Abnormality monitoring system and abnormality monitoring method

Abstract

To appropriately cope with abnormality in a system.SOLUTION: The abnormality monitoring system includes a sub unit that monitors operation states of a plurality of power-supply activation ECUs, and a main unit that monitors operation states of a plurality of communication activation ECUs, wherein a monitoring target of the sub unit includes an event related to an abnormality that can be detected by the power-supply activation ECU, and a monitoring target of the main unit includes an event related to an abnormality that can be detected by the communication activation ECU. The main unit executes a process of determining the presence or absence of an abnormality in the system based on a monitoring result of the main unit and a monitoring result notified from the subunit, and a process of distributing the determined event to a communication node in the system when a determination result is affirmative. 1ECU: An ECU that operates or stops in accordance with the status of the power source system. First 2ECU: An ECU that operates or stops in accordance with the management communication.SELECTED DRAWING: Figure 1A

Description

[Technical Field]

[0001] The present disclosure relates to an abnormality monitoring system and an abnormality monitoring method. [Background technology]

[0002] Patent document 1 describes an in-vehicle network system that includes a power supply, a host ECU (Electronic Control Unit), an intermediate ECU having a network management function (hereinafter referred to as "NM function") that communicates with the host ECU, and multiple lower ECUs having NM functions that communicate with the intermediate ECU.

[0003] In Patent Document 1, the intermediate ECU supplies power to the subordinate ECU in response to receiving a message from the superior ECU. The subordinate ECU normally maintains a power-off state, and transitions to a communication standby state when power is supplied from the intermediate ECU. In this way, since the lower ECU having the NM function maintains the power supply cut-off state during normal operation, the standby power consumption of the lower ECU in the system can be reduced. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-11228 Summary of the Invention [Problem to be solved by the invention]

[0005] According to Patent Document 1, since the lower ECU can be started by management communication based on the NM function, it is possible to reduce the number of wires in the system and the number of relays. However, Patent Document 1 does not consider how to best respond to abnormalities in each ECU in a system that mixes normal ECUs that start up depending on the status of the power supply system and ECUs that start up through management communication based on the NM function.

[0006] In view of the above-described conventional problems, the present disclosure has an object to appropriately respond to abnormalities in an in-vehicle communication system that includes multiple types of ECUs with different activation conditions. [Means for solving the problem]

[0007] A system according to one embodiment of the present disclosure is an abnormality monitoring system comprising a sub-unit that monitors the operating status of a plurality of power startup ECUs as described below, and a main unit that monitors the operating status of a plurality of communication startup ECUs as described below, wherein the objects monitored by the sub-unit include events related to abnormalities that can be detected by the power startup ECUs, and the objects monitored by the main unit include events related to abnormalities that can be detected by the communication startup ECUs.

[0008] In addition, the main unit performs the following processes: determining whether or not there is an abnormality in the system based on its own monitoring results and the monitoring results notified from the sub-unit; and, if the determination result is positive, distributing the determined event to communication nodes in the system. First ECU: An ECU that operates or stops depending on the status of the power supply system Second ECU: An ECU that operates or stops according to management communication

[0009] The present disclosure can be realized not only as a system or device having the above-described characteristic configuration, but also as a program for causing a computer to execute such characteristic configuration. Furthermore, the present disclosure can be realized as a semiconductor integrated circuit that realizes part or all of the device and system. [Effects of the Invention]

[0010] According to the present disclosure, in an in-vehicle communication system including a plurality of types of ECUs with different activation conditions, it is possible to appropriately respond to an abnormality in the system. [Brief explanation of the drawings]

[0011] [Figure 1A]FIG. 1A is the upper part of a network connection diagram of an anomaly monitoring system. [Figure 1B] FIG. 1B is the lower part of the network connection diagram of the anomaly monitoring system. [Figure 2] FIG. 2 is a sequence diagram illustrating an example of an abnormality monitoring process. DETAILED DESCRIPTION OF THE INVENTION

[0012] <Summary of Embodiments of the Present Disclosure> The following provides an outline of embodiments of the present disclosure.

[0013] (1) A system according to one aspect of this embodiment is an abnormality monitoring system including a sub-unit that monitors the operating status of a plurality of power startup ECUs as described below, and a main unit that monitors the operating status of a plurality of communication startup ECUs as described below, wherein the objects monitored by the sub-unit include events related to abnormalities that can be detected by the power startup ECUs, and the objects monitored by the main unit include events related to abnormalities that can be detected by the communication startup ECUs.

[0014] In addition, the main unit performs the following processes: determining whether or not there is an abnormality in the system based on its own monitoring results and the monitoring results notified from the sub-unit; and, if the determination result is positive, distributing the determined event to communication nodes in the system. First ECU: An ECU that operates or stops depending on the status of the power supply system Second ECU: An ECU that operates or stops according to management communication

[0015] According to the abnormality monitoring system of this embodiment, the main unit distributes the determined event to communication nodes within the system, so that, for example, the first ECU or second ECU that receives the distribution can immediately prevent the continuation of control involving the ECU in which the abnormality occurred by suspending cooperative control with the ECU related to the event. Therefore, in an in-vehicle communication system including a first ECU and a second ECU whose operating states are affected by different factors, it is possible to appropriately respond to an abnormality in the system.

[0016] (2) In the abnormality monitoring system of (1) above, the plurality of power startup ECUs may include an ECU that is the monitoring target of the sub-unit and an ECU that is the monitoring target of the main unit. In this case, the power startup ECU can be monitored in a distributed manner by both the main unit and the sub-unit.

[0017] (3) In the abnormality monitoring system of (1) or (2) described above, a power system that supplies power to the power startup ECU and the communication startup ECU may be further provided, and the monitoring targets of the main unit and the sub-unit may include events related to abnormalities in the power system. In this way, events relating to abnormalities in the power supply system can also be distributed to communication nodes within the system.

[0018] (4) In the abnormality monitoring systems described above in (1) to (3), the objects monitored by the main unit may include events related to abnormalities in its own in-vehicle communication unit, and the objects monitored by the sub-unit may include events related to abnormalities in its own in-vehicle communication unit. In this way, events relating to abnormalities in the in-vehicle communication unit of the main unit and the in-vehicle communication unit of the sub-unit can also be distributed to communication nodes within the system.

[0019] (5) A method according to one aspect of this embodiment is an abnormality monitoring method executed in the abnormality monitoring system described above in (1) to (4). Therefore, the abnormality monitoring method of this embodiment has the same effects as the abnormality monitoring system described above in (1) to (4).

[0020] <Details of the embodiment of the present disclosure> DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. At least some of the following preferred embodiments may be combined in any desired manner.

[0021] [Overall system configuration] FIG. 1A is the upper part of a network connection diagram of an anomaly monitoring system 100. FIG. FIG. 1B is the lower part of the network connection diagram of the anomaly monitoring system 100. Specifically, when Figures 1A and 1B are connected at connection points A, B, and C, a network connection diagram is obtained showing an example of the overall configuration of an abnormality monitoring system 100 and a power supply system 200 mounted on a vehicle 300. Note that solid lines in the diagram represent "communication lines" and dashed lines represent "power lines." Also, blank square dots in Figure 1 represent "relays."

[0022] As shown in FIGS. 1A and 1B (hereinafter abbreviated as "FIG. 1"), a vehicle 300 is equipped with an abnormality monitoring system 100, a power supply system 200, and a switch 80. The abnormality monitoring system 100 includes a main unit 10, a plurality of sub-units 20 and 30, a service unit 40, a plurality of types of ECUs 50 and 60 with different activation conditions, and a TCU (Telematics Control Unit) .

[0023] The abnormality monitoring system 100 of this embodiment includes a CAN (Controller Area Network) network having a bus-type network topology. The CAN network includes a plurality of CAN buses B1, B2, B3, and B4 connected to the respective units 10, 20, 30, and 40. A plurality of ECUs 50 and 60 are connected to the CAN bus B1 of the main unit 10.

[0024] A plurality of ECUs 50 and 60 are connected to the CAN bus B2 of the subunit 20, and a plurality of ECUs 50 and 60 are also connected to the CAN bus B3 of the subunit 30. A plurality of ECUs 50, 60 and a TCU 70 are connected to the CAN bus B4 of the service unit 40. Each of the ECUs 50, 60 is provided with a CAN interface that enables CAN communication.

[0025] The TCU 70 includes a CAN interface that is a type of in-vehicle communication unit and is capable of CAN communication, and a wireless interface for communication outside the vehicle. The wireless interface protocol may be, for example, at least one of LTE (Long Term Evolution), 5G (5th Generation Mobile Communication System), DSRC (Dedicated Short-Range Communications), Wi-Fi (registered trademark), and the like.

[0026] A communication protocol capable of transmitting and receiving periodic or non-periodic messages is adopted for each of the units 10, 20, 30, 40, the plurality of ECUs 50, 60, and the TCU 70. The communication protocol is, for example, CAN or CAN with Flexible Data Rate (CAN FD). The main unit 10 has a relay function between the CAN buses B1, B2, B3, and B4. That is, the CAN buses B2, B3, and B4 are also connected to the main unit 10, and the main unit 10 can relay a CAN message sent to any of the CAN buses B1, B2, B3, and B4 to the other CAN buses.

[0027] The ECUs 50, 60 belong to systems such as a control system relating to the engine and transmission, a body system relating to headlights and power windows, and an information system relating to car navigation and multimedia, and are disposed in various parts of the vehicle. The multiple ECUs 50, 60 individually control actuators in various parts of the vehicle, and generate measurement data (such as temperature, speed, acceleration, or digital images) from signals received from sensors in various parts of the vehicle.

[0028] The plurality of ECUs 50, 60 include the following "first ECU 50" and "second ECU 60" which have different activation conditions. The first ECU 50 is an ECU that does not have an NM function, so it operates or stops depending on the power source and can detect abnormalities related to its own device. The first ECU 50 is also called a "power startup ECU." The operating state of the first ECU 50 can be either "operating" (on) or "stopped" (off), depending on whether or not power is supplied from the power supply system 200.

[0029] The second ECU 60 is an ECU that has an NM function and operates or stops through communication, and can detect abnormalities related to its own device. The second ECU 60 is also called a "communication-activated ECU." The operating state of the second ECU 60 can be either "operating" (on) or "standby" (sleep) depending on management communication using NM messages.

[0030] In this embodiment, each of the units 10, 20, 30, and 40 is a type of communication-activated ECU with an NM function, and the main unit 10 monitors the operating states of all of the second ECUs 60 in the system. The multiple first ECUs 50 in the system are divided into the following types depending on which units 10, 20, and 30 monitor them: First ECU 50A: First ECU 50 monitored by main unit 10 First ECU 50B: First ECU 50 monitored by sub-unit 20 First ECU 50C: First ECU 50 monitored by sub-unit 30

[0031] The ECUs 50 and 60 have the function of providing services to the vehicle user. One service can be provided by one or more ECUs 50 and 60. For example, a service such as "autonomous driving" performed on a manned vehicle 300 is provided by an ECU group including at least one first ECU 50. Also, a service such as "smart entry" performed on an unmanned parked vehicle 300 is provided by an ECU group including at least one second ECU 60.

[0032] [Overall configuration of power supply system] 1, the power supply system 200 includes a high-voltage battery 110, a DC / DC converter 120, an auxiliary battery 130, and power controllers 140, 150, and 160. The high-voltage battery 110 has an output voltage of, for example, 400 V and is used for vehicle running. The DC / DC converter 120 is connected to the high voltage battery 110 and reduces the output voltage of the high voltage battery 110 to 12 V. The auxiliary battery 130 is a battery with an output voltage of 12 V, for example, and is used to drive the auxiliary devices in the vehicle 300.

[0033] In this embodiment, the multiple power controllers 140, 150, and 160 include, for example, the following controllers. Main controller 140: Power controller mounted on main unit 10 Sub-controller 150: Power controller installed in sub-unit 20 Sub-controller 160: Power controller installed in the sub-unit 30

[0034] The main controller 140 is configured by a switching circuit including a plurality of power semiconductors, and controls the opening and closing of relays R11, R12, and R13. The relay R11 is a relay that switches on and off the power supply from the DC / DC converter 120 and the auxiliary battery 130. The relay R12 is a relay that switches on and off the power distribution to the sub-controllers 150 and 160. The relay R13 is a relay that switches on and off the power distribution to the first ECUs 50A (three in the illustrated example) connected to the CAN buses B1 and B4.

[0035] The power line on the output side of DC / DC converter 120 and the power line of auxiliary battery 130 are electrically connected downstream of relay R11. Therefore, the output power of the DC / DC converter 120 can be used not only to power the sub-units 20 and 30 and the first ECU 50 but also to charge the auxiliary battery 130.

[0036] The sub-controller 150 is configured with a switching circuit including multiple power semiconductors, and controls the opening and closing of a relay R21. The relay R21 is a relay that opens and closes the power distribution to the first ECU 50B (two in the illustrated example) connected to the CAN bus B2. The sub-controller 160 is configured with a switching circuit including multiple power semiconductors and controls the opening and closing of a relay R31. The relay R31 is a relay that opens and closes the power distribution to the first ECU 50C (two in the example) connected to the CAN bus B3.

[0037] Each of the controllers 140, 150, and 160 is connected to a switch 80 provided on the dashboard or the like of the vehicle 300. The switch 80 is a switch that switches the status of the power supply system 200, and is formed, for example, by a push switch. The state transition of the power supply system 200 due to switch operation is, for example, as follows. Transition 1: Switch operation on +B → Power status changes to ACC Transition 2: Switch operation in ACC → Power status changes to IG Transition 3: Switch operation in IG → Power status changes to +B

[0038] Each of the controllers 140, 150, and 160 performs power control to switch the status of the power supply system 200 in response to a switch operation. Specifically, when the controllers 140, 150, and 160 detect a switch operation at +B, they switch the relays R11, R12, R13, R21, and R31 between open and closed states so as to achieve transition 1.

[0039] Similarly, when the controllers 140, 150, and 160 receive a switch operation in the ACC, they switch the relays R11, R12, R13, R21, and R31 between open and closed states to achieve transition 2. Similarly, when the controllers 140, 150, and 160 receive a switch operation at the IG, they switch the relays R11, R12, R13, R21, and R31 between open and closed states so as to achieve transition 3.

[0040] The power supply system 200 has a power supply line 170 that constantly supplies power to the second ECU 60. The power supply line 170 is made up of a power line that is connected to at least one of the DC / DC converter 120 and the auxiliary battery 130 without passing through a relay. The power supply line 170 branches off midway, and the branched ends are connected to the plurality of second ECUs 60 connected to the CAN buses B1, B2, B3, and B4, respectively.

[0041] 1, the second ECU 60 having the NM function may be connected to a power line whose power supply status is controlled by the controllers 140, 150, and 160. In this case, the second ECU 60 stops when power is no longer supplied from the power line. On the other hand, the first ECU 50 is not connected to the continuous power supply line 170. This is because the first ECU 50 does not have a sleep function based on communication and should not be connected to the continuous power supply line 170.

[0042] [Internal structure of the main unit] As shown in FIG. 1, the main unit 10 includes a processor 11, a storage 12, and a CAN interface 13 in addition to the main controller 140 described above. The processor 11 is configured by, for example, one or more CPUs (Central Processing Units), and is capable of executing computer programs stored in the storage 12. The computer programs include a program for realizing event determination (step S15 in FIG. 2), which will be described later.

[0043] The processor 11 may be an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), etc. In this case, the ASIC or FPGA is configured to be able to execute functions realized by a computer program. The storage 12 is a non-volatile memory such as a flash memory, a hard disk, or a ROM (Read Only Memory), etc. The storage 12 stores computer programs executed by the processor 11 and data required for the execution of the programs.

[0044] The CAN interface 13 is a communication module that complies with the CAN, which is a type of in-vehicle communication unit. The CAN interface 13 has a plurality of CAN ports, each of which is connected to a CAN bus B1, B2, B3, or B4. The processor 11 has a function of relaying CAN messages. Specifically, the processor 11 determines to which of the CAN buses B1, B2, B3, and B4 a received message should be transferred based on the CAN ID included in the received message.

[0045] When the processor 11 receives a CAN message addressed to itself, it uses the data contained in the message for predetermined processing including event determination (step S15 in FIG. 2) to be described later. When the processor 11 generates data to be provided to an external device such as a server of a vehicle manufacturer or a user's mobile terminal, the processor 11 outputs a CAN message including the data to the CAN interface 13 and addressed to the TCU 70 .

[0046] [Internal structure of the subunit] As shown in FIG. 1, the subunit 20 includes a processor 21 and a CAN interface 22 in addition to the subcontroller 150 described above. The processor 21 is configured by, for example, one or more CPUs and is capable of executing computer programs stored in storage (not shown). The computer programs include a program for realizing information collection (step S12 in FIG. 2) described below.

[0047] The CAN interface 22 is a communication module that conforms to the CAN, which is a type of in-vehicle communication unit. The CAN interface 22 is connected to a CAN bus B2, whose subordinate communication nodes are the first ECU 50B and the second ECU 60.

[0048] As shown in FIG. 1, the subunit 30 includes a processor 31 and a CAN interface 32 in addition to the subcontroller 160 described above. The processor 31 is configured by, for example, one or more CPUs and is capable of executing computer programs stored in storage (not shown). The computer programs include a program for realizing information collection (step S13 in FIG. 2) described below.

[0049] The CAN interface 32 is a communication module that conforms to the CAN, which is a type of in-vehicle communication unit. The CAN interface 32 is connected to a CAN bus B3, which has the first ECU 50 and the second ECU 60 as its subordinate communication nodes.

[0050] [Internal structure of the service unit] As shown in FIG. 1, the service unit 40 includes a processor 41 and a CAN interface 42 . The processor 41 is configured with, for example, one or more CPUs and is capable of executing computer programs stored in storage (not shown). The computer programs include a program for realizing an external notification (step S18 in FIG. 2) to notify the onboard diagnostic results, which will be described later.

[0051] The CAN interface 42 is a communication module that complies with the CAN, which is a type of in-vehicle communication unit. The CAN interface 42 is connected to a CAN bus B4, which has the first ECU 50, the second ECU 60, and the TCU 70 as its subordinate communication nodes.

[0052] [Type of abnormal event] As shown in Figure 1, each communication node 10, 20, 30, 50, and 60 included in the abnormality monitoring system 100 can diagnose the presence or absence of the following events E1, E2, E3, E4, E5, E6, E7, and E8 as types of events related to abnormalities in the power supply system 200 or communication interface, etc.

[0053] Event E1: An event related to an abnormality in the power supply system 200 monitored by the main unit 10. The main controller 140 is the entity that detects event E1. Event E1 includes a short circuit, an open circuit, or a disconnection of the power line due to a failure of relays R11, R12, or R13, etc. Event E1 also includes overheating and overcurrent detected by a temperature sensor or a current sensor provided in the main unit 10. When the main controller 140 detects event E1, it notifies the processor 11 of the detection result.

[0054] Event E2: This is an event related to an abnormality in CAN communication in the main unit 10. The event E2 is detected by the processor 11. Event E2 includes a failure of the CAN interface 13, an abnormality in a message received from the CAN buses B1 and B4, a communication failure that can be assumed to be caused by a break in the CAN buses B1 and B3, and the like.

[0055] Event E3: An event related to an abnormality in the power supply system 200 monitored by the subunit 20. The event E3 is detected by the subcontroller 150. Event E3 includes a short circuit, an open circuit, or a disconnection of the power line due to a failure of relay R21, etc. Event E3 also includes overheating or overcurrent detected by a temperature sensor or a current sensor provided in subunit 20. When subcontroller 150 detects event E3, it notifies processor 21 of the detection result.

[0056] Event E4: This is an event related to an abnormality in CAN communication in the subunit 20. The event E4 is detected by the processor 21. Event E4 includes a failure of the CAN interface 22, an abnormality in a message received from the CAN bus B2, a communication failure that can be assumed to be caused by a break in the CAN bus B2, and the like.

[0057] Event E5: This is an event related to an abnormality in the power supply system 200 monitored by the subunit 30. The event E5 is detected by the subcontroller 160. Event E5 includes a short circuit, an open circuit, or a disconnection of the power line due to a failure of relay R31, etc. Event E5 also includes overheating or overcurrent detected by a temperature sensor or a current sensor provided in subunit 30. When subcontroller 160 detects event E5, it notifies processor 31 of the detection result.

[0058] Event E6: This is an event related to an abnormality in CAN communication in the subunit 30. The controller 21 is the entity that detects event E6. Event E6 includes a failure of the CAN interface 32, an abnormality in a message received from the CAN bus B3, a communication failure that can be assumed to be caused by a break in the CAN bus B3, and the like.

[0059] Event E7: An event related to an abnormality that can be detected by the first ECU 50. Event E7 includes a failure of the CAN interface of the first ECU 50, a failure of a sensor or actuator controlled by the first ECU 50, overheating or overcurrent inside the ECU, and the like. When the first ECU 50 detects the event E7, the first ECU 50 includes the content of the detected event E7 in, for example, a response message of the operating state.

[0060] Event E8: This is an event related to an abnormality that can be detected by the second ECU 60. Event E8 includes a failure of the CAN interface of the second ECU 60, a failure of a sensor or actuator controlled by the second ECU 60, overheating or overcurrent inside the ECU, an abnormality in the NM function (for example, inability to sleep or wake), and the like. When the second ECU 60 detects the event E8, the second ECU 60 includes the detected event E6 in the response message of the operating state.

[0061] [Contents of abnormality monitoring process] FIG. 2 is a sequence diagram showing an example of an abnormality monitoring process executed in the abnormality monitoring system 100. As shown in FIG.

[0062] 2 is a trigger that instructs each of the units 10, 20, and 30 to collect information on the operating state. An example of the trigger T is the reception of a UDS (Unified Diagnostic Services) message sent from an external device. The external device may be, for example, a server of the vehicle manufacturer, a mobile terminal of the user, or a diagnostic tool connected to the service unit 40. However, the trigger T may also be, for example, the passage of a predetermined period (for example, one hour).

[0063] In the following description, each process that is executed by the main unit 10 or the sub-units 20 and 30 is actually executed by the processors 11, 21 and 31 of the main unit 10 or the sub-units 20 and 30.

[0064] As shown in FIG. 2, when the main unit 10 detects the trigger T, it executes "information collection" (step S11). This process is a process in which the main unit 10 collects monitoring results, such as whether or not events E1, E2, E7, and E8 have occurred, from the monitoring targets of its own device.

[0065] Specifically, the main unit 10 causes its own main controller 140 to diagnose whether or not the event E1 has occurred, and obtains the diagnosis result from the main controller 140. The main unit 10 checks the communication state in the CAN interface 13 to see if an event E2 has occurred.

[0066] The main unit 10 transmits a request message for the operating state to the first ECU 50A, and checks whether the response message from the first ECU 50A includes the event E7. The main unit 10 transmits a request message for the operating state to the second ECU 60, and checks whether the response message from the second ECU 60 includes the event E8.

[0067] As shown in FIG. 2, when the subunit 20 detects the trigger T, it executes "information collection" (step S12). This process is a process in which the subunit 20 collects monitoring results such as the presence or absence of events E3, E4, and E7 from the monitoring targets of its own device.

[0068] Specifically, the subunit 20 causes its own subcontroller 150 to diagnose whether or not the event E3 has occurred, and obtains the diagnosis result from the subcontroller 150. The subunit 20 checks the communication state in the CAN interface 22 to see if an event E4 has occurred.

[0069] The subunit 20 transmits a request message for the operating state to the first ECU 50B, and checks whether the response message from the first ECU 50B includes the event E7. The subunit 20 notifies the main unit 10 of the collected information (step S13). Therefore, if an abnormality such as events E3, E4, or E7 occurs in the object monitored by the subunit 20, the details of the abnormality are communicated to the main unit 10.

[0070] As shown in FIG. 2, when the subunit 30 detects the trigger T, it executes "information collection" (step S14). This process is a process in which the subunit 30 collects monitoring results, such as whether or not events E5, E6, and E7 have occurred, from the monitoring targets of its own device.

[0071] Specifically, the subunit 30 causes its own subcontroller 160 to diagnose whether or not the event E5 has occurred, and obtains the diagnosis result from the subcontroller 160. The subunit 30 checks the communication state in the CAN interface 32 to see if an event E6 has occurred.

[0072] The subunit 30 transmits a request message for the operating state to the first ECU 50C, and checks whether the response message from the first ECU 50C includes the event E7. The subunit 30 notifies the main unit 10 of the collected monitoring results (step S15). Therefore, if an abnormality such as events E5, E6, or E7 occurs in the object monitored by the subunit 30, the details of the abnormality are communicated to the main unit 10.

[0073] Next, the main unit 10 executes "information recording" (step S16). This process is a process of storing the monitoring results of the subunit itself and the monitoring results notified from the subunits 20 and 30 in the storage 12 together with the monitoring time. Next, the main unit 10 determines whether its own monitoring results and the monitoring results notified from the sub-units 20 and 30 include event Ei (i = 1 to 8) (step S17), and if the determination result is positive, performs "information distribution" (step S18).

[0074] This process involves sending a warning message W containing the details of the abnormal event that has occurred (for example, event E7) and related information (for example, CAN ID) to communication nodes within the system (subunits 20, 30, first and second ECUs 50, 60, and service unit 40).

[0075] Upon receiving the warning message W, the service unit 40 executes "external notification" (step S19). This process is a process of generating an external message (not shown) including the notified event E7 and related information, and transmitting the generated external message to the above-mentioned external device such as the vehicle manufacturer's server.

[0076] Upon receiving the warning message W, the first ECU 50 and the second ECU 60 execute a "process for stopping associated control" (step S20). This process is to temporarily stop the cooperative control with the CAN ID of the notified event E7, for example, thereby preventing the continuation of the control related to the ECU in which the abnormality occurred.

[0077] [Other Modifications] The embodiments disclosed herein are illustrative in all respects and are not restrictive. The scope of the present invention is defined by the claims rather than the above-described embodiments, and includes meanings equivalent to the claims and all modifications within the scope thereof.

[0078] In the above embodiment, the network of the anomaly monitoring system 100 is a CAN network, but the network may also be an Ethernet network ("Ethernet" is a registered trademark). The anomaly monitoring system 100 may also be configured with a network including both a CAN network and an Ethernet network. In this case, the main unit 10 may have a protocol conversion function between CAN and Ethernet. [Explanation of symbols]

[0079] 10 Main Unit 11 processors 12. Storage 13 CAN interface (in-vehicle communication unit) 20 subunits 21 processors 22 CAN interface (in-vehicle communication unit) 30 subunits 31 processors 32 CAN interface (in-vehicle communication unit) 40 service units 41 processors 42 CAN interface (in-vehicle communication unit) 50 1st ECU (power startup ECU) 50A 1st ECU (power start ECU) 50B 1st ECU (power start ECU) 50C 1st ECU (power start ECU) 60 2nd ECU (communication startup ECU) 70 TCU 80 Switch 100 Abnormality Monitoring System 110 High-voltage battery 120 Converter 130 Auxiliary Battery 140 Main Controller 150 Sub-controller 160 Sub-controller 170 Power Line 200 Power system 300 vehicles E1,E2,E3,E4,E5,E6,E7,E8 Events

Claims

1. a sub-unit for monitoring the operating states of a plurality of power startup ECUs as follows: An abnormality monitoring system comprising: a main unit that monitors the operating states of a plurality of communication-activated ECUs, The monitoring target of the subunit is: an event related to an abnormality that can be detected by the power startup ECU; The main unit monitors: an event related to an abnormality that can be detected by the communication activation ECU; The main unit comprises: A process of determining whether or not there is an abnormality in the system based on its own monitoring results and the monitoring results notified from the subunit; If the determination result is positive, the determined event is distributed to a communication node within the system. Power Start ECU: An ECU that operates or stops depending on the power source and can detect abnormalities related to its own device Communication-activated ECU: An ECU that operates or stops via communication and can detect abnormalities related to its own device.

2. The plurality of power supply start-up ECUs include:

2. The abnormality monitoring system according to claim 1, further comprising an ECU that is a monitoring target of the sub-unit and an ECU that is a monitoring target of the main unit.

3. a power system for supplying power to the power source startup ECU and the communication startup ECU; The monitoring targets of the main unit and the sub-unit are: The abnormality monitoring system according to claim 1 or 2, further comprising an event relating to an abnormality in the power supply system.

4. The main unit monitors: Including events related to abnormalities in the vehicle's own communication unit, The monitoring target of the subunit is: The abnormality monitoring system according to claim 1 or 2, further comprising an event relating to an abnormality in the in-vehicle communication unit of the abnormality monitoring system.

5. a sub-unit for monitoring the operating states of a plurality of power startup ECUs as follows: A main unit monitors the operating states of a plurality of communication-activated ECUs, and an abnormality monitoring method is executed by the main unit, The monitoring target of the subunit is: an event related to an abnormality that can be detected by the power startup ECU; The main unit monitors: an event related to an abnormality that can be detected by the communication activation ECU; a step in which the main unit determines whether or not there is an abnormality in the system based on the monitoring results notified from the subunit and the monitoring results it performs itself; and if the determination result is positive, the main unit distributes the determined event to a communication node within the system. Communication-activated ECU: An ECU that operates or stops via communication and can detect abnormalities related to its own device. Power Start ECU: An ECU that operates or stops depending on the power source and can detect abnormalities related to its own device

Images