In-vehicle network system and control method for an in-vehicle network system

Abstract

This invention provides an in-vehicle network system and a control method for the in-vehicle network system that can estimate the location of an abnormality when an abnormality occurs in a lower-level ECU. [Solution] The power / startup management ECU 10 receives NM messages that selectively instruct the startup of multiple lower-level ECUs 20 and 30, transmitted via the communication bus 8, on behalf of the multiple lower-level ECUs 20 and 30. The power / startup management ECU 10 then turns on relay circuits 15 and 16 provided on the power supply lines 6 of the lower-level ECUs 20 and 30 that have been instructed to start by the NM messages, thereby putting the instructed lower-level ECUs 15 and 16 into a startup state. The power / startup management ECU 10 then detects the power supply status to the lower-level ECUs 20 and 30 and the communication status with the lower-level ECUs 20 and 30 with the relay circuits 15 and 16 turned on, and determines the location of the abnormality based on the detection results.

Description

Technical Field

[0004] , , , ,

[0001] The present disclosure relates to an in-vehicle network system having a plurality of control devices connected to a communication bus and capable of communicating with each other in a vehicle, and a control method for the in-vehicle network system.

Background Art

[0002] For example, Patent Document 1 discloses an in-vehicle network system including a host ECU, an intermediate ECU, and a subordinate ECU. In the in-vehicle network system of Patent Document 1, power is supplied to the intermediate ECU from a power source, and the intermediate ECU supplies power from the power source to the subordinate ECU according to a message received from the host ECU. That is, the intermediate ECU maintains the subordinate ECU in a power-off state until a message is received from the host ECU. When a message from the host ECU is received by the intermediate ECU, power from the power source is supplied to the subordinate ECU. The subordinate ECU transitions from the power-off state to a standby state in which it waits for an instruction by this power supply.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In an in-vehicle network system as described in Patent Document 1, it is conceivable that some abnormality occurs and communication with the subordinate ECU is interrupted even though the intermediate ECU supplies power to the subordinate ECU. In this case, it is possible to detect that an abnormality has occurred in communication with the subordinate ECU by the intermediate ECU. However, if it is unclear what defect has caused the abnormality in communication with the subordinate ECU, it takes time to take measures to eliminate the defect, and there is a risk that the maintenance efficiency deteriorates.

[0005] This disclosure has been made in view of the above-mentioned points, and aims to provide an in-vehicle network system and a control method for an in-vehicle network system that can estimate the location of an abnormality when an abnormality occurs in a lower-level control device. [Means for solving the problem]

[0006] To achieve the above objective, the in-vehicle network system according to this disclosure is an in-vehicle network system (100) having a plurality of control devices (10, 20, 30, 40, 50) connected to a communication bus (8) in a vehicle and capable of communicating with each other, Multiple control devices include at least one higher-level control device (10) and multiple lower-level control devices (20, 30), The higher-level control unit is A power management unit (13) that turns on and off multiple relay circuits (15, 16) provided in the power supply lines (6) of multiple lower-level control devices, A startup management unit (12) receives network management messages (hereinafter referred to as NM messages) transmitted via a communication bus, which selectively instruct the startup of multiple lower-level control devices, on behalf of the multiple lower-level control devices, and instructs the power management unit to turn on the relay circuits provided in the power supply lines of the lower-level control devices that have been instructed to start by the NM messages, thereby putting the lower-level control devices that have been instructed to start into an started state. The system includes an abnormality location determination unit (17) that detects the power supply status to the lower-level control unit and the communication status with the lower-level control unit, and determines the location of the abnormality based on the detection results.

[0007] Furthermore, the control method for an in-vehicle network system according to this disclosure is a control method for an in-vehicle network system (100) having a plurality of control devices (10, 20, 30, 40, 50) connected to a communication bus (8) and capable of communicating with each other in a vehicle, Multiple control devices include at least one higher-level control device (10) and multiple lower-level control devices (20, 30), The higher-level control unit has a power management unit (13) that turns on and off multiple relay circuits (15, 16) provided in the power supply lines (6) of each of the multiple lower-level control units. The higher-level control unit receives network management messages (hereinafter referred to as NM messages) transmitted via the communication bus on behalf of the multiple lower-level control units, which selectively instruct the activation of those units (S100). The higher-level control unit turns on a relay circuit installed in the power supply line of the lower-level control unit that has been instructed to be started by an NM message, thereby putting the lower-level control unit that has been instructed to be started into an activated state (S130), and The higher-level control unit detects the power supply status to the lower-level control unit and the communication status with the lower-level control unit, and determines the location of the abnormality based on the detection results (S140).

[0008] According to the in-vehicle network system and control method for the in-vehicle network system disclosed herein, a higher-level control unit (10) receives NM messages on behalf of the multiple lower-level control units (20, 30) that selectively instruct the activation of the multiple lower-level control units transmitted via a communication bus (8). The higher-level control unit then activates the lower-level control units that have been instructed to be activated by the NM messages by turning on relay circuits (15, 16) provided on the power supply lines (6) of those lower-level control units. The higher-level control unit then detects the power supply status to the lower-level control units and the communication status with the lower-level control units, and determines the location of the abnormality based on the detection results.

[0009] Therefore, according to the in-vehicle network system and control method for the in-vehicle network system disclosed herein, it is possible to estimate the location of the abnormality, and thus, when an abnormality occurs, it is possible to suppress the deterioration of the efficiency of maintenance required to resolve the abnormality.

[0010] The reference numbers in parentheses above are merely examples of correspondences with specific configurations in embodiments described later, in order to facilitate understanding of this disclosure, and are not intended to limit the scope of this disclosure in any way.

[0011] Furthermore, technical features described in each claim of the patent claims, other than those described above, will become clear from the description of the embodiments and the accompanying drawings, which will be discussed later. [Brief explanation of the drawing]

[0012] [Figure 1] This is a configuration diagram showing an example of the configuration of an in-vehicle network system according to the embodiment. [Figure 2] This is an explanatory diagram illustrating an example of an NM message, PN request information, and PNC configuration information. [Figure 3] This figure shows an example of a PNC setting table stored in the memory unit of the power / startup management ECU. [Figure 4] This figure shows an example of relay connection information stored in the memory unit of the power / startup management ECU. [Figure 5] This is a configuration diagram showing an example of the configuration of the current detection unit, which is included in the abnormal location detection unit, for detecting the power supply status to the lower ECU. [Figure 6] This figure shows the first and second threshold values, which are compared with the detected current amount in the abnormality detection unit. [Figure 7] This flowchart shows an example of the process performed in the power / startup management ECU. [Figure 8] Figure 7 is a flowchart detailing the startup ECU identification process. [Figure 9] Figure 7 is a flowchart detailing the abnormality detection process. [Modes for carrying out the invention]

[0013] Hereinafter, embodiments of an in-vehicle network system and a control method for an in-vehicle network system according to the present disclosure will be described with reference to the drawings. However, the present disclosure is not limited to the following embodiments, and various modifications described hereinafter are also included in the technical scope of the present disclosure. Furthermore, various changes can be made and implemented without departing from the gist of the present disclosure other than those described below. The embodiments and various modifications can be appropriately combined and implemented as long as there is no technical contradiction. In the following description, the same or similar configurations may be given the same reference numerals in multiple drawings, and the description may be omitted. Also, when only a part of the configuration is mentioned, the description given elsewhere can be applied to other parts.

[0014] (First Embodiment) FIG. 1 is a configuration diagram showing an example of the configuration of an in-vehicle network system 100 according to the present embodiment. As shown in FIG. 1, the in-vehicle network system 100 includes a power / start management ECU 10 as an upper control device, first and second lower ECUs 20 and 30 as lower control devices, and first and second normal ECUs 40 and 50. ECU is an abbreviation for Electronic Control Unit (electronic control device). The first and second lower ECUs 20 and 30 are respectively connected to the power / start management ECU 10 via first and second relay circuits 15 and 16.

[0015] Note that the number of the first and second lower ECUs 20 and 30 respectively connected to the power supply / startup management ECU 10 via relay circuits such as the first and second relay circuits 15 and 16 may be not two but three or more. Also, the number of the first and second lower ECUs 20 and 30 respectively connected to each of the first and second relay circuits 15 and 16 may be not one but two or more. Further, in the in-vehicle network system 100, the combination of the power supply / startup management ECU 10 and the first and second lower ECUs 20 and 30 may be provided not in one set but in a plurality of sets. When a plurality of sets of the combination of the power supply / startup management ECU 10 and the first and second lower ECUs 20 and 30 are provided in the in-vehicle network system 100, the respective power supply / startup management ECU 10 and the first and second lower ECUs 20 and 30 can be communicably connected to each other via the communication bus 8.

[0016] The power supply / startup management ECU 10, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 can each be constituted by a computer including a processor, a memory, a storage, and the like. The power supply / startup management ECU 10, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 also include communication interfaces (communication IFs) 11, 21, 31, 41, and 51 for communicating with other ECUs.

[0017] A processor is, for example, a CPU, MPU, GPU, or DFP that executes predetermined processes according to a program. Memory is a volatile storage medium, such as RAM, that temporarily stores the results of the processor's calculations. Storage is a non-volatile storage medium, such as flash memory or ROM. Various programs and data executed by the processor are stored in the storage. Some or all of the functions of the power / start management ECU 10, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 may be implemented by hardware, such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array), rather than by software such as a program.

[0018] The power / startup management ECU 10 may function as a domain controller, for example, overseeing the control of the first and second lower-level ECUs 20 and 30. A domain refers to a functional unit when the functions of a vehicle are broadly divided, such as a powertrain domain, chassis domain, advanced driver assistance domain, body domain, or cockpit domain. The above is just one example of domain division, and the domain division may differ from the example above. Furthermore, the power / startup management ECU 10 may also function as an area controller, overseeing the control of the lower-level ECUs 20 and 30 located in each area of ​​the vehicle.

[0019] The in-vehicle network system 100 can use CAN (registered trademark, hereinafter the same) as a communication protocol for each ECU 10, 20, 30, 40, and 50 to communicate with each other. However, the communication protocol is not limited to CAN, and the in-vehicle network system 100 may adopt another communication protocol such as CAN-FD. However, in the in-vehicle network system 100 of this embodiment, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 are divided into multiple groups (these groups are referred to as clusters) for each ECU that needs to be started simultaneously to realize at least one desired function. Then, using network management messages (hereinafter referred to as NM messages) described later, each cluster is switched between a normal operation mode (startup state) and a power saving mode (e.g., sleep state). Note that the power saving mode includes the power-off state of the first and second lower ECUs 20 and 30. For this reason, the communication protocol adopted in the in-vehicle network system 100 must be compatible with sending and receiving NM messages.

[0020] The first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 are, for example, control ECUs for controlling a predetermined control object in a vehicle, or sensor ECUs that calculate a predetermined physical quantity based on detection signals detected by sensors. When it is necessary to control a control object or to calculate a predetermined physical quantity based on detection signals from sensors, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 are activated in normal operation mode and perform normal operations. On the other hand, when it is not necessary to control a control object or to calculate a predetermined physical quantity, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 are in power-saving mode, in a power-off state or sleep state.

[0021] To switch between this startup state (normal operation mode) and a power-off state or sleep state (power-saving mode), the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50, are each assigned to a cluster within a group of divided clusters. The assigned cluster is then stored in each ECU as cluster setting information (also referred to as PNC setting information). However, the PNC setting information for the first and second lower ECUs 20 and 30 is stored in the storage unit 14 of the power / startup management ECU 10, as will be described later. Then, in response to a request to start the cluster to which each ECU belongs, based on the startup cluster information (also referred to as PN request information) included in the NM message, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50 are configured to switch from the power-off state or sleep state to the startup state.

[0022] The first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50, each enter a startup state and transition to normal operation mode. While performing their normal operations, they periodically send NM messages to other ECUs. After performing necessary processing, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50, each stop sending periodic NM messages when they no longer need to perform normal operations. When the first and second normal ECUs 40 and 50 have not received NM messages from other ECUs belonging to the same cluster for a predetermined waiting period, they transition from normal operation mode to power-saving mode and switch from the startup state to a sleep state. The first and second lower ECUs 20 and 30 are monitored by the power / startup management ECU 10 for NM messages directed to them. Then, when the time during which no NM messages are received directed to the first and second lower ECUs 20 and 30 reaches a predetermined waiting time, the power / startup management ECU 10 turns off the first and second relay circuits 15 and 16 and stops supplying power to the first and second lower ECUs 20 and 30.

[0023] The first and second normal ECUs 40 and 50 have communication IFs 41 and 51 that can receive NM messages while in sleep mode and switch the first and second normal ECUs 40 and 50 from sleep mode to wake mode in response to the reception of an NM message. When woken up by the communication IFs 41 and 51, the first and second normal ECUs 40 and 50 each determine whether or not their own wake-up is requested based on the PN request information of the NM message and their own PNC setting information. If they determine that their own wake-up is requested, the first and second normal ECUs 40 and 50 continue in the wake-up state. On the other hand, if they determine that their own wake-up is not requested, the first and second normal ECUs 40 and 50 return to sleep mode. The determination based on the PN request information of the NM message and the PNC setting information may be configured to be performed by the communication IFs 41 and 51. In this case, if communication IFs 41 and 51 determine that a startup is requested based on the PN request information and PNC setting information, they transition the corresponding first and second normal ECUs 40 and 50 from sleep state to startup state. Examples of NM messages, PN request information, and PNC setting information are described in detail below.

[0024] An NM message contains data from bytes 0 to 7, as shown in Figure 2, for example. Byte 0 contains the Node ID (NID) as data. The Node ID is a unique identifier for each of the power / startup management ECU 10, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50. The Node ID allows identification of the source of the NM message. Byte 1 contains the Control Bit Vector (CBV) as data. The Control Bit Vector is data indicating whether or not partial networking is being used. If the Control Bit Vector indicates the use of partial networking, the user data area of ​​bytes 2 to 7 contains PN request information, which is startup cluster information indicating the cluster to be started. Partial networking means that only the ECUs belonging to some clusters are started, while the ECUs belonging to the remaining clusters are powered off or in sleep mode. In this way, by starting only the ECUs that need to operate, the power consumption of each ECU installed in the vehicle can be reduced.

[0025] In the example shown in Figure 2, the control bit vector indicates the use of partial networking, and PN request information is stored in bytes 6 and 7 of the user data area. The user data area from bytes 2 to 5 can be used to transmit any information, such as the ECU activation factor or information regarding normal or abnormal operation. Note that Figure 2 is merely one example of the format of an NM message, and NM messages may take other formats as long as they include information on whether or not partial networking is being used and the PN request information.

[0026] PN request information indicates which clusters should be started and which do not need to be started for each of the multiple divided clusters. More specifically, in the example shown in Figure 2, the clusters are pre-divided into 16. The PN request information contains 16 bits of data corresponding to the 16 divided clusters. In other words, the 16 bits of data in the PN request information are pre-associated with the 16 divided clusters. When each of the 16 bits of data in the PN request information is "0", it indicates that the associated cluster does not need to be started. On the other hand, when each of the 16 bits of data in the PN request information is "1", it indicates that the associated cluster needs to be started.

[0027] As described above, the first and second subordinate ECUs 20 and 30, and the first and second normal ECUs 40 and 50, have PNC setting information that indicates the cluster to which they belong among multiple divided clusters. An example of this PNC setting information is shown in Figure 2. Figure 2 shows an example of PNC setting information for any one of the first and second subordinate ECUs 20 and 30, and the first and second normal ECUs 40 and 50. In the PNC setting information shown in Figure 2, if the associated clusters are classified as A to P from left to right in the figure, the PNC setting information in Figure 2 indicates that the ECU possessing this PNC setting information belongs to clusters D, H, and J. Since the first and second subordinate ECUs 20 and 30, and the first and second normal ECUs 40 and 50 can perform various functions through program execution, they can belong to one or more clusters.

[0028] When the first and second normal ECUs 40 and 50 receive an NM message containing PN request information via their respective communication IFs 41 and 51, they compare the PN request information and PNC setting information bit by bit, as shown in Figure 2, and calculate, for example, a logical AND. In other words, when the first and second normal ECUs 40 and 50 receive an NM message via their respective communication IFs 41 and 51, they enter an activated state. Then, the first and second normal ECUs 40 and 50 determine whether the clusters requested to be activated by the PN request information contained in the NM message match the clusters of PNC setting information assigned to the first and second normal ECUs 40 and 40, respectively. For example, in the example shown in Figure 2, the clusters requested to be activated by the PN request information are clusters D, G, I, M, N, and O. The clusters to which the ECUs belong, as indicated by the PNC setting information, are clusters D, H, and J. In this case, in cluster D, the clusters requested to be activated by the PN request information contained in the NM message match the clusters of PNC setting information. Therefore, as shown in Figure 2, the result of the logical AND is "1" in cluster D.

[0029] If the logical AND result results in any bit being "1", the ECU with the PNC configuration information shown in Figure 2 determines that it is being requested to start up. Based on this determination, the ECU with the PNC configuration information shown in Figure 2 transitions from sleep state to startup state, and if it is already in startup state, it maintains that state. On the other hand, if the logical AND result does not result in any bit being "1", and all bits are "0", the ECU with the PNC configuration information shown in Figure 2 determines that it is not being requested to start up. In this case, the ECU with the PNC configuration information shown in Figure 2 discards the received NM message and returns to sleep state.

[0030] Thus, the first and second normal ECUs 40 and 50 have a function to identify whether an NM message requests the startup of their own ECU, based on the PNC setting information. Due to this function to identify NM messages, only the first and second normal ECUs 40 and 50 that have PNC setting information including the cluster that has been requested to start by the PN request information will enter the startup state in response to the NM message. Hereinafter, a communication interface that has the function of receiving an NM message while the ECU is in sleep state and switching the ECU from sleep state to startup state will be referred to as an NM-compatible communication interface.

[0031] In the in-vehicle network system 100 according to this embodiment, the first and second lower ECUs 20 and 30 do not have NM-compatible communication interfaces. In other words, the communication interfaces 21 and 31 of the first and second lower ECUs 20 and 30 are both non-NM-compatible communication interfaces. As described above, an NM-compatible communication interface has the function of receiving an NM message while the ECU is in sleep mode and switching the ECU from sleep mode to wake-up mode. For this reason, an NM-compatible communication interface is more expensive than a non-NM-compatible communication interface. As described above, the communication interfaces 21 and 31 of the first and second lower ECUs 20 and 30 are non-NM-compatible communication interfaces. Therefore, by using a combination of the power / start-up management ECU 10 and the lower ECUs 20 and 30, the overall cost of the in-vehicle network system 100 can be reduced.

[0032] In the in-vehicle network system 100 according to this embodiment, even though the communication IFs 21 and 31 of the first and second lower ECUs 20 and 30 are both NM-incompatible communication IFs, the power / startup management ECU 10 is configured so that the first and second lower ECUs 20 and 30 are subject to partial networking in response to NM messages. Furthermore, the power / startup management ECU 10 is configured to determine the location of the abnormality when some abnormality occurs in at least one of the first and second lower ECUs 20 and 30, rendering it unable to operate normally. The power / startup management ECU 10 according to this embodiment will be described in detail below with reference to the drawings.

[0033] As shown in Figure 1, the power supply / startup management ECU 10 includes a communication IF 11, a startup management unit 12, a power supply management unit 13, a storage unit 14, first and second relay circuits 15 and 16, an abnormal location detection unit 17, an abnormality transmission unit 18, and an abnormality storage unit 19. The startup management unit 12, the power supply management unit 13, the abnormal location detection unit 17, and the abnormality transmission unit 18 are functional units built within the power supply / startup management ECU 10 by software and / or hardware. The storage unit 14 and the abnormality storage unit 19 may be configured by the storage of the power supply / startup management ECU 10. The storage unit 14 and the abnormality storage unit 19 may be provided in separate storage or in the same storage.

[0034] The first and second relay circuits 15 and 16 of the power / start management ECU 10 are located on the power supply line 6, respectively, for supplying power to the first and second lower ECUs 20 and 30. The power supply circuit 4 can, if necessary, convert the power supply voltage of the vehicle's battery 2 into the operating voltage of the power / start management ECU 10, the first and second lower ECUs 20 and 30, and the first and second normal ECUs 40 and 50. Voltage from the power supply circuit 4 is supplied to the power supply line 6.

[0035] In the example shown in Figure 1, the power line of the first lower-level ECU 20 is connected to the first power port 15a, which is connected to the first relay circuit 15. Similarly, the power line of the second lower-level ECU 30 is connected to the second power port 16a, which is connected to the second relay circuit 16. The first and second lower-level ECUs 20 and 30 are supplied with power, respectively, through the first and second relay circuits 15 and 16 and their respective power lines. In other words, the first and second relay circuits and their respective power lines correspond to the power supply lines.

[0036] The first and second relay circuits 15 and 16 can be composed of semiconductor switches such as MOSFETs and IGBTs. However, the first and second relay circuits 15 and 16 may be composed of ordinary mechanical relays instead of semiconductor switches. Also, the first and second relay circuits 15 and 16 may be provided inside the power supply / startup management ECU 10, as shown in Figure 1, or they may be provided outside the power supply / startup management ECU 10.

[0037] The communication IF11 of the power / startup management ECU10 is an NM-compatible communication IF capable of receiving NM messages. As described above, the communication IFs21 and 31 of the multiple lower-level ECUs20 and 30 are non-NM-compatible communication IFs. In this embodiment, when operation is not required, the multiple lower-level ECUs20 and 30 enter a power-off state in power-saving mode. Therefore, the communication IFs21 and 31 of the multiple lower-level ECUs20 and 30 cannot receive NM messages when the corresponding lower-level ECUs20 and 30 are in power-saving mode. For this reason, the communication IF11 of the power / startup management ECU10 receives NM messages that selectively instruct the multiple lower-level ECUs20 and 30 to start up, on behalf of the communication IFs21 and 31 of the multiple lower-level ECUs20 and 30. The NM messages received by the communication IF21 are provided to the startup management unit12.

[0038] Here, the storage unit 14 of the power / startup management ECU 10 stores PNC setting information that is assigned to each of the first and second lower ECUs 20 and 30, and indicates the cluster to which each of the first and second lower ECUs 20 and 30 belongs, in addition to the program executed by the processor of the power / startup management ECU 10. Furthermore, the storage unit 14 stores relay connection information that indicates the correspondence between the first and second relay circuits 15 and 16 and the first and second lower ECUs 20 and 30.

[0039] For example, the storage unit 14 can store PNC setting information indicating the cluster assigned to each of the first and second lower ECUs 20 and 30 using a PNC setting table as shown in Figure 3. The PNC setting table illustrated in Figure 3 shows the correspondence between node IDs, which are unique identifiers of multiple lower ECUs including the first and second lower ECUs 20 and 30, and the PNC setting information assigned to multiple lower ECUs including the first and second lower ECUs 20 and 30. In addition, as relay connection information showing the correspondence between the first and second relay circuits 15 and 16 and the first and second lower ECUs 20 and 30, the storage unit 14 stores the correspondence between the numbers of multiple relay circuits including the first and second relay circuits 15 and 16 or the power port numbers and node IDs, which are unique identifiers of multiple lower ECUs including the first and second lower ECUs 20 and 30, as illustrated in Figure 4.

[0040] The startup management unit 12 of the power / startup management ECU 10 can obtain the PNC setting information for each of the first and second lower ECUs 20 and 30 by referring to the PNC setting table illustrated in Figure 3. The startup management unit 12 can then determine which of the lower ECUs 20 and 30 has been instructed to start by the NM message, based on the obtained PNC setting information for each lower ECU 20 and 30 and the PN request information of the NM message. Specifically, the startup management unit 12 compares the PN request information of the NM message with the PNC setting information of each of the multiple lower ECUs 20 and 30 bit by bit. Based on the comparison result, if the startup management unit 12 determines that there is PNC setting information that includes a cluster that has been requested to start by the PN request information, it determines that the startup of the lower ECU 20 or 30 corresponding to that PNC setting information has been instructed. In this case, the startup management unit 12 provides the power management unit 13 with a node ID indicating the lower ECU 20 or 30 that has been instructed to start by the NM message. On the other hand, if the startup management unit 12 determines that there is no PNC configuration information including the cluster that was requested to be started by the PN request information, it discards the NM message because the received NM message does not instruct the startup of any of the lower ECUs 20 or 30.

[0041] When the power management unit 13 of the power / startup management ECU 10 receives the node IDs of the subordinate ECUs 20 and 30 that have been instructed to start up by the startup management unit 12, it refers to the relay connection information stored in the memory unit 14, which shows the correspondence between each relay circuit 15 and 16 and each subordinate ECU 20 and 30. The power management unit 13 then identifies the relay circuits 15 and 16 corresponding to the node IDs of the subordinate ECUs 20 and 30 that have been instructed to start up, and outputs a drive signal to turn on the identified relay circuits 15 and 16. As a result, power is supplied to the subordinate ECUs 20 and 30 that have been instructed to start up via the corresponding relay circuits 15 and 16, and the corresponding subordinate ECUs 20 and 30 enter the startup state.

[0042] The first and second lower ECUs 20 and 30 control various controllable devices mounted on the vehicle that are controlled only when specific conditions are met or under specific environmental conditions (e.g., door locking mechanisms, power window drive motors, headlight light sources, wiper motors, AV equipment, etc.), or calculate predetermined physical quantities necessary for such control based on sensor detection signals. For example, the door locking mechanism is controlled by the door lock control ECU when a vehicle user is about to get into or out of the vehicle. The power window drive motor is controlled by the power window control ECU when the window up / down switch is operated by the user.

[0043] Thus, the first and second lower ECUs 20 and 30 control controlled devices that operate only when specific conditions are met or under specific environments, or calculate predetermined physical quantities necessary for such control. Therefore, when the power / startup management ECU 10 receives an NM message instructing it to start the first and second lower ECUs 20 and 30, it turns on the first and second relay circuits 15 and 16 corresponding to the first and second lower ECUs 20 and 30 to supply power to them. On the other hand, when the power / startup management ECU 10 does not receive an NM message instructing it to start the first and second lower ECUs 20 and 30, it turns off the first and second relay circuits 15 and 16 corresponding to the first and second lower ECUs 20 and 30 to stop supplying power to them. This cuts downtime when the operation of each lower ECU 20 and 30 is not required, making it possible to further reduce power consumption for the entire in-vehicle system.

[0044] An NM message may be generated, for example, by a power / startup management ECU 10 as a function of a domain controller or area controller. In this case, the power / startup management ECU 10 determines the function to be performed in the vehicle. If the power / startup management ECU 10 determines that the desired function needs to be performed, it determines the cluster that needs to be in an activated state simultaneously when the relevant function is performed, and generates an NM message containing PN request information designating it as the activated cluster. The generated NM message is transmitted via the communication bus 8 to the first and second normal ECUs 40, 50, or other power / startup management ECUs 10. Furthermore, the generated NM message is also used by the power / startup management ECU 10 to determine whether it needs to switch its own subordinate ECUs 20, 30 to an activated state. However, the function of determining the function to be performed in the vehicle and sending an NM message containing PN request information may be possessed by other ECUs, such as the first and second normal ECUs 40, 50, rather than the power / startup management ECU 10.

[0045] Furthermore, the power / startup management ECU 10 may enter a sleep state if all ECUs belonging to the in-vehicle network system 100 are in a sleep state or power-off state and a predetermined period of time has passed during which no NM messages have been received.

[0046] The abnormal location determination unit 17 of the power supply / startup management ECU 10 detects the power supply status to the lower ECUs 20 and 30 and the communication status with the lower ECUs 20 and 30, which have their relay circuits 15 and 16 turned on, and determines the location of the abnormality based on the detection results. The abnormal location determination unit 17 has, for example, a current detection unit 70 as shown in Figure 5, to detect the power supply status to the lower ECUs 20 and 30. The current detection unit 70 is provided individually for each of the multiple relay circuits 15 and 16. The current detection unit 70 includes a shunt resistor 71, a differential amplifier 72, and an A / D converter 73.

[0047] The shunt resistor 71 is connected to the upstream and downstream sides of the respective relay circuits 15 and 16 in the power supply lines 6 that branch off from the common power supply line 6 to the respective lower ECUs 20 and 30. Alternatively, the shunt resistor 71 may be connected to the power supply line 6 within each of the relay circuits 15 and 16. When the corresponding relay circuits 15 and 16 are turned on and power is supplied to the lower ECUs 20 and 30, a current flows through the shunt resistor 71 corresponding to the power supplied to the lower ECUs 20 and 30. As a result, a potential difference is generated across the shunt resistor 71 corresponding to the magnitude of the current flowing through it.

[0048] The differential amplifier 72 amplifies the potential difference across the shunt resistor 71 and outputs it. The A / D converter 73 converts the potential difference amplified by the differential amplifier 72 from an analog value to a digital value. The potential difference converted to a digital value represents the amount of current flowing through the power supply line 6 of the lower ECUs 20 and 30. Therefore, the current detection unit 70 can detect the amount of current flowing through the power supply line 6 of the lower ECUs 20 and 30 when the relay circuits 15 and 16 are turned on and power is supplied to the lower ECUs 20 and 30, as a power supply state for the lower ECUs 20 and 30.

[0049] The abnormality location determination unit 17 then compares the detected current amount with a first threshold for determining a short-circuit abnormality and a second threshold for determining a wire break abnormality, as shown in Figure 6. If the detected current amount is greater than the first threshold, the abnormality location determination unit 17 can determine that a short-circuit abnormality has occurred in the power supply line 6 of the lower ECUs 20 and 30. Also, if the detected current amount is less than the second threshold, the abnormality location determination unit 17 can determine that a wire break abnormality has occurred in the power supply line 6 of the lower ECUs 20 and 30.

[0050] Furthermore, if the detected current amount is smaller than the second threshold, the abnormality location determination unit 17 may determine that the detected current amount is smaller than the second threshold based on the results of multiple determinations, rather than just one determination. This is because if the detected current amount is small, there is a possibility of misjudging the magnitude relationship with the second threshold. In this case, the abnormality location determination unit 17 repeats the magnitude comparison between the detected current amount and the second threshold a predetermined number of times. Then, if the abnormality location determination unit 17 obtains a result that the detected current amount is smaller than the second threshold in the results of multiple comparisons, it may determine that a disconnection abnormality has occurred in the power supply line 6 of the lower ECUs 20 and 30. In addition, to ensure the accuracy of the determination, the first threshold may also be compared with the detected current amount multiple times. In this case, the abnormality location determination unit 17 repeats the magnitude comparison between the detected current amount and the first threshold a predetermined number of times. The predetermined number of times the magnitude comparison with the first threshold is repeated and the predetermined number of times the magnitude comparison with the second threshold is repeated may be the same or different.

[0051] In addition to comparing the detected current amount with the second threshold, or alternatively, the abnormality location determination unit 17 may compare the detected current amount with the minimum current consumption value during normal operation of the lower ECUs 20 and 30 which are in the activated state. In this case, if the detected current amount is smaller than the minimum current consumption value, the abnormality location determination unit 17 may determine that an abnormality has occurred in the power supply line 6 of the lower ECUs 20 and 30, and / or in the lower ECUs 20 and 30.

[0052] If the detection unit 17 determines that an abnormality has occurred in the power supply line 6 of the lower ECUs 20 and 30 based on a comparison of the detected current amount with the first threshold, the second threshold, and / or the minimum current consumption value, the abnormality location detection unit 17 outputs a drive signal to turn off the corresponding relay circuits 15 and 16. As a result, the relay circuits 15 and 16 installed in the power supply line 6 where the abnormality occurred are switched from on to off. Consequently, the power supply to the lower ECUs 20 and 30, which have experienced an abnormality and cannot be expected to operate normally, can be cut off.

[0053] Furthermore, the abnormality detection unit 17 sends a message to the lower ECUs 20 and 30, whose relay circuits 15 and 16 are turned on, via the communication IF 11 and communication bus 8, in order to detect the communication status with the lower ECUs 20 and 30. The abnormality detection unit 17 then detects whether or not there is a response from the lower ECUs 20 and 30 to the message it sent. In other words, the abnormality detection unit 17 detects whether or not there is a response to the message sent to the lower ECUs 20 and 30 as the communication status with the lower ECUs 20 and 30. Note that the sending of the message and the detection of the presence or absence of a response are performed individually for multiple lower ECUs 20 and 30.

[0054] The abnormal location determination unit 17 can determine that the communication status with the lower ECUs 20 and 30 is normal if a response is received from the lower ECUs 20 and 30. Conversely, the abnormal location determination unit 17 can determine that the communication status with the lower ECUs 20 and 30 is abnormal if no response is received from the lower ECUs 20 and 30. More specifically, the abnormal location determination unit 17 can determine that an abnormality has occurred in the communication bus 8 with the lower ECUs 20 and 30, the communication IFs 21 and 31 of the lower ECUs 20 and 30, and / or the lower ECUs 20 and 30, if no response to a message is received from the lower ECUs 20 and 30, even though the power supply status to the lower ECUs 20 and 30 is normal.

[0055] If an abnormality occurs in the communication bus 8 with the lower ECUs 20 and 30, the communication IFs 21 and 31 of the lower ECUs 20 and 30, and / or in the lower ECUs 20 and 30, the abnormality location determination unit 17 may turn off the corresponding relay circuits 15 and 16, and then turn them on. This will restart the corresponding lower ECUs 20 and 30. The restart may allow the lower ECUs 20 and 30 to return to a normal state. Furthermore, if the abnormality location determination unit 17 fails to receive a response to a message from the lower ECUs 20 and 30 after attempting to recover from the abnormality a predetermined number of times, it may determine that an abnormality has occurred in the communication bus 8 with the lower ECUs 20 and 30, the communication IFs 21 and 31 of the lower ECUs 20 and 30, and / or in the lower ECUs 20 and 30. Note that an abnormality in the communication IFs 21 and 31 of the lower ECUs 20 and 30 can be considered an abnormality in the lower ECUs 20 and 30.

[0056] When the abnormality detection unit 17 determines that an abnormality has occurred in the communication bus 8 with the lower ECUs 20 and 30, the communication IFs 21 and 31 of the lower ECUs 20 and 30, and / or in the lower ECUs 20 and 30, it outputs a drive signal to turn off the corresponding relay circuits 15 and 16. As a result, the relay circuits 15 and 16 corresponding to the abnormal lower ECUs 20 and 30 are switched from on to off. Consequently, the power supply to the lower ECUs 20 and 30 that have experienced an abnormality and cannot be expected to operate normally can be cut off.

[0057] The abnormality transmission unit 18 of the power / startup management ECU 10 creates an abnormality notification message when the abnormality location determination unit 17 determines the location of the abnormality. This message includes the node ID of the corresponding lower-level ECU 20, 30 and / or information indicating the cluster to which the corresponding lower-level ECU 20, 30 belongs. The abnormality transmission unit 18 then transmits the created abnormality notification message to other ECUs of the in-vehicle network system 100 (for example, the first and second normal ECUs 40, 50) via the communication IF 11 and the communication bus 8. This allows the other ECUs of the in-vehicle network system 100 to understand the cause of communication interruption if communication with the lower-level ECU 20, 30 is interrupted.

[0058] The abnormality storage unit 19 of the power / startup management ECU 10 stores information indicating the location of the abnormality when the abnormality location determination unit 17 determines that an abnormality has occurred. For example, if the abnormality location determination unit 17 determines that an abnormality has occurred in the power supply line 6 of the first lower ECU 20, the abnormality storage unit 19 stores the power supply line 6 of the first lower ECU 20 as the location of the abnormality. The location of the abnormality stored in the abnormality storage unit 19 can be read by a diagnostic tool connected to the communication bus 8 via a data link coupler, or by a data center 60 that acts as a diagnostic tool. This allows maintenance personnel to obtain information about the location of the abnormality and to smoothly take measures to resolve the abnormality.

[0059] The power / startup management ECU 10 does not necessarily have to have an error storage unit 19. For example, the error location determination unit 17 can be configured to send information indicating the location of the error to an external server such as a data center 60 each time an error location is determined. In this case, maintenance personnel can obtain information regarding the location of the error from the data center 60.

[0060] In the in-vehicle network system 100 according to this embodiment, a PNC setting information changing unit 42 for changing the PNC setting information held in each ECU 10, 40, and 50 may be implemented in any of the ECUs belonging to the in-vehicle network system 100, such as the power / start management ECU 10 and the first and second normal ECUs 40 and 50. Figure 1 shows an example in which the PNC setting information changing unit 42 is implemented in the first normal ECU 40.

[0061] The first normal ECU 40, on which the PNC setting information change unit 42 is implemented, has an external communication device capable of wirelessly communicating with an external server such as a data center 60. The first normal ECU 40 is configured to download application programs for realizing new functions in the vehicle, or update programs for upgrading programs already implemented in any of the ECUs 10, 20, 30, 40, or 50, from the data center 60 via the external communication device. The downloaded programs are provided to the corresponding ECUs 10, 20, 30, 40, or 50 via the communication bus 8, and the installation of new application programs or rewriting with update programs is performed. Note that the ECU that communicates with the external server via the external communication device and the ECU on which the PNC setting information change unit 42 is implemented may be separate ECUs.

[0062] Here, with respect to ECUs 10, 20, 30, 40, and 50 on which new application programs or updates have been implemented, it is possible that, depending on the functionality of the application program or update, it may be necessary to add or change the startup conditions for the corresponding ECU. Therefore, if it is necessary to add or change the startup conditions for an ECU on which an application program or update has been implemented, the data center 60 will have the first normal ECU 40 download new PNC configuration information corresponding to the addition or change in startup conditions, along with the application program or update.

[0063] When the PNC configuration information change unit 42 obtains new PNC configuration information from the data center 60, it changes (rewrites) the PNC configuration information held in the ECUs 10, 20, 30, 40, and 50 on which the application program or update program is implemented to the new PNC configuration information. As a result, the ECUs 10, 20, 30, 40, and 50 on which the application program or update program is implemented switch from a sleep state (including a power-off state) to an active state according to the cluster indicated by the changed PNC configuration information. The rewriting of the PNC configuration information may be performed in the corresponding ECU after receiving a rewrite instruction from the PNC configuration information change unit 42 along with the new PNC configuration information. Alternatively, the rewriting of the PNC configuration information may be performed by the PNC configuration information change unit 42 by accessing the memory of the corresponding ECU.

[0064] The PNC setting information change unit 42 can be located outside the in-vehicle network system 100, for example, in a data center 60, rather than being an ECU belonging to the in-vehicle network system 100. However, if the PNC setting information change unit 42 is implemented in an ECU belonging to the in-vehicle network system 100, the PNC setting information change unit 42 can terminate communication with the outside once it has obtained data from the outside to change the PNC setting information of the ECU. On the other hand, if the PNC setting information change unit 42 is located on a server outside the in-vehicle network system 100, each ECU that needs to change its PNC setting information will need to communicate with the external server individually via an ECU equipped with an external communication device. This may result in the disadvantage of increased communication volume with the external server.

[0065] Next, an example of the processing performed by the power / startup management ECU 10 will be described with reference to the flowcharts in Figures 7 to 9. The processing performed by the power / startup management ECU 10 includes processing to make the first and second lower ECUs 20 and 30 the target of partial networking in response to NM messages. The processing performed by the power / startup management ECU 10 also includes processing to determine the location of an abnormality based on the power supply status to the first and second lower ECUs 20 and 30 and the communication status with the lower ECUs 20 and 30, and to take action if an abnormality is found. The power / startup management ECU 10 executing the processing shown in the flowcharts in Figures 7 to 9 corresponds to executing the control method of the in-vehicle network system 100 of this disclosure.

[0066] In step S100, the power / startup management ECU 10 receives an NM message. In step S110, the power / startup management ECU 10 performs a startup ECU identification process to identify the subordinate ECUs 20 and 30 that have been instructed to start by the NM message. Details of this startup ECU identification process are shown in the flowchart of Figure 8. The startup ECU identification process will be described below with reference to the flowchart of Figure 8.

[0067] In step S300, the power / startup management ECU 10 identifies the cluster for which startup is requested based on the PN request information in the NM message. In step S310, the power / startup management ECU 10 reads the PNC setting information of multiple lower ECUs 20 and 30 from the storage unit 14. Then, in step S320, the power / startup management ECU 10 identifies the PNC setting information that includes the cluster that matches the cluster for which startup has been requested (startup request cluster) based on the PN request information.

[0068] In step S330, the power / startup management ECU 10 determines whether, in step S320, at least one PNC setting information among the PNC setting information of multiple subordinate ECUs 20 and 30 was identified as PNC setting information containing a cluster that matches the startup request cluster. If at least one PNC setting information is identified, the power / startup management ECU 10 proceeds to the process in step S340. On the other hand, if no identified PNC setting information exists, the power / startup management ECU 10 proceeds to the process in step S350.

[0069] In step S340, the power / startup management ECU 10 sets the subordinate ECUs 20 and 30 corresponding to the identified PNC setting information as start-up ECUs, and sets the other subordinate ECUs 20 and 30 as non-startup ECUs. Then, in step S350, the power / startup management ECU 10 sets all subordinate ECUs 20 and 30 as non-startup ECUs. After that, the power / startup management ECU 10 returns to the process shown in the flowchart of Figure 7.

[0070] In step S120 of the flowchart in Figure 7, the power / startup management ECU 10 determines whether there are any subordinate ECUs 20 and 30 that have been set as startup ECUs. If there are any subordinate ECUs 20 and 30 that have been set as startup ECUs, the power / startup management ECU 10 proceeds to the process in step S130. On the other hand, if there are no subordinate ECUs 20 and 30 that have been set as startup ECUs, the power / startup management ECU 10 terminates the process shown in the flowchart in Figure 7. In this case, the NM message is discarded.

[0071] In step S130, the power / startup management ECU 10 turns on the relay circuits 15 and 16 connected to the lower-level ECUs 20 and 30, which are set as the startup ECUs, based on the relay connection information stored in the memory unit 14 that shows the correspondence between each relay circuit 15 and 16 and each lower-level ECU 20 and 30. The power / startup management ECU 10 also turns off the relay circuits 15 and 16 connected to the lower-level ECUs 20 and 30, which are set as the non-startup ECUs.

[0072] When relay circuits 15 and 16 are turned on, the lower ECUs 20 and 30 receive power, as shown in step S200 of the flowchart in Figure 7. As a result, the lower ECUs 20 and 30, with relay circuits 15 and 16 turned on, undergo predetermined startup processes in step S210 and enter a startup state.

[0073] In step S140, the power / startup management ECU 10 performs an abnormality location determination process to determine the location of the abnormality based on the power supply status to the lower-level ECUs 20 and 30 and the communication status with the lower-level ECUs 20 and 30, for which relay circuits 15 and 16 have been turned on. Details of this abnormality location determination process are shown in the flowchart of Figure 9. The startup ECU identification process will now be explained with reference to the flowchart of Figure 9.

[0074] In step S400, the power / startup management ECU 10 detects the amount of current flowing through the power supply line 6 to the lower ECUs 20 and 30, which have their relay circuits 15 and 16 turned on, as a measure of the power supply status to the lower ECUs 20 and 30.

[0075] In step S410, the power supply / startup management ECU 10 determines whether the detected current is greater than a first threshold for determining a short-circuit abnormality. If it determines that the detected current is greater than the first threshold, the power supply / startup management ECU 10 proceeds to step S420. In step S420, the power supply / startup management ECU 10 determines that the abnormality occurred in the power supply line 6 to the lower ECUs 20 and 30 that turned on the relay circuits 15 and 16. On the other hand, if it determines that the detected current is less than or equal to the first threshold, the power supply / startup management ECU 10 proceeds to step S430.

[0076] In step S430, the power / startup management ECU 10 determines whether the detected current is less than a second threshold for determining a wire break. If it determines that the detected current is less than the second threshold, the power / startup management ECU 10 proceeds to step S440. On the other hand, if it determines that the detected current is greater than or equal to the second threshold, the power / startup management ECU 10 proceeds to step S460.

[0077] In step S440, the power / startup management ECU 10 repeatedly compares the detected current amount with the second threshold a predetermined number of times. Then, in step S450, if the power / startup management ECU 10 finds that the detected current amount is smaller than the second threshold after the predetermined number of comparisons, it proceeds to step S420. In step S420, the power / startup management ECU 10 determines that an abnormality has occurred in the power supply line 6 to the lower ECUs 20 and 30 that have turned on the relay circuits 15 and 16. On the other hand, if the power / startup management ECU 10 does not find that the detected current amount is smaller than the second threshold after the predetermined number of comparisons, it proceeds to step S460.

[0078] In step S460, the power / startup management ECU 10 sends a message to the lower ECUs 20 and 30, which have their relay circuits 15 and 16 turned on, in order to detect the communication status with the lower ECUs 20 and 30. Then, in step S470, the power / startup management ECU 10 determines whether or not it has detected a response from the lower ECUs 20 and 30 to the message it sent. If it determines that a response has been detected, the power / startup management ECU 10 proceeds to the process in step S510. On the other hand, if it determines that no response has been detected, the power / startup management ECU 10 proceeds to the process in step S480.

[0079] In step S480, the power / startup management ECU 10 performs an abnormal recovery process that restarts the lower ECUs 20 and 30 by turning off relay circuits 15 and 16 corresponding to the lower ECUs 20 and 30 that have not detected a response, up to a predetermined number of times, and then turning on relay circuits 15 and 16. Then, in step S490, the power / startup management ECU 10 determines whether it has detected a response to a message from the restarted lower ECUs 20 and 30 before executing the abnormal recovery process a predetermined number of times, in other words, whether the lower ECUs 20 and 30 have returned to normal. If it determines that the lower ECUs 20 and 30 have not returned to normal, the power / startup management ECU 10 proceeds to the process in step S500. On the other hand, if it determines that the lower ECUs 20 and 30 have returned to normal, the power / startup management ECU 10 proceeds to the process in step S510.

[0080] In step S500, the power / startup management ECU 10 determines that the abnormality occurred in the communication bus 8 of the lower ECUs 20 and 30, and / or in the lower ECUs 20 and 30, as it did not detect a response to the message. In step S510, the power / startup management ECU 10 determines that no abnormality occurred in the power supply line 6 and communication bus 8 of the lower ECUs 20 and 30.

[0081] In step S150 of the flowchart in Figure 7, the power / startup management ECU 10 determines whether or not an abnormality location was identified in the abnormality location determination process in step S140. If it determines that an abnormality location has been identified, the power / startup management ECU 10 proceeds to the process in step S160. On the other hand, if it determines that no abnormality location has been identified, the power / startup management ECU 10 terminates the process shown in the flowchart in Figure 7.

[0082] In step S160, the relay circuits 15 and 16 corresponding to the location of the malfunction are turned off. This allows the power supply to the lower ECUs 20 and 30, which have malfunctions in the power supply line 6, communication bus 8, and / or lower ECUs 20 and 30 and cannot be expected to operate normally, to be cut off.

[0083] In step S170, the power / startup management ECU 10 creates an anomaly notification message that includes the node IDs of the lower-level ECUs 20 and 30 corresponding to the location of the anomaly, and / or information indicating the cluster to which the lower-level ECUs 20 and 30 belong. The power / startup management ECU 10 then sends the created anomaly notification message to other ECUs in the in-vehicle network system 100. This allows the other ECUs in the in-vehicle network system 100 to understand the cause of any communication interruption with the lower-level ECUs 20 and 30.

[0084] In step S180, the power / startup management ECU 10 stores information indicating the location of the malfunction. The stored location of the malfunction can be read by a diagnostic tool connected to the communication bus 8 via a data link coupler, or by the data center 60, which acts as a diagnostic tool.

[0085] As described above, according to the in-vehicle network system 100 of this embodiment, the power / startup management ECU 10 receives NM messages that selectively instruct the startup of multiple lower-level ECUs 20 and 30, transmitted via the communication bus 8, on behalf of the multiple lower-level ECUs 20 and 30. The power / startup management ECU 10 then turns on the relay circuits 15 and 16 connected to the lower-level ECUs 20 and 30 that have been instructed to start by the NM message. As a result, the lower-level ECUs 20 and 30 that have been instructed to start enter the startup state. Therefore, according to the in-vehicle network system 100 of this embodiment, it is possible to finely manage the supply and shutdown of power to the lower-level ECUs 20 and 30 while configuring the system to switch the power supply of the lower-level ECUs 20 and 30 from a stopped state to a supplied state in response to the NM message instructing startup.

[0086] Furthermore, according to the in-vehicle network system 100 of this embodiment, with respect to the lower-level ECUs 20 and 30 with relay circuits 15 and 16 turned on, the power supply status to the lower-level ECUs 20 and 30 and the communication status with the lower-level ECUs 20 and 30 are detected, and the location of the abnormality is determined based on the detection results. Therefore, with the in-vehicle network system 100 of this embodiment, the location of the abnormality can be determined, and when an abnormality occurs, it is possible to suppress the deterioration of the efficiency of maintenance required to resolve the abnormality.

[0087] (modified version) While preferred embodiments of this disclosure have been described above, this disclosure is not limited to the embodiments described above and can be implemented in various modified ways without departing from the spirit of this disclosure.

[0088] For example, in the embodiment described above, an example was explained in which the power supply status to lower ECUs 20 and 30 and the communication status with lower ECUs 20 and 30 are detected with relay circuits 15 and 16 turned on, and the location of the abnormality is determined based on the detection results. In addition to this, the power supply status to lower ECUs 20 and 30 and the communication status with lower ECUs 20 and 30 are also detected with relay circuits 15 and 16 turned off, and the location of the abnormality is determined based on the detection results. This makes it possible to detect abnormalities such as when relay circuits 15 and 16 are short-circuited, resulting in power being unintentionally supplied to lower ECUs 20 and 30.

[0089] Furthermore, the flowchart in Figure 9 illustrates an example of detecting the communication status with the lower ECUs 20 and 30 when power is being supplied to them normally. However, the communication status with the lower ECUs 20 and 30 may be detected regardless of whether power is being supplied to them normally.

[0090] The systems and methods described in this disclosure may be implemented by a dedicated computer comprising a processor programmed to perform one or more functions embodied by a computer program. The systems and methods described in this disclosure may be implemented using dedicated hardware logic circuits. The systems and methods described in this disclosure may be implemented by one or more dedicated computers comprising a combination of a processor that executes a computer program and one or more hardware logic circuits. For example, some or all of the functions of the power / startup management ECU 10 may be implemented as hardware. Embodiments of implementing a certain function as hardware include embodiments using one or more ICs, etc. Some or all of the functions of the power / startup management ECU 10 may be implemented using a system-on-a-chip (SoC), an integrated circuit (IC), or a field-programmable gate array (FPGA). The concept of an IC also includes an application-specific integrated circuit (ASIC). Furthermore, the computer program only needs to be stored on a computer-readable non-transitory tangible storage medium as instructions executed by the computer. Suitable storage media for the program include HDDs (Hard-disk drives), SSDs (Solid State Drives), flash memory, etc. The scope of this disclosure also includes the form of a program for causing the computer to function as a power / startup management ECU 10, and a non-transitory physical storage medium such as semiconductor memory on which this program is stored.

[0091] (Disclosure of technical ideas) Finally, this specification discloses several technical concepts described in several sections listed below. Some sections may be written in a polynomial form, selectively referencing several preceding sections. Furthermore, some sections may be written in a multiple polynomial form, referencing several sections, including other sections in a polynomial form. These sections written in polynomial and multiple polynomial forms define several technical concepts. Furthermore, the several technical concepts described in the sections listed below also apply to methods for controlling in-vehicle network systems.

[0092] (Technical thought 1) An in-vehicle network system (100) in a vehicle having a plurality of control devices (10, 20, 30, 40, 50) connected to a communication bus (8) and capable of communicating with each other, The plurality of control devices include at least one higher-level control device (10) and a plurality of lower-level control devices (20, 30), The aforementioned higher-level control device is A power management unit (13) that turns on and off multiple relay circuits (15, 16) provided in each power supply line (6) of the multiple lower control devices, A startup management unit (12) receives network management messages (hereinafter referred to as NM messages) transmitted via the communication bus that selectively instruct the startup of a plurality of the lower-level control devices, on behalf of the plurality of the lower-level control devices, and instructs the power management unit to turn on the relay circuit provided in the power supply line of the lower-level control device that has been instructed to start by the NM message, thereby putting the lower-level control device that has been instructed to start into a startup state, An in-vehicle network system comprising: an abnormality location determination unit (17) that detects the power supply status to the lower-level control device and the communication status with the lower-level control device, and determines the location of the abnormality based on the detection result.

[0093] (Technical thought 2) The abnormality location determination unit detects the power supply status to the lower control device and the communication status with the lower control device with respect to the relay circuit that has been turned on, and determines the location of the abnormality based on the detection result, in the in-vehicle network system according to Technical Concept 1.

[0094] (Technical Thought 3) The aforementioned NM message includes startup cluster information that specifies a startup cluster indicating a group of control devices to be started, The higher-level control device has a storage unit (14) that stores cluster setting information indicating the cluster to which the lower-level control device belongs for each of the multiple lower-level control devices, The in-vehicle network system according to technical concept 1 or 2, wherein the startup management unit determines that the startup cluster specified in the startup cluster information of the NM message matches the cluster of the cluster setting information stored in the storage unit, and that the NM message instructs the startup of the lower-level control device corresponding to the relevant cluster setting information.

[0095] (Technical Thought 4) The in-vehicle network system according to technical concept 3, further comprising a modification unit (42) capable of modifying the cluster setting information of each of the multiple lower-level control units stored in the higher-level control unit.

[0096] (Technical Thought 5) The modified part is implemented in one of the multiple control devices connected to the communication bus, in the in-vehicle network system according to technical concept 4.

[0097] (Technical Thought 6) The above-level control device has a storage unit (14) that stores the cluster setting information of each of the plurality of lower-level control devices and relay connection information indicating the correspondence between the plurality of lower-level control devices and the plurality of relay circuits, wherein the in-vehicle network system is according to any one of technical ideas 3 to 5.

[0098] (Technical Thought 7) The above-level control unit turns on the relay circuit corresponding to the lower-level control unit where the startup cluster specified in the startup cluster information included in the NM message matches the cluster in the cluster setting information, and turns off the relay circuit corresponding to the lower-level control unit where they do not match, based on the cluster setting information and the relay connection information, in the in-vehicle network system according to technical concept 6.

[0099] (Technical Thought 8) The in-vehicle network system according to any one of technical concepts 1 to 7, wherein the abnormality location determination unit detects the amount of current flowing through the power supply line of the lower-level control device as the power supply status to the lower-level control device.

[0100] (Technical Thought 9) The in-vehicle network system according to technical concept 8, wherein the abnormality location determination unit determines that an abnormality has occurred in the power supply line of the lower-level control device when the detected current amount is greater than a first threshold for determining a short-circuit abnormality, or when the detected current amount is less than a second threshold for determining a wire break abnormality.

[0101] (Technical Thought 10) The in-vehicle network system according to technical concept 8 or 9, wherein the abnormality location determination unit, when the detected current amount is greater than a first threshold for determining a short circuit abnormality, or less than a second threshold for determining a wire break abnormality, repeatedly compares the detected current amount with the first threshold or the second threshold a predetermined number of times, and when, in the results of multiple comparisons, the current amount is found to be greater than the first threshold or less than the second threshold, determines that an abnormality has occurred in the power supply line of the lower-level control device.

[0102] (Technical Thought 11) The in-vehicle network system according to any one of technical ideas 8 to 10, wherein the abnormality location determination unit determines that an abnormality has occurred in the power supply line of the lower-level control device and / or the lower-level control device if the detected current amount is smaller than the minimum current consumption during normal operation of the lower-level control device when it is in an activated state.

[0103] (Technical Thought 12) The in-vehicle network system according to any one of technical concepts 9 to 11, wherein the abnormality location determination unit switches the relay circuit from on to off in response to determining that an abnormality has occurred in the power supply line of the lower-level control device.

[0104] (Technical Thought 13) The in-vehicle network system according to any one of technical concepts 1 to 12, wherein the abnormal location determination unit transmits a message to the lower control device via the communication bus as a communication status with the lower control device, and detects whether or not there is a response to the message.

[0105] (Technical Thought 14) The in-vehicle network system according to technical concept 13, wherein the abnormality location determination unit determines that an abnormality has occurred in the communication bus to the lower control unit and / or in the lower control unit if, despite the power supply status to the lower control unit being normal, a response to the message is not obtained from the lower control unit.

[0106] (Technical Thought 15) The in-vehicle network system according to technical concept 13, wherein the abnormality location determination unit attempts to recover from the abnormality by turning off the relay circuit and then turning on the relay circuit in response to determining that an abnormality has occurred in the communication bus with the lower control device or in the lower control device, and if no response to the message is obtained from the lower control device after attempting to recover a predetermined number of times, the unit determines that an abnormality has occurred in the communication bus with the lower control device and / or in the lower control device.

[0107] (Technical Thought 16) The in-vehicle network system according to technical concept 14 or 15, wherein the abnormality location determination unit turns off the relay circuit in response to determining that an abnormality has occurred in the communication bus with the lower control device and / or in the lower control device.

[0108] (Technical Thought 17) The in-vehicle network system according to any one of technical ideas 1 to 16, wherein the higher-level control device further comprises an abnormality transmission unit (18) that, when the abnormality location determination unit determines the location of an abnormality, creates an abnormality notification message including an identifier of the corresponding lower-level control device and / or information indicating the cluster to which the corresponding lower-level control device belongs, and transmits it to other control devices.

[0109] (Technical Thought 18) The above-level control device further comprises an abnormality storage unit (19) that stores information indicating the location of the abnormality when the abnormality location determination unit determines the location of the abnormality, in the in-vehicle network system according to any one of technical ideas 1 to 17. [Explanation of Symbols]

[0110] 2: Battery, 4: Power supply circuit, 6: Power supply line, 8: Communication bus, 10: Power / startup management ECU, 11: Communication interface, 12: Startup management unit, 13: Power management unit, 14: Memory unit, 15: First relay circuit, 16: Second relay circuit, 17: Anomaly location detection unit, 18: Anomaly transmission unit, 19: Anomaly memory unit, 20: First lower-level ECU, 21: Communication interface, 30: Second lower-level ECU, 31: Communication interface, 40: First normal ECU, 41: Communication interface, 42: PNC setting information change unit, 50: Second normal ECU, 51: Communication interface, 60: Data center, 100: In-vehicle network system

Claims

1. An in-vehicle network system (100) in a vehicle having a plurality of control devices (10, 20, 30, 40, 50) connected to a communication bus (8) and capable of communicating with each other, The plurality of control devices include at least one higher-level control device (10) and a plurality of lower-level control devices (20, 30), The aforementioned higher-level control device is A power management unit (13) that turns on and off multiple relay circuits (15, 16) provided in each power supply line (6) of the multiple lower control devices, A startup management unit (12) receives network management messages (hereinafter referred to as NM messages) transmitted via the communication bus that selectively instruct the startup of a plurality of the lower-level control devices, on behalf of the plurality of the lower-level control devices, and instructs the power management unit to turn on the relay circuit provided in the power supply line of the lower-level control device that has been instructed to start by the NM message, thereby putting the lower-level control device that has been instructed to start into a startup state, An in-vehicle network system comprising: an abnormality location determination unit (17) that detects the power supply status to the lower control unit and the communication status with the lower control unit, and determines the location of the abnormality based on the detection result.

2. The in-vehicle network system according to claim 1, wherein the abnormality location determination unit detects the power supply status to the lower control device and the communication status with the lower control device with respect to the relay circuit that has been turned on, and determines the location of the abnormality based on the detection result.

3. The aforementioned NM message includes startup cluster information that specifies a startup cluster indicating a group of control devices to be started, The higher-level control device has a storage unit (14) that stores cluster setting information indicating the cluster to which the lower-level control device belongs for each of the multiple lower-level control devices, The in-vehicle network system according to claim 1 or 2, wherein the startup management unit determines that the startup cluster specified in the startup cluster information of the NM message matches the cluster of the cluster setting information stored in the storage unit, and that the NM message instructs the startup of the lower-level control device corresponding to the relevant cluster setting information.

4. The in-vehicle network system according to claim 3, further comprising a modification unit (42) capable of modifying the cluster setting information of each of the plurality of lower-level control units stored in the higher-level control unit.

5. The in-vehicle network system according to claim 4, wherein the modified part is implemented in one of the plurality of control devices connected to the communication bus.

6. The in-vehicle network system according to claim 3, wherein the higher-level control device has a storage unit (14) that stores the cluster setting information of each of the plurality of lower-level control devices and relay connection information indicating the correspondence between the plurality of lower-level control devices and the plurality of relay circuits.

7. The in-vehicle network system according to claim 6, wherein the higher-level control unit turns on the relay circuit corresponding to the lower-level control unit whose startup cluster specified in the startup cluster information included in the NM message matches the cluster in the cluster setting information, and turns off the relay circuit corresponding to the lower-level control unit whose cluster does not match, based on the cluster setting information and the relay connection information.

8. The in-vehicle network system according to claim 1, wherein the abnormality location determination unit detects the amount of current flowing through the power supply line of the lower-level control device as the power supply status to the lower-level control device.

9. The in-vehicle network system according to claim 8, wherein the abnormality location determination unit determines that an abnormality has occurred in the power supply line of the lower-level control device if the detected current amount is greater than a first threshold for determining a short-circuit abnormality, or if the detected current amount is less than a second threshold for determining a wire break abnormality.

10. The in-vehicle network system according to claim 8, wherein the abnormality location determination unit, when the detected current amount is greater than a first threshold for determining a short circuit abnormality, or less than a second threshold for determining a wire break abnormality, repeatedly compares the detected current amount with the first threshold or the second threshold a predetermined number of times, and when, in the results of multiple comparisons, the current amount is greater than the first threshold or less than the second threshold, it determines that an abnormality has occurred in the power supply line of the lower-level control device.

11. The in-vehicle network system according to claim 8, wherein the abnormality location determination unit determines that an abnormality has occurred in the power supply line of the lower control device and / or the lower control device if the detected current amount is smaller than the minimum current consumption during normal operation of the lower control device when it is in an activated state.

12. The in-vehicle network system according to any one of claims 9 to 11, wherein the abnormality location determination unit switches the relay circuit from on to off in response to determining that an abnormality has occurred in the power supply line of the lower-level control device.

13. The in-vehicle network system according to claim 1, wherein the abnormal location determination unit transmits a message to the lower control device via the communication bus as a communication status with the lower control device, and detects whether or not there is a response to the message.

14. The in-vehicle network system according to claim 13, wherein the abnormality location determination unit determines that an abnormality has occurred in the communication bus to the lower control unit and / or the lower control unit if, despite the power supply status to the lower control unit being normal, a response to the message is not obtained from the lower control unit.

15. The in-vehicle network system according to claim 13, wherein the abnormality location determination unit attempts to recover from the abnormality by turning off the relay circuit and then turning on the relay circuit in response to determining that an abnormality has occurred in the communication bus with the lower control device or in the lower control device, and if no response to the message is obtained from the lower control device after attempting to recover a predetermined number of times, the unit determines that an abnormality has occurred in the communication bus with the lower control device and / or in the lower control device.

16. The in-vehicle network system according to claim 14 or 15, wherein the abnormality location determination unit turns off the relay circuit in response to determining that an abnormality has occurred in the communication bus with the lower control device and / or in the lower control device.

17. The in-vehicle network system according to claim 1, wherein the higher-level control device further comprises an abnormality transmission unit (18) that, when the abnormality location determination unit determines the location of an abnormality, creates an abnormality notification message including an identifier of the corresponding lower-level control device and / or information indicating the cluster to which the corresponding lower-level control device belongs, and transmits it to other control devices.

18. The above-level control device further comprises an abnormality storage unit (19) that stores information indicating the location of the abnormality when the abnormality location determination unit determines the location of the abnormality.

19. A control method for an in-vehicle network system (100) having a plurality of control devices (10, 20, 30, 40, 50) connected to a communication bus (8) and capable of communicating with each other, The plurality of control devices include at least one higher-level control device (10) and a plurality of lower-level control devices (20, 30), The higher-level control device has a power management unit (13) that turns on and off a plurality of relay circuits (15, 16) provided in each of the power supply lines (6) of the plurality of lower-level control devices. The higher-level control unit receives network management messages (hereinafter referred to as NM messages) transmitted via the communication bus, which selectively instruct the activation of the multiple lower-level control units, on behalf of the multiple lower-level control units (S100). The higher-level control unit turns on the relay circuit provided in the power supply line of the lower-level control unit that has been instructed to be started by the NM message, thereby putting the lower-level control unit that has been instructed to be started into an activated state (S130), and A control method for an in-vehicle network system, comprising: the higher-level control unit detecting the power supply status to the lower-level control unit and the communication status with the lower-level control unit, and determining the location of the abnormality based on the detection result (S140).

Images