In-vehicle device, in-vehicle system, relay method, and computer program

Abstract

To provide a technique capable of suppressing transmission of a frame including abnormality.SOLUTION: An in-vehicle device comprising: a relay processing unit configured to relay a frame between a plurality of processing devices; and a control unit configured to control the relay processing unit, wherein the control unit is configured to, based on a first frame from a first transmission source processing device among the plurality of processing devices, A processing unit configured to execute a process of generating a second frame directed to a transmission destination processing device among the plurality of processing devices, and a process of generating a substitute frame directed to the transmission destination processing device instead of the second frame when an abnormality of the first frame is detected, wherein the substitute frame is generated based on an associated frame including associated data associated with data in the first frame, the associated data being transmitted from a second transmission source processing device among the plurality of processing devices.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle device, an in-vehicle system, a relay method, and a computer program. [Background technology]

[0002] Patent Document 1 discloses a technology relating to a conversion device for connecting an ECU (Electronic Control Unit) connected to an Ethernet (registered trademark) network and an ECU connected to a CAN (Controller Area Network) bus in an in-vehicle network system so that information can be transmitted between them. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2021-119724 Summary of the Invention [Problem to be solved by the invention]

[0004] In the above conversion device, even if a frame from a sender contains an abnormality, the frame containing the abnormality is protocol converted and relayed. As a result, the frame containing the abnormality is sent to the destination ECU. There is a risk that the normal operation of the ECU receiving the frame containing the abnormality may be impaired. [Means for solving the problem]

[0005] An embodiment of an in-vehicle device includes a relay processing unit that relays frames between a plurality of processing devices, and a control unit that controls the relay processing unit. The control unit has a processing unit that executes the following processes: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices, and generating a substitute frame addressed to the destination processing device in place of the second frame when an abnormality in the first frame is detected. The substitute frame is generated based on an associated frame that includes associated data related to the data in the first frame and is transmitted from a second source processing device among the plurality of processing devices. [Effects of the Invention]

[0006] According to the present disclosure, it is possible to suppress transmission of frames containing anomalies. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment. [Figure 2] FIG. 2 is a block diagram showing an example of the configuration of the in-vehicle device. [Figure 3] FIG. 3 is a flowchart illustrating an example of the relay process. [Figure 4] FIG. 4 is a flowchart showing an example of a detection process for detecting an abnormality. [Figure 5] FIG. 5 is a diagram illustrating an example of the substitution table. [Figure 6] FIG. 6 is a diagram showing a state in which CAN frame A contains an abnormality. DETAILED DESCRIPTION OF THE INVENTION

[0008] First, the contents of the embodiment will be listed and explained. [Outline of the embodiment]

[0009] (1) An embodiment of an in-vehicle device includes a relay processing unit that relays frames between a plurality of processing devices, and a control unit that controls the relay processing unit. The control unit has a processing unit that executes the following processes: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device in place of the second frame. The substitute frame is generated based on an associated frame that includes associated data related to the data in the first frame and is transmitted from a second source processing device among the plurality of processing devices. According to the above configuration, since the substitute frame is generated based on the related frame including the related data related to the data in the first frame, the substitute frame is transmitted to the destination processing device as an appropriate substitute. This prevents the generation of the second frame based on the abnormal frame and prevents the transmission of the abnormal frame to the destination processing device.

[0010] (2) In the in-vehicle device of (1) above, the type of data in the first frame and the type of the related data may be the same, in which case an alternative frame containing the same type of data as the data in the second frame is obtained.

[0011] (3) In the in-vehicle device of (1) above, the related data may be data that directly or indirectly indicates the data in the first frame, in which case an alternative frame is obtained that includes data that directly or indirectly indicates the data in the second frame.

[0012] (4) In the in-vehicle device of (1) above, when an abnormality in the first frame is detected, the processing unit may further execute a reference process in which the processing unit references a table in which identification information of the first frame and identification information of the related frame are registered in correspondence with each other, and a process in which the related frame is identified based on the reference result of the table. In this case, the processing unit can easily identify the relevant frame by referring to the table.

[0013] (5) In the in-vehicle device of (4) above, when the table registers identification information of multiple candidate frames that are candidates for the related frame and priorities for the multiple candidate frames in correspondence with each other, the process of identifying the related frame may include a process of selecting a candidate frame to be identified as the related frame from the multiple candidate frames based on the priorities. In this case, a relevant frame can be selected from among multiple candidate frames, so that even if some of the multiple candidate frames are not provided or are missing, they can be complemented by other candidate frames.

[0014] (6) In any one of the in-vehicle devices (1) to (5) above, the processing unit may further perform a process of referencing the data included in the first frame, and a process of determining whether or not there is an abnormality in the first frame based on a comparison result between the data included in the first frame and the data most recent to the data included in the first frame. In this case, if the fluctuation in the data included in the first frame is very large, it can be determined that there is an abnormality in the first frame.

[0015] (7) In addition, in any one of the in-vehicle devices described above in (1) to (6), the detection process may include a process of determining whether or not there is an abnormality in the first frame based on the reception interval of the first frame.

[0016] (8) In the in-vehicle device of (4) above, if there are multiple tables and each of the multiple tables has registered therein identification information of the first frame and identification information of the related frame in correspondence with each other according to the state of the vehicle, the processing unit may be configured to further perform a process of selecting a table to be referenced in the reference process from the multiple tables based on the state of the vehicle. In this case, a table can be selected according to the state of the vehicle.

[0017] (9) In the in-vehicle device described in any one of (1) to (8) above, when an abnormality in the first frame is detected, the processing unit may further execute a process of saving the detection result, in which case the detection result can be saved as a log.

[0018] (10) In the in-vehicle device described in any one of (1) to (8) above, the communication protocol of the first frame may be different from the communication protocol of the second frame and the alternative frame. In this case, the in-vehicle device can convert the communication protocol while suppressing the transmission of frames containing an abnormality.

[0019] (11) Another embodiment is an in-vehicle system including a plurality of processing devices mounted on a vehicle and the in-vehicle device (1) that relays frames provided from the plurality of processing devices.

[0020] (12) Another embodiment is a relay method for relaying frames between a plurality of processing devices. The relay method includes the steps of: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device among the plurality of processing devices in place of the second frame. The substitute frame is generated based on an associated frame that includes associated data related to the data in the first frame and is transmitted from a second source processing device among the plurality of processing devices.

[0021] (13) An embodiment from another perspective is a computer program causing a computer to execute relay control of an in-vehicle device that relays frames between a plurality of processing devices. The computer program causes the computer to execute the steps of: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device among the plurality of processing devices in place of the second frame. The substitute frame is generated based on an associated frame that is transmitted from a second source processing device among the plurality of processing devices and includes associated data related to the data in the first frame.

[0022] [Details of the embodiment] Preferred embodiments will now be described with reference to the drawings. At least some of the embodiments described below may be combined in any manner. [Overall configuration of the in-vehicle system] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment. The in-vehicle system 1 is a network system mounted on a vehicle V such as an automobile. The in-vehicle system 1 includes a first network N1 in which frames are transmitted in accordance with a CAN (Controller Area Network) communication protocol, and a second network N2 in which frames are transmitted in accordance with an Ethernet (registered trademark) communication protocol.

[0023] The in-vehicle system 1 includes an in-vehicle device 2, a central gateway (CGW) 4, a plurality of CAN-ECUs (Electronic Control Units) 6, and a plurality of Ethernet ECUs 8.

[0024] The multiple CAN-ECUs 6 are connected to the in-vehicle device 2 via the CAN bus 10 and the CGW 4. The multiple CAN-ECUs 6 communicate using the CAN communication protocol. Therefore, the multiple CAN-ECUs 6 and the CGW 4 configure a first network N1.

[0025] The plurality of Ethernet ECUs 8 communicate using the Ethernet communication protocol. The plurality of Ethernet ECUs 8 are connected to the in-vehicle device 2 via an Ethernet cable 12. The plurality of Ethernet ECUs 8 communicate using the Ethernet communication protocol. Therefore, the plurality of Ethernet ECUs 8 and the in-vehicle device 2 configure a second network N2.

[0026] The multiple CAN-ECUs 6 are processing devices mounted on various parts of the vehicle V. The multiple CAN-ECUs 6 include, for example, ECUs (operation system ECUs) that control various parts of the vehicle V (for example, the engine, steering device, braking device, doors, battery, air conditioner, etc.).

[0027] The multiple Ethernet ECUs 8 are processing devices mounted in various parts of the vehicle V. The multiple Ethernet ECUs 8 include an ECU (cognitive ECU) that monitors the state of various parts of the vehicle V using on-board sensors, an ECU having a TCU (Telematics Control Unit) function, and an ECU having a function related to ADAS (Advanced Driver-Assistance Systems).

[0028] The in-vehicle device 2 is a relay device that relays frames transmitted and received between multiple Ethernet ECUs 8. The in-vehicle device 2 is also connected to the CGW 4, and has a function of relaying frames between multiple CAN-ECUs 6 and multiple Ethernet ECUs 8. Therefore, the in-vehicle device 2 has a function of performing protocol conversion between frames that comply with the CAN communication protocol and frames that comply with the Ethernet communication protocol. Furthermore, the in-vehicle device 2 has the function of detecting whether or not there is an abnormality in the frame from the sender, and if an abnormality is detected, performing protocol conversion to generate an alternative frame in place of the frame in which the abnormality was detected, and generating a frame addressed to the destination.

[0029] [Configuration of the in-vehicle device] FIG. 2 is a block diagram showing an example of the configuration of the in-vehicle device 2. As shown in FIG. The in-vehicle device 2 includes a control unit 16 and a relay processing unit 18. The relay processing unit 18 is connected to the CAN bus 14 extending from the CGW 4. Therefore, the relay processing unit 18 can receive CAN frames transmitted from multiple CAN-ECUs 6. In FIG. 2, six CAN-ECUs 6 are shown connected. In FIG. 2, the six CAN-ECUs 6 are indicated as CAN-ECUs 6a, 6b, 6c, 6d, 6e, and 6f.

[0030] In this embodiment, the CAN-ECU 6a, the CAN-ECU 6b, and the CAN-ECU 6c are ECUs that output data related to the speed of the vehicle V. The CAN-ECU 6d and the CAN-ECU 6e are ECUs that output data relating to the steering angle of the vehicle V.

[0031] The CAN-ECU 6a is an ECU that performs processing related to the meter display of the vehicle V. The CAN-ECU 6a transmits a CAN frame A. The reception interval of the CAN frame A is 5 μs. The data contained in the CAN frame A is the speed value Va of the vehicle V. The speed value Va is a value used for the meter display of the vehicle V. The resolution of the speed value Va is, for example, 1 km / hour. CAN-ECU 6b is an ECU that performs processing related to stability control of vehicle V. CAN-ECU 6b transmits CAN frame B. The reception interval of CAN frame B is 1 μs. The data contained in CAN frame B is the speed value Vb of vehicle V. The speed value Vb is a value used to calculate the average vehicle speed of vehicle V. The resolution of the speed value Vb is, for example, 0.01 km / h. Therefore, the accuracy of the speed value Vb is higher than the accuracy of the speed value Va.

[0032] CAN-ECU 6c is an ECU that performs processing related to stability control of vehicle V. CAN-ECU 6c transmits CAN frame C. The reception interval of CAN frame C is 1 μs. The data contained in CAN frame C is the integrated value of pulses output by the vehicle speed sensor of vehicle V. The integrated value of pulses is information that can be processed to obtain the speed of vehicle V. Therefore, the integrated value of pulses is information that indirectly indicates the speed of vehicle V. The accuracy of the speed obtained from the integrated value of pulses is higher than the accuracy of speed value Vb.

[0033] The CAN-ECU 6d is an ECU that performs processing related to the meter display of the vehicle V. The CAN-ECU 6d transmits a CAN frame D. The reception interval of the CAN frame D is 5 μs. The data contained in the CAN frame D is the steering angle Rd of the vehicle V. The steering angle Rd is, for example, a value used for the meter display of the vehicle V. The resolution of the steering angle Rd is, for example, 5 degrees. The CAN-ECU 6e is an ECU that controls the steering angle sensor of the vehicle V. The CAN-ECU 6e transmits a CAN frame E. The reception interval of the CAN frame E is 1 μs. The data contained in the CAN frame E is the output value of the steering angle sensor. The output value of the steering angle sensor is information that can be processed to obtain the steering angle. Therefore, the output value of the steering angle sensor is information that indirectly indicates the steering angle. The accuracy of the output value of the steering angle sensor is higher than the accuracy of the steering angle Rd.

[0034] In this way, CAN-ECU 6a, CAN-ECU 6b, and CAN-ECU 6c output data indicating the speed of vehicle V. In other words, the data contained in CAN frame A, CAN frame B, and CAN frame C are data indicating the speed of vehicle V and are related to each other. Furthermore, the data contained in CAN frame A and CAN frame B include the speed of vehicle V, which is the same type of data. In addition, CAN-ECU 6d and CAN-ECU 6e output data indicating the steering angle of vehicle V. In other words, the data included in CAN frame D and CAN frame E are data indicating the steering angle of vehicle V and are related to each other.

[0035] The CAN-ECU 6f is an ECU that controls the ignition switch of the vehicle V. The CAN-ECU 6f transmits a signal indicating whether the state of the ignition switch is in an on state or an off state.

[0036] Furthermore, the relay processing unit 18 is connected to the Ethernet cables 12 extending from the plurality of Ethernet ECUs 8 . The relay processing unit 18 has a function of relaying Ethernet frames between a plurality of Ethernet ECUs 8 . The relay processing unit 18 further has a function of converting the protocol of CAN frames from the multiple CAN-ECUs 6 into Ethernet frames, and generating Ethernet frames directed to the Ethernet ECU 8 as a predetermined destination. 2, for the sake of simplicity, only one Ethernet ECU 8 is shown, and the following description will be made of the processing for one Ethernet ECU 8a.

[0037] The control unit 16 has a function of controlling the relay processing unit 18 . 2, the control unit 16 includes a processing unit 20, a memory 22, an input / output interface 24, a storage unit 26, and a bus 28. The bus 28 connects the various units to one another.

[0038] The processing unit 20 includes a circuit configuration such as a processor. The processor included in the processing unit 20 may be a GPU. In this case, the processing unit 20 can read out a program stored in the storage unit 26 and execute various calculations and controls described below. The processing unit 20 may be a processor that includes a pre-programmed program. For example, the processing unit 20 may be an integrated circuit such as a Complex Programmable Logic Device (CPLD), a Field-Programmable Gate Array (FPGA), or an Application Specific Integrated Circuit (ASIC). In this case, the processing unit 20 executes various processes based on the pre-programmed program.

[0039] The memory 22 includes a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The storage unit 26 includes, for example, a flash memory, a hard disk, an SSD (Solid State Drive), etc. The storage unit 26 stores computer programs and necessary information to be executed by the processing unit 20. The computer programs stored in the storage unit 26, which is a computer-readable non-transitory recording medium, are loaded into the memory 22, and the computer programs loaded into the memory 22 are executed by the processing unit 20, thereby realizing various processing functions of the processing unit 20. The storage unit 26 also stores an alternative table 27 and a destination table 29.

[0040] The destination table 29 is a table in which the CAN-ID of a CAN frame is associated with the MAC address of the Ethernet ECU 8, and is used to identify the Ethernet ECU 8 that is the destination of the CAN frame. The substitute table 27 is information used in the relay process executed by the vehicle-mounted device 2. The substitute table 27 will be described later.

[0041] Based on the CAN frame (first frame), the processing unit 20 executes a relay process to cause the relay processing unit 18 to generate an Ethernet frame directed to the destination Ethernet ECU 8. The relay process will be described later.

[0042] The input / output interface 24 is connected to the relay processing unit 18. The processing unit 20 controls the relay processing unit 18 via the input / output interface 24. In addition, the processing unit 20 can acquire information indicating the state of the vehicle V from the CAN-ECU 6 and the Ethernet ECU 8 via the input / output interface 24. The CAN-ECU 6f is an ECU that controls the ignition switch of the vehicle V, as described above. The processing unit 20 of this embodiment can acquire, via the input / output interface 24, a signal indicating the state of the ignition switch of the vehicle V, which is transmitted from the CAN-ECU 6f, as the state of the vehicle V.

[0043] [About relay processing] FIG. 3 is a flowchart illustrating an example of the relay process. In the following, a case will be described in which the CAN-ECU 6a and the CAN-ECU 6d in FIG. 2 are first source processing devices, and one Ethernet ECU 8a among the plurality of Ethernet ECUs 8 is a destination processing device.

[0044] In the relay process, the processing unit 20 monitors the CAN frame A and the CAN frame D (step S1). The processing unit 20 monitors the reception intervals of the CAN frame A and the CAN frame D. The processing unit 20 also refers to the data included in the CAN frame A and the CAN frame D. Next, the processing unit 20 performs abnormality detection for the CAN frame A and the CAN frame D (step S2).

[0045] FIG. 4 is a flowchart showing an example of a detection process for detecting an abnormality. First, the processing unit 20 determines whether or not the CAN frame A and the CAN frame D are received at the above-mentioned predetermined reception interval (step S11). If it is determined that at least one of CAN frame A and CAN frame D has not been received within the predetermined reception interval, the processing unit 20 proceeds to step S13, determines that there is an abnormal frame (step S13), and ends the processing. If CAN frame A and CAN frame D are not received within a predetermined interval, there is a risk of a communication error, such as a communication interruption. Therefore, the processing unit 20 determines that a CAN frame that is not received within a predetermined interval is abnormal.

[0046] On the other hand, when it is determined that both CAN frame A and CAN frame D have been received at the predetermined reception interval, the processing unit 20 determines whether the difference Δd between the current data of each of CAN frame A and CAN frame D and the most recent past data is equal to or greater than a preset threshold value Th (step S12). The threshold value Th is a value that is set individually for CAN frame A and CAN frame D. The threshold value Th is a threshold value for determining abnormal fluctuations occurring in the data. The threshold value Th is set to a value that can determine that there is an abnormality in the data. This makes it possible to determine that there is an abnormality in CAN frame A and CAN frame D when there is a significant fluctuation in the data contained in these CAN frames.

[0047] If it is determined that the difference Δd between at least one of CAN frame A and CAN frame D is equal to or greater than the threshold value Th, the processing unit 20 proceeds to step S13, determines that there is an abnormal frame (step S13), and ends the processing. The processing unit 20 determines that a CAN frame having data with a difference Δd equal to or greater than the threshold value Th is an abnormal frame. Furthermore, if it is determined that the difference Δd between both CAN frame A and CAN frame D is not greater than or equal to the threshold value Th (the difference Δd is smaller than the threshold value Th), the processing unit 20 proceeds to step S14, determines that there is no abnormal frame (step S13), and ends the processing.

[0048] In addition, when it is determined in the detection process that there is an abnormal frame, the processing unit 20 may execute a process of saving the detection results, such as the data included in the abnormal frame and the time, etc. The detection results are saved in the storage unit 26. In this case, the detection results can be saved as a log and can be used later to identify the cause of the abnormality.

[0049] 3, after completing the detection process, the processing unit 20 proceeds to step S3. If the detection process determines that there are no abnormal frames, the processing unit 20 generates a normal frame (step S9). After generating the normal frame, the processing unit 20 returns to step S1 and monitors CAN frame A and CAN frame D. The normal frame (second frame) is a frame generated based on the normal CAN frame A and CAN frame D (first frame). The normal frame is an Ethernet frame directed to the Ethernet ECU 8a. The processing unit 20 generates a normal frame by packing the CAN frame A and the CAN frame D. That is, the processing unit 20 converts the protocol of the CAN frame A and the CAN frame D into an Ethernet frame, thereby obtaining a normal frame.

[0050] On the other hand, if it is determined in the detection process that there is an abnormal frame, the processing unit 20 refers to the state of the vehicle V (step S4). The processing unit 20 refers to the signal indicating the state of the ignition switch of the vehicle V transmitted from the CAN-ECU 6f as the state of the vehicle V. In step S4, the processing unit 20 determines whether the state of the ignition switch is on or off.

[0051] After referring to the state of the vehicle V, the processing unit 20 proceeds to step S5 and selects the alternative table 27 (step S5). FIG. 5 is a diagram showing an example of the substitution table 27. As shown in FIG. As shown in FIG. 5, the alternate table 27 of this embodiment includes a first table 27a and a second table 27b. The first table 27a is a table corresponding to the state of the vehicle V when the ignition switch is in the on state. The second table 27b is a table corresponding to the state of the vehicle V when the ignition switch is in the off state.

[0052] The processing unit 20 selects either the first table 27a or the second table 27b depending on the state of the ignition switch. Therefore, the processing unit 20 can select a table according to the state of the vehicle V.

[0053] After selecting the table, the processing unit 20 identifies the relevant frames (step S6). A related frame is a frame that contains related data that is related to the data contained in CAN frame A and CAN frame D.

[0054] As shown in FIG. 5, the substitution table 27 registers the CAN-IDs of the CAN frames related to vehicle speed, the CAN-IDs of the CAN frames related to steering angle, and priorities in association with one another. The CAN-IDs of a plurality of candidate frames are registered in the substitution table 27. A candidate frame is a frame that can become a related frame. The above-mentioned CAN frame A, CAN frame B, and CAN frame C are registered as candidate frames related to vehicle speed. Furthermore, the above-mentioned CAN frame D and CAN frame E are registered as candidate frames related to steering angles. The processing unit 20 selects a relevant frame from among the plurality of candidate frames based on the priority.

[0055] Looking at the vehicle speed-related items, CAN frame A has the highest priority, followed by CAN frame B and CAN frame C in descending order of priority. CAN frame A is the CAN frame that is being monitored, and if no abnormalities are found, it is adopted with the highest priority. For this reason, CAN frame A has the highest priority. Furthermore, CAN frame A, CAN frame B, and CAN frame C are associated with CAN frame D and CAN frame E, respectively. In this way, the substitution table 27 registers a plurality of combinations of a CAN frame related to vehicle speed and a CAN frame related to steering angle. Priorities (priorities) are assigned to multiple combinations.

[0056] For example, if both CAN frame A and CAN frame D are abnormal, the combination of CAN frame B and CAN frame E, which have a priority of 4, is selected as the associated frames. CAN frame B is the associated frame of CAN frame A. CAN frame E is the associated frame of CAN frame D. Also, if only CAN frame D is abnormal, the combination of CAN frame A and CAN frame E, which have a priority of 2, is selected as the related frames.

[0057] As shown in FIG. 3, once the related frames are selected and identified, the processing unit 20 identifies the destinations of the CAN frames A and D (step S7). The processing unit 20 refers to the destination table 29 stored in the storage unit 26, acquires the MAC address of the Ethernet ECU 8a, and identifies the destination of the CAN frame A and the CAN frame D.

[0058] Next, the processing unit 20 generates an alternative frame based on the identified relevant frame (step S8). An alternative frame is an Ethernet Frame that is generated in place of a normal frame when an abnormality is detected in at least one of CAN frame A and CAN frame D. The processing unit 20 generates a substitute frame in which the associated frame is packed. That is, the processing unit 20 converts the associated frame, which is a CAN frame, into an Ethernet frame in terms of protocol, thereby obtaining the substitute frame.

[0059] After generating the substitute frame, the processing unit 20 returns to step S1 and monitors the CAN frame A and the CAN frame D. The normal frame and the alternative frame generated as described above are transmitted to the Ethernet ECU 8a.

[0060] Fig. 6 is a diagram showing a state in which CAN frame A contains an abnormality. In Fig. 6, it is assumed that the ignition switch is in the ON state. Also, assume that CAN frames B, C, D, and E are transmitted normally. If all CAN frames are normal, the in-vehicle device 2 packs CAN frame A and CAN frame D into one Ethernet frame. This converts the protocol of CAN frame A and CAN frame D into an Ethernet frame. The converted Ethernet frame is received by the Ethernet ECU 8a as a normal frame.

[0061] On the other hand, if only CAN frame A is abnormal among the CAN frames, the in-vehicle device 2 selects the combination of CAN frame B and CAN frame D, which has a priority of 3, from the substitution table 27. The in-vehicle device 2 packs the CAN frame B and the CAN frame D into one Ethernet frame. As a result, the CAN frame B and the CAN frame D are protocol-converted into an Ethernet frame. The converted Ethernet frame is received by the Ethernet ECU 8a as a substitute frame.

[0062] Here, CAN frame B is a related frame of CAN frame A. As described above, the CAN frame A stores the speed value Va of the vehicle V. The speed value Va is a value used for displaying the vehicle V on a meter. The CAN frame B stores the speed value Vb of the vehicle V. The speed value Vb is a value used to calculate the average vehicle speed of the vehicle V. The accuracy of the speed value Vb is higher than the accuracy of the speed value Va. Therefore, even if CAN frame B is transmitted instead of CAN frame A, there is a risk that the processing load will increase in the destination Ethernet ECU 8a due to high accuracy, but no data will be lost. This prevents the Ethernet ECU 8a from being hindered from operating normally.

[0063] According to the above configuration, an alternative frame is generated based on CAN frame B, which is an associated frame containing associated data related to the data in CAN frame A (first frame), and an appropriate alternative frame is transmitted to the Ethernet ECU 8a (destination processing device). This prevents the generation of a normal frame (second frame) based on an abnormal frame, and prevents an abnormal frame from being transmitted to the destination ECU.

[0064] In this way, the in-vehicle device 2 of this embodiment executes a process (step S9) of generating a normal frame (second frame) directed to the Ethernet ECU 8a (destination processing device) based on the CAN frame A (first frame) from the CAN-ECU 6a (first source processing device), and a process (step S8) of generating an alternative frame in place of the normal frame when an abnormality in the CAN frame A is detected. The alternative frame is generated based on CAN frame B or CAN frame C, which is an associated frame containing associated data related to the data in CAN frame A and is transmitted from at least one of CAN-ECU 6b and CAN-ECU 6c (second source processing device). This makes it possible to prevent a frame containing an abnormality from being sent to the destination ECU.

[0065] Furthermore, in the above embodiment, when an abnormality in CAN frame A is detected, a reference process (step S5) is executed in which the processing unit 20 references the alternative table 27 in which the identification information of CAN frame A is associated with the identification information of the related frames CAN frame B and CAN frame C and a process (step S6) is executed in which the related frames are identified based on the reference results of the alternative table 27. Therefore, the processing unit 20 can easily identify the related frames.

[0066] In addition, in the above embodiment, the alternative table 27 stores identification information of multiple candidate frames (CAN frame B and CAN frame C) that are candidates for related frames of CAN frame A, in association with the priorities of the multiple candidate frames, and an associated frame is selected from the multiple candidate frames based on the priorities. This allows a relevant frame to be selected from among multiple candidate frames, so that even if some of the multiple candidate frames are not provided or are missing, they can be complemented by other candidate frames.

[0067] Furthermore, in the above embodiment, the case where the transmission destination is only the Ethernet ECU 8a has been exemplified, but a plurality of Ethernet ECUs 8 are connected to the in-vehicle device 2. Therefore, the in-vehicle device 2 can perform the same relay processing for a plurality of Ethernet ECUs 8 as the above-mentioned Ethernet ECU 8a. Therefore, the transmission of abnormal frames to the multiple Ethernet ECUs 8 can be suppressed in a centralized manner by the in-vehicle device 2. This eliminates the need to provide a configuration for processing abnormal frames to the multiple Ethernet ECUs 8. As a result, the configuration of the in-vehicle system 1 as a whole can be simplified.

[0068] 〔others〕 It should be noted that the embodiments disclosed herein are to be considered as illustrative in all respects and not restrictive. In the above embodiment, an example was given of the case where the data of CAN frame B, which is an associated frame of CAN frame A, is the same type of data (speed of vehicle V) as the data of CAN frame A, but the data held by the associated frame may be any data that indirectly indicates the speed of vehicle V, and for example, the accelerator opening, engine speed, etc. may be used as data that indirectly indicates the speed of vehicle V.

[0069] For example, in the above embodiment, the state of the ignition switch is used as the state of the vehicle V, but the vehicle speed, an operation mode preset in the vehicle V, or the like may also be used as the state of the vehicle V. In this case, multiple tables are prepared according to the vehicle speed and the operation mode.

[0070] In the above embodiment, the difference Δd between the current data and the most recent data is used to determine whether or not there is an anomaly in the CAN frame. However, the same type of data can be acquired from another CAN frame and the current data can be compared to determine whether or not there is an anomaly in the CAN frame. In this case, by acquiring multiple pieces of data of the same type and comparing them together, including the current data, it is possible to accurately determine whether or not the data is correct.

[0071] For example, when determining whether there is an abnormality in CAN frame A, the data from CAN frame A (speed value Va) as well as the data from CAN frame B (speed value Vb) and the data from CAN frame C (integrated pulse value) are acquired, and the three vehicle speeds are compared. If the speed value Va of CAN frame A is significantly different from the other two data, it can be determined that CAN frame A has an abnormality. If the speed value Va of CAN frame A can be determined to be the same as the value of at least one of the other two data, it can be determined that the speed value Va of CAN frame A is not abnormal.

[0072] In addition, in the above embodiment, the case where the sender of CAN frame A is different from the sender of CAN frame B and CAN frame C, which are related frames of CAN frame A, is exemplified, but there are cases where the sender of CAN frame A and the sender of the related frames of CAN frame A are the same CAN-ECU 6.

[0073] The scope of the present invention is defined by the claims, not by the meaning described above, and is intended to include meanings equivalent to the claims and all modifications within the scope thereof. [Explanation of symbols]

[0074] 1. In-vehicle systems 2 Onboard equipment 4. Central Gateway 6, 6a, 6b, 6c, 6d, 6e, 6f CAN-ECU 8, 8a Ethernet ECU 10 CAN bus 12 Ethernet cable 14 CAN bus 16 Control Unit 18 Relay Processing Unit 20 Processing section 22 Memory 24 Input / Output Interfaces 26 Memory section 27 Alternative Table 27a Table 1 27b Second Table 28 Bus 29 Destination Table N1 Network 1 N2 Second Network V vehicle

Claims

1. An in-vehicle device, a relay processing unit that relays frames between a plurality of processing devices; a control unit that controls the relay processing unit, The control unit generating a second frame directed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; a processing unit that executes a process of generating a substitute frame directed to the destination processing device in place of the second frame when an abnormality in the first frame is detected, The alternative frame is generated based on an associated frame transmitted from a second source processing device among the plurality of processing devices, the associated frame including associated data related to the data in the first frame. In-vehicle device.

2. The type of the data in the first frame is the same as the type of the related data. The in-vehicle device according to claim 1 .

3. The related data is data that directly or indirectly indicates the data in the first frame. The in-vehicle device according to claim 1 .

4. The processing unit a reference process in which, when an abnormality in the first frame is detected, the processing unit references a table in which identification information of the first frame and identification information of the related frame are registered in association with each other; and further performing a process of identifying the relevant frame based on the reference result of the table. The in-vehicle device according to claim 1 .

5. The table registers identification information of a plurality of candidate frames that are candidates for the related frame and priorities of the plurality of candidate frames in association with each other, The process of identifying the relevant frame includes a process of selecting a candidate frame to be identified as the relevant frame from among the plurality of candidate frames based on the priority order. The in-vehicle device according to claim 4.

6. The processing unit a process of referencing data included in the first frame; and determining whether or not there is an abnormality in the first frame based on a comparison result between the data included in the first frame and the data immediately preceding the data included in the first frame. The in-vehicle device according to claim 1 .

7. The processing unit and further executing a process of determining whether or not there is an abnormality in the first frame based on the reception interval of the first frame. The in-vehicle device according to claim 1 .

8. The table is plural, In each of the plurality of tables, identification information of the first frame and identification information of the related frame are registered in association with each other according to a state of the vehicle, The processing unit further performs a process of selecting a table to be referenced in the reference process from among the plurality of tables based on the state of the vehicle. The in-vehicle device according to claim 4.

9. When an abnormality in the first frame is detected, the processing unit further executes a process of storing a detection result. The in-vehicle device according to any one of claims 1 to 8.

10. The communication protocol of the first frame is different from the communication protocol of the second frame and the alternative frame. The in-vehicle device according to any one of claims 1 to 8.

11. a plurality of processing devices mounted on the vehicle; and an in-vehicle device according to claim 1 that relays frames provided from the plurality of processing devices. In-vehicle systems.

12. A relay method for relaying frames between a plurality of processing devices, comprising: generating a second frame directed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; generating a substitute frame for the second frame, directed to a destination processing device among the plurality of processing devices, when an abnormality in the first frame is detected; The alternative frame is generated based on an associated frame transmitted from a second source processing device among the plurality of processing devices, the associated frame including associated data related to the data in the first frame. Relay method.

13. A computer program for causing a computer to execute relay control of an in-vehicle device that relays frames between a plurality of processing devices, comprising: On the computer, generating a second frame directed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and when an abnormality in the first frame is detected, generating a substitute frame in place of the second frame and directed to a destination processing device among the plurality of processing devices, The alternative frame is generated based on an associated frame transmitted from a second source processing device among the plurality of processing devices, the associated frame including associated data related to the data in the first frame. Computer program.

Images