Communication system

Abstract

To provide technology that can properly transmit data to its destination. [Solution] In the communication system 1, the Mobicon 3 and each zone ECU 5 are connected to communicate via the main communication line 11. The first zone ECU 5a and the second zone ECU 5b are connected to communicate via the first redundant communication line 13a, and the second zone ECU 5b and the second zone ECU 5c are connected to communicate via the second redundant communication line 13b. When the Mobicon 3 transmits data to the zone ECU 5 to be transmitted, it is configured to transmit data via the main communication line 11 connected to the zone ECU 5, and is also configured to transmit data to the zone ECU 5 to be transmitted by reducing the amount of data transmitted via a backup path that includes other main communication lines 11 and redundant communication lines 13 different from the main communication line 11.

Description

Technical Field

[0001] The present disclosure relates to a technology applicable to a system with redundant communication.

Background Art

[0002] In recent years, a communication control method for a ring network composed of a plurality of communication devices has been disclosed (see, for example, Patent Document 1). Note that a ring network is a network formed by connecting a plurality of nodes in a ring shape.

[0003] Also, as a fail-safe in case of communication failure, a method of redundant communication is known, and as one method of this redundancy, the above-described ring network has been proposed.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, as a result of the inventors' detailed examination, the following problems were found in the conventional technology. For example, when configuring a ring network using a main communication line and a communication line for redundancy (i.e., a redundant communication line), the communication data volume of the redundant communication line (i.e., the amount of data that can be transmitted per unit time, also referred to as the communication bandwidth) may be less than that of the main communication line.

[0006] However, when the amount of data transmitted via redundant communication lines is less than that transmitted via the main communication lines, there is insufficient consideration of how and under what circumstances data should be transmitted. For example, there is insufficient consideration of how data should be transmitted using redundant communication lines in the event of a communication failure on the main communication line.

[0007] One aspect of this disclosure aims to provide a technology that enables data to be properly transmitted to destinations within a ring network. [Means for solving the problem]

[0008] One aspect of the present disclosure relates to a communication system (1) comprising a first electronic control unit (3) and a plurality of second electronic control units (5). In the communication system, the first electronic control unit and the multiple second electronic control units are each connected to each other via a main path (11) so as to be communicative, and at least one of the multiple second electronic control units is connected to the other second electronic control units via a redundant path (13) which has a lower transmission capacity in terms of data communication volume than the main path.

[0009] The first electronic control unit is configured to transmit data to the second electronic control unit via a main path connected to the second electronic control unit, which is the target of the data transmission. It is also configured to transmit data to the second electronic control unit via backup paths, including other main paths and redundant paths, which reduce the amount of data transmitted.

[0010] With this configuration, the present disclosure allows data to be sent to the recipient via the main path, as well as via the redundant path. Furthermore, when sending data via the redundant path, the amount of data transmitted can be reduced. In addition, since data can be sent to the recipient via both the main path and the redundant path, data can still be sent via the redundant path even if communication on the main path is interrupted.

[0011] Furthermore, the reference numerals in parentheses in this section and in the claims indicate a correspondence with the specific means described later in the embodiments, and do not limit the technical scope of this disclosure. [Brief explanation of the drawing]

[0012] [Figure 1] This is a block diagram showing the configuration of the communication system according to the first embodiment. [Figure 2] Figure 2A is an explanatory diagram illustrating the functional configuration of the Mobicon, Figure 2B is an explanatory diagram illustrating the functional configuration of the Zone ECU, and Figure 2C is an explanatory diagram illustrating the functional configuration of the End-Side ECU. [Figure 3] This is an explanatory diagram showing the location of a communication interruption in a communication system. [Figure 4] This is a flowchart showing the first control process. [Figure 5] This is an explanatory diagram showing the location of a communication interruption and the backup path in a communication system (i.e., an explanatory diagram corresponding to the second control process). [Figure 6] This is a flowchart showing the second control process. [Figure 7] This is an explanatory diagram showing the location of a communication interruption and the backup path in a communication system (i.e., an explanatory diagram corresponding to the third control process). [Figure 8] This is a flowchart showing the third control process. [Figure 9] This is an explanatory diagram showing the location of a communication interruption and the backup path in the communication system (i.e., an explanatory diagram corresponding to the fourth control process). [Figure 10] This is a flowchart showing the fourth control process. [Figure 11] This is a block diagram showing the configuration of the communication system according to the second embodiment. [Figure 12] This is a block diagram showing the configuration of the communication system according to the third embodiment. [Figure 13] This is a flowchart showing the frame transmission process of the third embodiment. [Figure 14]It is a flowchart showing the frame transfer process of the third embodiment. [Figure 15] It is a flowchart showing the failure detection process of the third embodiment. [Figure 16] It is a flowchart showing the master startup process of the fourth embodiment. [Figure 17] It is a flowchart showing the slave startup process of the fourth embodiment. [Figure 18] It is a flowchart showing the restart process of the fourth embodiment.

Modes for Carrying Out the Invention

[0013] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings. [1. First Embodiment] [1-1. Overall Configuration] As shown in FIG. 1, the communication system 1 of the first embodiment is a communication system 1 mounted on a vehicle such as an automobile.

[0014] 0The communication system 1 of the first embodiment is based on a well-known zone architecture and uses a plurality of electronic control units arranged according to a division called a zone, which is a plurality of regions (i.e., locations in the vehicle).

[0015] The communication system 1 includes a mobile computer (i.e., a management control device) 3, a plurality of zone ECUs 5 (e.g., the first zone ECU 5a, the second zone ECU 5b, the third zone ECU 5c) communicably connected to the mobile computer 3, and a plurality of terminal-side ECUs 7 communicably connected to each zone ECU 5. As will be described later, this communication system 1 has a so-called ring network configuration. Note that the terminal-side ECU 7 may sometimes be simply referred to as the ECU 7. ECU is an abbreviation for Electronic Control Unit. [[ID=:36]]

[0016] Mobicon 3 is a control device capable of controlling each zone ECU 5 connected to Mobicon 3. Mobicon 3 and each zone ECU 5 are connected to each other via a main communication line 11, which is the main path, enabling communication between them. The main communication line 11 is a communication line capable of communication using, for example, Ethernet (registered trademark). Hereinafter, the communication line is referred to as a communication bus. Communication using CAN (for example, CAN FD) may also be possible. CAN stands for Controller Area Network, and CAN FD stands for CAN With Flexible Data Rate.

[0017] Examples of main communication lines 11 include a first main communication line 11a connected to the first zone ECU 5a, a second main communication line 11b connected to the second zone ECU 5b, and a third main communication line 11c connected to the third zone ECU 5c.

[0018] Each zone ECU 5 is a control device capable of controlling each terminal ECU 7 connected to it. The first zone ECU 5a and the second zone ECU 5b are connected via a redundant communication line 13a, which is a redundant communication line 13. The second zone ECU 5b and the third zone ECU 5c are connected via a similar redundant communication line 13b. The redundant communication line 13 is a communication line that can communicate using, for example, Ethernet or CAN. The redundant communication line 13 is a redundant path with lower data transmission capacity (i.e., less data that can be transmitted per unit time) compared to the main communication line 11.

[0019] In the following explanation, we will use the case where the first zone ECU 5a and the second zone ECU 5b are used as an example. Each zone ECU 5 and each terminal ECU 7 are connected by terminal communication lines 15 that enable CAN communication. Each zone ECU 5 is connected to multiple terminal communication lines 15 (for example, two lines), and each terminal communication line 15 is connected to multiple terminal ECU 7.

[0020] For example, the first zone ECU5a is connected to the first terminal ECU7a, second terminal ECU7b, third terminal ECU7c, fourth terminal ECU7d, fifth terminal ECU7e, sixth terminal ECU7f, etc. The second zone ECU5b is connected to the seventh terminal ECU7g, eighth terminal ECU7h, ninth terminal ECU7i, tenth terminal ECU7j, eleventh terminal ECU7k, twelfth terminal ECU7l, etc.

[0021] In this case, the amount of data that can be transmitted (i.e., the communication speed) has the following relationship: "Communication speed a of the main communication line 11 > 2 × (Communication speed c of each terminal communication line 15) > Communication speed c of the redundant communication line 13".

[0022] [1-2. Configuration of Each Control Device] Next, we will briefly explain the hardware configuration of each control device. <Mobicon> As shown in Figure 2A, the Mobicon 3 is an electronic control device that controls the overall operation of the communication system 1, and comprises a Mobicon control unit 21, a Mobicon storage unit 23, and a Mobicon communication unit 25.

[0023] The Mobicon control unit 21 is a device that performs various calculations related to the operation of the Mobicon 3, and is mainly composed of a microcomputer (hereinafter referred to as "microcontroller") having a well-known CPU 21a, RAM 21b, ROM 21c, etc.

[0024] The various functions of the Mobicon control unit 21 are realized by the CPU 21a executing a program stored in a non-transitional physical recording medium. In this example, for example, the ROM 21c corresponds to the non-transitional physical recording medium that stores the program. Furthermore, when this program is executed, the method corresponding to the program is executed.

[0025] The number of microcontrollers constituting the Mobicon control unit 21 may be one or more. Furthermore, the method for realizing the various functions of the Mobicon control unit 21 is not limited to software; some or all of its elements may be realized using one or more hardware components. For example, if the above functions are realized by an electronic circuit which is hardware, that electronic circuit may be a digital circuit containing many logic circuits, an analog circuit, or a combination thereof.

[0026] Examples of the Mobicon memory unit 23 include well-known non-volatile memory, such as flash memory or EEPROM, which can be rewritten with various types of data. The Mobicon communication unit 25 is a communication device that can communicate with each zone ECU 5, such as sending and receiving data, via each main communication line 11.

[0027] <Zone ECU> As shown in Figure 2B, the zone ECU 5 is an electronic control device that controls the operation of the zone ECU 5, and comprises a zone control unit 27, a zone storage unit 29, and a zone communication unit 31.

[0028] The zone control unit 27 is a device that performs various calculations related to the operation of the zone ECU 5, and is mainly composed of a microcontroller having, for example, a well-known CPU 27a, RAM 27b, ROM 27c, etc.

[0029] The various functions of the zone control unit 27 are realized by the CPU 27a executing a program stored in a non-transitional physical recording medium. Note that the zone control unit 27 is basically the same as the Mobicon control unit 21, etc., so its explanation will be omitted.

[0030] Examples of the zone storage unit 29 include well-known non-volatile memory, such as flash memory or EEPROM, which can be rewritten with various types of data. The zone communication unit 31 is a communication device that can communicate with the Mobicon 3, such as sending and receiving data, via each main communication line 11. It is also a communication device that can communicate with each terminal ECU 7, such as sending and receiving data, via terminal communication line 15.

[0031] <End side ECU> As shown in Figure 2C, the terminal ECU 7 is an electronic control device that controls the operation of the terminal ECU 7, and comprises a terminal control unit 33, a terminal storage unit 35, and a terminal communication unit 37.

[0032] The terminal control unit 33 is a device that performs various calculations related to the operation of the terminal ECU 7, and is mainly composed of a microcontroller having, for example, a well-known CPU 33a, RAM 33b, ROM 33c, etc.

[0033] The various functions of the terminal control unit 33 are realized by the CPU 33a executing a program stored in a non-transitional physical recording medium. Note that the terminal control unit 33 is basically the same as the Mobicon control unit 21, etc., so its explanation will be omitted.

[0034] Examples of terminal storage units 35 include well-known non-volatile memory, such as flash memory or EEPROM, which can be rewritten with various types of data. The terminal communication unit 37 is a communication device that enables communication such as sending and receiving data with each zone ECU 5 via each terminal communication line 15.

[0035] [1-3. Functional Configuration] Next, we will describe the functionality of communication system 1. Returning to Figure 1, the MobiCon 3 functionally comprises an App processing unit 3A, an interruption detection unit 3B, a communication path switching unit 3C, a data filter unit 3D, and a data transmission / reception unit 3E.

[0036] The first zone ECU 5a functionally comprises a disconnection detection unit 5aA, a communication path switching unit 5aB, a data filter unit 5aC, a data conversion unit 5aD, and a data transmission / reception unit 5aE. The second zone ECU 5b, like the first zone ECU 5a, functionally includes a disruption detection unit 5bA, a communication path switching unit 5bB, a data filter unit 5bC, a data conversion unit 5bD, and a data transmission / reception unit 5bE.

[0037] The following describes the functions of each configuration. The aforementioned App processing unit 3A has a mobile control function that exchanges data with each terminal ECU 7.

[0038] Interruption detection units 3B, 5aA, and 5bA have the function of detecting communication interruptions on the main communication line 11 (for example, the first and second main communication lines 11a and 11b). Of these, interruption detection units 5aA and 5bA have the function of detecting communication interruptions on the redundant communication line 13 (for example, the first and second redundant communication lines 13a and 13b).

[0039] The communication path switching units 3C, 5aA, and 5bA have the function of switching to a communication path using the redundant communication line 13 when communication on the main communication line 11 is interrupted. The data filter units 3D, 5aC, and 5bC have the function of determining whether the data requested for transmission is data that is to be transmitted at the time of the interruption (i.e., data to be transmitted at the time of interruption) when communication is interrupted, and if it is data to be transmitted at the time of interruption, reducing the amount of data (i.e., amount of information) as necessary (i.e., thinning out the data).

[0040] The data conversion units 5aD and 5bD have a function to change the amount of data to match the amount of data that can be transmitted on the redundant communication line 13 when communication on the main communication line 11 is interrupted, and to transmit the data while taking into account the priority when transmitting the data.

[0041] The data transmission / reception units 3E, 5aE, and 5bE have the function of transmitting and receiving data. Each terminal ECU 7 has the function of exchanging data with the MobiCon 3 via each zone ECU 5.

[0042] [1-4. Control Processing] Next, the control processes performed in communication system 1 will be described. <First control process> First, we will explain the process that occurs when communication is interrupted on the first main communication line 11a between Mobicon 3 and the first zone ECU 5a, as shown in Figure 3. In Figure 3, the location where communication was interrupted is indicated by an X. Here, we will explain the process up to switching the communication path. This process mainly describes the processes performed in the first zone ECU 5a.

[0043] As shown in Figure 4, in step (hereinafter referred to as S) 100, the first zone ECU 5a monitors for communication interruptions on the first main communication line 11a and the first redundant communication line 13a. In other words, it checks whether communication with the communication target is being carried out normally. For example, it checks whether the transmission and reception of predetermined data is being carried out normally.

[0044] In the subsequent S100, it is determined whether or not communication has been interrupted. If the determination is positive, the process proceeds to S120; if the determination is negative, it returns to S100. For example, if the transmission and reception of predetermined data could not be performed within a predetermined period, it can be determined that communication has been interrupted.

[0045] In S120, the location where communication was interrupted is determined. For example, by detecting that communication was interrupted on the first main communication line 11a (see Figure 3) or on the first redundant communication line 13a, the location where communication was interrupted can be determined.

[0046] In the subsequent S130, the location where communication was lost is notified to each terminal ECU7. For example, if communication is lost on the first main communication line 11a, the first zone ECU5a notifies the second zone ECU5b and the first to sixth terminal ECUs7a to 7f that communication has been lost and the location of the communication interruption. In other words, it notifies where communication was lost.

[0047] Furthermore, since this notification can be sent via broadcast, the notification content will also be sent to each device (i.e., node) connected to the second zone ECU5b, etc. For example, it will also be sent to Mobicon 3 and the third zone ECU5C.

[0048] In the subsequent S140, a process is performed to switch the communication path, and this process is temporarily terminated. The process of switching the communication path will be described in detail later, but for example, if communication is interrupted on the first main communication line 11a, a path (i.e., a backup path) is set up using the second main communication line 11b and the first redundant communication line 13a, which are not interrupted, and a process is performed to enable data transmission and reception via this backup path.

[0049] In addition to the above, Mobicon 3 may also detect a communication interruption on the main communication line 11. For example, if Mobicon 3 detects a communication interruption on the first main communication line 11a, it may notify the system of the detection via broadcast through the second and third main communication lines 11b and 11c.

[0050] Furthermore, as mentioned above, if the location of a communication interruption is notified, for example, if the recipient of the notification (i.e., a network node) has a so-called routing table containing information on the shortest path, it can update its routing table based on the notified information.

[0051] <Second control process> Next, as shown in Figure 5, when a communication interruption occurs on the first main communication line 11a between the Mobicon 3 and the first zone ECU 5a, a method will be described in which the communication path before the communication interruption (i.e., under normal conditions) is switched to the backup path BK, and data is transmitted, for example, from the Mobicon 3 to the first terminal side ECU 7a.

[0052] The communication path for transmitting data from Mobicon 3 to the first terminal ECU 7a is, under normal circumstances (i.e., when communication is not interrupted), "Mobicon 3 → First main communication line 11a → First zone ECU 5a → Terminal communication line 15 → First terminal ECU 7a".

[0053] In normal operation, for example, when Mobicon 3 transmits data to the first terminal ECU 7a, Mobicon 3 first transmits a communication frame containing the data to be transmitted to the first zone ECU 5a. As is well known, this communication frame contains data for the destination (i.e., the recipient). Upon receiving this communication frame, the first terminal ECU 7a can refer to its stored routing table (i.e., data containing data for the shortest transmission path, etc.) and transmit this communication frame to the first zone ECU 5a, which is the destination.

[0054] On the other hand, the backup route BK (i.e., the route shown by the thick solid line in Figure 5) that is set up when a communication failure occurs on the first main communication line 11a is "Mobicon 3 → second main communication line 11b → second zone ECU 5b → first redundant communication line 13a → first zone ECU 5a → terminal communication line 15 → first terminal ECU 7a".

[0055] Next, as shown in Figure 6, we will explain the process of sending data from Mobicon 3 to the first terminal ECU 7a via the backup path BK when a communication interruption occurs on the first main communication line 11a, or more specifically, the process of sending a communication frame containing the data to be sent.

[0056] As shown in Figure 6, first, the App processing unit 3A requests data transmission in S200. This request is processed by the Mobicon control unit 21, which then initiates the process of transmitting data from the Mobicon 3 to the data transmission target (for example, the first ECU 7a).

[0057] In the following S210, it is determined whether or not the data is data to be transmitted when communication is interrupted. Data to be transmitted when communication is interrupted is, for example, data that needs to be transmitted when communication on the first main communication line 11a is interrupted. Depending on the circumstances when communication is interrupted (for example, timing of driving status, etc.), the data that needs to be transmitted can be set in advance. If the determination is positive, the process proceeds to S220; if the determination is negative, the process proceeds to S320.

[0058] If the data is determined to be data to be transmitted during an interruption, it will be stored in a first table for data to be transmitted during an interruption, for example, as data to be transmitted via the backup path BK as described below. For example, the type of data and the numerical value of the data itself will be stored. If there are multiple types of data to be transmitted during an interruption (for example, vehicle speed data, temperature data, etc.), each can be stored in the first table.

[0059] In S320, since the data is not one to be transmitted during an interruption, the data is discarded and the process proceeds to S330. S330 sends a message to App processing unit 3A indicating that it could not send the message, and then terminates this process.

[0060] On the other hand, in S220, which proceeds after a positive judgment in S210, since the data is to be transmitted during an interruption, a process is performed to reduce the amount of data (i.e., a data thinning process) considering that the data cannot be transmitted over the first main communication line 11a, which has a high communication speed. In other words, a process is performed to reduce the amount of data transmitted.

[0061] One way to reduce the amount of data is to reduce the number of digits in quantitative data. For example, if there is data with two decimal places, the data may be reduced to one decimal place. In the case of image data, for example, this could involve reducing the number of pixels transmitted or reducing color information (for example, reducing the number of colors).

[0062] The data after thinning (i.e., the data actually sent) is stored, for example, in a second table. In the subsequent S230, Mobicon 3 transmits the aforementioned data (i.e., data with reduced data volume) to the second zone ECU 5b via the second main communication line 11b, which has not been interrupted.

[0063] Mobicon 3 has information on how Mobicon 3, each zone ECU 5, and each terminal ECU 7 are connected in a communicative manner. More specifically, Mobicon 3 has information on which zone ECU 5 to send data to in order to send it to the target terminal ECU 7 via the shortest path (for example, a path with the fewest relay nodes). Therefore, for example, when sending data from Mobicon 3 to the first terminal ECU 7a, the data is sent to the second zone ECU 5b via the second main communication line 11b.

[0064] In the subsequent S240, the second zone ECU5b receives data transmitted from Mobicon 3 (i.e., data with reduced data volume). In the subsequent S250, the second zone ECU 5b divides the data to match the frame payload size corresponding to the first redundant communication line 13a in order to transmit the data via the first redundant communication line 13a, which has a lower communication speed, and modifies the protocol accordingly. In other words, it modifies the communication frame used when transmitting the data to reduce the amount of data.

[0065] In the subsequent S260, the second zone ECU5b determines the data transmission order according to priority. For example, if there are multiple types of data to be transmitted (i.e., data to be transmitted when the connection is interrupted), the data with higher priority will be sent first (i.e., earlier in the transmission order).

[0066] Priority may be predetermined depending on the type of data. For example, if there is both speed data and temperature data, speed data is considered to be more prone to change, so the priority of speed data can be set higher than that of temperature data. Also, if a transmission priority is set in the communication frame, the transmission order may be set based on that priority information. For example, in Ethernet, priority can be set using various well-known methods (e.g., DSCP). DSCP stands for Differential Services Code Point.

[0067] In the subsequent S270, the second zone ECU5b sends data to the first zone ECU5a according to priority. Since the second zone ECU5b stores the routing table described above, if the destination is, for example, the first terminal ECU7a, it can send the data to the first zone ECU5a, which is the adjacent node determined by the shortest distance based on the destination data (e.g., the destination address).

[0068] In the subsequent S280, the first zone ECU 5a receives the aforementioned data from the second zone ECU 5b. In the subsequent S290, the first zone ECU 5a modifies the protocol to transmit data via CAN through the terminal communication line 15.

[0069] In the subsequent S300, the first zone ECU 5a transmits data to the first terminal ECU 7a via the terminal communication line 15. Since the first zone ECU 5a stores the routing table described above, if the destination is, for example, the first terminal ECU 7a, it can transmit data to the first terminal ECU 7a based on the destination data.

[0070] In the subsequent S310, the first terminal ECU7a receives the data transmitted from the first zone ECU5a and terminates this process. <Third control process> Next, as shown in Figure 7, when a communication interruption occurs on the first main communication line 11a between Mobicon 3 and the first zone ECU 5a, the method of switching the communication path before the communication interruption (i.e., under normal conditions) to the backup path BK and transmitting data from the first terminal side ECU 7a to Mobicon 3 will be described.

[0071] In such cases, the backup route BK will be "First terminal ECU7a → Terminal communication line 15 → First zone ECU5a → First redundant communication line 13a → Second zone ECU5b → Second main communication line 11b → Mobicon 3".

[0072] Here, as shown in Figure 8, we will explain the process of sending data from the first terminal ECU 7a to the Mobicon 3 via the backup path BK when a communication interruption occurs on the first main communication line 11a, and more specifically, the process of sending a communication frame containing the data to be sent.

[0073] Furthermore, if a communication interruption occurs on the first main communication line 11a, it is detected by Mobicon 3 and the first zone ECU 5a, and broadcast from Mobicon 3 and the first zone ECU 5a to each node connected to the network. Each node can then receive this information and update its routing table. This makes it possible to change the data transmission route in response to a communication interruption on the first main communication line 11a.

[0074] As shown in Figure 8, for example, the first terminal ECU 7a requests data transmission in S400. In other words, the first terminal ECU 7a requests processing to transmit data to the Mobicon 3, which is the final destination.

[0075] In the subsequent S410, the first terminal ECU 7a transmits data (i.e., a communication frame) to the first zone ECU 5a via the terminal communication line 15. In the following S420, the first zone ECU 5a receives data transmitted from the first terminal side ECU 7a.

[0076] In the following step S430, the first zone ECU 5a determines whether the received data is data to be transmitted during an interruption. If the determination is positive, the process proceeds to S440; if the determination is negative, the process proceeds to S520.

[0077] In S520, since the data is not one to be transmitted during an interruption, the data is discarded and the process proceeds to S530. S530 sends a message to the first terminal ECU7a indicating that transmission failed, and then terminates this process.

[0078] On the other hand, in S440, which proceeds after a positive judgment in S430, since the data is to be transmitted during an interruption, a process to reduce the amount of data (i.e., data thinning) is performed, taking into consideration that the data will be transmitted over the first redundant communication line 13a, which has a lower communication speed. However, if the amount of data transmitted over the terminal communication line 15 is small, the data thinning process may be omitted.

[0079] In the subsequent S450, the first zone ECU 5a divides the data to match the frame payload size corresponding to the first redundant communication line 13a in order to transmit the data over the first redundant communication line 13a, which has a lower communication speed, and modifies the protocol accordingly.

[0080] In the subsequent S460, the first zone ECU5a determines the data transmission order according to priority. In the subsequent S470, the first zone ECU 5a transmits data to the second zone ECU 5b according to priority. Since the first zone ECU 5a stores the routing table described above, if the destination is, for example, Mobicon 3, it can transmit the data to the second zone ECU 5b, which is the adjacent node determined by the shortest distance based on the destination data (for example, the destination address).

[0081] In the subsequent S480, the second zone ECU 5b receives the aforementioned data from the first zone ECU 5a. In the subsequent S490, the second zone ECU 5b changes the protocol to transmit data via the second main communication line 11b.

[0082] In the subsequent S500, the second zone ECU 5b transmits data to the Mobicon 3 via the second main communication line 11b. Since the second zone ECU 5b stores the routing table described above, if the destination is, for example, the Mobicon 3, it can transmit data to the Mobicon 3 based on the destination data.

[0083] In the subsequent S510, Mobicon 3 receives data transmitted from the second zone ECU 5b and temporarily terminates this process. <Fourth control process> Next, we will explain the case where a communication interruption occurs on the first redundant communication line 13a between the first zone ECU 5a and the second zone ECU 5b, as shown in Figure 9.

[0084] Furthermore, any communication interruption on the first redundant communication line 13a is detected by the first zone ECU 5a and the second zone ECU 5b. These two zone ECUs then broadcast this information to each node connected to the network, allowing each node to receive the information and update its routing table.

[0085] As shown in Figure 10, for example, the first zone ECU 5a monitors for communication path interruptions in S600. Then, in S610, it is determined whether or not there are any routes where communication has been interrupted. If the determination is positive, the process proceeds to S620; if the determination is negative, it returns to S600.

[0086] The S620 determines the location where communication was lost. In the subsequent S630, the communication interruption and the location of the communication interruption are notified to each end-side ECU7. A similar notification may also be sent to Mobicon 3.

[0087] Similarly, for example, the second zone ECU5b monitors for communication path interruptions at S640. Then, in S650, it is determined whether or not there are any routes where communication has been interrupted. If the determination is positive, the process proceeds to S660; if the determination is negative, it returns to S640.

[0088] The S660 determines the location where communication was lost. In the subsequent S670, the communication interruption and the location of the communication interruption are notified to each end-side ECU7. A similar notification may also be sent to Mobicon 3.

[0089] Then, in the processing following S630 and S640, S680 performs information arbitration at each terminal ECU7. In other words, each terminal ECU7 receives various information (for example, information on which communication path has been blocked) from Mobicon 3, the first zone ECU5a, the second zone ECU5b, etc., and here, the information received first is adopted.

[0090] In the subsequent S680, each terminal ECU7 switches the communication path as needed and then terminates this process. For example, when considering the transmission of data from each terminal ECU 7 to the Mobicon 3, even if a communication interruption occurs on the first redundant communication line 13a, the same communication path as under normal conditions can be used. For instance, when transmitting data from the first terminal ECU 7a to the Mobicon 3, the data can be transmitted from the first zone ECU 5a via the first main communication line 11a without using the first redundant communication line 13a.

[0091] Similarly, when transmitting data from the seventh terminal ECU 7g to the Mobicon 3, the data can be transmitted from the second zone ECU 5b via the second main communication line 11b without using the first redundant communication line 13a.

[0092] [1-5. Effects] According to this first embodiment, the following effects can be obtained. (1a) In this first embodiment, in the communication system 1, the Mobicon 3 and each zone ECU 5 are each connected to communicate via the main communication line 11. The first zone ECU 5a and the second zone ECU 5b are connected to communicate via a first redundant communication line 13a which has a lower transmission capacity in terms of data communication volume than the main communication line 11 (for example, a smaller amount of data that can be transmitted per unit time), and the second zone ECU 5b and the third zone ECU 5c are connected to communicate via a similar second redundant communication line 13b.

[0093] Furthermore, when Mobicon 3 transmits data to a target zone ECU 5, it is configured to transmit data via the main communication line 11 connected to that zone ECU 5, and is also configured to transmit data to the target zone ECU 5 with reduced data traffic via a backup path BK that includes other main communication lines 11 and redundant communication lines 13 different from the main communication line 11.

[0094] With this configuration, in this first embodiment, data can be transmitted to a target recipient via a main communication line 11, and also via a redundant communication line 13 to the same target recipient. Furthermore, when transmitting data via the redundant communication line 13, the amount of data transmitted can be reduced. Moreover, since data can be transmitted to a target recipient via both the main communication line 11 and the redundant communication line 13, even if communication on the main communication line 11 is interrupted, data can still be transmitted via the redundant communication line 13.

[0095] (1b) In this first embodiment, the Mobicon 3 is equipped with a disconnection detection unit 3B and each zone ECU 5 is equipped with disconnection detection units 5aA and 5bA in order to detect a disconnection of communication on the main communication line 11 between the Mobicon 3 and each zone ECU 5. When a disconnection of communication on the main communication line 11 is detected by each disconnection detection unit 3B, 5aA, or 5bA, data can be transmitted through a backup path BK that includes the other main communication lines 11 and redundant communication lines 13.

[0096] For example, if the interruption detection unit 3B of the Mobicon 3 detects an interruption in communication on the main communication line 11, it can perform processing to transmit data via the backup route BK.

[0097] (1c) In this first embodiment, when the Mobicon 3 and each zone ECU 5 transmit data via the backup path BK, the amount of information (i.e., the amount of data) to be transmitted can be reduced. Therefore, even if the transmission capacity of the redundant communication line 13 is low, necessary data (for example, data necessary for controlling the vehicle's movement) can be transmitted at the appropriate timing, even if the amount of data is small.

[0098] (1d) In this first embodiment, when the Mobicon 3 and each zone ECU 5 transmit data via the backup path BK, they can choose not to transmit data if the data to be transmitted is not the data to be transmitted when communication is interrupted. This suppresses the transmission of data that is not needed and allows necessary data to be transmitted at the appropriate time.

[0099] (1e) In this first embodiment, when each zone ECU 5 transmits data via the redundant communication line 13, it can divide and transmit the data in accordance with the amount of data that can be transmitted via the redundant communication line 13.

[0100] (1f) In this first embodiment, when each zone ECU 5 transmits data via the redundant communication line 13, it can transmit data based on priority information that defines the transmission priority of the data to be transmitted. This allows necessary data to be transmitted preferentially.

[0101] (1g) In this first embodiment, when each zone ECU 5 transmits data via the redundant communication line 13, it can transmit data according to a predetermined transmission priority depending on the case of a communication interruption. This allows necessary data to be transmitted preferentially.

[0102] [1-6. Correspondence] Next, the relationship between this disclosure and this first embodiment will be described. The communication system corresponds to communication system 1, the first electronic control unit corresponds to Mobicon 3, the second electronic control unit corresponds to each zone ECU 5, the main path corresponds to each main communication line 11, and the redundant path corresponds to each redundant communication line 13.

[0103] [2. Second Embodiment] Since the basic configuration of the second embodiment is the same as that of the first embodiment, the differences from the first embodiment will be described below. Reference numerals that are the same as those in the first embodiment indicate the same components, and refer to the preceding description.

[0104] This second embodiment differs from the first embodiment in the configuration of the communication system, so the explanation will focus on the differences. [2-1. Structure] The communication system of this second embodiment is based on a well-known domain architecture and uses multiple electronic control devices classified into multiple domains (i.e., separated by function).

[0105] As shown in Figure 11, the communication system 101 of this embodiment comprises a plurality of domain ECUs 105 and a plurality of terminal ECUs 107 that are each connected to each domain ECU 105 in a communicative manner.

[0106] Of the multiple domain ECUs 105, the first domain ECU 105a, the second domain ECU 105b, and the third domain ECU 105c are connected to each other via a main communication line 111, similar to the first embodiment.

[0107] The first domain ECU 105a and the second domain ECU 105b are communicated to each other via a first redundant communication line 113a, which is a redundant communication line 113 similar to that in the first embodiment. The second domain ECU 105b and the third domain ECU 105c are communicated to each other via a similar second redundant communication line 113b.

[0108] In the following explanation, we will use the case where the first domain ECU105a and the second domain ECU105b are used as an example. Each domain ECU 105 and each terminal ECU 107 are connected by terminal communication lines 115, similar to those in the first embodiment.

[0109] The functional configuration of each domain ECU105, namely the interruption detection unit, communication path switching unit, data filter unit, data conversion unit, and data transmission / reception unit, is the same as in the first embodiment.

[0110] [2-2. Operation and Effects] This second embodiment provides the same effects as the first embodiment. In this second embodiment, for example, if a communication interruption occurs between the first domain ECU 105a and the second domain ECU 105b on the main communication line 111, data can be transmitted and received between the first to sixth terminal ECUs 107a to 107f and the second domain ECU 105b using a backup route BK with the first redundant communication line 111a, instead of the normal route.

[0111] [3. Third Embodiment] Since the basic configuration of the third embodiment is the same as that of the first embodiment, the differences from the first embodiment will be described below. Note that the same reference numerals as in the first embodiment indicate the same components, and refer to the preceding description.

[0112] [3-1. Structure] In this third embodiment, the in-vehicle communication system 201 includes a management ECU 202, control ECUs 203, 204, 205, slave ECUs 206, 207, 208, 209, 210, 211, and batteries 212, 213, as shown in Figure 12.

[0113] The management ECU 202 coordinates the control ECUs 203, 204, and 205 to achieve coordinated control throughout the entire vehicle. The control ECUs 203, 204, and 205 are provided for each zone into which the vehicle is divided, and primarily control the slave ECUs located within that zone.

[0114] Slave ECUs 206 and 207 belong to the same zone as control ECU 203. Slave ECUs 208 and 209 belong to the same zone as control ECU 204. Slave ECUs 210 and 211 belong to the same zone as control ECU 205.

[0115] Batteries 212 and 213 supply power to various parts of the vehicle with a DC battery voltage (for example, 12V). The control ECU 203 receives power from the battery 212 via a power supply path 221 between the battery 212 and the control ECU 203. The control ECU 204 receives power from the battery 213 via a power supply path 222 between the battery 213 and the control ECU 204. The control ECU 205 receives power from the battery 213 via a power supply path 223 between the battery 213 and the control ECU 205.

[0116] Slave ECUs 206 and 207 receive power from battery 212 via power supply paths 224 and 225 between control ECU 203 and slave ECUs 206 and 207, respectively. Slave ECUs 208 and 209 receive power from battery 213 via power supply paths 226 and 227 between control ECU 204 and slave ECUs 208 and 209, respectively. Slave ECUs 210 and 211 receive power from battery 213 via power supply paths 228 and 229 between control ECU 205 and slave ECUs 210 and 211, respectively.

[0117] The management ECU 202 and control ECU 203 are connected to each other via communication line 231, enabling data communication. The management ECU 202 and control ECU 204 are connected to each other via communication line 232, enabling data communication. The management ECU 202 and control ECU 205 are connected to each other via communication line 233, enabling data communication.

[0118] Control ECU 203 and control ECU 204 are connected to each other via communication line 234 to enable data communication. Control ECU 204 and control ECU 205 are connected to each other via communication line 235 to enable data communication. Control ECU 203 and slave ECUs 206 and 207 are connected to each other via communication line 236 to enable data communication.

[0119] The control ECU 204 and the slave ECUs 208 and 209 are connected to each other via communication line 237, enabling data communication. The control ECU 205 and the slave ECUs 210 and 211 are connected to each other via communication line 238, enabling data communication.

[0120] The management ECU 202 comprises a control unit 241, a communication unit 242, and a storage unit 243. The control unit 241 is an electronic control unit that is mainly composed of a microcomputer equipped with a CPU 51, ROM 52, RAM 53, etc.

[0121] The communication unit 242 communicates with the control ECU 203 connected to communication line 231, with the control ECU 204 connected to communication line 232, and with the control ECU 205 connected to communication line 233 by sending and receiving communication frames based on, for example, the Ethernet communication protocol. Here, communication lines 231, 232, and 233 correspond to the main communication lines described above.

[0122] The memory unit 243 is a storage device for storing various types of data. The memory unit 243 stores the management table 256, which will be described later. The control ECU 203 comprises a control unit 261, a communication unit 262, a CAN communication unit 263, a storage unit 264, and power distribution switches 265 and 266. The CAN communication unit 262 communicates using the CAN communication protocol (the same applies to the other CAN communication units below).

[0123] The control unit 261 is an electronic control unit that is mainly composed of a microcomputer equipped with a CPU 271, ROM 272, RAM 273, etc. The communication unit 262 communicates with the management ECU 202 connected to the communication line 231 by sending and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 262 may also send and receive communication frames with the control ECU 204 connected to the communication line 234 based on, for example, the Ethernet or CAN communication protocol. In this case, the communication line 234 may be the redundant communication line described above, which has a lower transmission capacity than the main communication line.

[0124] The CAN communication unit 263 communicates with the slave ECUs 206 and 207 connected to the communication line 236 by sending and receiving communication frames based on the CAN communication protocol.

[0125] The memory unit 264 is a memory device for storing various types of data. The power distribution switch 265 is located on the power supply path 224, which is connected to the power supply path 221. The power distribution switch 265 is configured to conduct or interrupt the power supply path 224 according to commands from the control unit 261.

[0126] The power distribution switch 266 is located on the power supply path 225, which is connected to the power supply path 221. The power distribution switch 266 is configured to conduct or interrupt the power supply path 225 according to commands from the control unit 261.

[0127] The control ECU 204 includes a control unit 281, a communication unit 282, a CAN communication unit 283, a storage unit 284, and power distribution switches 285 and 286. The control unit 281 is an electronic control unit that is mainly composed of a microcomputer equipped with a CPU 291, ROM 292, RAM 293, etc.

[0128] The communication unit 282 communicates with the management ECU 202 connected to the communication line 232 by sending and receiving communication frames based on, for example, the Ethernet communication protocol. It may also send and receive communication frames based on, for example, the Ethernet or CAN communication protocol with the control ECU 203 connected to the communication line 234, and with the control ECU 205 connected to the communication line 235. In this case, the communication line 235 may be the redundant communication line described above, which has a lower transmission capacity than the main communication line.

[0129] The CAN communication unit 283 communicates with the slave ECUs 208 and 209 connected to the communication line 237 by sending and receiving communication frames based on the CAN communication protocol.

[0130] The memory unit 284 is a memory device for storing various types of data. The power distribution switch 285 is located on the power supply path 226, which is connected to the power supply path 222. The power distribution switch 285 is configured to conduct or interrupt the power supply path 226 according to commands from the control unit 281.

[0131] The power distribution switch 286 is located on the power supply path 227, which is connected to the power supply path 222. The power distribution switch 286 is configured to conduct or interrupt the power supply path 227 according to commands from the control unit 281.

[0132] The control ECU 205 comprises a control unit 301, a communication unit 302, a CAN communication unit 303, a storage unit 304, and power distribution switches 305 and 306. The control unit 301 is an electronic control unit that is mainly composed of a microcomputer equipped with a CPU 311, ROM 312, RAM 313, etc.

[0133] The communication unit 302 communicates with the management ECU 202 connected to the communication line 233 by sending and receiving communication frames based on, for example, the Ethernet communication protocol. It may also send and receive communication frames with the control ECU 204 connected to the communication line 235 based on, for example, the Ethernet or CAN communication protocol.

[0134] The CAN communication unit 303 communicates with the slave ECUs 210 and 211 connected to the communication line 238 by sending and receiving communication frames based on the CAN communication protocol.

[0135] The memory unit 304 is a memory device for storing various types of data. The power distribution switch 305 is located on the power supply path 228, which is connected to the power supply path 223. The power distribution switch 305 is configured to conduct or interrupt the power supply path 228 according to commands from the control unit 301.

[0136] The power distribution switch 306 is located on the power supply path 229, which is connected to the power supply path 223. The power distribution switch 306 is configured to conduct or interrupt the power supply path 229 according to commands from the control unit 301.

[0137] The management table 256 contains, for each of several events, a correspondence between the event and the power distribution switch that will turn it on (i.e., the power supply path will be open) and the power distribution switch that will turn it off (i.e., the power supply path will be blocked).

[0138] Specifically, the management table 256 contains six pieces of switching information for each event, indicating whether to turn on or off each of the power distribution switches 265, 266, 285, 286, 305, and 306.

[0139] When the management ECU 202 detects an event, it extracts six pieces of switching information corresponding to the detected event from the management table 256. The management ECU 202 then generates a communication frame containing the six extracted pieces of switching information as an NM frame and transmits the generated NM frame. NM stands for Network Management.

[0140] When the control ECU 203 receives an NM frame transmitted by the management ECU 202, it extracts the switching information of the power distribution switches 265 and 266 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 265 and 266 to either the ON or OFF state.

[0141] When the control ECU 204 receives an NM frame transmitted by the management ECU 202, it extracts the switching information of the power distribution switches 285 and 286 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 285 and 286 to either the ON or OFF state.

[0142] When the control ECU 205 receives an NM frame transmitted by the management ECU 202, it extracts the switching information of the power distribution switches 305 and 306 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 305 and 306 to either the ON or OFF state.

[0143] [3-2. Processing] <Frame transmission process> Next, the procedure for frame transmission processing performed by the control unit 241 of the management ECU 202 will be described. Frame transmission processing is a process that is repeatedly performed while the management ECU 202 is operating.

[0144] As shown in Figure 13, when the frame transmission process is executed, the CPU 251 of the control unit 241 determines in S710 whether or not an event has been detected. If no event has been detected, the CPU 251 terminates the frame transmission process.

[0145] On the other hand, if an event is detected, CPU 251 extracts six switching information items corresponding to the detected event from management table 256 in S720 and generates an NM frame containing the six extracted switching information items.

[0146] CPU 251, in S730, starts the process of sending the NM frame generated in S720 to control ECUs 203, 204, and 205 via communication lines 231, 232, and 233 respectively, and then finishes the frame transmission process. As a result, management ECU 202 periodically and repeatedly sends the NM frame generated in S720.

[0147] <Frame transfer processing> Next, the procedure for frame transfer processing performed by the control units 261, 281, and 301 of the control ECUs 203, 204, and 205 will be described. Frame transfer processing is a process that is repeatedly performed while the control ECUs 203, 204, and 205 are operating.

[0148] When frame transfer processing is executed, the CPUs 271, 291, and 311 of the control units 261, 281, and 301 determine in S810 whether or not an NM frame has been received, as shown in Figure 14. If an NM frame has not been received, the CPUs 271, 291, and 311 terminate the frame transfer processing.

[0149] On the other hand, when an NM frame is received, CPUs 271, 291, and 311 forward the received NM frame at S820 via the remaining communication lines, excluding the communication lines 231, 232, and 233 connected to the management ECU 202, and the communication line used to receive the NM frame at S810.

[0150] For example, if the control ECU 203 receives an NM frame from the management ECU 202 via the communication line 231, it forwards the NM frame to the control ECU 204 via the communication line 234.

[0151] For example, if the control ECU 203 receives an NM frame from the control ECU 204 via the communication line 234, it does not perform the forwarding of the NM frame. For example, if the control ECU 204 receives an NM frame from the management ECU 202 via communication line 232, it forwards the NM frame to the control ECUs 203 and 205 via communication lines 234 and 235.

[0152] For example, if the control ECU 204 receives an NM frame from the control ECU 203 via the communication line 234, it forwards the NM frame to the control ECU 205 via the communication line 235.

[0153] For example, if the control ECU 204 receives an NM frame from the control ECU 205 via the communication line 235, it forwards the NM frame to the control ECU 203 via the communication line 234.

[0154] For example, if the control ECU 205 receives an NM frame from the management ECU 202 via the communication line 233, it forwards the NM frame to the control ECU 204 via the communication line 235.

[0155] For example, if the control ECU 205 receives an NM frame from the control ECU 204 via the communication line 235, it does not perform the forwarding of the NM frame. CPUs 271, 291, and 311 determine whether they have already received an NM frame from the same source (i.e., management ECU 202) within the period between the time S810 determines that it has received an NM frame and the time S810 determines that it has received an NM frame (hereinafter referred to as the same frame reception determination period). Note that the NM frame contains a source address indicating the source.

[0156] The same frame reception determination period is set based on the difference in the timing of receiving NM frames for each communication line when the control ECU receives NM frames via multiple communication lines.

[0157] For example, in the control ECU 204, the same frame reception determination period is set based on the differences in timing when an NM frame is received from communication line 231, when an NM frame is received via communication lines 232 and 234, and when an NM frame is received via communication lines 233, 234, and 235. The same frame reception determination period may be the same for control ECUs 203, 204, and 205, or it may be different for control ECUs 203, 204, and 205.

[0158] If an NM frame from the same source has already been received within the same frame reception determination period, CPUs 271, 291, and 311 terminate the frame transfer process. On the other hand, if no NM frame from the same source has already been received within the same frame reception determination period, CPUs 271, 291, and 311 return an acknowledgment at S840 via the communication line on which the NM frame was received at S810.

[0159] For example, if the control ECU 204 receives an NM frame from the management ECU 202 via the communication line 232, it returns an acknowledgment to the management ECU 202 via the communication line 232. Also, if the control ECU 204 receives an NM frame from the control ECU 203 via the communication line 234, it returns an acknowledgment to the control ECU 203 via the communication line 234.

[0160] CPUs 271, 291, and 311, at S850, turn on or off the power distribution switches under them based on the switching information contained in the NM frame received by S810, and then terminate the frame transfer process.

[0161] <Fault detection process> Next, the procedure for fault detection processing performed by the control units 261, 281, and 301 of the control ECUs 203, 204, and 205 will be described. Fault detection processing is a process that is repeatedly performed while the control ECUs 203, 204, and 205 are operating.

[0162] When fault detection processing is executed, the CPUs 271, 291, and 311 of the control units 261, 281, and 301 determine in S910 whether there is currently a communication line that is periodically receiving NM frames, as shown in Figure 15. If there is no communication line currently receiving NM frames periodically, the CPUs 271, 291, and 311 terminate the fault detection processing.

[0163] On the other hand, if there is currently a communication line that is receiving NM frames periodically, CPUs 271, 291, and 311 determine in S220 whether other communication lines identified in S910 are currently receiving NM frames periodically.

[0164] If, at this point, NM frames are being received periodically on other communication lines besides the one identified in S910, CPUs 271, 291, and 311 terminate the fault detection process. On the other hand, if NM frames are not being received periodically on other communication lines besides the one identified in S910, CPUs 271, 291, and 311 determine in S930 that a communication interruption has occurred on the communication line that is not currently receiving NM frames periodically.

[0165] For example, if communication line 232 is disconnected, the control ECU 204 will periodically receive NM frames from control ECUs 203 and 205 via communication lines 234 and 235, but will not be able to receive NM frames from management ECU 202 via communication line 232. Therefore, the control ECU 204 will determine that a communication interruption has occurred on communication line 232.

[0166] For example, if communication line 234 is disconnected, the control ECU 204 will periodically receive NM frames from the management ECU 202 and control ECU 205 via communication lines 232 and 235, but will not be able to receive NM frames from the control ECU 203 via communication line 234. Therefore, the control ECU 204 will determine that a communication interruption has occurred on communication line 234.

[0167] For example, if communication line 231 is disconnected, the control ECU 203 will periodically receive NM frames from the control ECU 204 via communication line 234, but will not be able to receive NM frames from the management ECU 202 via communication line 231. Therefore, the control ECU 203 will determine that a communication interruption has occurred on communication line 231.

[0168] CPUs 271, 291, and 311 notify the management ECU 202 of the communication line interruption determination result in S940, indicating the communication line where the communication interruption has occurred. Upon receiving the interruption determination result, the management ECU 202 stores the diagnostic information indicating the received interruption determination result in the storage unit 243 as a fail-safe action. The management ECU 202 may also notify the vehicle occupants that a communication interruption has occurred.

[0169] CPUs 271, 291, and 311 store the diagnostic information indicating the interruption determination result notified in S840 in memory units 264, 284, and 304 in S850, and terminate the fault detection process. This fault detection process does not need to be performed if the control ECU, which is the communication partner, is in sleep mode.

[0170] [3-3. Effects] (3a) In this third embodiment, even if the management ECU 202 is unable to transmit an NM frame to the control ECU 203 via the communication line 231, the management ECU 202 can transmit an NM frame to the control ECU 203 via the communication lines 232 and 234. Also, even if the management ECU 202 is unable to transmit an NM frame to the control ECU 204 via the communication line 232, the management ECU 202 can transmit an NM frame to the control ECU 204 via the communication lines 231 and 234. This makes it possible to prevent the inability to switch between allowing and denying power supply to the slave ECUs 206 and 208.

[0171] (3b) In this third embodiment, the control ECU 203 is configured to transmit NM frames received from the management ECU 202 to the control ECU 204 via the communication line 234, even when the communication line 232 is available. The control ECU 204 is configured to transmit NM frames received from the management ECU 202 to the control ECU 203 via the communication line 234, even when the communication line 231 is available. Therefore, the control ECUs 203 and 204 can transmit NM frames via the communication line 234 even under normal circumstances when both communication lines 231 and 232 are available.

[0172] (3c) In this third embodiment, even if communication lines 231 and 232 cannot be used, NM frames can be transmitted to control ECUs 203 and 204 via communication lines 233, 234 and 235, thereby further suppressing the inability to switch between allowing and denying power supply to slave ECUs 206 and 208.

[0173] (3d) In this third embodiment, control ECUs 203, 204, and 205 are configured to determine that a communication interruption has occurred in communication line 231 to 235 if they periodically receive a management frame on at least one of the communication lines 231 to 235 connected to them, and do not periodically receive an NM frame on at least one of the communication lines 231 to 235 connected to them. With this configuration, it is possible to identify the communication line 231 to 235 where an abnormality has occurred.

[0174] (3e) In this third embodiment, the management ECU 202 can be made aware of the communication lines 231 to 235 where an abnormality has occurred. (3f) The third embodiment provides the same effects as the first embodiment in terms of configuration. Furthermore, in the third embodiment, data can be transmitted to a communication target via the main communication line as well as using redundant communication lines, thereby increasing the redundancy of communication.

[0175] [4. Fourth Embodiment] Since the basic configuration of the fourth embodiment is the same as that of the third embodiment, the differences from the first embodiment will be described below. Note that the same reference numerals as in the third embodiment indicate the same components, and refer to the preceding description.

[0176] In the third embodiment described above, the management ECU 202 transmits NM frames to each of the multiple communication lines 231 to 233, and the control ECUs 203, 204, and 205 are configured to relay the NM frames to each other. In contrast, in the fourth embodiment, a communication path to be used (for example, a normally used communication path) is set in advance for each communication partner, and the management ECU 202 transmits an NM frame to only one communication line 231 to 233 that corresponds to the communication path set in association with a predetermined communication partner. This differs from the third embodiment in that the NM frames are relayed according to that communication path.

[0177] [4-1. Structure] As described above, in the fourth embodiment of the communication system 201, a communication path is set in advance for each communication partner. Specifically, the storage unit 243 of the management ECU 202 and the storage units 264, 284, and 304 of the control ECUs 203, 204, and 205 store information regarding the communication path to be used for each communication partner in a rewritable format. The information regarding the communication path is, for example, information about the ports corresponding to the communication lines 231 to 238 that should be used for each communication partner, and is information necessary when communicating along a predetermined communication path.

[0178] The communication paths between each device constituting the communication system 201 (i.e., the management ECU 202, control ECUs 203, 204, 205, and slave ECUs 206-211) are basically configured to minimize the number of hops. For example, the communication path from management ECU 202 to slave ECU 206 is configured to communicate via communication line 231, control ECU 203, and communication line 236 in that order. Also, for example, the communication path from slave ECU 208 to management ECU 202 is configured to communicate via communication line 237, control ECU 204, and communication line 232 in that order. Also, for example, the communication path from slave ECU 206 to slave ECU 208 is configured to communicate via communication line 236, control ECU 203, communication line 234, control ECU 204, and communication line 237 in that order.

[0179] [4-2. Processing] In the fourth embodiment, assuming a communication interruption occurs, several processes are described below to ensure that NM frames are relayed successfully. These processes include starting up the slave ECU and stopping the slave ECU, but here we will describe the process of starting up the slave ECU.

[0180] First, we will explain the process of starting up the slave ECU, specifically the process of starting up slave ECU206. Note that the process described below can be applied not only to starting up slave ECU206, but also to identifying the communication partner and sending an NM frame.

[0181] <Master Startup Process> Figure 15 is a flowchart showing the master startup process. The master startup process is a process that starts, for example, when the management ECU 202 starts up, and is executed by the CPU 251 of the management ECU 202.

[0182] In the master startup process, as shown in Figure 16, first, the CPU 251 of the management ECU 202 performs a disconnection check in S1010. This process is the same as S930 described above. In other words, this process detects a communication interruption. Note that this process may also detect abnormalities in the communication path, such as a broken wire or excessive delay.

[0183] Next, the CPU 251 of the management ECU 202 determines whether or not there is a communication interruption in S1020. If there is no communication interruption, it returns to S1010. If there is a communication interruption, it proceeds to S1025.

[0184] Next, the CPU 251 of the management ECU 202 sends an anomaly notification regarding the detected anomaly within the management ECU 202 at S1025. That is, the function in the management ECU 202 that notifies of anomalies sends an anomaly notification, and the function in the management ECU 202 that selects the communication path (for example, the function in S1030 described below) receives the anomaly notification. The anomaly notification is a notification that includes information to identify the anomaly location (for example, one of the communication lines 231 to 235) where the anomaly occurred among multiple communication paths.

[0185] Next, when the CPU 251 of the management ECU 202 receives an abnormality notification in S1030, it selects a new communication path that avoids the abnormal area. Specifically, for example, if the communication path from the management ECU 202 to the slave ECU 206 includes communication lines 231 and 236, and a communication interruption is detected on communication line 231, a new communication path that avoids communication line 231 is established.

[0186] The management ECU 202 stores a routing table in the storage unit 243, which is a selection of communication paths configured based on which communication lines each device is connected to. For example, the management ECU 202 selects a new communication path that avoids communication line 231, starting from the management ECU 202, going through communication line 232, control ECU 204, communication line 234, control ECU 203, and communication line 236 to reach the slave ECU 206.

[0187] The management ECU 202 stores the new communication path and the communication path used before the anomaly detection (hereinafter referred to as the old communication path) in the storage unit 243. These new and old communication paths are configured to be readable from the storage unit 243 when the management ECU 202 is restarted.

[0188] Next, the CPU 251 of the management ECU 202 determines in S1040 whether an event exists. The event here may be the same as the event described in S710 above, or it may be a different event. In this fourth embodiment, it determines whether there is an event that should start the slave ECU 206. If there is no event, S1040 is repeated. If there is an event, the process proceeds to S1050.

[0189] Next, the CPU 251 of the management ECU 202 selects the ECU to be activated in response to the event at S1050. In this fourth embodiment, the slave ECU 206 is selected.

[0190] Next, the CPU 251 of the management ECU 202 sends an NM frame to the new communication path in S1060. This NM frame contains a configuration notification and a start command. The configuration notification informs the devices that make up the new communication path, including multiple control ECUs 203, 204, and 205, that communication will be performed using the selected new communication path. The start command is a command to start the slave ECU 206.

[0191] Next, the management ECU202 is configured in S1070 to calculate the diagnostic mask time. The diagnostic mask time is the time it takes for a newly joined device (for example, the control ECU203) to operate normally. The diagnostic mask time is calculated based on the known startup time of the slave ECU206.

[0192] Furthermore, each ECU constituting the communication system 201 is configured to send a diagnostic (e.g., an error code) if communication with the target ECU is interrupted (e.g., timeout). In this fourth embodiment, each ECU ignores frames related to newly joined devices for the duration of the diagnostic mask. Thus, a diagnostic mask temporarily ignores frames from the target ECU, so that even if one of the ECUs determines that communication has been interrupted, it is not considered an abnormality.

[0193] Furthermore, the diagnostic mask time may be set to take into account the increase in communication delay time due to the length of the communication path. In the absence of a communication interruption, the diagnostic mask time for the slave ECU 206 is calculated based, for example, on the startup time of the slave ECU 206 and the delay time on the old communication path (e.g., communication lines 231 and 236). On the other hand, in the absence of a communication interruption, this diagnostic mask time is calculated based on the startup time of the slave ECU 206 and the delay time on the new communication path (e.g., with the addition of the control ECU 204, communication lines 232, 234, and 236).

[0194] Furthermore, each device constituting the communication system 201 may perform time synchronization to determine the timing of signal transmission and reception according to a common time. In this case, the time synchronization may be corrected according to the communication delay time. That is, the time held by each ECU may be corrected taking into account the communication delay time to ensure accurate synchronization. In addition, the control timing may be adjusted taking into account the communication delay time. For example, the control timing may be adjusted to match the timing at which the ECU that receives the frame the latest receives that frame.

[0195] When a diagnostic mask time is set for a communication partner device in each device, signals related to that communication partner device are ignored within the diagnostic mask time. More specifically, for example, within the diagnostic mask time period for slave ECU206, signals related to slave ECU206 are ignored in all devices.

[0196] Next, the CPU 251 of the management ECU 202 is configured in S1080 to notify at least several control ECUs 203, 204, and 205 of diagnostic mask information. The diagnostic mask information includes the diagnostic mask time. Once this process is complete, this process terminates.

[0197] The diagnostic mask time may also be notified from control ECU 203 to slave ECUs 206 and 207, from control ECU 204 to slave ECUs 208 and 209, and from control ECU 205 to slave ECUs 210 and 211.

[0198] <Slave startup process> Next, Figure 17 is a flowchart showing the slave startup process for starting up slave ECUs 206-211, which is executed by the CPUs 271, 291, and 311 (hereinafter referred to as the dependent CPU 271, etc.) of multiple control ECUs 203, 204, and 205, respectively. The slave startup process is a process that starts, for example, when the power to the control ECUs 203, 204, and 205 is turned on.

[0199] In the slave startup process, as shown in Figure 17, the slave CPU 271, etc., first determines in S1110 whether or not an NM frame has been received. The NM frame here may include a configuration notification and a startup command sent by the management ECU 202.

[0200] Next, the dependent CPU 271, etc., configures itself in S1115 to communicate using the new communication path according to the configuration notification. The dependent CPU 271, etc., stores the new and old communication paths in the storage units 264, 284, and 304. These new and old communication paths are configured to be readable from the storage units 264, 284, and 304 when the dependent CPU 271, etc. is restarted.

[0201] Next, the subordinate CPU 271, etc., determines in S1120 whether or not to start the subordinate ECUs according to the NM frame. The subordinate ECUs refer to the slave ECUs 206 to 211 that are subordinate to the control ECUs 203, 204, and 205. Slave ECUs 206 and 207 are subordinate to control ECU 203, slave ECUs 208 and 209 are subordinate to control ECU 204, and slave ECUs 210 and 211 are subordinate to control ECU 205. Note that control ECUs 203, 204, and 205 may also be considered subordinate ECUs from the perspective of management ECU 202.

[0202] In S1120, for example, if the control ECU 204 does not need to start the subordinate ECUs and simply relays the NM frame, it is judged negatively, and if the control ECU 203 starts the slave ECU 206, it is judged positively. If the subordinate ECUs are not started, the process proceeds to S1150. If the subordinate ECUs are started, the process proceeds to S1130.

[0203] Next, the subordinate CPU 271, etc., turns on the power distribution switch corresponding to the subordinate ECU in S1130. Then, power is supplied to the subordinate ECU, and the ECU starts up. For example, when the control ECU 203 turns on the power to the slave ECU 206 (i.e., supplies power), it turns on the power distribution switch 265.

[0204] Next, the subordinate CPU 271, etc., determines in S1140 whether the startup time has elapsed. The startup time is the time from when the power to the subordinate ECU is turned on until the startup is complete. The startup time is approximately the same as the diagnostic mask time. If the startup time has not elapsed, S1140 is repeated. If the startup time has elapsed, the process proceeds to S1150.

[0205] Next, the subordinate CPU 271, etc., sends an NM frame to the relay control ECU or subordinate ECU in S1150. The NM frame sent here may contain configuration notifications and startup commands, similar to the NM frame received from the management ECU 202. However, when sending an NM frame to a subordinate ECU, a startup command is unnecessary because the subordinate ECU is already running. Once this process is complete, this process terminates.

[0206] The NM frame may include not only a start command, but also stop information, or commands to wake up or put the ECU to sleep. If the subordinate ECU is in sleep mode, the control ECUs 203, 204, and 205 may send a wake-up command to the subordinate ECU in S1130 as described above. Also, if the configuration allows the subordinate ECU to recognize the NM frame while in sleep mode, the transmission of the wake-up command from the control ECUs 203, 204, and 205 may be omitted. Furthermore, the subordinate ECU may receive the NM frame transmitted in S1150 and wake up itself.

[0207] <Restart process> Next, Figure 18 is a flowchart showing the restart process. The restart process is a process that starts when the management ECU 202 goes into sleep mode or powers off due to, for example, turning off the ignition after a change in the communication path, and then starts up again. This process is executed by the CPU 251 of the management ECU 202.

[0208] Next, the CPU 251 of the management ECU 202 determines in S1260 whether it is configured to use the new communication path. Here, the management ECU 202 is pre-configured to either use the new communication path or the old communication path (the one used before the communication interruption) when it restarts after detecting a communication interruption. This setting can be changed at will, and this setting is shared with each device that makes up the network using NM frames, etc. If the new communication path is to be used, the process proceeds to S1270; if the old communication path is to be used, the process proceeds to S1280.

[0209] Next, the CPU 251 of the management ECU 202 is configured in S1270 to use the new communication path. In this case, communication resumes using the new communication path without using the old one.

[0210] Meanwhile, the CPU 251 of the management ECU 202 is configured in S1280 to use the old communication path. In this case, if a communication interruption is detected again during the master startup process described above, the new communication path will be used. Once these processes are complete, the restart process ends.

[0211] Whether to use the new communication path or the old communication path will be notified to each device via the NM frame configuration notification. [4-3. Effects] The fourth embodiment described in detail above achieves the effects of the first and third embodiments mentioned above, and further achieves the following effects.

[0212] (4a) In this fourth embodiment, if an abnormality occurs in the communication path, a new communication path that avoids the abnormal part can be established, and communication can be performed using this new communication path, making it less likely that the event of being unable to perform necessary communication will occur.

[0213] (4b) In this fourth embodiment, when the management ECU 202 is restarted, communication can be performed using a new communication path. This is effective when the situation does not improve even after the management ECU 2 is restarted, such as when there is physical damage to the communication path.

[0214] (4c) In this fourth embodiment, the same configuration as in the first and second embodiments will produce the same effects. [5. Other Embodiments] While embodiments of this disclosure have been described above, it goes without saying that this disclosure is not limited to the embodiments described above and can take various forms.

[0215] (5a) The operation of the communication system described herein may be realized by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program.

[0216] Alternatively, the operation of the communication system described herein may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits.

[0217] Alternatively, the operation of the communication system described herein may be implemented by one or more dedicated computers comprising a combination of a processor and memory programmed to perform one or more functions and a processor comprising one or more hardware logic circuits.

[0218] Furthermore, the computer program may be stored on a computer-readable, non-transitional tangible recording medium as instructions executed by the computer. The method for realizing the functions of the communication system does not necessarily have to include software; all of its functions may be realized using one or more hardware components.

[0219] (5b) In addition to the communication system described above, the disclosure can also be realized in various forms, such as a configuration that uses the communication system as a component, a program for making the computer of the communication system function, a non-transitional tangible recording medium such as a semiconductor memory on which this program is recorded, and a communication method.

[0220] (5c) Multiple functions of one component in each of the above embodiments may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, some of the configurations of each of the above embodiments may be omitted. Furthermore, at least some of the configurations of each of the above embodiments may be added to or replaced with the configurations of other embodiments. [Technical Concept Disclosed in This Specified Specification] [Item 1] In a communication system (1) comprising a first electronic control unit (3) and a plurality of second electronic control units (5), The first electronic control unit and the plurality of second electronic control units are each connected to each other via the main path (11) so as to be able to communicate. At least one of the plurality of second electronic control units is connected to the other second electronic control units via a redundant path (13) that has a lower transmission capacity in terms of data traffic than the main path. The first electronic control unit is The device is configured to transmit the data to the second electronic control unit via the main path connected to the second electronic control unit to which the data is to be transmitted, and is also configured to transmit the data to the second electronic control unit via a backup path that includes another main path different from the main path and the redundant path, thereby reducing the amount of data transmitted. Communication system.

[0221] [Item 2] The communication system described in item 1, It includes interruption detection units (3B, 5aA, 5bA) that detect an interruption in communication on the main path between the first electronic control unit and the second electronic control unit, The interruption detection unit is configured to transmit the data through the backup path, which includes the main path and the redundant path, if it detects an interruption in communication on the main path. Communication system.

[0222] [Item 3] The communication system described in item 2, Each of the aforementioned second electronic control devices is equipped with the interruption detection unit (5aA, 5bA), Each of the second electronic control units is configured to perform processing to transmit the data via the backup path when the interruption detection unit detects an interruption in communication on the main path. Communication system.

[0223] [Item 4] The communication system described in item 3, The first electronic control unit or each of the second electronic control units is configured to reduce the amount of information in the data to be transmitted when transmitting the data via the backup path. Communication system.

[0224] [Item 5] The communication system described in item 3, The first electronic control unit or each of the second electronic control units is configured not to transmit the data when transmitting the data via the backup path if the data to be transmitted is not the data to be transmitted when communication is interrupted. Communication system.

[0225] [Item 6] A communication system described in any one of items 1 through 5, Each of the second electronic control units is configured to transmit the data in a divided manner, in accordance with the amount of data that can be transmitted via the redundant path, when transmitting the data via the redundant path. Communication system.

[0226] [Item 7] A communication system described in any one of items 1 through 6, Each of the second electronic control units is configured to transmit the data via the redundant path based on priority information that defines the transmission priority included in the transmitted data. Communication system.

[0227] [Item 8] A communication system described in any one of items 1 through 7, Each of the second electronic control units is configured to transmit the data via the redundant path in accordance with a predetermined transmission priority in the event of a communication interruption. Communication system.

[0228] [Item 9] A communication system described in any one of items 2 through 8, The first electronic control unit includes the interruption detection unit (3B), The first electronic control unit is configured to perform processing to transmit the data via the backup path when the interruption detection unit detects an interruption in communication on the main path. Communication system.

[0229] [Item 10] A communication system described in any one of items 1 through 9, If communication on the main path between the first electronic control unit and the second electronic control unit is not interrupted, The first electronic control unit is The system is configured to transmit the data to the second electronic control unit via the main path connected to the second electronic control unit to which the data is to be transmitted, and to transmit the data to the second electronic control unit via a backup path that includes another main path different from the main path and the redundant path, thereby reducing the amount of data transmitted. Communication system.

[0230] [Item 11] A communication system described in any one of items 1 through 10, The main path and the redundant path are configured to transmit communication frames containing information that specifies whether to put the electronic control device to be controlled into an ON state where power supply is permitted or an OFF state where power supply is prohibited. Communication system. [Explanation of Symbols]

[0231] 1, 101, 201…Communication system, 3…Mobicon, 3A, 5aA, 5bA…Disconnection detection unit, 5…Zone ECU, 5a…First zone ECU, 5b…Third zone ECU, 5c…Third zone ECU, 11…Main communication line, 11a…First main communication line, 11b…Second main communication line, 11c…Third main communication line, 13…Redundant communication line, 13a…First redundant communication line, 11b…Second redundant communication line

Claims

1. In a communication system (1) comprising a first electronic control unit (3) and a plurality of second electronic control units (5), The first electronic control unit and the plurality of second electronic control units are each connected to each other via a main path (11) so as to be able to communicate. At least one of the plurality of second electronic control devices is connected to the other second electronic control devices via a redundant path (13) that has a lower transmission capacity in terms of data communication volume than the main path. The first electronic control unit is The system is configured to transmit the data to the second electronic control unit via the main path connected to the second electronic control unit to which the data is to be transmitted, and is also configured to transmit the data to the second electronic control unit with reduced data traffic via a backup path that includes another main path different from the main path and the redundant path. Communication system.

2. A communication system according to claim 1, The system includes interruption detection units (3B, 5aA, 5bA) that detect interruptions in communication on the main path between the first electronic control unit and the second electronic control unit. The interruption detection unit is configured to transmit the data through the backup path, which includes the main path and the redundant path, if it detects an interruption in communication on the main path. Communication system.

3. A communication system according to claim 2, Each of the aforementioned second electronic control devices is equipped with the interruption detection unit (5aA, 5bA), Each of the second electronic control units is configured to perform processing to transmit the data via the backup path when the interruption detection unit detects an interruption in communication on the main path. Communication system.

4. A communication system according to claim 3, The first electronic control unit or each of the second electronic control units is configured to reduce the amount of information in the data to be transmitted when transmitting the data via the backup path. Communication system.

5. A communication system according to claim 3, The first electronic control unit or each of the second electronic control units is configured not to transmit the data when transmitting the data via the backup path if the data to be transmitted is not the data to be transmitted when communication is interrupted. Communication system.

6. A communication system according to claim 1, Each of the second electronic control units is configured to transmit the data in a divided manner, in accordance with the amount of data that can be transmitted via the redundant path, when transmitting the data via the redundant path. Communication system.

7. A communication system according to claim 1, Each of the second electronic control units is configured to transmit the data via the redundant path based on priority information that defines the transmission priority included in the transmitted data. Communication system.

8. A communication system according to claim 1, Each of the second electronic control units is configured to transmit the data via the redundant path in accordance with a predetermined transmission priority in the event of a communication interruption. Communication system.

9. A communication system according to claim 2, The first electronic control device includes the interruption detection unit (3B), The first electronic control unit is configured to perform processing to transmit the data via the backup path when the interruption detection unit detects an interruption in communication on the main path. Communication system.

10. A communication system according to claim 1, If communication on the main path between the first electronic control unit and the second electronic control unit is not interrupted, The first electronic control unit is The system is configured to transmit the data to the second electronic control unit via the main path connected to the second electronic control unit to which the data is to be transmitted, and to transmit the data to the second electronic control unit via a backup path that includes another main path different from the main path and the redundant path, thereby reducing the amount of data transmitted. Communication system.

11. A communication system according to claim 1, The main path and the redundant path are configured to transmit communication frames containing information that specifies whether to put the electronic control device to be controlled into an ON state where power supply is permitted or an OFF state where power supply is prohibited. Communication system.

Images