relay messages exchanged among a plurality of communication buses; The transmitting electronic control device in an in-vehicle network system includes: When the operating state is shifted to the standby state, a standby notification is transmitted to the receiving electronic control unit, which is a message indicating that the state will be shifted to the standby state. Electronic control unit.

Images