In-vehicle system, route switching device, and route switching method

Abstract

To more surely provide a function related to traveling or the like of a vehicle.SOLUTION: An in-vehicle system includes a first communication path including an in-vehicle device having a function of communicating with an outside of a vehicle, a second communication path not including the in-vehicle device, and a switching processing unit configured to perform switching processing from a state in which the first communication path is used to a state in which the second communication path is used when it is detected that the state of the first communication path is remotely taken over from the outside of the vehicle.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle system, a route switching device, and a route switching method. [Background technology]

[0002] Conventionally, techniques for detecting anomalies in an in-vehicle network have been developed. For example, Patent Document 1 (WO 2019 / 117184) discloses the following technique. That is, an in-vehicle network anomaly detection system is arranged on an in-vehicle network including a first network to which a plurality of first devices that communicate using a first protocol are connected and a second network to which a plurality of second devices that communicate using a second protocol different from the first protocol are connected, and determines whether or not an anomaly exists in data communicated on the in-vehicle network, and includes a first communication unit that receives, from the first network, first unit data that is communication unit data in the first protocol transmitted by the plurality of first devices, and an anomaly determination database that includes information on an anomaly determination rule used to determine whether or not an anomaly exists in the first unit data, and an anomaly determination unit that determines whether or not the first unit data includes an anomaly based on the anomaly determination rule; The device includes a unit data conversion unit that extracts second unit data, which is communication unit data in the second protocol included in a data field of the first unit data, from the first unit data if it is determined that the first unit data does not contain an abnormality, and a second communication unit that sends the extracted second unit data to the second network, wherein the first unit data includes source information indicating a first device among the plurality of first devices that is the source of the first unit data, and the second unit data included in the first unit data includes a data identifier that is an identifier of the second unit data, and the abnormality determination unit makes the determination by comparing the combination of the source information and the data identifier with the abnormality determination rule, and if it is determined that the first unit data contains an abnormality, executes a predetermined abnormality response process. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2019 / 117184 Summary of the Invention [Problem to be solved by the invention]

[0004] In an in-vehicle network that includes in-vehicle devices that communicate with the outside of the vehicle, the in-vehicle devices may be used to provide functions related to the vehicle's operation, etc. If the in-vehicle devices are attacked from outside the vehicle and taken over, there is a possibility that the provision of such functions may fail.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle system, a route switching device, and a route switching method that can more reliably provide functions related to vehicle driving, etc. [Means for solving the problem]

[0006] The in-vehicle system of the present disclosure comprises a first communication path including an in-vehicle device having the function of communicating with the outside of the vehicle, a second communication path that does not include the in-vehicle device, and a switching processing unit that performs switching processing from a state in which the first communication path is used to a state in which the second communication path is used when it is detected that the state of the first communication path has been remotely taken over from the outside of the vehicle.

[0007] One aspect of the present disclosure can be realized not only as an in-vehicle system including such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle system.

[0008] One aspect of the present disclosure may be realized not only as a route switching device including such a characteristic processing unit, but also as a method having such characteristic processing steps, or as a program for causing a computer to execute such steps. Furthermore, one aspect of the present disclosure may be realized as a semiconductor integrated circuit that realizes part or all of the route switching device. [Effects of the Invention]

[0009] According to the present disclosure, functions relating to vehicle driving and the like can be provided more reliably. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating a configuration of an in-vehicle relay device according to an embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating a configuration of an in-vehicle relay device according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining an example of a switching process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 5] FIG. 5 is a diagram illustrating a configuration of an in-vehicle relay device according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs a switching process. [Figure 7] FIG. 7 is a diagram illustrating a configuration of a modified example of the in-vehicle system according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating a configuration of a modified example of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of a correspondence table held by a modified example of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 10]FIG. 10 is a flowchart defining an example of an operation procedure when the modified example of the vehicle-mounted relay device according to the embodiment of the present disclosure performs a switching process. DETAILED DESCRIPTION OF THE INVENTION

[0011] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure includes a first communication path including an in-vehicle device having the function of communicating with the outside of the vehicle, a second communication path not including the in-vehicle device, and a switching processing unit that performs switching processing from a state in which the first communication path is used to a state in which the second communication path is used when it is detected that the state of the first communication path has been remotely taken over from the outside of the vehicle.

[0012] With this configuration, even if a communication path including an on-board device that communicates with the outside of the vehicle is hijacked, functions related to the vehicle's running, etc. can be provided using another communication path that does not include the on-board device, thereby making it possible to more reliably provide functions related to the vehicle's running, etc.

[0013] (2) In the above (1), the first communication path and the second communication path may be paths for transmitting measurement information indicating measurement results in the vehicle.

[0014] With this configuration, when providing functions related to vehicle operation, etc. using measurement information, the functions can be continuously provided using measurement information transmitted via a communication path other than the hijacked communication path.

[0015] (3) In the above (1) or (2), if the switching processing unit detects that the state of the first communication path has been remotely taken over from outside the vehicle, the switching processing unit may further perform processing to notify a message to a passenger in the vehicle.

[0016] With this configuration, for example, a vehicle occupant can recognize that a communication path including an on-board device that communicates with the outside of the vehicle has been hijacked.

[0017] (4) In the above (3), the message may indicate a service that can be provided using the first communication path but that has become unavailable due to the switching process.

[0018] With this configuration, vehicle occupants can easily understand which services are no longer available in the vehicle, and can therefore take the necessary measures to resume the provision of those services, for example.

[0019] (5) In any of (1) to (4) above, the in-vehicle system may further include a judgment unit that, when a control event occurs for the vehicle from outside the vehicle, judges whether or not the switching processing unit needs to perform the switching processing using correspondence information indicating the correspondence between the state of the vehicle and whether or not the switching processing is performed.

[0020] With this configuration, when an event occurs in which control is performed on the vehicle from outside the vehicle, it is possible to appropriately determine whether or not to switch the communication path depending on the state of the vehicle at the time of the event occurrence. Furthermore, it is possible to easily determine whether or not to switch the communication path using the correspondence information.

[0021] (6) A route switching device according to an embodiment of the present disclosure is a route switching device used in an in-vehicle system mounted on a vehicle, the in-vehicle system having a first communication path including an in-vehicle device having a function of communicating with the outside of the vehicle, and a second communication path that does not include the other in-vehicle device, and the route switching device has a detection unit that detects that the state of the first communication path has been remotely taken over from the outside of the vehicle, and a switching processing unit that performs switching processing from a state in which the first communication path is used to a state in which the second communication path is used when the detection unit detects that the state of the first communication path has been taken over.

[0022] With this configuration, even if a communication path including an on-board device that communicates with the outside of the vehicle is hijacked, functions related to the vehicle's running, etc. can be provided using another communication path that does not include the on-board device, thereby making it possible to more reliably provide functions related to the vehicle's running, etc.

[0023] (7) A route switching method according to an embodiment of the present disclosure is a communication route switching method in an in-vehicle system, the in-vehicle system having a first communication route including an in-vehicle device having a function of communicating with the outside of the vehicle, and a second communication route not including the in-vehicle device, the route switching method including the steps of: detecting that the state of the first communication route is in a state in which it has been remotely taken over from outside the vehicle; and, when it is detected that the state of the first communication route is in a state in which it has been remotely taken over from outside the vehicle, performing a switching process from a state in which the first communication route is being used to a state in which the second communication route is being used.

[0024] With this method, even if a communication path including an on-board device that communicates with the outside of the vehicle is hijacked, functions related to the vehicle's running, etc. can be provided using another communication path that does not include the on-board device, thereby making it possible to more reliably provide functions related to the vehicle's running, etc.

[0025] (8) In any of (1) to (5) above, when an event of control of the vehicle from outside the vehicle occurs, the switching processing unit may perform the switching processing depending on whether or not a predetermined condition is met, and the predetermined condition may include whether or not the terminal device that is the control source is present within the vehicle.

[0026] With this configuration, it is possible to appropriately determine whether or not the communication path needs to be switched depending on the state of the vehicle, that is, whether or not a terminal device that controls the vehicle is present inside the vehicle.

[0027] (9) In the above (8), it may further include whether the vehicle is moving.

[0028] With this configuration, it is possible to more appropriately determine whether or not the communication path needs to be switched, depending on whether or not a terminal device that controls the vehicle is present inside the vehicle, as well as whether or not the vehicle is moving.

[0029] (10) In the above (8) or (9), the control may be a parking operation of the vehicle.

[0030] This configuration makes it possible to prevent hijacking of parking operations, which is an example of hijacking of communication paths.

[0031] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0032] [In-vehicle system] 1 is a diagram showing a configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to FIG. 1, an in-vehicle system 301 includes a plurality of in-vehicle relay devices 100 and a plurality of in-vehicle devices 202. The in-vehicle system 301 is mounted on a vehicle 1. The vehicle 1 is, for example, an electric vehicle.

[0033] The in-vehicle devices 202 include an in-vehicle ECU (Electronic Control Unit), sensors, actuators, a navigation device, a human-machine interface, a camera, etc. The in-vehicle ECUs include a TCU (Telematics Communication Unit), an engine ECU, an autonomous driving ECU, a steering ECU, a brake ECU, and a door lock ECU.

[0034] A plurality of vehicle-mounted relay devices 100 and a plurality of vehicle-mounted devices 202 constitute a vehicle-mounted network 401 .

[0035] 1, the vehicle-mounted system 301 includes vehicle-mounted relay devices 101, 102, and 103 that are the vehicle-mounted relay device 100. The vehicle-mounted relay device 103 is an example of a route switching device and an example of a switching processing unit.

[0036] In the example shown in FIG. 1, the in-vehicle system 301 includes the in-vehicle devices 202A, 202B, 202C, 202D, 202E, 202F, 202G, 202H, and 202J.

[0037] The in-vehicle devices 202A, 202B, 202C, 202D, 202E, and 202F are connected to the in-vehicle repeater 101 or 102 via a CAN bus 51 that conforms to the CAN (Controller Area Network) standard, for example.

[0038] In the example shown in FIG. 1, CAN bus 51 includes CAN buses 51A, 51B, 51C, and 51D.

[0039] The in-vehicle devices 202A and 202B are connected to the in-vehicle relay device 101 via a CAN bus 51A. The in-vehicle devices 202C and 202D are connected to the in-vehicle relay device 101 via a CAN bus 51B. The in-vehicle devices 202E and 202F are connected to the in-vehicle relay device 101 via a CAN bus 51C. The in-vehicle device 202G is connected to the in-vehicle relay device 102 via a CAN bus 51D.

[0040] In the following description, the in-vehicle device 202 connected to the in-vehicle relay device 101 via the CAN bus 51A or CAN bus 51B is also referred to as the "CAN device M1." Also, the in-vehicle device 202 connected to the in-vehicle relay device 102 via the CAN bus 51C or CAN bus 51D is also referred to as the "CAN device M2."

[0041] The in-vehicle devices 202H and 202J are connected to the in-vehicle repeater 103 via an Ethernet (registered trademark) cable 52, for example.

[0042] In the example shown in FIG. 1, the Ethernet cable 52 includes Ethernet cables 52A and 52B.

[0043] The in-vehicle device 202H is connected to the in-vehicle repeater 103 via an Ethernet cable 52A. The in-vehicle device 202J is connected to the in-vehicle repeater 103 via an Ethernet cable 52B.

[0044] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 51 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 51 are provided.

[0045] Furthermore, the in-vehicle devices 202A, 202B, 202C, 202D, 202E, 202F, and 202G are not limited to being connected to the in-vehicle repeater 101 or the in-vehicle repeater 102 via the CAN bus 51, but may also be connected to the in-vehicle repeater 101 or the in-vehicle repeater 102 via a transmission line conforming to other communication standards such as CAN FD (CAN with Flexible Data Rate) and Ethernet.

[0046] Furthermore, the in-vehicle devices 202H, 202J are not limited to being connected to the in-vehicle repeater 103 via an Ethernet cable 52, but may also be connected to the in-vehicle repeater 103 via a transmission line conforming to other communication standards such as CAN and CAN FD.

[0047] 1, the in-vehicle devices 202A, 202B, 202C, 202D, 202E, 202F, and 202G are an accelerator sensor, a brake sensor, a steering sensor, a TCU, an accelerator sensor, a brake sensor, and a steering sensor, respectively. In the following description, the in-vehicle devices 202A, 202B, 202C, 202D, 202E, 202F, and 202G are also referred to as the accelerator sensor 202A, the brake sensor 202B, the steering sensor 202C, the TCU 202D, the accelerator sensor 202E, the brake sensor 202F, and the steering sensor 202G, respectively.

[0048] The accelerator sensors 202A and 202E measure the opening degree of the accelerator of the vehicle 1 (hereinafter also referred to as "accelerator opening degree"), for example, periodically.

[0049] The brake sensors 202B and 202F measure the brake pressure of the foot brake of the vehicle 1, for example, periodically.

[0050] The steering sensors 202C and 202G, for example, periodically measure the steering angle of the steering wheel of the vehicle 1. For example, the steering angle indicates the amount of rotation in the direction in which the driver turns the steering wheel from the neutral position of the steering wheel.

[0051] The TCU 202D communicates with an external device outside the vehicle 1 via, for example, a wireless base station device (not shown).

[0052] In the example shown in FIG. 1, the in-vehicle device 202H and the in-vehicle device 202J are a navigation device and a driving-related device, respectively.

[0053] The driving-related devices are in-vehicle devices 202 that execute functions related to driving, etc. of the vehicle 1. Specifically, the driving-related devices are an autonomous driving ECU, an EPS (Electric Power Steering), an ADAS (Advanced Driving Assistant System) ECU, a steering ECU, a foot brake ECU, etc. In the following description, the in-vehicle devices 202H and 202J are also referred to as the navigation device 202H and the driving-related devices 202J, respectively.

[0054] The in-vehicle device 202 transmits to other in-vehicle devices 202 frames including various information, which will be described later, such as information for assisting the automatic driving performed by the vehicle 1 and information used for entertainment.

[0055] Specifically, for example, CAN device M1 transmits a CAN frame including various information and a CAN-ID (Identifier) ​​indicating the type of data, etc., to another CAN device M1 or the in-vehicle relay device 101. Also, CAN device M2 transmits a CAN frame including various information and the CAN-ID to another CAN device M2 or the in-vehicle relay device 102.

[0056] The on-vehicle repeater 103 is connected to the on-vehicle repeater 101 via, for example, an Ethernet cable 53, a relay 61, and an Ethernet cable 54. The on-vehicle repeater 103 is also connected to the on-vehicle repeater 102 via, for example, an Ethernet cable 55, a relay 62, and an Ethernet cable 56.

[0057] The relay 61 is connected between the Ethernet cable 53 and the Ethernet cable 54. The relay 61 is, for example, a semiconductor switch. The relay 61 switches the connection state C1 between the Ethernet cable 53 and the Ethernet cable 54.

[0058] Specifically, for example, the relay 61 switches between an on state and an off state under the control of a switching processing unit 32 in the in-vehicle relay device 103, which will be described later. When the state of the relay 61 transitions from the on state to the off state, the connection state C1 switches from the on state to the off state.

[0059] The relay 62 is connected between the Ethernet cable 55 and the Ethernet cable 56. The relay 62 is, for example, a semiconductor switch. The relay 62 switches the connection state C2 between the Ethernet cable 55 and the Ethernet cable 56.

[0060] Specifically, for example, the relay 62 switches between an on state and an off state under the control of a switching processing unit 32 in the vehicle-mounted repeater 103, which will be described later.

[0061] Normally, the relay 61 is in an on state, and the relay 62 is in an off state.

[0062] Between the vehicle-mounted repeater 101 and the vehicle-mounted repeater 103, and between the vehicle-mounted repeater 102 and the vehicle-mounted repeater 103, information is exchanged using Ethernet frames.

[0063] The vehicle-mounted relay device 101 performs a relay process for relaying data transmitted and received between devices connected to the vehicle-mounted relay device 101.

[0064] (Communication paths P1, P2) The in-vehicle system 301 includes a communication path P1 that includes an in-vehicle device 202 that has a function of communicating with the outside of the vehicle 1, and a communication path P2 that does not include the in-vehicle device 202. The communication path P1 is an example of a first communication path. The communication path P2 is an example of a second communication path.

[0065] More specifically, for example, communication path P1 includes accelerator sensor 202A, brake sensor 202B, steering sensor 202C, TCU 202D, and in-vehicle relay device 101. Communication path P2 includes accelerator sensor 202E, brake sensor 202F, steering sensor 202G, and in-vehicle relay device 102. That is, unlike communication path P1, communication path P2 does not include TCU 202D.

[0066] For example, the communication paths P1 and P2 are paths for transmitting measurement information indicating the measurement results in the vehicle 1.

[0067] More specifically, for example, the measurement information transmitted over communication path P1 includes accelerator information A1 indicating the measurement results of accelerator sensor 202A, brake information B1 indicating the measurement results of brake sensor 202B, and steering information S1 indicating the measurement results of steering sensor 202C.

[0068] The measurement information transmitted through the communication path P2 is accelerator information A2 indicating the measurement result of the accelerator sensor 202E, brake information B2 indicating the measurement result of the brake sensor 202F, and steering information S2 indicating the measurement result of the steering sensor 202G.

[0069] In the in-vehicle network 401, various services relating to the running of the vehicle 1 and the like are provided by using the communication path P1 or the communication path P2.

[0070] Services provided using communication path P1 include a device control service that controls driving-related devices 202J using measurement information from various sensors, a driving assistance service that assists in driving the vehicle 1, and a remote control service that drives the vehicle 1 through operation by the user of the vehicle 1 from outside the vehicle. Specifically, the driving assistance service is a service that provides driving assistance such as automatically limiting the vehicle speed using measurement information from sensors that measure tire air pressure. The remote control service is a parking assistance service that automatically parks the unmanned vehicle 1 in a predetermined location specified by the user from outside the vehicle, and a door unlocking service that unlocks the doors of the vehicle 1 from outside the vehicle.

[0071] Services provided using communication path P2 include device control services, but do not include driving assistance services or remote control services.

[0072] [In-vehicle relay device 101] 2 is a diagram showing the configuration of an in-vehicle repeater 101 according to an embodiment of the present disclosure.

[0073] 2, the vehicle-mounted relay device 101 includes a relay unit 11, a monitoring unit 12, and a storage unit 13. One or both of the relay unit 11 and the monitoring unit 12 are realized by, for example, a processing circuit including one or more processors. The storage unit 13 is, for example, a non-volatile memory included in the processing circuit.

[0074] (Relay section) For example, the relay unit 11 performs relay processing involving conversion of a communication protocol. More specifically, for example, when the relay unit 11 receives an Ethernet frame addressed to the in-vehicle relay device 103 from the CAN device M1, the relay unit 11 converts the format of the received CAN frame into the format of an Ethernet frame and transmits the converted frame to the in-vehicle relay device 103.

[0075] Specifically, when the relay unit 11 receives a CAN frame from a certain CAN device M1, it checks whether the received CAN frame is a CAN frame that its own in-vehicle relay device 101 should receive.

[0076] The storage unit 13 stores, for example, a reception list L1 indicating the CAN-IDs contained in the CAN frames that the in-vehicle relay device 101 of its own should receive.

[0077] When the relay unit 11 receives a CAN frame from the CAN device M1, it refers to the reception list L1 in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0078] For example, if the CAN-ID included in the received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0079] For example, the memory unit 13 stores a routing table showing the correspondence between the CAN-ID, the CAN bus 51 (hereinafter also referred to as the "source bus") to which the in-vehicle device 202 that is the source of the CAN frame is connected, and the device to which the CAN frame is to be sent.

[0080] For example, if the CAN-ID contained in the CAN frame received from the CAN device M1 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0081] When the destination device of the received CAN frame is the in-vehicle relay device 103 , the relay unit 11 changes the format of the CAN frame to the Ethernet frame format and transmits it to the in-vehicle relay device 103 .

[0082] Furthermore, when the relay unit 11 receives an Ethernet frame from the in-vehicle relay device 103, it changes the format of the received Ethernet frame to the format of a CAN frame and transmits the frame to the destination CAN device M1.

[0083] Furthermore, for example, the relay unit 11 performs relay processing without converting the communication protocol. For example, the storage unit 13 stores a bus table Tb1 indicating the correspondence between the CAN-ID and the CAN bus 51 to which the CAN device M1 is connected.

[0084] When the destination device corresponding to a CAN frame received from a CAN device M1 is another CAN device M1, the relay unit 11 identifies the CAN bus 51 corresponding to the CAN-ID included in the CAN frame by referring to the bus table Tb1 in the storage unit 13. Then, the relay unit 11 outputs the received CAN frame to the identified CAN bus 51.

[0085] (Monitoring Department) The monitoring unit 12 monitors the status of the communication path P1 including its own in-vehicle relay device 101. In this embodiment, for example, the monitoring unit 12 monitors the communication load (hereinafter also referred to as "bus load") on the source bus of the CAN frame. More specifically, the monitoring unit 12 monitors, for example, periodically the bus load on each of the multiple source buses connected to its own in-vehicle relay device 101, i.e., the CAN bus 51A and the CAN bus 51B.

[0086] Specifically, for example, the monitoring unit 12 calculates an estimated value of the bus load for each of the multiple source buses every time a calculation period E for the estimated value of the bus load has elapsed since its own vehicle-mounted relay device 101 was started up.

[0087] For example, if the CAN-ID included in the CAN frame received from the CAN device M1 is registered in the reception list L1, the relay unit 11 outputs ID information indicating the CAN-ID to the monitor unit 12.

[0088] During the calculation period E, the monitoring unit 12 counts, for each source bus, the number of times that the monitoring unit 12 receives, from the relay unit 11, ID information indicating the CAN-ID corresponding to the source bus.

[0089] Specifically, during the calculation period E, each time the monitoring unit 12 receives ID information from the relay unit 11, it counts up the counter value corresponding to the CAN-ID indicated by the ID information.

[0090] When the calculation period E has elapsed, the monitoring unit 12 creates load information that indicates the counter value for each source bus as an estimated value of the bus load on that source bus. The monitoring unit 12 then stores the created load information in the storage unit 13. The monitoring unit 12 resets the counter value to zero for each calculation period E. In the following description, the load information corresponding to CAN bus 51A and the load information corresponding to CAN bus 51B are also referred to as load information Da and load information Db, respectively.

[0091] [In-vehicle relay device 103] 3 is a diagram illustrating the configuration of an in-vehicle repeater 103 according to an embodiment of the present disclosure.

[0092] 3, the vehicle-mounted relay device 103 includes a relay unit 21, a processing unit 22, and a storage unit 23. The processing unit 22 includes a detection unit 31, a switching processing unit 32, a notification unit 33, and a control unit 34. One or both of the relay unit 21 and the processing unit 22 are realized, for example, by a processing circuit including one or more processors. The storage unit 23 is, for example, a non-volatile memory included in the processing circuit.

[0093] (Detection unit) The detection unit 31 performs a detection process to detect that the state of the communication path P1 has been remotely taken over from outside the vehicle 1 (hereinafter also referred to as an "abnormal state").

[0094] For example, the storage unit 23 stores communication route information indicating the communication route used while the vehicle 1 is traveling.

[0095] More specifically, the communication path information indicates the correspondence between a communication path and determination information (hereinafter also referred to as a "determination flag") indicating whether the communication path is in use.

[0096] When communication path P1 is in use and communication path P2 is not in use, in the communication path information, the value F1 of the discrimination flag corresponding to communication path P1 is set to the value "1" indicating that it is in use, and the value F2 of the discrimination flag corresponding to communication path P2 is set to the value "0" indicating that it is not in use. In the communication path information, the initial values ​​of the values ​​F1 and F2 are "1" and "0", respectively.

[0097] The detection unit 31 performs the detection process, for example, periodically. Specifically, every time the processing timing T of the detection process arrives, the detection unit 31 checks whether the value F1 of the determination flag corresponding to the communication path P1 is “1” by referring to the communication path information in the storage unit 23.

[0098] If the value F1 of the determination flag corresponding to the communication path P1 is "1", the detection unit 31 transmits a request notification R1 to the vehicle relay device 101 via the relay unit 21, requesting a status report on the communication path P1.

[0099] On the other hand, if the value F1 of the determination flag corresponding to the communication path P1 is "zero", the detection unit 31 does not transmit the request notification R1 to the vehicle-mounted relay device 101.

[0100] 2 and 3, in the vehicle-mounted relay device 101, when the relay unit 11 receives the request notification R1 from the vehicle-mounted relay device 103, the relay unit 11 outputs the received request notification R1 to the monitoring unit 12. In the example shown in FIG.

[0101] When the monitoring unit 12 receives the request notification R1 from the relay unit 11, it acquires the load information Da and the load information Db from the storage unit 13. Then, the monitoring unit 12 checks whether the estimated value of the bus load indicated by at least one of the load information Da and the load information Db is equal to or greater than the threshold value Th1.

[0102] If both the estimated bus load indicated by the load information Da and the estimated bus load indicated by the load information Db are less than the threshold value Th1, the monitoring unit 12 transmits route status information indicating that the situation on the communication route P1 is normal to the vehicle relay device 103 via the relay unit 11.

[0103] On the other hand, if the estimated value of the bus load indicated by at least one of the load information Da and the load information Db is greater than or equal to the threshold value Th1, the monitoring unit 12 transmits route status information indicating that the situation on the communication route P1 is abnormal to the vehicle relay device 103 via the relay unit 11.

[0104] In addition, the monitoring unit 12 is not limited to a configuration that monitors the bus load on the source bus when monitoring the status of the communication path P1, but may also be a configuration that monitors whether or not regular measurement information is being transmitted on the CAN bus 51.

[0105] In the vehicle-mounted repeater 103 , when the repeater 21 receives the route status information from the vehicle-mounted repeater 101 , the repeater 21 outputs the received route status information to the detector 31 .

[0106] When the detection unit 31 receives from the relay unit 21 path status information indicating that the situation on the communication path P1 is normal, the detection unit 31 transmits a request notification R11 indicating a request to transmit accelerator information A1 to the accelerator sensor 202A via the relay unit 21 and the in-vehicle relay device 101. The detection unit 31 also transmits a request notification R12 indicating a request to transmit brake information B1 to the brake sensor 202B via the relay unit 21 and the in-vehicle relay device 101. The detection unit 31 also transmits a request notification R13 indicating a request to transmit steering information S1 to the steering sensor 202C via the relay unit 21 and the in-vehicle relay device 101.

[0107] On the other hand, when the detection unit 31 receives from the relay unit 21 route status information indicating that the status of the communication path P1 is abnormal, the detection unit 31 determines that the status of the communication path P1 is abnormal. Then, the detection unit 31 outputs detection result information indicating that the status of the communication path P1 is abnormal to the switching processing unit 32 and the notification unit 33.

[0108] (Transmission of control information to driving-related devices) Referring back to FIG. 1, when the accelerator sensor 202A receives the request notification R11 from the in-vehicle relay device 103 via the in-vehicle relay device 101, the accelerator sensor 202A transmits the accelerator information A1 to the in-vehicle relay device 103 via the in-vehicle relay device 101, for example, periodically.

[0109] When the brake sensor 202B receives the request notification R12 from the in-vehicle relay device 103 via the in-vehicle relay device 101, the brake sensor 202B transmits the brake information B1 to the in-vehicle relay device 103 via the in-vehicle relay device 101, for example, periodically. For example, the brake sensor 202B transmits the brake information B1 at the same timing as the accelerator sensor 202A transmits the accelerator information A1.

[0110] When the steering sensor 202C receives the request notification R13 from the in-vehicle relay device 103 via the in-vehicle relay device 101, the steering sensor 202C transmits the steering information S1 to the in-vehicle relay device 103 via the in-vehicle relay device 101, for example, periodically. For example, the steering sensor 202C transmits the steering information S1 at the same timing as the accelerator sensor 202A transmits the accelerator information A1.

[0111] Referring again to Figures 1 and 3, in the vehicle relay device 103, the relay unit 21 outputs to the control unit 34 the accelerator information A1, brake information B1, and steering information S1 received from the accelerator sensor 202A, brake sensor 202B, and steering sensor 202C, respectively, via the vehicle relay device 101.

[0112] For example, the control unit 34 generates control information W for controlling the traveling-related device 202J using at least one of the accelerator information A1, the brake information B1, and the steering information S1. In this embodiment, the control unit 34 uses all of the accelerator information A1, the brake information B1, and the steering information S1.

[0113] More specifically, for example, the control unit 34 generates the control information W based on the accelerator information A1, the brake information B1, and the steering information S1 received from the relay unit 21.

[0114] Then, the control unit 34 transmits the generated control information W to the traveling-related device 202J via the relay unit 21.

[0115] The driving-related equipment 202J operates in accordance with the control information W received from the vehicle-mounted relay device 103.

[0116] (Switching process) FIG. 4 is a diagram for explaining an example of a switching process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0117] Referring to Figures 3 and 4, in the vehicle-mounted relay device 103, when the detection unit 31 detects that the state of communication path P1 is abnormal, the switching processing unit 32 performs switching processing K from a state in which communication path P1 is used to a state in which communication path P2 is used.

[0118] More specifically, for example, when the switching processing unit 32 receives the detection result information from the detection unit 31, it switches the relay 61 from the on state to the off state and switches the relay 62 from the off state to the on state, thereby switching the communication path used in the in-vehicle network 401 from the communication path P1 to the communication path P2.

[0119] When the switching process K is completed, the switching process unit 32 outputs a switching completion notification indicating that the switching process K has been completed to the detection unit 31.

[0120] When the detection unit 31 receives a switching completion notification from the switching processing unit 32, it transmits request notifications R21, R22, and R23 to the accelerator sensor 202E, the brake sensor 202F, and the steering sensor 202G via the relay unit 21 and the in-vehicle relay device 102, respectively. The request notification R21 indicates a request to transmit accelerator information A2. The request notification R22 indicates a request to transmit brake information B2. The request notification R23 indicates a request to transmit steering information S2.

[0121] (Update communication route information) Furthermore, when the detection unit 31 detects that the state of the communication path P1 is abnormal, the switching processing unit 32 performs an update process to update the communication path information.

[0122] Specifically, when the switching processing unit 32 receives detection result information from the detection unit 31, it updates the value F1 of the discrimination flag corresponding to communication path P1 from "1" to "zero" in the communication path information in the memory unit 23, and updates the value F2 of the discrimination flag corresponding to communication path P2 from "zero" to "1".

[0123] When the switching processing unit 32 completes the update processing, it outputs to the detection unit 31 an update notification indicating that the communication path information has been updated.

[0124] When the detection unit 31 receives the update notification from the switching processing unit 32, it stops transmitting the request notification R1 to the vehicle-mounted relay device 101.

[0125] [In-vehicle relay device 102] 5 is a diagram illustrating the configuration of an in-vehicle repeater 102 according to an embodiment of the present disclosure.

[0126] 5, the vehicle-mounted relay device 102 includes a relay unit 71 and a storage unit 72. The relay unit 71 is realized by, for example, a processing circuit including one or more processors. The storage unit 72 is, for example, a non-volatile memory included in the processing circuit.

[0127] When the relay unit 71 receives a CAN frame from a certain CAN device M2, it checks whether the received CAN frame is a CAN frame that should be received by its own in-vehicle relay device 102 or not.

[0128] The storage unit 72 stores, for example, a reception list L2 indicating the CAN-IDs contained in the CAN frames that the in-vehicle relay device 102 of its own should receive.

[0129] When the relay unit 71 receives a CAN frame from the CAN device M2, it refers to the reception list L2 in the storage unit 72 to check whether the CAN-ID included in the CAN frame is registered in the reception list L2.

[0130] For example, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the relay unit 71 discards the CAN frame.

[0131] The storage unit 72 stores a routing table. For example, when a CAN-ID included in a CAN frame received from the CAN device M2 is registered in the reception list L2, the relay unit 71 refers to the routing table in the storage unit 72 to confirm the destination device corresponding to the CAN-ID.

[0132] When the destination device of the received CAN frame is the in-vehicle relay device 103 , the relay unit 71 changes the format of the CAN frame to the Ethernet frame format and transmits it to the in-vehicle relay device 103 .

[0133] Furthermore, when the relay unit 71 receives an Ethernet frame from the in-vehicle relay device 103, it changes the format of the received Ethernet frame to the format of a CAN frame and transmits the frame to the destination CAN device M2.

[0134] Furthermore, for example, the relay unit 71 performs relay processing without converting the communication protocol. For example, the storage unit 72 stores a bus table Tb2 indicating the correspondence between the CAN-ID and the CAN bus 51 to which the CAN device M2 is connected.

[0135] When the destination device corresponding to a CAN frame received from a CAN device M2 is another CAN device M2, the relay unit 71 identifies the CAN bus 51 corresponding to the CAN-ID included in the CAN frame by referring to the bus table Tb2 in the storage unit 72. Then, the relay unit 71 outputs the received CAN frame to the identified CAN bus 51.

[0136] [Generation of control information after switching process] Referring again to FIG. 4, upon receiving a request notification R21 from the in-vehicle relay device 103 via the in-vehicle relay device 102, the accelerator sensor 202E transmits the accelerator information A2 to the in-vehicle relay device 103 via the in-vehicle relay device 102, for example, periodically.

[0137] When the brake sensor 202F receives the request notification R22 from the in-vehicle relay device 103 via the in-vehicle relay device 102, the brake sensor 202F transmits the brake information B2 to the in-vehicle relay device 103 via the in-vehicle relay device 102, for example, periodically. For example, the brake sensor 202F transmits the brake information B2 at the same timing as the accelerator sensor 202E transmits the accelerator information A2.

[0138] When the steering sensor 202G receives the request notification R23 from the in-vehicle relay device 103 via the in-vehicle relay device 102, the steering sensor 202G transmits the steering information S2 to the in-vehicle relay device 103 via the in-vehicle relay device 102, for example, periodically. For example, the steering sensor 202G transmits the steering information S2 at the same timing as the accelerator sensor 202E transmits the accelerator information A2.

[0139] In the vehicle-mounted relay device 103, the relay unit 21 outputs to the control unit 34 the accelerator information A2, the brake information B2, and the steering information S2 received from the accelerator sensor 202E, the brake sensor 202F, and the steering sensor 202G, respectively, via the vehicle-mounted relay device 102.

[0140] For example, the control unit 34 generates control information W for controlling the traveling-related device 202J using at least one of the accelerator information A2, the brake information B2, and the steering information S2. In this embodiment, the control unit 34 uses all of the accelerator information A2, the brake information B2, and the steering information S2.

[0141] More specifically, for example, the control unit 34 generates the control information W based on the accelerator information A2, the brake information B2, and the steering information S2 received from the relay unit 21.

[0142] Then, the control unit 34 transmits the generated control information W to the traveling-related device 202J via the relay unit 21.

[0143] [Message Notifications] For example, when the detection unit 31 detects that the state of the communication path P1 is abnormal, the notification unit 33 notifies the passengers of the vehicle 1 of a message N.

[0144] More specifically, for example, the message N indicates a service that can be provided using the communication path P1 but that has become unavailable due to the switching process K (hereinafter also referred to as an "unavailable service").

[0145] For example, the storage unit 23 stores unavailable service information indicating unavailable services. In this embodiment, for example, the unavailable services indicated by the unavailable service information are a driving assistance service and a remote control service.

[0146] When the notification unit 33 receives the detection result information from the detection unit 31, it acquires the non-provision information from the storage unit 23. Then, the notification unit 33 transmits the acquired non-provision information to the navigation device 202H via the relay unit 21.

[0147] Referring back to FIG. 1, when the navigation device 202H receives the non-provision information from the vehicle-mounted relay device 103, it performs notification processing based on the non-provision information.

[0148] Specifically, for example, when the navigation device 202H receives unavailability information from the in-vehicle relay device 103, the navigation device 202H displays on its display unit the content indicated by the unavailability information, i.e., a screen indicating the unavailable service. Note that the navigation device 202H may be configured to notify the passengers of the vehicle 1 by a method other than displaying the content indicated by the unavailability information, specifically, by sound, light, or the like.

[0149] [Operation flow] Next, the operation of each device in the in-vehicle system according to the embodiment of the present disclosure will be described with reference to the drawings.

[0150] FIG. 6 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs a switching process.

[0151] 6, first, the vehicle-mounted relay device 103 waits for the arrival of the processing timing T of the detection process (NO in step ST101), and when the processing timing T arrives (YES in step ST101), it checks whether the communication path P1 is in use. For example, as described above, the vehicle-mounted relay device 103 checks whether the value F1 of the determination flag corresponding to the communication path P1 is "1" by referring to the communication path information in the memory unit 23 (step ST102).

[0152] Next, if the communication path P1 is in use (YES in step ST102), the vehicle-mounted relay device 103 sends a request notification R1 to the vehicle-mounted relay device 101 requesting a status report on the communication path P1 (step ST103).

[0153] Next, the vehicle-mounted repeater 103 waits for reception of route status information from the vehicle-mounted repeater 101 (NO in step ST104).

[0154] Then, when the vehicle-mounted relay device 103 receives the route status information from the vehicle-mounted relay device 101 (YES in step ST104), it checks whether the status on the communication route P1 is abnormal (step ST105).

[0155] Then, when the vehicle-mounted relay device 103 receives route status information from the vehicle-mounted relay device 101 indicating that the situation on the communication path P1 is normal (NO in step ST105), it requests the accelerator sensor 202A, brake sensor 202B, and steering sensor 202C included in the communication path P1 to transmit measurement information used to generate control information W for controlling the driving-related equipment 202J (step ST106), and waits for the arrival of the next processing timing T (NO in step ST101).

[0156] On the other hand, when the in-vehicle repeater 103 receives from the in-vehicle repeater 101 route status information indicating that the situation in the communication route P1 is abnormal (YES in step ST105), the in-vehicle repeater 103 performs a switching process K from the state in which the communication route P1 is used to the state in which the communication route P2 is used. For example, as described above, the in-vehicle repeater 103 switches the relay 61 from the on state to the off state, and switches the relay 62 from the off state to the on state (step ST107).

[0157] Next, the in-vehicle relay device 103 performs an update process to update the communication path information in the storage unit 23. For example, as described above, the in-vehicle relay device 103 updates the value F1 of the discrimination flag corresponding to the communication path P1 from "1" to "zero" in the communication path information, and updates the value F2 of the discrimination flag corresponding to the communication path P2 from "zero" to "1" (step ST108).

[0158] Next, the in-vehicle relay device 101 notifies the passengers of the vehicle 1 of a message N indicating the unavailable service that has become unavailable due to the switching process K (step ST109). Note that steps ST108 and ST109 may be executed in reverse order or in parallel.

[0159] Next, the vehicle relay device 103 requests the accelerator sensor 202E, the brake sensor 202F, and the steering sensor 202G included in the communication path P2 to transmit measurement information used to generate the control information W (step ST110), and waits for the arrival of the next processing timing T (NO in step ST101).

[0160] On the other hand, when the communication path P1 is not in use, that is, when the communication path P2 is in use (NO in step ST102), the vehicle-mounted relay device 103 waits for the arrival of the next processing timing T (NO in step ST101).

[0161] In the in-vehicle system 301 according to the embodiment of the present disclosure, the communication paths P1 and P2 are described as paths for transmitting measurement information indicating measurement results in the vehicle 1, but are not limited to this. The communication paths P1 and P2 may also be paths for transmitting information other than the measurement information.

[0162] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 103 is configured to notify the passengers of the vehicle 1 of a message N indicating an unavailable service when it detects that the communication path P1 is in an abnormal state. However, this is not limited to this. Instead of the unavailable service, the in-vehicle relay device 103 may be configured to notify the passengers of the vehicle 1 of a message N indicating other content, such as the need to contact a dealer or the like, the need to repair the communication path P1, the date and location when the communication path P1 was hijacked, and the route to the nearest dealer. Furthermore, the in-vehicle relay device 103 may be configured to notify the message N not only to the passengers of the vehicle 1 but also to the dealer or the like. In this case, for example, the in-vehicle relay device 103 notifies the dealer or the like of the ID of the vehicle 1 in the message N. Furthermore, the in-vehicle relay device 103 may be configured not to notify the message N.

[0163] Furthermore, although the in-vehicle system 301 according to the embodiment of the present disclosure has been described as having a configuration including communication path P1 and communication path P2, this is not limited to this. The in-vehicle system 301 may be configured to have one or more other communication paths that do not include the TCU 202D in addition to the communication path P1 and communication path P2. That is, the in-vehicle system 301 may be configured to have multiple communication paths that do not include the TCU 202D. In this case, when the in-vehicle relay device 103 detects that the state of the communication path P1 is abnormal, it selects a communication path to use from the multiple communication paths.

[0164] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the processing unit 22 in the in-vehicle relay device 103 is configured to include the detection unit 31, the switching processing unit 32, the notification unit 33, and the control unit 34, but this is not limited to this. Some or all of the detection unit 31, the switching processing unit 32, the notification unit 33, and the control unit 34 may be provided in a device other than the in-vehicle relay device 103 in the in-vehicle network 401 that is not included in the communication path P1.

[0165] <Modification> In the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 103 is configured to check the status of the communication path P1 each time the processing timing T of the detection process arrives and to determine whether or not to perform the switching process K depending on the check result, but this is not limited to this. When an event occurs that controls the vehicle 1 from outside the vehicle 1, the in-vehicle relay device 103 may be configured to determine whether or not to perform the switching process K depending on the state J of the vehicle 1 at the time the event occurs.

[0166] 7 is a diagram illustrating a configuration of a modified example of the in-vehicle system according to the embodiment of the present disclosure. Referring to FIG. 7, compared to the in-vehicle system 301 illustrated in FIG. 1, the in-vehicle system 301A includes an in-vehicle repeater 103A instead of the in-vehicle repeater 103, and further includes an in-vehicle device 202L.

[0167] The in-vehicle device 202L is connected to the in-vehicle relay device 103A via an Ethernet cable 52C, which is an Ethernet cable 52.

[0168] 7, the in-vehicle device 202L is a vehicle speed sensor. In the following description, the in-vehicle device 202L is also referred to as the vehicle speed sensor 202L. The vehicle speed sensor 202L measures the vehicle speed of the vehicle 1, for example, periodically.

[0169] [In-vehicle relay device] Fig. 8 is a diagram showing the configuration of a modified example of an in-vehicle repeater according to an embodiment of the present disclosure, Fig. 8 shows the configuration of an in-vehicle repeater 103A.

[0170] 8, compared to the in-vehicle relay device 103 shown in Fig. 4, the in-vehicle relay device 103A includes a processing unit 22A instead of the processing unit 22, and further includes a wireless communication unit 24. Compared to the processing unit 22 shown in Fig. 4, the processing unit 22A further includes a determination unit 35.

[0171] (Service Request Information) The wireless communication unit 24 communicates with a terminal device 601 such as a smartphone owned by a passenger of the vehicle 1. For example, the wireless communication unit 24 and the terminal device 601 perform wireless communication in accordance with the Bluetooth (registered trademark) standard.

[0172] In response to a user's operation, the terminal device 601 transmits service request information indicating a request for provision of a service and the type of the service to the vehicle-mounted relay device 103A.

[0173] In the vehicle-mounted relay device 103A, when the wireless communication unit 24 receives the service request information from the terminal device 601, it outputs the received service request information to the detection unit 31.

[0174] When the detection unit 31 receives the service request information from the wireless communication unit 24, it refers to the communication path information in the storage unit 23 to check whether the value F1 of the determination flag corresponding to the communication path P1 is "1".

[0175] When the value F1 of the discrimination flag corresponding to the communication path P1 is "1", the detection unit 31 outputs to the judgment unit 35 the usage path information G1 indicating that the communication path P1 is being used, included in the service request information received from the wireless communication unit 24.

[0176] On the other hand, when the value F1 of the discrimination flag corresponding to the communication path P1 is "zero," the detection unit 31 outputs to the judgment unit 35 the usage path information G2 indicating that the communication path P2 is being used, included in the service request information received from the wireless communication unit 24.

[0177] (Judgment Department) The determination unit 35 performs a state determination process to determine state J related to the vehicle 1. More specifically, the determination unit 35 determines the state of the ignition power supply of the vehicle 1 as state J, for example.

[0178] Specifically, for example, when the determination unit 35 receives service request information from the wireless communication unit 24, it measures the output voltage of the ignition power supply. Then, the determination unit 35 checks whether the measured voltage value is equal to or greater than the threshold value Th11.

[0179] If the measured voltage value is equal to or greater than the threshold value Th11, the determination unit 35 determines that the state of the ignition power supply is in the ON state.

[0180] On the other hand, if the measured voltage value is less than the threshold value Th11, the determination unit 35 determines that the state of the ignition power supply is in the OFF state.

[0181] Also, for example, the determination unit 35 determines the state of the communication connection between its own vehicle-mounted relay device 103A and the terminal device 601 as state J.

[0182] More specifically, the judgment unit 35 judges whether its own vehicle-mounted relay device 103A is communicatively connected to a terminal device 601 located outside the vehicle 1, or whether it is communicatively connected to a terminal device 601 located inside the vehicle 1.

[0183] Specifically, for example, when the judgment unit 35 receives service request information from the detection unit 31, it outputs a request notification R30 to the wireless communication unit 24 indicating a request to measure the reception strength of the radio waves transmitted from the terminal device 601.

[0184] For example, the wireless communication unit 24 has a function of measuring the reception strength of radio waves transmitted from the terminal device 601. Upon receiving a request notification R30 from the determination unit 35, the wireless communication unit 24 measures the reception strength and outputs measurement result information indicating the measurement result to the determination unit 35.

[0185] The determination unit 35 checks whether the reception strength indicated by the measurement result information received from the wireless communication unit 24 is equal to or greater than a threshold value Th12.

[0186] If the reception strength indicated by the measurement result information received from the wireless communication unit 24 is less than the threshold value Th12, the judgment unit 35 judges that its own vehicle-mounted relay device 103A is communicatively connected to a terminal device 601 located outside the vehicle 1.

[0187] On the other hand, if the reception strength indicated by the measurement result information received from the wireless communication unit 24 is equal to or greater than the threshold value Th12, it is determined that the in-vehicle repeater 103A is in communication connection with the terminal device 601 present in the vehicle 1. In FIG. 7, an example is shown in which the terminal device 601 is present in the vehicle 1.

[0188] Furthermore, for example, the determination unit 35 determines, as the state J, whether the vehicle 1 is running, stopped, parked, or charging.

[0189] Specifically, for example, the determination unit 35 transmits a request notification R31 requesting a report of the vehicle speed of the vehicle 1 to the vehicle speed sensor 202L via the relay unit 21.

[0190] When the vehicle speed sensor 202L receives the request notification R31 from the vehicle-mounted relay device 103A, it transmits vehicle speed information indicating the latest vehicle speed to the vehicle-mounted relay device 103A.

[0191] In the vehicle-mounted repeater 103A, when the repeater 21 receives the vehicle speed information from the vehicle speed sensor 202L via the vehicle-mounted repeater 101, the repeater 21 outputs the received vehicle speed information to the determination unit .

[0192] The determination unit 35 checks whether the vehicle speed indicated by the vehicle speed information received from the relay unit 21 (hereinafter also referred to as "vehicle speed Va") is equal to or greater than a threshold value Th13.

[0193] If the vehicle speed Va is equal to or greater than the threshold value Th13, the determination unit 35 determines that the vehicle 1 is traveling.

[0194] On the other hand, when the vehicle speed Va is less than the threshold value Th13, the determination unit 35 checks whether the ignition power supply is in the ON state.

[0195] Then, when the vehicle speed Va is less than the threshold value Th13 and the ignition power supply is in the on state, the determination unit 35 determines that the vehicle 1 is stopped.

[0196] On the other hand, when the vehicle speed Va is less than the threshold value Th13 and the state of the ignition power supply is in the off state, the determination unit 35 determines whether the vehicle 1 is parked or whether the vehicle 1 is being charged.

[0197] Specifically, for example, a charging connector (not shown) to which a charger is connected is provided in vehicle 1. Determination unit 35 detects the state of the charging connector when vehicle speed Va is less than threshold value Th13 and the state of the ignition power is in the off state.

[0198] The determination unit 35 determines that the vehicle 1 is parked when the vehicle speed Va is less than the threshold value Th13, the ignition power is in the off state, and no charger is connected to the charging connector.

[0199] On the other hand, when the vehicle speed Va is less than the threshold value Th13, the ignition power is in the off state, and a charger is connected to the charging connector, the determination unit 35 determines that the vehicle 1 is being charged.

[0200] In addition, when the vehicle 1 is a gasoline-powered vehicle, the determination unit 35 may be configured to determine, as the state J, whether the vehicle 1 is running, stopped, parked, or being refueled.

[0201] (Corresponding table) FIG. 9 is a diagram illustrating an example of a correspondence table held by a modified example of the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0202] 7 and 9, for example, storage unit 23 stores a correspondence table Tb3 indicating a correspondence relationship between a state J of vehicle 1 and whether or not switching processing K has been performed by switching processing unit 32. Correspondence table Tb3 is an example of correspondence information.

[0203] More specifically, the storage unit 23 stores a plurality of correspondence tables Tb3 corresponding to a plurality of services provided in the in-vehicle network 401. Fig. 9 shows the correspondence table Tb3 corresponding to the parking assistance service. Each correspondence table Tb3 is registered in the storage unit 23 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0204] 9, when the ignition power supply is on, the in-vehicle relay device 103A is communicatively connected to the terminal device 601 located inside the vehicle, and the vehicle 1 is stopped or traveling, the switching process K is performed. Also, when the ignition power supply is on, the in-vehicle relay device 103A is communicatively connected to the terminal device 601 located outside the vehicle, and the vehicle 1 is stopped, the switching process K is not performed. Also, when the ignition power supply is on, the in-vehicle relay device 103A is communicatively connected to the terminal device 601 located outside the vehicle, and the vehicle 1 is traveling, the switching process K is performed.

[0205] Furthermore, when the ignition power is off, the in-vehicle relay device 103A is communicatively connected to the terminal device 601 located inside the vehicle, and the vehicle 1 is parked or charging, the switching process K is not performed. Furthermore, when the ignition power is off, the in-vehicle relay device 103A is communicatively connected to the terminal device 601 located outside the vehicle, and the vehicle 1 is parked or charging, the switching process K is not performed.

[0206] (Switching decision processing) When an event Q of control over the vehicle 1 occurs from outside the vehicle 1, the determination unit 35 performs a switching determination process to determine whether or not switching process K is required by the switching processing unit 32. Here, for example, it is assumed that the control is a parking operation of the vehicle 1 from outside the vehicle 1. That is, when the type of service indicated by the service request information received from the detection unit 31 is a parking assistance service, the determination unit 35 performs the switching determination process.

[0207] Note that the control of the vehicle 1 from outside the vehicle performed in the event Q is not limited to the parking operation of the vehicle 1, but may be other operations such as opening and closing the windows of the vehicle 1.

[0208] For example, when an event Q occurs, the determination unit 35 performs the switching determination process using the correspondence table Tb3 in the storage unit 23.

[0209] Specifically, for example, when the judgment unit 35 completes the state judgment process, it selects from the multiple correspondence tables Tb3 stored in the memory unit 23 a correspondence table Tb3 that corresponds to the type of service indicated by the service request information received from the detection unit 31, i.e., the parking assistance service.

[0210] Then, the determination unit 35 determines whether or not the switching process K is necessary using the selected correspondence table Tb3 and the result of the state determination process.

[0211] For example, if the state J resulting from the state determination process corresponds to "Yes" for the switching process K in the selected correspondence table Tb3, the determination unit 35 determines that it is necessary to perform the switching process K. Then, the determination unit 35 outputs a switching necessity notification indicating that it is necessary to perform the switching process K to the detection unit 31.

[0212] On the other hand, if the state J resulting from the state determination process corresponds to "no switching process K" in the selected correspondence table Tb3, the determination unit 35 determines that there is no need to perform the switching process K. Then, the determination unit 35 outputs a switching-unnecessary notification to the detection unit 31 indicating that the switching process K is unnecessary.

[0213] When the detection unit 31 receives the notification that switching is necessary from the determination unit 35, it determines that the state of the communication path P1 is abnormal. Then, the detection unit 31 outputs a request notification R40 indicating a request to execute a switching process K to the switching processing unit 32.

[0214] On the other hand, when receiving a notification that switching is not required from the determination unit 35, the detection unit 31 determines that the state of the communication path P1 is normal. Then, the detection unit 31 requests the accelerator sensor 202A, the brake sensor 202B, and the steering sensor 202C included in the communication path P1 to transmit measurement information used to generate control information W for controlling the driving-related device 202J.

[0215] When the switching processing unit 32 receives the request notification R40 from the detection unit 31, it performs switching processing K. Specifically, for example, the switching processing unit 32 switches the relay 61 from the on state to the off state, and switches the relay 62 from the off state to the on state.

[0216] (When using communication path P2) For example, when the judgment unit 35 receives service request information including usage route information G2 from the detection unit 31, it checks whether the type of service indicated by the service request information is the same as the unavailable service indicated by the unavailable service information stored in the memory unit 23.

[0217] If the type of service indicated by the service request information received from the detection unit 31 is the same as the unavailable service indicated by the unavailable service information stored in the memory unit 23, the judgment unit 35 outputs a service confirmation notification to the notification unit 33 indicating the type of service indicated by the service request information and that the service is an unavailable service.

[0218] On the other hand, if the type of service indicated in the service request information received from the detection unit 31 is different from the unavailable service indicated in the unavailable service information stored in the memory unit 23, the judgment unit 35 does not output a service confirmation notification to the notification unit 33.

[0219] When the notification unit 33 receives the service confirmation notification from the determination unit 35, it creates service unavailability information indicating that the type of service indicated in the service confirmation notification cannot be provided. Then, the notification unit 33 transmits the created service unavailability information to the navigation device 202H via the relay unit 21.

[0220] When the navigation device 202H receives the service unavailability information from the vehicle-mounted relay device 103A, it performs notification processing based on the service unavailability information.

[0221] Specifically, for example, when the navigation device 202H receives service denial information from the in-vehicle relay device 103A, the navigation device 202H displays a screen showing the content of the service denial information on its display unit. Note that the navigation device 202H may be configured to notify the passengers of the vehicle 1 by a method other than displaying the content of the service denial information, specifically, by sound, light, or the like.

[0222] [Operation flow] FIG. 10 is a flowchart defining an example of an operation procedure when the modified example of the vehicle-mounted relay device according to the embodiment of the present disclosure performs a switching process.

[0223] 10, first, the vehicle-mounted relay device 103A waits for reception of service request information from the terminal device 601 (NO in step ST201).

[0224] Then, when the in-vehicle repeater 103A receives the service request information from the terminal device 601 (YES in step ST201), it checks whether the communication path P1 is in use. For example, as described above, the in-vehicle repeater 103A checks whether the value F1 of the determination flag corresponding to the communication path P1 is "1" by referring to the communication path information in the storage unit 23 (step ST202).

[0225] Next, if the communication path P1 is in a state of being used (YES in step ST202), the vehicle-mounted relay device 103A performs a state determination process to determine a state J regarding the vehicle 1 (step ST203).

[0226] Next, the vehicle-mounted relay device 103A selects the correspondence table Tb3 corresponding to the type of service indicated by the received service request information from among the plurality of correspondence tables Tb3 stored in the storage unit 23 (step ST204).

[0227] Next, when the vehicle-mounted relay device 103A selects the correspondence table Tb3, it uses the correspondence table Tb3 and the result of the state determination process to determine whether or not it is necessary to perform the switching process K, i.e., whether or not the state of the communication path P1 is abnormal (step ST205).

[0228] If the state of communication path P1 is normal (NO in step ST205), the vehicle relay device 103A requests the accelerator sensor 202A, brake sensor 202B, and steering sensor 202C included in communication path P1 to transmit measurement information used to generate control information W for controlling driving-related equipment 202J (step ST206), and waits to receive new service request information (NO in step ST201).

[0229] On the other hand, if the state of the communication path P1 is abnormal (YES in step ST205), the in-vehicle repeater 103A performs a switching process K from the state of using the communication path P1 to the state of using the communication path P2. For example, as described above, the in-vehicle repeater 103A switches the relay 61 from the on state to the off state, and switches the relay 62 from the off state to the on state (step ST207).

[0230] The processing from step ST208 to step ST210 is the same as the processing from step ST108 to step ST110 shown in FIG.

[0231] In addition, when communication path P1 is not being used, i.e., communication path P2 is being used (NO in step ST202), the vehicle-mounted relay device 103A checks whether the type of service indicated by the received service request information is the same as the unavailable service (step ST211).

[0232] If the type of service indicated by the received service request information is the same as the unavailable service (YES in step ST211), the vehicle-mounted relay device 103A transmits service unavailable information indicating that the type of service indicated by the service request information cannot be provided to the navigation device 202H (step ST212), and waits to receive new service request information (NO in step ST201).

[0233] On the other hand, if the type of service indicated by the received service request information is different from the unavailable service (NO in step ST211), the vehicle-mounted relay device 103A waits for reception of new service request information (NO in step ST201).

[0234] In the modified example of the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 103A is configured to perform switching processing when an event Q occurs, depending on the determination result of the state J related to the vehicle 1, specifically, depending on whether the terminal device 601 is present in the vehicle 1 and whether the vehicle 1 is moving. However, this is not limited to this. For example, the in-vehicle relay device 103A may be configured to perform switching processing K depending on whether the terminal device 601 is present in the vehicle 1, regardless of whether the vehicle 1 is moving. Furthermore, the in-vehicle relay device 103A may be configured to perform switching processing K depending on other determination results of the state J related to the vehicle 1 when an event Q occurs.

[0235] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0236] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the programs read from the one or more memories, or according to logic circuits pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separate processors may execute each of the processes in cooperation with each other. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium.

[0237] The above description includes the following additional features. [Appendix 1] A route switching device used in an in-vehicle system mounted on a vehicle, The in-vehicle system includes: a first communication path including an in-vehicle device having a function of communicating with the outside of the vehicle; a second communication path that does not include the in-vehicle device; The route switching device processing circuitry; The processing circuitry Detecting that the state of the first communication path is a state in which it has been remotely taken over from outside the vehicle; A route switching device that, when detecting that the state of the first communication route has been hijacked, performs a switching process from a state in which the first communication route is used to a state in which the second communication route is used.

[0238] [Appendix 2] A route switching method in a route switching device used in an in-vehicle system mounted on a vehicle, comprising: The in-vehicle system includes: a first communication path including an in-vehicle device having a function of communicating with the outside of the vehicle; a second communication path that does not include the in-vehicle device; The route switching method includes: detecting that the state of the first communication path is in a state where it has been remotely taken over from outside the vehicle; A route switching method including a step of performing a switching process from a state in which the first communication route is used to a state in which the second communication route is used when it is detected that the state of the first communication route has been hijacked.

[0239] [Appendix 3] A route switching program used in a route switching device used in an in-vehicle system mounted on a vehicle, The in-vehicle system includes: a first communication path including an in-vehicle device having a function of communicating with the outside of the vehicle; a second communication path that does not include the in-vehicle device; Computer, a detection unit that detects that the state of the first communication path is a state in which the first communication path has been remotely taken over from outside the vehicle; a switching processing unit that performs a switching process from a state in which the first communication path is used to a state in which the second communication path is used when the detection unit detects that the state of the first communication path is hijacked; A route switching program to function as a [Explanation of symbols]

[0240] 1 vehicle 11, 21, 71 relay section 12 Monitoring Department 13,23,72 Storage part 22, 22A Processing section 31 Detection unit 32 Switching processing section 33 Notification Department 34 Control Unit 35 Judgment Department 51 CAN bus 52, 53, 54, 55, 56 Ethernet cable 61,62 Relay 101, 102, 103, 103A Vehicle relay device 202 Automotive equipment 301 In-Vehicle Systems 401 In-Vehicle Network Tb3 compatible table

Claims

1. a first communication path including an in-vehicle device having a function of communicating with an outside of the vehicle; a second communication path that does not include the in-vehicle device; An in-vehicle system comprising: a switching processing unit that performs switching processing from a state in which the first communication path is used to a state in which the second communication path is used when it is detected that the state of the first communication path has been remotely taken over from outside the vehicle.

2. The in-vehicle system according to claim 1 , wherein the first communication path and the second communication path are paths for transmitting measurement information indicating measurement results in the vehicle.

3. 3. The in-vehicle system according to claim 1, wherein the switching processing unit further performs a process of notifying a passenger of the vehicle of a message when the switching processing unit detects that the state of the first communication path has been remotely taken over from outside the vehicle.

4. The in-vehicle system according to claim 3 , wherein the message indicates a service that can be provided using the first communication path but that has become unavailable due to the switching process.

5. The in-vehicle system further comprises:

3. The in-vehicle system according to claim 1, further comprising a determination unit that, when a control event for the vehicle occurs from outside the vehicle, determines whether the switching processing unit needs to perform the switching processing using correspondence information indicating a correspondence relationship between a state of the vehicle and whether the switching processing is performed.

6. A route switching device used in an in-vehicle system mounted on a vehicle, The in-vehicle system includes: a first communication path including an in-vehicle device having a function of communicating with an outside of the vehicle; a second communication path that does not include the in-vehicle device; The route switching device a detection unit that detects that the state of the first communication path is in a state where it has been remotely taken over from outside the vehicle; A path switching device comprising: a switching processing unit that performs switching processing from a state in which the first communication path is used to a state in which the second communication path is used when the detection unit detects that the state of the first communication path has been hijacked.

7. A route switching method in an in-vehicle system, comprising: The in-vehicle system includes: a first communication path including an in-vehicle device having a function of communicating with an outside of the vehicle; a second communication path that does not include the in-vehicle device; The route switching method includes: detecting that the state of the first communication path is in a state where it has been remotely taken over from outside the vehicle; and when it is detected that the state of the first communication path has been remotely taken over from outside the vehicle, performing a switching process from a state in which the first communication path is being used to a state in which the second communication path is being used.

Images