In-vehicle system, state management device, and control method

Abstract

To start determination of communication interruption to an on-vehicle device started by communication.SOLUTION: An in-vehicle system includes a first in-vehicle device that transitions from a standby state to an active state in response to reception of a frame, a second in-vehicle device capable of communicating with the first in-vehicle device, and a state management device capable of communicating with the first in-vehicle device and the second in-vehicle device. The state management device includes a first determination unit configured to determine whether or not the first activation completion notification transmitted from the first in-vehicle device has been received, and a first transmission unit configured to transmit a first state notification in a case where the first determination unit determines that the first activation completion notification has been received, and the second in-vehicle device starts a first communication disruption determination process of determining whether or not communication disruption has occurred in the first in-vehicle device in a case where the first state notification transmitted from the state management device has been received.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle system, a state management device, and a control method. [Background technology]

[0002] A vehicle is equipped with a variety of on-board devices, such as control system ECUs (Electronic Control Units) that control the engine, transmission, etc., body system ECUs that control headlights, power windows, etc., and information system ECUs for navigation devices, multimedia devices, etc. Each on-board device is connected to an on-board network and can communicate with each other.

[0003] Patent Document 1 discloses an engine control ECU that performs fault detection and communication with an immobilizer control ECU that receives power from a battery only via an IG switch. The engine control ECU disclosed in Patent Document 1 receives power from the battery not only via the IG switch but also via a main relay with a self-holding function that is inserted in parallel with the IG switch. This engine control ECU prohibits fault detection when the IG switch is turned off, thereby preventing erroneous detection caused by a discrepancy in the timing of power-off due to the self-holding function of the main relay. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-011192 Summary of the Invention [Problem to be solved by the invention]

[0005] In recent years, new ECUs have become available that support a network management (NM) function that synchronizes ECUs within the same network by transmitting and receiving frames and transitioning them from a standby state to an active state. However, the engine control ECU disclosed in Patent Document 1 is compatible only with conventional ECUs that switch between stopped and active states using a relay (IG switch), and is not compatible with new ECUs. [Means for solving the problem]

[0006] An in-vehicle system according to one embodiment of the present disclosure comprises a first in-vehicle device that transitions from a standby state to a startup state upon receiving a frame, a second in-vehicle device capable of communicating with the first in-vehicle device, and a state management device capable of communicating with the first in-vehicle device and the second in-vehicle device, wherein the first in-vehicle device transmits a first startup completion notification when it transitions from the standby state to the startup state, and the state management device includes a first determination unit that determines whether the first startup completion notification transmitted from the first in-vehicle device has been received, and a first transmission unit that transmits a first state notification when the first determination unit determines that the first startup completion notification has been received, and when the second in-vehicle device receives the first state notification transmitted from the state management device, it initiates a first communication disruption determination process that determines whether a communication disruption has occurred in the first in-vehicle device. [Effects of the Invention]

[0007] According to the present disclosure, it is possible to start determining whether communication has been interrupted for an in-vehicle device that is activated by communication. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a gateway device according to the embodiment. [Figure 3] FIG. 3 is a functional block diagram illustrating an example of functions of the gateway device according to the embodiment. [Figure 4] FIG. 4 is a schematic diagram showing a CAN frame format. [Figure 5] FIG. 5 is a flowchart illustrating an example of a state management process in the gateway device according to the embodiment. [Figure 6] FIG. 6 is a sequence diagram for explaining an example of a state management operation for a power-on ECU in the in-vehicle system according to the embodiment. [Figure 7] FIG. 7 is a sequence diagram for explaining an example of a state management operation for a communication-activated ECU in the in-vehicle system according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] <Summary of Embodiments of the Present Disclosure> The following provides an outline of embodiments of the present disclosure.

[0010] (1) An in-vehicle system according to this embodiment includes a first in-vehicle device that transitions from a standby state to an active state upon receiving a frame, a second in-vehicle device capable of communicating with the first in-vehicle device, and a state management device capable of communicating with the first and second in-vehicle devices. The first in-vehicle device transmits a first startup completion notification when the first in-vehicle device transitions from the standby state to the active state. The state management device includes a first determination unit that determines whether the first startup completion notification transmitted from the first in-vehicle device has been received, and a first transmission unit that transmits a first state notification when the first determination unit determines that the first startup completion notification has been received. The second in-vehicle device, upon receiving the first state notification transmitted from the state management device, initiates a first communication disruption determination process that determines whether a communication disruption has occurred in the first in-vehicle device. This allows the second in-vehicle device to initiate a communication disruption determination process for the first in-vehicle device, which is activated by communication.

[0011] (2) In the above (1), the first in-vehicle device may transmit a first stop preparation completion notification when the first in-vehicle device transitions from the activated state to the standby state, the state management device may further include a second determination unit that determines whether the first stop preparation completion notification transmitted from the first in-vehicle device has been received, the transmission unit may transmit a second state notification different from the first state notification when the second determination unit determines that the first stop preparation completion notification has been received, and the second in-vehicle device may terminate the first communication disruption determination process when it receives the second state notification transmitted from the state management device. This makes it possible to terminate the determination of communication disruption to the first in-vehicle device.

[0012] (3) In the above (2), the state management device may transmit a state notification frame including state information of a plurality of in-vehicle devices, the first state notification being the state notification frame including the state information indicating that the first in-vehicle device is in the activated state, and the second state notification being the state notification frame including the state information indicating that the first in-vehicle device is in the standby state. This allows the first communication disruption determination process to be started and ended by a common state notification frame.

[0013] (4) In any one of (1) to (3) above, the in-vehicle system may further include a third in-vehicle device capable of communicating with each of the second in-vehicle device and the state management device and transitioning from a stopped state to an activated state upon application of power from a power source, the third in-vehicle device transmitting a second startup completion notification when the third in-vehicle device transitions from the stopped state to the activated state, the state management device further including a third determination unit determining whether the second startup completion notification transmitted from the second in-vehicle device has been received, the transmission unit transmitting a third state notification different from the first state notification when the third determination unit determines that the second startup completion notification has been received, and the second in-vehicle device, upon receiving the third state notification transmitted from the state management device, may start a second communication disruption determination process for determining whether a communication disruption has occurred in the third in-vehicle device. This makes it possible to start a communication disruption determination for the third in-vehicle device that is activated by power from a power source.

[0014] (5) In the above (4), the third in-vehicle device may transmit a second stop preparation completion notification when the third in-vehicle device transitions from the activated state to the stopped state, the state management device may further include a fourth determination unit that determines whether the second stop preparation completion notification transmitted from the third in-vehicle device has been received, the transmission unit may transmit a fourth state notification different from the first state notification and the third state notification when the fourth determination unit determines that the second stop preparation completion notification has been received, and the second in-vehicle device may terminate the second communication disruption determination process when it receives the fourth state notification transmitted from the state management device. This makes it possible to terminate the determination of communication disruption to the second in-vehicle device.

[0015] (6) In the above (5), the state management device may transmit a state notification frame including state information of a plurality of in-vehicle devices, the first state notification being the state notification frame including the state information indicating that the first in-vehicle device is in the activated state, the third state notification being the state notification frame including the state information indicating that the third in-vehicle device is in the activated state, and the fourth state notification being the state notification frame including the state information indicating that the third in-vehicle device is in the stopped state. This makes it possible to start each of the first communication disruption determination process and the second communication disruption determination process and to end the second communication disruption determination process by using a common state notification frame.

[0016] (7) In any one of (1) to (6) above, the first in-vehicle device may transmit a specific first frame at a first period in the activated state, and the first communication disruption determination may be a process of determining whether the first frame has been received at a period corresponding to the first period. This allows the first in-vehicle device to determine whether communication has been disrupted by using the periodically transmitted first frame.

[0017] (8) In any one of (4) to (6) above, the third in-vehicle device may transmit a specific second frame at a second period in the activated state, and the second communication disruption determination may be a process of determining whether the second frame has been received at a period corresponding to the second period. This allows the second in-vehicle device to determine whether communication has been disrupted using the periodically transmitted second frame.

[0018] (9) The state management device according to the present embodiment includes a first determination unit that determines whether or not a first startup completion notification transmitted from a first in-vehicle device that transitions from a standby state to an activated state upon receiving a frame has been received, and a first transmission unit that transmits a first state notification that triggers a second in-vehicle device that can communicate with the first in-vehicle device to start a first communication disruption determination process in which the second in-vehicle device determines whether or not a communication disruption has occurred in the first in-vehicle device when the first determination unit determines that the first startup completion notification has been received. This allows the state management device to start a communication disruption determination process for the first in-vehicle device that is activated by communication.

[0019] (10) A control method according to this embodiment includes the steps of: transmitting a first startup completion notification when a first in-vehicle device that transitions from a standby state to an activated state upon receiving a frame transitions from the standby state to the activated state; determining, by a state management device capable of communicating with the first in-vehicle device and a second in-vehicle device that can communicate with the first in-vehicle device, whether the first startup completion notification transmitted from the first in-vehicle device has been received; transmitting a first status notification when the state management device determines that the first startup completion notification has been received; and starting a first communication disruption determination process in which the second in-vehicle device determines whether a communication disruption has occurred in the first in-vehicle device when the second in-vehicle device receives the first status notification transmitted from the state management device. This makes it possible to start a communication disruption determination for a first in-vehicle device that is activated by communication.

[0020] The present disclosure can be realized not only as an in-vehicle system having the above-described characteristic configuration, a state management device included in the in-vehicle system, and a control method including characteristic steps, but also as a state management program for causing the state management device to execute characteristic processing, or as a semiconductor integrated circuit in which part or all of the state management device is implemented.

[0021] <Details of the embodiment of the present disclosure> DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. At least some of the following preferred embodiments may be combined in any desired manner.

[0022] [1. In-vehicle systems] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment.

[0023] The in-vehicle system 10 includes a gateway device (hereinafter referred to as "GW device") 100, a power management device 200, and ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B.

[0024] The GW device 100 is connected to an in-vehicle network 250. The in-vehicle network 250 according to the embodiment is a CAN (Controller Area Network) network having a bus-type network topology. The in-vehicle network 250 includes buses 250A, 250B, and 250C.

[0025] The GW device 100, the power management device 200, and the ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B use a communication protocol for periodically or aperiodically transmitting and receiving frames. In the embodiment, the communication protocol is CAN or CAN FD (CAN with Flexible Data Rate).

[0026] ECUs 310A, 320A, 330A, and 340A are connected to bus 250A. ECUs 310B, 320B, 330B, and 340B are connected to bus 250B. Each of ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B has a CAN interface and is capable of communication via CAN.

[0027] Each of the ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B is disposed in a different part of the vehicle. Each of the ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B individually controls the hardware of each part of the vehicle and monitors the status of the hardware of each part of the vehicle. For example, each of the ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B is an ECU for a control system, a body system, or an information system.

[0028] ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B have the function of providing services. One service can be provided by one or more ECUs. For example, a smart entry service is provided by an ECU group including ECUs 330A and 330B. For example, a preceding vehicle tracking service is provided by an ECU group including ECUs 320A and 320B.

[0029] 1, ECUs 310A, 310B, 320A, and 320B are old-type ECUs, and ECUs 330A, 330B, 340A, and 340B are new-type ECUs. ECUs 310A, 310B, 320A, and 320B are examples of "third in-vehicle devices," and ECUs 330A, 330B, 340A, and 340B are examples of "first in-vehicle devices." Hereinafter, old-type ECUs 310A, 310B, 320A, and 320B are also referred to as "power-started ECUs," and new-type ECUs 330A, 330B, 340A, and 340B are also referred to as "communication-started ECUs."

[0030] The old ECU does not have the NM function. The old ECU has two states: a stopped state and an activated state.

[0031] The new ECU has an NM function. The new ECU has two states: a standby state (sleep state) and an active state. When the new ECU receives an NM frame in the standby state, it transitions from the standby state to the active state.

[0032] The bus 250C is connected to the power management device 200. For example, the power management device 200 is provided with a CAN interface and is capable of communication via the CAN.

[0033] The GW device 100 is connected to buses 250A, 250B, and 250C. The GW device 100 is provided with a CAN interface as will be described later, and is capable of communication via the CAN.

[0034] The GW device 100 has a communication relay function, that is, the GW device 100 can relay communications (frames) between the buses 250A, 250B, and 250C.

[0035] The vehicle is equipped with an auxiliary battery 410, a high-voltage battery 420, and a DC / DC converter 430 as power sources. The auxiliary battery 410 is, for example, a battery with an output voltage of 12 V, and is used to drive auxiliary devices such as ECUs. The high-voltage battery 420 is, for example, a battery with an output voltage of 400 V, and is used to drive the vehicle. The DC / DC converter 430 is connected to the high-voltage battery 420 and reduces the output voltage from the high-voltage battery 420 to 12 V. The output side of the DC / DC converter 430 is connected to a power line 450 extending from the auxiliary battery 410, and the output power of the DC / DC converter 430 can be used to charge the auxiliary battery 410 and to supply power to each of the ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B.

[0036] A power line 450 extending from auxiliary battery 410 is connected at multiple points to power lines 451A, 451B, 451C, 451D, 451E, and 451F. Power line 451A is connected to ECU 310A. A relay 460A is provided on power line 451A. Power line 451B is connected to ECU 310B. A relay 460B is provided on power line 451B. Power line 451C is connected to ECU 320A. A relay 460C is provided on power line 451C. Power line 451D is connected to ECU 320B. A relay 460D is connected to power line 451D. Power line 451E branches midway, and each branch is connected to ECU 330A and 330B. No relay is provided on power line 451E. Power line 451F branches off midway, and the branches are connected to ECUs 340A and 340B. No relay is provided on power line 451F.

[0037] The power management device 200 manages the activation and deactivation of the ECUs 310A, 310B, 320A, and 320B. In a specific example, the power management device 200 switches the relays 460A, 460B, 460C, and 460D individually between an on state (connected state) and an off state (disconnected state). When the relay 460A is in the on state, power is supplied to the ECU 310A, and the ECU 310A is activated. When the relay 460A is in the off state, power supply to the ECU 310A is stopped, and the ECU 310A is deactivated. When the relay 460B is in the on state, power is supplied to the ECU 310B, and the ECU 310B is activated. When the relay 460B is in the off state, power supply to the ECU 310B is stopped, and the ECU 310B is deactivated. When relay 460C is turned on, power is supplied to ECU 320A, and ECU 320A is activated. When relay 460C is turned off, power supply to ECU 320A is stopped, and ECU 320A is deactivated. When relay 460D is turned on, power is supplied to ECU 320B, and ECU 320B is activated. When relay 460D is turned off, power supply to ECU 320B is stopped, and ECU 320B is deactivated.

[0038] [2. Vehicle condition] The vehicle states according to the embodiment will be described below. The vehicle states according to the embodiment include a first vehicle state and a second vehicle state.

[0039] [2-1. First vehicle status] The first vehicle state is a vehicle state for starting and stopping the old-type ECU. The first vehicle state includes the +B, ACC, and IG states.

[0040] A switch 210 is connected to the power management device 200. The switch 210 is used to switch the first vehicle state among +B, ACC, and IG. The switch 210 is, for example, a push switch.

[0041] When switch 210 is pressed (ON) while in +B, a transition occurs from +B to ACC. When switch 210 is pressed while in ACC, a transition occurs from ACC to IG. When switch 210 is pressed while in IG, a transition occurs from IG to +B.

[0042] The first vehicle state determines the state of the old-model ECUs. In +B, power is supplied to ECUs 330A and 330B. In +B, relays 460A, 460B, 460C, and 460D are each in an OFF state, and no power is supplied to ECUs 310A, 310B, 320A, and 320B. That is, in +B, ECUs 310A, 310B, 320A, and 320B are in a stopped state.

[0043] When the transition occurs from +B to ACC, relays 460A, 460B are switched from off to on. In ACC, power is supplied to ECUs 310A, 310B by auxiliary battery 410 (and DC / DC converter 430), which is a power source, and ECUs 310A, 310B are activated. Since power is always supplied to ECUs 330A, 330B, they can also be activated in ACC. In ACC, relays 460C, 460D are in the off state, and power is not supplied to ECUs 320A, 320B. That is, in ACC, ECUs 320A, 320B are in a stopped state.

[0044] When the vehicle transitions from ACC to IG, relays 460C and 460D are switched from off to on. In the IG, power is supplied to ECUs 320A and 320B by auxiliary battery 410 (and DC / DC converter 430), which is a power source, and ECUs 320A and 320B are activated. Since ECUs 330A and 330B are constantly supplied with power, they can also be activated in the IG. Furthermore, since relays 460A and 460B maintain an on state in the IG, ECUs 310A and 310B are also activated in the IG. Note that the above-described power management is an example and is not limiting. For example, relays 460A, 460B, 460C, and 460D may be individually switched on / off depending on the state of the vehicle or its surroundings.

[0045] [2-2. Second vehicle status] The second vehicle state is a vehicle state for starting and stopping a new ECU. The vehicle is equipped with an input device that receives various instructions from a user (passenger) and various sensors that detect the state or objects of the vehicle or its surroundings (neither is shown). The input device is, for example, a touch sensor attached to a display arranged on the dashboard. In another example, the input sensor is a switch provided on the dashboard, steering wheel, etc. of the vehicle. The sensor is, for example, a camera, radar, LiDAR, a human presence sensor, a seating sensor, a shift position sensor, an oil pressure sensor, a temperature sensor, a vehicle speed sensor, an engine (or motor) rotation speed sensor, an accelerator pedal stroke sensor, a brake pedal stroke sensor, a steering angle sensor, etc.

[0046] The second vehicle state includes, for example, a vehicle waiting state, an unmanned parked state, a manned parked state, a manned driving state, and the like.

[0047] The vehicle standby state is a state in which the vehicle is stopped. In the vehicle standby state, only a minimum number of sensors and ECUs are active. The new ECUs 340A and 340B are constantly connected to the power source (auxiliary battery 410 and DC / DC converter 430). Therefore, power is constantly supplied to the ECUs 340A and 340B. In the vehicle standby state, the ECUs 340A and 340B are in a standby state. The standby state of the new ECUs 340A and 340B is a state in which only a minimum number of functions are active and most functions are stopped. Specifically, in the standby state, the CAN interfaces of the ECUs 340A and 340B, input devices that accept instructions from the user, and sensors that detect the state of the vehicle, the state around the vehicle, or objects around the vehicle are active, and the processors are stopped. In other words, the standby state of the ECUs 340A and 340B is a power-saving state in which power consumption is suppressed.

[0048] The unmanned parking state is a vehicle state in which an unmanned parking service is being executed. That is, the unmanned parking state is a state in which the ECU group that provides the unmanned parking service is activated. The unmanned parking service includes, for example, a smart entry service.

[0049] For example, the unmanned parking state is started by receiving an instruction to start the execution of the unmanned parking service from a user. For example, when the GW device 100 receives an instruction to start the execution of the unmanned parking service in a vehicle standby state, the vehicle transitions from the vehicle standby state to the unmanned parking state.

[0050] For example, a partial network function is implemented in an in-vehicle network, which divides the in-vehicle network into clusters called PNCs (Partial Network Clusters) for each function (service), wakes up the ECUs belonging to the PNC used to execute the service, and puts the ECUs of other PNCs to sleep. The NM frame includes a specification of the PNC to be woken up (activated), and an ECU that receives the NM frame wakes up if the specified PNC matches the PNC to which the ECU belongs, and remains asleep if the specified PNC does not match the PNC to which the ECU belongs.

[0051] For example, when some new ECUs receive an instruction to start executing an unmanned parking service, they transmit an NM frame specifying a PNC corresponding to the unmanned parking service to the bus to which the ECU is connected. When the GW device 100 receives the NM frame transmitted over the bus, it relays the NM frame to the bus to which the ECU belonging to the PNC specified in the NM frame is connected. When the ECU belonging to the PNC corresponding to the unmanned parking service receives the NM frame, it transitions from a standby state to an active state. This transitions the second vehicle state to an unmanned parking state.

[0052] For example, a smart entry service is executed by an image processing ECU that processes images taken by a camera capturing images of the exterior of the vehicle, and a door lock control ECU that controls door locking and unlocking. In the smart entry service, a camera captures images of the vehicle's surroundings, and the image processing ECU performs facial recognition. If user authentication by facial recognition is successful and contact with the door handle is detected, the door lock control ECU unlocks the door.

[0053] The attended parking state is a vehicle state in which attended parking service is being executed. That is, the attended parking state is a state in which the ECU group that provides the attended parking service is activated. The attended parking service includes, for example, an audio / visual service (hereinafter also referred to as "AV service").

[0054] For example, the attended parking state is initiated when an occupancy sensor installed on a seat detects a seated person in the unmanned parking state. For example, when some new ECUs detect a seated person in the unmanned parking state, they transmit an NM frame specifying a PNC corresponding to the attended parking service to the bus to which the ECU is connected. When the GW device 100 receives the NM frame transmitted through the bus, it relays the NM frame to the bus to which the ECU belonging to the PNC specified in the NM frame is connected. When the ECU belonging to the PNC corresponding to the attended parking service receives the NM frame, it transitions from the standby state to the activated state. This transitions the second vehicle state to the attended parking state.

[0055] For example, an AV service is executed by a multimedia ECU, which plays back content such as music or video.

[0056] The manned driving state is a vehicle state in which a manned driving service is being executed. That is, the manned driving state is a state in which the ECU group that provides the manned driving service is activated. The manned driving service includes, for example, a following vehicle service in which the vehicle drives while maintaining a distance from the vehicle in front.

[0057] For example, the manned driving state is initiated when a shift position sensor detects a shift of the shift lever from P range to D range during manned parking. For example, when some new ECUs detect a shift of the shift lever to D range during manned parking, they transmit an NM frame specifying a PNC corresponding to the manned driving service to the bus to which the ECU is connected. When the GW device 100 receives the NM frame transmitted through the bus, it relays the NM frame to the bus to which the ECU belonging to the PNC specified in the NM frame is connected. When the ECU belonging to the PNC corresponding to the manned driving service receives the NM frame, it transitions from a standby state to an activated state. This transitions the second vehicle state to the manned driving state.

[0058] For example, a vehicle following service is performed by a vehicle distance detection ECU connected to a LiDAR or a camera, an image processing ECU that detects lanes in an image of the vehicle ahead obtained by the camera, a steering ECU that controls the steering wheel, and an engine ECU that controls the engine (or a motor ECU that controls the driving motor). In the vehicle following service, the vehicle's steering angle (tire angle) and vehicle speed are controlled so that the vehicle does not deviate from the lane detected by the image processing ECU while maintaining the distance from the vehicle ahead using the vehicle distance detection ECU.

[0059] [3. Hardware configuration of the gateway device] 2 is a block diagram showing an example of a hardware configuration of a GW device according to an embodiment. The GW device 100 includes a processor 101, a nonvolatile memory 102, a volatile memory 103, a relay circuit 104, and interfaces (hereinafter also referred to as "I / F") 105A, 105B, and 105C. The processor 101 is connected to the nonvolatile memory 102, the volatile memory 103, and the relay circuit 104 by signal lines. Each of the I / Fs 105A, 105B, and 105C is connected to the relay circuit 104 by a signal line.

[0060] The volatile memory 103 is, for example, a semiconductor memory such as an SRAM (Static Random Access Memory) or a DRAM (Dynamic Random Access Memory). The non-volatile memory 102 is, for example, a flash memory, a hard disk, or a ROM (Read Only Memory). The non-volatile memory 102 stores a state management program 110, which is a computer program, and data used for executing the state management program 110. The functions of the GW device 100, which will be described later, are realized when the processor 101 executes the state management program 110.

[0061] The processor 101 is, for example, a CPU (Central Processing Unit). However, the processor 101 is not limited to a CPU. The processor 101 may be a GPU (Graphics Processing Unit). In a specific example, the processor 101 is a multi-core processor. The processor 101 may be a single-core processor. The processor 101 is configured to be able to execute a computer program. However, the processor 101 may be, for example, an ASIC (Application Specific Integrated Circuit) or a programmable logic device such as an FPGA (Field Programmable Gate Array). In this case, the ASIC or programmable logic device is configured to be able to execute the same function as the state management program 110.

[0062] The I / Fs 105A, 105B, and 105C are communication interfaces (CAN interfaces) that conform to the CAN standard. Each of the I / Fs 105A, 105B, and 105C includes a transceiver that conforms to the CAN standard. The I / F 105A is connected to the bus 250A, and the I / F 105B is connected to the bus 250B. The I / F 105C is connected to the bus 250C that is connected to the power management device 200.

[0063] The relay circuit 104 is a circuit for relaying CAN frames (CAN frames). For example, the relay circuit 104 determines whether a frame received from bus 250A at I / F 105A is a frame that should be transferred to bus 250B or bus 250C. If the frame is to be transferred to bus 250B, the relay circuit 104 outputs the frame to I / F 105B. If the frame is to be transferred to bus 250C, the relay circuit 104 outputs the frame to I / F 105C. The relay circuit 104 determines whether a frame received from bus 250B at I / F 105B is a frame that should be transferred to bus 250A or bus 250C. If the frame is to be transferred to bus 250A, the relay circuit 104 outputs the frame to I / F 105A. If the frame is to be transferred to bus 250C, the relay circuit 104 outputs the frame to I / F 105C. The relay circuit 104 determines whether the frame received from the bus 250C at the I / F 105C is a frame that should be transferred to the bus 250A or the bus 250B. If the frame is to be transferred to the bus 250A, the relay circuit 104 outputs the frame to the I / F 105A, and if the frame is to be transferred to the bus 250B, the relay circuit 104 outputs the frame to the I / F 105B.

[0064] The relay circuit 104 includes a communication circuit that complies with CAN. When transmitting specific data to at least one of the buses 250A, 250B, and 250C, the relay circuit 104 generates a CAN frame in response to an instruction from the processor 101, for example, and outputs the frame to at least one of the I / Fs 105A, 105B, and 105C. The relay circuit 104 extracts data contained in the frame received by one of the I / Fs 105A, 105B, and 105C, and outputs the data to the processor 101. However, some or all of the functions of the relay circuit 104 may be executed by the processor 101.

[0065] [4. Functions of the GW device] FIG. 3 is a functional block diagram illustrating an example of functions of the GW device according to the embodiment.

[0066] The GW device 100 is an example of a “state management device.” When the processor 101 of the GW device 100 executes the state management program 110, the functions of a receiving unit 111, a first determination unit 112, a transmitting unit 113, a second determination unit 114, a third determination unit 115, and a fourth determination unit 116 are realized.

[0067] The receiving unit 111 receives frames transmitted through the in-vehicle network 250 .

[0068] Now, let's explain the CAN frame. Figure 4 is a schematic diagram showing the CAN frame format. Figure 4 shows the data frame structure of the standard CAN format. The upper line in the figure indicates recessive, and the lower line indicates dominant. As shown in Figure 4, a CAN data frame includes the following fields: SOF (Start of Frame), CAN ID, RTR (Remote Transmission Request), control field, data field, CRC (Cyclic Redundancy Check) sequence, CRC delimiter, ACK (Acknowledgement) slot, ACK delimiter, and EOF (End of Frame). SOF indicates the start of the frame. CAN ID is used to identify the ECU and frame type. RTR is used to distinguish between data frames and remote frames. In data frames, RTR is dominant. The control field stores information used for communication control. The data field stores up to 8 bytes of actual data (payload). The CRC sequence and CRC delimiter are collectively called the CRC field, which stores a type of error detection code. The ACK slot and ACK delimiter together are called the ACK field, and the ACK field stores information indicating whether the data up to the CRC field was received correctly. EOF indicates the end of the frame.

[0069] In CAN, frames contain identification information called a CAN ID. The CAN ID indicates the type of frame. For example, the CAN ID of a frame containing data on "engine RPM" is "0x100," and the CAN ID of a frame containing data on "accelerator opening" is "0x200."

[0070] 1, each of ECUs 310A, 310B, 320A, 320B, 330A, 330B, 340A, and 340B executes a startup sequence upon startup. The startup sequence is a process for transitioning the state of the ECU from a state in which the ECU's functions, such as a function for controlling hardware, are stopped (stopped state or standby state) to a state in which the above functions are performed (activated state).

[0071] When power is applied to the power-on ECUs 310A, 310B, 320A, and 320B, the power-on ECUs execute a startup sequence and transition from a stopped state to a running state. For example, the startup sequence of the power-on ECUs includes a process of executing a boot loader, loading an operating system into a volatile memory, and a process of starting software (hereinafter also referred to as "application software" or "APP") for controlling hardware or monitoring the state of the hardware or the state around the vehicle. When the startup sequence is completed, the ECUs 310A, 310B, 320A, and 320B transmit a startup completion notification. The startup completion notification transmitted from the power-on ECU is an example of a "second startup completion notification."

[0072] When the communication-startup ECUs 340A and 340B receive an NM frame, receive a specific instruction from a user via an input device, or detect a specific state of the vehicle, a specific state around the vehicle, or a specific object around the vehicle via a sensor (i.e., detect a trigger for starting a specific service), they execute a startup sequence and transition from a standby state to an active state. The activated ECUs 340A and 340B transmit an NM frame specifying their own PNC to start other ECUs belonging to their own PNC. For example, the startup sequence of a communication-startup ECU includes a process of restoring to volatile memory data that was being worked on in the previous active state and that was saved in nonvolatile memory. When the startup sequence is complete, the ECUs 340A and 340B transmit a startup completion notification. The startup completion notification transmitted from a communication-startup ECU is an example of a "first startup completion notification."

[0073] The startup completion notification is a frame including information indicating that the ECU has completed its state transition to the startup state. In one example, the startup completion notification includes the CAN ID of the frame sender (i.e., the ECU whose startup sequence has been completed) in the CAN ID field, and includes information indicating startup completion in the data field.

[0074] Each of ECUs 310A, 310B, 320A, and 320B executes a stop preparation process when transitioning from an active state to a stopped state. The stop preparation process is a process for properly stopping the ECU. Each of ECUs 330A, 330B, 340A, and 340B executes a standby preparation process when transitioning from an active state to a standby state. The standby preparation process is a process for properly transitioning the ECU to the standby state.

[0075] When power-on ECUs 310A, 310B, 320A, and 320B receive a stop instruction from a user generated by pressing switch 210, they execute a stop preparation process. For example, the stop preparation process of a power-on ECU includes an APP termination process. When the stop preparation process is completed, ECUs 310A, 310B, 320A, and 320B transmit a stop preparation completion notification. The stop preparation process of a power-on ECU is an example of a "second stop preparation process," and the stop preparation completion notification transmitted from a power-on ECU is an example of a "second stop preparation completion notification." When ECUs 310A, 310B, 320A, and 320B transmit the stop preparation completion notification, they promptly transition to a stopped state.

[0076] When the communication startup ECUs 340A, 340B receive a standby instruction from the user, they execute a standby preparation process. For example, the standby preparation process of the communication startup ECUs includes a process of saving data in progress that is stored in the volatile memory to the non-volatile memory 202. When the standby preparation process is completed, the ECUs 340A, 340B transmit a standby preparation completion notification. The standby preparation process of the communication startup ECUs is an example of a "first stop preparation process," and the standby preparation completion notification transmitted from the communication startup ECUs is an example of a "first stop preparation completion notification." When the ECUs 340A, 340B transmit the standby preparation completion notification, they promptly transition to a standby state.

[0077] As described above, when the communication-startup ECUs 340A, 340B transition from the standby state to the activated state, the ECUs 340A, 340B transmit a startup completion notification. Returning to FIG. 3, the first determination unit 112 determines whether or not the receiver 111 has received a startup completion notification (first startup completion notification) transmitted from the communication-startup ECU. That is, the first determination unit 112 determines whether or not the frame received by the receiver 111 is a startup completion notification (first startup completion notification) transmitted from the communication-startup ECU.

[0078] In a specific example, the first determination unit 112 analyzes a frame received by the receiving unit 111 and determines whether the frame is a startup completion notification transmitted from a communication-startup ECU. The first determination unit 112 checks the sender of the frame using the CAN ID of the received frame and determines whether the sender is a communication-startup ECU. The first determination unit 112 references information stored in the data field of the received frame and determines whether the frame is a startup completion notification. For example, when startup of the ECU 340A is completed, a startup completion notification including the CAN ID of the ECU 340A and information indicating startup completion is transmitted. The first determination unit 112 analyzes the startup completion notification to determine that startup of the ECU 340A is completed.

[0079] When the first determination unit 112 determines that a startup completion notification (first startup completion notification) transmitted from a communication startup type ECU has been received, the transmission unit 113 transmits information (first state notification) to notify that the communication startup type ECU has transitioned to a startup state.

[0080] The GW device 100 manages the states of all ECUs in the vehicle. As described above, the GW device 100 identifies the state of each ECU (activated state, stopped state, standby state) and notifies the entire vehicle of the states of all ECUs. Specifically, the GW device 100 creates a state notification frame. The state notification frame is a frame for notifying all ECUs of the state of each ECU in the vehicle.

[0081] The status notification frame includes status information of all ECUs in the data field. For example, the status information indicates whether the activation status is "on" or "off." That is, the status information for a power-on ECU indicates that the activation status is "on" when the ECU is in the activated state and "off" when the ECU is in the stopped state. The status information for a communication-activated ECU indicates that the activation status is "on" when the ECU is in the activated state and "off" when the ECU is in the standby state.

[0082] In a specific example, the status information is stored in the status notification frame in association with the identification information of each ECU, thereby making it possible to identify the status information for each ECU in the status notification frame.

[0083] For example, the first state notification is a state notification frame. Specifically, the first state notification is a state notification frame in which the activation state is set to "ON" in the state information corresponding to the identification information of the target ECU (the ECU that has transmitted the activation completion notification). The transmitting unit 113 transmits such a state notification frame to all ECUs. When the activation of the ECU 340A is completed, the identification information of the ECU 340A is associated with the state information in which the activation state is "ON" in the state notification frame. The transmitting unit 113 broadcasts the state notification frame, for example. This makes it possible to notify all ECUs of the ECU 340A that is in the activated state. Each ECU can identify the ECU 340A that is in the activated state by analyzing the state notification frame.

[0084] When an ECU (e.g., ECU 330A) in an activated state different from a communication-activated ECU (e.g., ECU 340A) whose activation has been completed receives a state notification frame (first state notification) transmitted from the GW device 100, the ECU starts a communication disruption determination process for the communication-activated ECU 340A whose activation has been completed. The communication disruption determination process for the communication-activated ECU 340A is a process for determining whether a communication disruption has occurred in the communication-activated ECU 340A. In a specific example, the activated ECU 340A transmits a specific frame (first frame) at a specific cycle (first cycle). The specific frame (hereinafter also referred to as a "periodic frame") is, for example, a frame including the CAN ID of the ECU 340A. If the periodic frame from the ECU 340A reaches the ECU 330A, it can be determined that the communication between the ECU 330A and the ECU 340A has not been disrupted.

[0085] The communication disruption determination is a process of determining whether or not a periodic frame has been received at a period corresponding to the transmission period of the periodic frame (hereinafter also referred to as the "determination period"). The determination period is, for example, a period that is an integer multiple of the transmission period of the periodic frame. The ECU 330A determines whether or not a periodic frame has been received at each determination period. For example, if a periodic frame is not received after a certain point in time, the ECU 330A can determine that communication with the ECU 340A has been disrupted. For example, if a periodic frame is not received in a certain period but is received thereafter, the ECU 330A can determine that a communication failure occurred with the ECU 340A, but that the communication state has been restored.

[0086] The second determination unit 114 determines whether or not a standby preparation completion notification (first stop preparation completion notification) transmitted from a communication startup ECU has been received by the receiving unit 111. That is, the second determination unit 114 determines whether or not the frame received by the receiving unit 111 is a standby preparation completion notification (first stop preparation completion notification) transmitted from a communication startup ECU.

[0087] In a specific example, the second determination unit 114 analyzes a frame received by the receiving unit 111 and determines whether the frame is a standby preparation completion notification transmitted from a communication-activated ECU. The second determination unit 114 checks the sender of the frame using the CAN ID of the received frame and determines whether the sender is a communication-activated ECU. The second determination unit 114 references information stored in the data field of the received frame and determines whether the frame is a standby preparation completion notification. For example, when the standby preparation process of the ECU 340A is completed, a standby preparation completion notification including the CAN ID of the ECU 340A and information indicating the completion of standby preparation is transmitted. The second determination unit 114 analyzes the standby preparation completion notification to determine that the standby preparation process of the ECU 340A has been completed.

[0088] When the second determination unit 114 determines that a standby preparation completion notification (first stop preparation completion notification) transmitted from the communication-activated ECU has been received, the transmission unit 113 transmits information (second state notification) to notify that the communication-activated ECU has transitioned to a standby state.

[0089] For example, the second state notification is a state notification frame. Specifically, the second state notification is a state notification frame in which the activation state is set to "off" in the state information corresponding to the identification information of the target ECU (the ECU that transmitted the standby preparation completion notification). The transmitting unit 113 transmits such a state notification frame to all ECUs. When the standby preparation process of the ECU 340A is completed, the identification information of the ECU 340A is associated with the state information in which the activation state is "off" in the state notification frame. The transmitting unit 113 broadcasts the state notification frame, for example. This makes it possible to notify all ECUs of the ECU 340A that is in the standby state. Each ECU can identify the ECU 340A that is in the standby state by analyzing the state notification frame.

[0090] An ECU in an activated state (for example, ECU 330A) terminates the communication disruption determination process for the communication-activated ECU 340A that has completed the standby preparation process when it receives the state notification frame (second state notification) transmitted from the GW device 100. This allows the communication disruption determination process for the ECU 340A to be terminated at the timing when the ECU 340A transitions to the standby state.

[0091] The third determination unit 115 determines whether or not a boot completion notification (second boot completion notification) transmitted from a power-on ECU has been received by the receiving unit 111. That is, the third determination unit 115 determines whether or not the frame received by the receiving unit 111 is a boot completion notification (second boot completion notification) transmitted from a power-on ECU.

[0092] In a specific example, the third determination unit 115 analyzes a frame received by the receiving unit 111 and determines whether the frame is a startup completion notification transmitted from a power-on ECU. The third determination unit 115 checks the sender of the frame using the CAN ID of the received frame and determines whether the sender is a power-on ECU. The third determination unit 115 references information stored in the data field of the received frame and determines whether the frame is a startup completion notification. For example, when the startup of the ECU 310A is completed, a startup completion notification including the CAN ID of the ECU 310A and information indicating the startup completion is transmitted. The third determination unit 115 analyzes the startup completion notification to determine that the startup of the ECU 310A is completed.

[0093] When the third determination unit 115 determines that a startup completion notification (second startup completion notification) transmitted from a power-on ECU has been received, the transmission unit 113 transmits information (third state notification) to notify that the power-on ECU has transitioned to a startup state.

[0094] For example, the third state notification is a state notification frame. Specifically, the third state notification is a state notification frame in which the activation state is set to "ON" in the state information corresponding to the identification information of the target ECU (the ECU that transmitted the activation completion notification). The transmission unit 113 transmits such a state notification frame to all ECUs. When the activation of the ECU 310A is completed, the identification information of the ECU 310A is associated with the state information in which the activation state is "ON" in the state notification frame. The transmission unit 113 broadcasts the state notification frame, for example. This allows all ECUs to be notified that the ECU 310A is in the activated state. Each ECU can identify the ECU 310A in the activated state by analyzing the state notification frame.

[0095] When an ECU (e.g., ECU 330A) in an activated state different from a power-on ECU (e.g., ECU 310A) whose activation has been completed receives a state notification frame (third state notification) transmitted from the GW device 100, the ECU starts a communication disruption determination process for the power-on ECU 310A whose activation has been completed. The communication disruption determination process for the power-on ECU 310A is a process for determining whether a communication disruption has occurred in the communication-activated ECU 310A. In a specific example, the activated ECU 310A transmits a specific frame (second frame) at a specific cycle (second cycle). The specific frame (periodic frame) is, for example, a frame including the CAN ID of the ECU 310A. If the periodic frame from the ECU 310A reaches the ECU 330A, it can be determined that the communication between the ECU 330A and the ECU 310A has not been disrupted. The second cycle can be a cycle different from an integral multiple of the first cycle. The communication disruption determination process for the power-on type ECU 310A is the same as the communication disruption determination process for the communication-on type ECU 340A, except for the determination period.

[0096] The fourth determination unit 116 determines whether or not a shutdown preparation completion notification (second shutdown preparation completion notification) transmitted from a power-on ECU has been received by the receiving unit 111. That is, the fourth determination unit 116 determines whether or not the frame received by the receiving unit 111 is a shutdown preparation completion notification (second shutdown preparation completion notification) transmitted from a power-on ECU.

[0097] In a specific example, the fourth determination unit 116 analyzes a frame received by the receiving unit 111 and determines whether the frame is a shutdown preparation completion notification transmitted from a power-on ECU. The fourth determination unit 116 checks the sender of the received frame using the CAN ID of the frame and determines whether the sender is a power-on ECU. The fourth determination unit 116 references information stored in the data field of the received frame and determines whether the frame is a shutdown preparation completion notification. For example, when the shutdown preparation process of the ECU 310A is completed, a shutdown preparation completion notification including the CAN ID of the ECU 310A and information indicating the completion of shutdown preparation is transmitted. The fourth determination unit 116 analyzes the shutdown preparation completion notification to determine that the shutdown preparation process of the ECU 310A has been completed.

[0098] When the fourth determination unit 116 determines that a stop preparation completion notification (second stop preparation completion notification) transmitted from a power-start type ECU has been received, the transmission unit 113 transmits information (fourth state notification) to notify that the power-start type ECU has transitioned to a stopped state.

[0099] For example, the fourth state notification is a state notification frame. Specifically, the fourth state notification is a state notification frame in which the activation state is set to "off" in the state information corresponding to the identification information of the target ECU (the ECU that transmitted the stop preparation completion notification). The transmission unit 113 transmits such a state notification frame to all ECUs. When the stop preparation process of the ECU 310A is completed, the identification information of the ECU 310A is associated with the state information in which the activation state is set to "off" in the state notification frame. The transmission unit 113 broadcasts the state notification frame, for example. This allows all ECUs to be notified that the ECU 310A is in the stopped state. Each ECU can identify the ECU 310A in the stopped state by analyzing the state notification frame.

[0100] An ECU in an activated state (for example, ECU 330A) terminates the communication disruption determination process for the power-on ECU 310A for which the stop preparation process has been completed when receiving the state notification frame (fourth state notification) transmitted from the GW device 100. This allows the communication disruption determination process for the ECU 310A to be terminated at the timing when the ECU 310A transitions to the stopped state.

[0101] [5. Operation of in-vehicle systems] Next, the operation of the in-vehicle system 10 according to the embodiment will be described. Fig. 5 is a flowchart showing an example of state management processing in the GW device according to the embodiment. The processor 101 of the GW device 100 executes the following state management processing by the state management program 110.

[0102] The processor 101 determines whether the received frame is a boot completion notification (first boot completion notification, second boot completion notification) (step S101).

[0103] If the received frame is a startup completion notification (YES in step S101), the processor 101 transmits a state notification frame in which the startup state is set to "ON" in the state information corresponding to the identification information of the ECU for which the startup sequence has been completed (step S102). After transmitting the state notification frame, the processor 101 returns to step S101.

[0104] On the other hand, if the received frame is not a start-up completion notification (NO in step S101), the processor 101 determines whether the received frame is a standby preparation completion notification or a stop preparation completion notification (step S103). Note that, hereinafter, the standby preparation completion notification and the stop preparation completion notification are also collectively referred to as "stop preparation completion notification."

[0105] If the received frame is a shutdown preparation completion notification (YES in step S103), the processor 101 transmits a state notification frame in which the startup state is set to "OFF" in the state information corresponding to the identification information of the ECU for which the standby preparation process or the shutdown preparation process has been completed (step S104). After transmitting the state notification frame, the processor 101 returns to step S101.

[0106] On the other hand, if the received frame is not a shutdown preparation completion notification (NO in step S103), the processor 101 returns to step S101.

[0107] The operation of the in-vehicle system 10 will be described below using a specific example. Fig. 6 is a sequence diagram for explaining an example of the state management operation for a power-on type ECU in the in-vehicle system according to the embodiment.

[0108] When switch 210 is pressed and a switch signal (ACC signal, IG signal, +B signal) is output, power management device 200 detects the output of the switch signal. Power management device 200 switches on relays 460A, 460B, 460C, 460D corresponding to the detected switch signal (step S1).

[0109] For example, when relay 460A is switched on, power-on type ECU 310A is started (step S2). When the start-up sequence is completed, ECU 310A transmits a start-up completion notice (second start-up completion notice) (step S3).

[0110] The processor 101 of the GW device 100 determines whether the received frame is a startup completion notification.

[0111] If the received frame is a startup completion notification, processor 101 broadcasts a state notification frame in which the startup state is set to "ON" in the state information corresponding to the identification information of ECU 310A whose startup sequence has been completed (step S4).

[0112] The transmitted state notification frame is received by ECU 330A, which monitors the communication state. ECU 330A is an example of a "second in-vehicle device." By receiving the state notification frame, ECU 330A, which monitors the communication state, recognizes that the ECU to be monitored is in an activated state, and starts a communication disruption determination process (step S5). In the communication disruption determination process, ECU 330A receives a periodic frame from ECU 310A, which is the target of monitoring, and determines whether communication for ECU 310A has been disrupted.

[0113] When switch 210 is pressed and a switch signal is output, power management device 200 detects the output of the switch signal. For example, when a switch signal instructing a transition to +B is detected, power management device 200 transmits a shutdown preparation instruction frame to power startup type ECU 310A (step S6). The instruction frame is relayed from bus 250C to bus 250A by GW device 100.

[0114] When ECU 310A receives the instruction frame for stop preparation, it executes a stop preparation process (step S7). When ECU 310A completes the stop preparation process, it transmits a stop preparation completion notification (step S8).

[0115] The processor 101 of the GW device 100 determines whether the received frame is a stop preparation completion notification.

[0116] If the received frame is a shutdown preparation completion notification, processor 101 broadcasts a state notification frame in which the activation state is set to "OFF" in the state information corresponding to the identification information of ECU 310A for which the shutdown preparation process has been completed (step S9).

[0117] The transmitted state notification frame is received by power management device 200. Power management device 200 recognizes from the state notification frame that preparation for stopping ECU 310A has been completed, and turns off relay 460A (step S10). As a result, ECU 310A transitions to a stopped state (step S11).

[0118] The transmitted state notification frame is also received by ECU 330A, which monitors the communication state. Upon receiving the state notification frame, ECU 330A, which monitors the communication state, recognizes that the ECU to be monitored is in a stopped state (or that the stop preparation process has been completed), and ends the communication disruption determination process (step S5).

[0119] FIG. 7 is a sequence diagram for explaining an example of a state management operation for a communication-activated ECU in the in-vehicle system according to the embodiment.

[0120] When a service activation trigger is detected (step S21), such as a user inputting an instruction to start execution of a specific service into an input device, or a sensor outputting a detection signal of a specific state, the communication-activated ECU transmits an NM frame (step S22). Here, it is assumed that ECU 340B has transmitted an NM frame specifying the PNC to which ECU 340A belongs. The NM frame is transmitted through bus 250B to which ECU 340B is connected, and GW device 100 relays the NM frame to bus 250A to which ECU 340A is connected.

[0121] When the communication startup ECU 340A receives the NM frame, the ECU 340A starts up (wakes up) (step S23). When the startup sequence is completed, the ECU 340A transmits a startup completion notification (first startup completion notification) (step S24).

[0122] The processor 101 of the GW device 100 determines whether the received frame is a startup completion notification.

[0123] If the received frame is a startup completion notification, processor 101 broadcasts a state notification frame in which the startup state is set to "ON" in the state information corresponding to the identification information of ECU 340A whose startup sequence has been completed (step S25).

[0124] The transmitted state notification frame is received by the ECU 330A that monitors the communication state. By receiving the state notification frame, the ECU 330A that monitors the communication state recognizes that the ECU to be monitored is in an activated state, and starts a communication disruption determination process (step S26). In the communication disruption determination process, the ECU 330A receives a periodic frame from the ECU 340A that is to be monitored, and determines whether communication for the ECU 340A has been disrupted.

[0125] When a cause for waiting for a service is detected (step S27), such as a user inputting an instruction to end a specific service to an input device or a sensor outputting a detection signal of a specific state, the ECU 340B transmits a standby instruction frame (step S28). The GW device 100 relays the standby instruction frame from the bus 250B to the bus 250A.

[0126] When receiving the standby instruction frame, ECU 340A executes standby preparation processing (step S29). When the standby preparation processing is completed, ECU 340A transmits a standby preparation completion notification (step S30).

[0127] The processor 101 of the GW device 100 determines whether the received frame is a standby preparation completion notification.

[0128] If the received frame is a standby preparation completion notification, processor 101 broadcasts a state notification frame in which the activation state is set to "OFF" in the state information corresponding to the identification information of ECU 340A that has completed the standby preparation process (step S31).

[0129] When ECU 340A transmits the standby preparation completion notification, it immediately transitions to a standby state (step S32).

[0130] The transmitted state notification frame is received by ECU 330A, which monitors the communication state. Upon receiving the state notification frame, ECU 330A, which monitors the communication state, recognizes that the ECU to be monitored is in a standby state (or that the standby preparation process has been completed), and ends the communication disruption determination process (step S32).

[0131] [6. Modifications] In the above-described embodiment, the in-vehicle network 250 is configured using a CAN network, but is not limited to this. The in-vehicle network 250 may be compatible with communication protocols such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark). The in-vehicle network 250 may include both a CAN network and a network compatible with the above communication protocols. In this case, the GW device 100 may have a protocol conversion function between CAN and the above communication protocols.

[0132] [7. Supplementary Notes] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is defined by the claims rather than the above-described embodiments, and includes meanings equivalent to the claims and all modifications within the scope thereof. [Explanation of symbols]

[0133] 10 In-Vehicle Systems 100 Gateway device (GW device, status management device) 101 processors 102 Non-volatile memory 103 Volatile Memory 104 Relay Circuit 105A, 105B, 105C Interface (I / F) 110 Condition Management Program 111 Receiving unit 112 1st Judgment Department 113 Transmitter 114 Second Judgment Department 115 Third Judgment Department 116 4th Judgment Section 200 Power management device 210 Switch 250 In-Vehicle Network 250A, 250B, 250C buses 310A, 310B, 320A, 320B ECU (3rd in-vehicle device) 330A, 330B ECU (2nd in-vehicle device) 340A, 340B ECU (1st in-vehicle device) 410 Auxiliary Battery 420 High Voltage Battery 430 DC / DC Converter 450,451A,451B,451C,451D,451E,451F Power line 460A, 460B, 460C, 460D Relays 470A, 470B signal line

Claims

1. a first in-vehicle device that transitions from a standby state to an active state upon receiving a frame; a second in-vehicle device capable of communicating with the first in-vehicle device; a state management device capable of communicating with the first in-vehicle device and the second in-vehicle device; Equipped with the first in-vehicle device transmits a first startup completion notification when the first in-vehicle device transitions from the standby state to the startup state; The state management device a first determination unit that determines whether the first boot completion notification transmitted from the first in-vehicle device has been received; a transmitter that transmits a first status notification when the first determination unit determines that the first startup completion notification has been received; Including, the second in-vehicle device starts a first communication disruption determination process for determining whether a communication disruption has occurred in the first in-vehicle device when the second in-vehicle device receives the first status notification transmitted from the status management device. In-vehicle systems.

2. the first in-vehicle device transmits a first stop preparation completion notification when the first in-vehicle device transitions from the activated state to the standby state; The state management device a second determination unit that determines whether the first stop preparation completion notification transmitted from the first in-vehicle device has been received; further comprising the transmission unit transmits a second status notification different from the first status notification when the second determination unit determines that the first stop preparation completion notification has been received; the second in-vehicle device terminates the first communication disruption determination process when receiving the second status notification transmitted from the status management device. The in-vehicle system according to claim 1 .

3. the state management device transmits a state notification frame including state information of a plurality of in-vehicle devices; the first status notification is the status notification frame including the status information indicating that the first in-vehicle device is in the activated status, the second status notification is the status notification frame including the status information indicating that the first in-vehicle device is in the standby status; The in-vehicle system according to claim 2 .

4. the in-vehicle system further includes a third in-vehicle device that is capable of communicating with both the second in-vehicle device and the state management device and that transitions from a stopped state to an activated state upon application of power from a power source; the third in-vehicle device transmits a second startup completion notification when the third in-vehicle device transitions from the stopped state to the started state; The state management device a third determination unit that determines whether the second boot completion notification transmitted from the third in-vehicle device has been received; further comprising the transmission unit transmits a third status notification different from the first status notification when the third determination unit determines that the second startup completion notification has been received; the second in-vehicle device starts a second communication disruption determination process for determining whether a communication disruption has occurred in the third in-vehicle device when the second in-vehicle device receives the third state notification transmitted from the state management device. The in-vehicle system according to claim 1 .

5. the third in-vehicle device transmits a second stop preparation completion notification when the third in-vehicle device transitions from the activated state to the stopped state; The state management device a fourth determination unit that determines whether the second stop preparation completion notification transmitted from the third in-vehicle device has been received; further comprising the transmission unit transmits a fourth status notification different from the first status notification and the third status notification when the fourth determination unit determines that the second stop preparation completion notification has been received; the second in-vehicle device terminates the second communication disruption determination process when receiving the fourth state notification transmitted from the state management device. The in-vehicle system according to claim 4 .

6. the state management device transmits a state notification frame including state information of a plurality of in-vehicle devices; the first status notification is the status notification frame including the status information indicating that the first in-vehicle device is in the activated status, the third status notification is the status notification frame including the status information indicating that the third in-vehicle device is in the activated status, the fourth status notification is the status notification frame including the status information indicating that the third in-vehicle device is in the stopped state; The in-vehicle system according to claim 5 .

7. the first in-vehicle device transmits a specific first frame at a first period in the activated state; the first communication disruption determination is a process of determining whether the first frame has been received at a period corresponding to the first period; The in-vehicle system according to any one of claims 1 to 6.

8. the third in-vehicle device transmits a specific second frame at a second period in the activated state; The second communication disruption determination is a process of determining whether the second frame has been received at a period corresponding to the second period. The in-vehicle system according to any one of claims 4 to 6.

9. a first determination unit that determines whether or not the first startup completion notification transmitted from the first in-vehicle device that transitions from a standby state to an activated state upon receiving a frame has been received; a first transmitting unit that transmits a first status notification that triggers a second in-vehicle device that can communicate with the first in-vehicle device to start a first communication disruption determination process in which the second in-vehicle device determines whether a communication disruption has occurred in the first in-vehicle device when the first determining unit determines that the first startup completion notification has been received; Equipped with Status management device.

10. a step of transmitting a first startup completion notification when a first in-vehicle device that transitions from a standby state to an active state in response to reception of a frame has transitioned from the standby state to the active state; a state management device capable of communicating with the first in-vehicle device and a second in-vehicle device capable of communicating with the first in-vehicle device determining whether or not the first boot completion notification transmitted from the first in-vehicle device has been received; transmitting a first status notification when the state management device determines that the first boot completion notification has been received; a step of starting a first communication disruption determination process in which the second in-vehicle device determines whether a communication disruption has occurred in the first in-vehicle device when the second in-vehicle device receives the first status notification transmitted from the status management device; Including, Control method.

Images