Vehicle Systems

Abstract

To provide a vehicle system capable of properly constructing a system for ensuring safety.SOLUTION: In a vehicle system 1, a plurality of devices E have predetermined levels of safety standards set for functions to be realized. A central ECU 30 includes ASIL ECUs 31 to 34 that are assigned to each safety standard level and that can execute confirmation processing on the devices E according to the assigned level. A network branch unit 40 distributes and transmits input signals from the devices E transmitted from a plurality of zone ECUs 21 to 24 to the ASIL ECUs 31 to 34 assigned with levels corresponding to the functions of the devices E, and distributes and transmits output signals from the ASIL ECUs 31 to 34 transmitted from the ASIL ECUs 31 to 34 to the zone ECUs 21 to 24 that have transmitted input signals from the devices E subject to the confirmation processing.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle system. [Background technology]

[0002] Conventionally, as a vehicle system, for example, Patent Document 1 describes a vehicle control device that controls a vehicle using a plurality of software programs with different safety levels. This vehicle control device includes, for example, a plurality of software programs with different safety levels, a safety level-corresponding storage area that is divided into a plurality of areas corresponding to the safety levels of the plurality of software programs and stores data calculated by the software, a shared storage area that stores data calculated by the software with a high safety level for access by the software with a low safety level, and a switching unit that switches the storage area to be accessed when referring to the same data according to the safety level of the software, and the plurality of software programs include a function that calls the switching unit to refer to the same data. With this configuration, the vehicle control device can call the switching unit by the software function to refer to the same data without using hardware such as a memory management unit when the storage area to which the software accesses is changed, thereby improving the reusability of the software. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-99517 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the vehicle control device described in the above-mentioned Patent Document 1, for example, mixes software with different safety levels within the same vehicle control device, so it is necessary to match the performance of the device to the software with the higher safety level. As a result, there is a risk of excessive performance when executing software with a lower safety level.

[0005] Therefore, the present invention has been made in consideration of the above, and an object of the present invention is to provide a vehicle system that can properly configure a system that ensures safety. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems and achieve the object, the vehicle system of the present invention comprises a plurality of devices mounted on a vehicle, each of which has a predetermined level of safety standard set for the function it realizes, a plurality of device control units each of which is divided into control systems and controls the devices, a central control unit capable of executing a confirmation process related to the safety standards for the plurality of devices, and a relay unit that relays input signals related to the confirmation process from the devices and output signals related to the confirmation process from the central control unit between the plurality of device control units and the central control unit, wherein the central control unit includes a plurality of single-level control units assigned to each level of the safety standard and capable of executing the confirmation process for the devices according to the assigned level, and the relay unit distributes and transmits the input signals from the devices transmitted from the plurality of device control units to the single-level control units to which the level corresponding to the function of the devices is assigned, and distributes and transmits the output signals from the single-level control units transmitted from the plurality of single-level control units to the device control unit that transmitted the input signals from the devices that were the subject of the confirmation process. Effect of the Invention

[0007] The vehicle system of the present invention does not need to execute processing related to multiple levels of safety standards. As a result, when multiple levels of safety standards are present in the same system as in the past, it is no longer necessary to apply processing of a higher level of safety standard to processing of a lower level of safety standard. Since excessive performance is not imparted, a system that ensures safety can be properly constructed. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a schematic diagram showing an example of the configuration of a vehicle system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of the configuration of a vehicle system according to the embodiment. [Diagram 3] FIG. 3 is a block diagram showing an example of the configuration of the zone ECU according to the embodiment. [Figure 4] FIG. 4 is a diagram showing the relationship between the functions of the vehicle and vehicle safety standards according to the embodiment. [Diagram 5] FIG. 5 is a diagram illustrating an example of the software configuration of the ASIL-A according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of a software configuration of ASIL-B according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of a software configuration of ASIL-C according to the embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of a software configuration of ASIL-D according to the embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of a frame configuration of an input signal according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a configuration of a level-integrated frame according to the embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of a frame configuration of an output signal according to the embodiment. [Figure 12] FIG. 12 is a diagram illustrating a configuration example of a destination integrated frame according to the embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of frame communication according to the embodiment. [Figure 14] FIG. 14 is a flowchart showing an example of the operation of the vehicle system according to the embodiment. [Figure 15] FIG. 15 is a schematic diagram illustrating an example of the configuration of a vehicle system according to a first modified example of the embodiment. [Figure 16] FIG. 16 is a schematic diagram illustrating an example of the configuration of a vehicle system according to a second modified example of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] The form (embodiment) for carrying out the present invention will be described in detail with reference to the drawings. The present invention is not limited to the contents described in the following embodiment. Furthermore, the components described below include those that a person skilled in the art can easily imagine and those that are substantially the same. Furthermore, the configurations described below can be appropriately combined. Furthermore, various omissions, substitutions, or modifications of the configurations can be made without departing from the gist of the present invention.

[0010] [Embodiment] A vehicle system 1 according to an embodiment will be described with reference to the drawings. The vehicle system 1 is provided in a vehicle V and controls a plurality of devices E mounted on the vehicle V. The plurality of devices E are divided into control systems. The plurality of control systems include, for example, a control system representing a power train system representing devices for efficiently transmitting rotational energy generated by an engine (motor) to drive wheels, a control system representing a chassis system including suspension, steering, etc., a control system representing an ADAS (Advanced Driver-Assistance Systems) or an automatic driving system, and a control system representing a body system including backlights, etc. Note that an ADAS is a system that grasps the situation around the vehicle V using various sensors and assists the driver in driving operations. The plurality of devices E are provided in a divided manner for each area D (also referred to as "zone") of the vehicle V, as shown in FIG. 1. Here, the area D indicates a certain range in the vehicle V, and the vehicle V is divided into a plurality of areas D (for example, a first area D1 to a fourth area D4).

[0011] Each area D is provided with a plurality of devices E, and the plurality of devices E realize functions for which a predetermined level of safety standard (automotive safety level), i.e., an Automotive Safety Integrity Level (ASIL), is set. That is, an ASIL is set for each function of the vehicle V, and the plurality of devices E realize functions for which the ASIL is set. Here, ASIL indicates a safety standard for the vehicle V defined by the ISO26262 standard, and includes four stages from ASIL-A to ASIL-D according to the level of the safety standard. The level of the safety standard increases from ASIL-A to ASIL-D. That is, ASIL-D has the highest level of safety standard, ASIL-C has the second highest level of safety standard, ASIL-B has the third highest level of safety standard, and ASIL-A has the lowest level of safety standard. The vehicle system 1 controls each device E for which a function for which an ASIL is set is set, and the vehicle system 1 will be described in detail below.

[0012] The vehicle system 1 includes a TCU (Telematics control unit) 10, a plurality of devices E, a device control unit 20, a central ECU 30 as a central control unit, and a network branch unit 40 as a relay unit.

[0013] The TCU 10 is a wireless communication device capable of communicating with an external device provided outside the vehicle V. The TCU 10 wirelessly connects the vehicle V to the external device of the vehicle V via an antenna, and transmits and receives signals between the vehicle V and the external device of the vehicle V. The TCU 10 wirelessly communicates with the external device using various wireless communication methods, such as wide-area wireless and narrow-area wireless. The TCU 10 is connected to a network branching unit 40, and outputs a signal received from the external device to the network branching unit 40. The TCU 10 also transmits a signal output from the network branching unit 40 to the external device.

[0014] The multiple devices E are mounted on the vehicle V and execute various processes to control the vehicle V, and as described above, are provided in separate areas D of the vehicle V. Each area D contains a mixture of devices E of different control systems. Each area D includes, for example, at least one of powertrain system devices E, chassis system devices E, ADAS or autonomous driving system devices E, body system devices E, etc.

[0015] The device control unit 20 controls a plurality of devices E, and includes a plurality of zone ECUs 21 to 24. The plurality of zone ECUs 21 to 24 are provided in separate areas D.

[0016] The zone ECU 21 is provided in the first area D1, and is connected to at least one of a powertrain system device E, a chassis system device E, an ADAS or autonomous driving system device E, a body system device E, etc., and is connected to a mixture of devices E of different control systems. The zone ECU 21 includes, for example, an I / F 20a, a CPU 20b, and an I / O 20c, as shown in FIG. 3.

[0017] The I / F 20a defines the connector shape of the connection cable, and further defines the signal format, communication protocol, signal processing procedure, etc. The I / F 20a is connected to the CPU 20b and the network branching unit 40, and outputs a signal output from the CPU 20b to the network branching unit 40. The I / F 20a also outputs a signal output from the network branching unit 40 to the CPU 20b.

[0018] The CPU 20b controls a plurality of devices E. The CPU 20b is connected to the I / O 20c and the I / F 20a, and outputs a signal output from the device E via the I / O 20c to the I / F 20a. The CPU 20b also controls the device E via the I / O 20c based on the signal output from the I / F 20a.

[0019] The I / O 20c is an input / output circuit capable of inputting and outputting signals. The I / O 20c includes an I / O 211c, an I / O 212c, an I / O 213c, and an I / O 214c. The I / O 211c to I / O 214c are connected to devices E that realize functions for which different ASILs are set. Specifically, the I / O 211c is connected to a device E that realizes a function for which ASIL-A is set, the I / O 212c is connected to a device E that realizes a function for which ASIL-B is set, the I / O 213c is connected to a device E that realizes a function for which ASIL-C is set, and the I / O 214c is connected to a device E that realizes a function for which ASIL-D is set. The I / O 211c to I / O 214c are connected to a plurality of devices E and the CPU 20b, and output signals output from the plurality of devices E to the CPU 20b. Moreover, the I / O 211c to I / O 214c output the signal output from the CPU 20b to a plurality of devices E. The zone ECU 21 configured as described above transmits an input signal S1 from the device E to the network branching unit 40. The zone ECU 21 also controls the device E based on an output signal S4 transmitted from the network branching unit 40.

[0020] The zone ECU 22 is provided in the second area D2, and is connected to at least one of the powertrain system devices E, the chassis system devices E, the ADAS or autonomous driving system devices E, and the body system devices E, and the devices E of different control systems are mixed and connected to the zone ECU 22. The zone ECU 22 includes an I / F 20a, a CPU 20b, and an I / O 20c, as shown in FIG. 3. The specific configurations of the I / F 20a, the CPU 20b, and the I / O 20c have been described in the above-mentioned zone ECU 21, and will not be described here. The zone ECU 22 transmits an input signal S1 from the device E to the network branching unit 40. The zone ECU 22 also controls the device E based on an output signal S4 transmitted from the network branching unit 40.

[0021] The zone ECU 23 is provided in the third area D3, and is connected to at least one of the powertrain system devices E, the chassis system devices E, the ADAS or autonomous driving system devices E, and the body system devices E, and the devices E of different control systems are connected in a mixed manner. The zone ECU 23 includes an I / F 20a, a CPU 20b, and an I / O 20c, as shown in FIG. 3. The specific configurations of the I / F 20a, the CPU 20b, and the I / O 20c have been described in the above-mentioned zone ECU 21, and will not be described here. The zone ECU 23 transmits an input signal S1 from the device E to the network branching unit 40. The zone ECU 23 also controls the device E based on an output signal S4 transmitted from the network branching unit 40.

[0022] The zone ECU 24 is provided in the fourth area D4, and is connected to at least one of the powertrain system devices E, the chassis system devices E, the ADAS or autonomous driving system devices E, and the body system devices E, and the devices E of different control systems are connected to the zone ECU 24. The zone ECU 24 includes an I / F 20a, a CPU 20b, and an I / O 20c, as shown in FIG. 3. The specific configurations of the I / F 20a, the CPU 20b, and the I / O 20c have been described in the above-mentioned zone ECU 21, and will not be described here. The zone ECU 24 transmits an input signal S1 from the device E to the network branching unit 40. The zone ECU 24 also controls the device E based on an output signal S4 transmitted from the network branching unit 40.

[0023] Next, the central ECU 30 will be described. The central ECU 30 performs appropriate control including confirmation processing related to safety standards (ASIL) for a plurality of devices E. The central ECU 30 includes a plurality of ECUs, each of which is assigned to a respective level of a safety standard and capable of executing confirmation processing for the devices E according to the assigned level. Specifically, the central ECU 30 includes an ASIL-A ECU 31, an ASIL-B ECU 32, an ASIL-C ECU 33, and an ASIL-D ECU 34 as a plurality of ECUs.

[0024] The ASIL-A ECU 31 is an integrated ECU that integrates individual ECUs and performs appropriate control, including confirmation processing related to ASIL-A for multiple devices E. The ASIL-A ECU 31 is configured to include an electronic circuit mainly made of a well-known microcomputer including a CPU, a ROM constituting a storage unit, a RAM, and an interface. The ASIL-A ECU 31 performs confirmation processing related to ASIL-A for data included in an input signal S2 (a level integration frame F21 described later) from a device E that realizes a function for which ASIL-A, the lowest safety standard level among ASILs, is set. For example, as shown in FIG. 4, the functions for which ASIL-A is set include a navigation function, a function for turning on a backlight, and the like. The ASIL-A ECU 31 performs confirmation processing according to the level of the safety standard (ASIL-A) assigned to the ASIL-A ECU 31 for data included in an input signal S2 from a device E that realizes a navigation function, a function for turning on a backlight, and the like. 5, the ASIL-A ECU 31 executes error detection B2 including checking input / output data as confirmation processing according to the ASIL-A. The ASIL-A ECU 31 executes error detection B2 for software B1 that executes normal processing (e.g., navigation processing, backlight lighting processing) to check input / output data. If the confirmation result is normal, the ASIL-A ECU 31 transmits an output signal S3 indicating that to the network branching unit 40, and if the confirmation result is abnormal, the ASIL-A ECU 31 transmits an output signal S3 indicating that to the network branching unit 40.

[0025] The ECU 32 for ASIL-B is an integrated ECU that includes confirmation processing related to ASIL-B for multiple devices E and executes appropriate control, and integrates individual ECUs. The ECU 32 for ASIL-B is configured to include an electronic circuit mainly including a known microcomputer including a CPU, a ROM constituting a storage unit, a RAM, and an interface. In general, the ECU 32 for ASIL-B has higher performance (higher CPU clock speed) than the ECU 31 for ASIL-A. The ECU 32 for ASIL-B executes confirmation processing related to ASIL-B for data included in an input signal S2 (a level integration frame F22 described later) from the device E that realizes a function set with ASIL-B, which is the third highest safety standard level among ASILs. The functions set with ASIL-B include, for example, a rearview camera function, a function to assist reverse driving, etc., as shown in FIG. 4. The ASIL-B ECU 32 executes a check process according to the level of the safety standard (ASIL-B) assigned to the ASIL-B ECU 32 for data included in the input signal S2 from the device E that realizes the rearview camera function, the function of supporting reverse driving, etc. The ASIL-B ECU 32 executes an error detection B2 including a check of input / output data and a check of data validity as a check process according to ASIL-B, as shown in FIG. 6, for example. The ASIL-B ECU 32 executes the error detection B2 for software B1 that executes normal processing (for example, the rearview camera function, the function of supporting reverse driving) to check input / output data and check the validity of the data. If the check result is normal, the ASIL-B ECU 32 transmits an output signal S3 indicating that to the network branching unit 40, and if the check result is abnormal, the ASIL-B ECU 32 transmits an output signal S3 indicating that to the network branching unit 40.

[0026] The ECU 33 for ASIL-C is an integrated ECU that includes confirmation processing related to ASIL-C for multiple devices E and executes appropriate control, and integrates individual ECUs. The ECU 33 for ASIL-C is configured to include an electronic circuit mainly made up of a well-known microcomputer including a CPU, a ROM constituting a storage unit, a RAM, and an interface. In general, the ECU 33 for ASIL-C has higher performance (higher CPU clock speed) than the ECU 32 for ASIL-B. The ECU 33 for ASIL-C executes confirmation processing related to ASIL-C for data included in an input signal S2 (a level integration frame F23 described later) from a device E that realizes a function set with ASIL-C, which is the second highest safety standard level among ASILs. The functions set with ASIL-C include, for example, a vehicle-to-vehicle communication function and a road-to-vehicle communication function, as shown in FIG. 4. The ASIL-C ECU 33 executes a check process according to the level of the safety standard (ASIL-C) assigned to the ASIL-C ECU 33 for data included in the input signal S2 from the device E that realizes the vehicle-to-vehicle communication function, the road-to-vehicle communication function, and the like. For example, as shown in FIG. 7, the ASIL-C ECU 33 executes an error detection B2 including an input / output data check, a data validity check, and external monitoring as a check process according to ASIL-C, and further executes an error processing B3 including an error display and a degenerate function. The ASIL-C ECU 33 executes an error detection B2 for software B1 that executes normal processing (for example, the vehicle-to-vehicle communication function, the road-to-vehicle communication function), checks the input / output data, the data validity check, and external monitoring, and if the check result is normal, transmits an output signal S3 indicating that to the network branching unit 40, and if the check result is abnormal, executes an error processing B3 and transmits an output signal S3 indicating that an error display or degenerate operation is to be performed to the network branching unit 40.

[0027] The ECU 34 for ASIL-D is an integrated ECU that integrates individual ECUs and performs appropriate control, including confirmation processing related to ASIL-D for multiple devices E. The ECU 34 for ASIL-D is configured to include an electronic circuit mainly made up of a well-known microcomputer including a CPU, a ROM constituting a storage unit, a RAM, and an interface. In general, the ECU 34 for ASIL-D has higher performance (higher CPU clock speed) than the ECU 33 for ASIL-C. The ECU 34 for ASIL-D performs confirmation processing related to ASIL-D for data included in an input signal S2 (a level integration frame F24 described later) from a device E that realizes a function set with ASIL-D, which is the highest safety standard level among ASILs. The functions set with ASIL-D include, for example, an antilock brake function, an electric power steering function, etc., as shown in FIG. 4. The ASIL-D ECU 34 executes a check process according to the level of the safety standard (ASIL-D) assigned to the ASIL-D ECU 34 for data included in the input signal S2 from the device E that realizes an antilock brake function, an electric power steering function, etc. For example, as shown in Fig. 8, the ASIL-D ECU 34 executes error detection B2 including input / output data check, data validity check, external monitoring, control flow monitoring, and software redundancy as check processes according to ASIL-D, and further executes error processing B3 including error display, degeneration function, and parallel redundancy processing. The ASIL-D ECU 34 executes error detection B2 for software B1 that executes normal processing (e.g., anti-lock brake function, electric power steering function), checking input / output data, data validity check, external monitoring, control flow monitoring, and software redundancy, and if the confirmation result is normal, transmits an output signal S3 indicating this to the network branching unit 40, and if the confirmation result is abnormal, executes error processing B3 and transmits an output signal S3 to the network branching unit 40 indicating that an error will be displayed, degenerate operation will be performed, and parallel redundant processing will be performed.

[0028] Next, the configuration of the confirmation process according to each safety standard will be described. The process related to the relatively high level safety standard includes at least a part of the process related to the relatively low level safety standard. For example, the process related to the highest level safety standard (ASIL-D) (error detection B2, error processing B3) includes all the processes related to the relatively low level safety standards (ASIL-A, ASIL-B, ASIL-C) (error detection B2, error processing B3) as shown in Figs. 5 to 8. Moreover, the process related to the second highest level safety standard (ASIL-C) (error detection B2, error processing B3) includes all the processes related to the relatively low level safety standards (ASIL-A, ASIL-B) (error detection B2) as shown in Figs. 5 to 7. Moreover, the process related to the third highest level safety standard (ASIL-B) (error detection B2) includes all the processes related to the relatively low level safety standard (ASIL-A) (error detection B2) as shown in Figs. 5 and 6.

[0029] Next, the network branching unit 40 will be described. The network branching unit 40 relays signals between the equipment control unit 20 (the multiple zone ECUs 21-24) and the central ECU 30. The network branching unit 40 relays, for example, an input signal S1 related to confirmation processing from the equipment E transmitted from the equipment control unit 20 and an output signal S3 related to confirmation processing from the central ECU 30 transmitted from the central ECU 30, between the equipment control unit 20 and the central ECU 30. The network branching unit 40 includes a signal integration unit 41 and a signal distribution unit 42.

[0030] The signal integration unit 41 generates an integrated frame by integrating data included in each frame constituting a plurality of signals. For example, the signal integration unit 41 integrates data extracted for each level from data included in a plurality of input frames F1 constituting an input signal S1 from an equipment E transmitted from a plurality of zone ECUs 21 to 24 for each level to generate a level integrated frame F2 for each level. Here, the plurality of input frames F1 constituting the input signal S1 from the equipment E are configured to include a plurality of data areas as shown in FIG. 9. Specifically, the input frame F1 is configured to include a data area representing "frame start" indicating the start of the frame, "source ID: zone ECU 〇〇" indicating the identifier of the source, "destination ID: network branch" indicating the identifier of the source, "ASIL-A", "ASIL-B", "ASIL-C", and "ASIL-D" indicating the data areas from ASIL-A to ASIL-D, "error detection and correction area" indicating the error detection and correction area, and "frame end" indicating the end of the frame. The data area of ​​"ASIL-A" stores data from device E that realizes a function set in ASIL-A, the data area of ​​"ASIL-B" stores data from device E that realizes a function set in ASIL-B, the data area of ​​"ASIL-C" stores data from device E that realizes a function set in ASIL-C, and the data area of ​​"ASIL-D" stores data from device E that realizes a function set in ASIL-D. Note that, in FIG. 9, four input frames F1 (F11 to F14) are illustrated, and each input frame F1 corresponds to a frame transmitted from each of the zone ECUs 21 to 24. For example, an input frame F11 whose source ID is zone ECU21 corresponds to a frame transmitted from zone ECU21, an input frame F12 whose source ID is zone ECU22 corresponds to a frame transmitted from zone ECU22, an input frame F13 whose source ID is zone ECU23 corresponds to a frame transmitted from zone ECU23, and an input frame F14 whose source ID is zone ECU24 corresponds to a frame transmitted from zone ECU24.

[0031] The signal integration unit 41 extracts data for each level of the safety standard (ASIL-A to ASIL-D) from a data area included in a plurality of input frames F1 (F11 to F14) transmitted from a plurality of zone ECUs 21 to 24. Then, the signal integration unit 41 integrates the data extracted for each level of the safety standard for each level to generate a level-integrated frame F2 (F21 to F24) for each level. Here, the level-integrated frame F2 is configured to include a plurality of data areas as shown in FIG. 10. Specifically, the level-integrated frame F2 is configured to include a data area representing "frame start" indicating the start of the frame, "source ID: network branch" indicating an identifier of the source, "destination ID: ECU XX for ASIL-XX" indicating an identifier of the destination, "zone ECU 21", "zone ECU 22", "zone ECU 23", and "zone ECU 24" indicating the data area from the zone ECU 21 to the zone ECU 24, "error detection and correction area" indicating an error detection and correction area, and "frame end" indicating the end of the frame.

[0032] For example, the signal integrating unit 41 extracts data included in the data area of ​​ASIL-A, data included in the data area of ​​ASIL-B, data included in the data area of ​​ASIL-C, and data included in the data area of ​​ASIL-D by distinguishing them by safety standard level from four input frames F1 (F11 to F14) shown in Fig. 9. Then, the signal integrating unit 41 integrates the data extracted for each safety standard level (ASIL-A to ASIL-D) for the same level as shown in Fig. 10 to generate a level-integrated frame F2 (F21 to F24) for each level.

[0033] 9, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​ASIL-A into a level integration frame F21 whose destination ID is the ASIL-A ECU 31. At this time, the signal integration unit 41 stores the ASIL-A data transmitted from each of the zone ECUs 21-24 in the corresponding data area in the level integration frame F21, which is divided into data areas for each of the zone ECUs 21-24. For example, the signal integration unit 41 stores ASIL-A data transmitted from zone ECU 21 in a data area allocated to zone ECU 21 in the level integration frame F21 (destination ID: ECU 31 for ASIL-A), stores ASIL-A data transmitted from zone ECU 22 in a data area allocated to zone ECU 22 in the level integration frame F21, stores ASIL-A data transmitted from zone ECU 23 in a data area allocated to zone ECU 23 in the level integration frame F21, and stores ASIL-A data transmitted from zone ECU 24 in a data area allocated to zone ECU 24 in the level integration frame F21.

[0034] 9, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​ASIL-B into a level integration frame F22 having the destination ID of the ECU 32 for ASIL-B. At this time, the signal integration unit 41 stores, for example, the data of ASIL-B transmitted from the zone ECU 21 in the data area allocated to the zone ECU 21 in the level integration frame F22 (destination ID: ECU 32 for ASIL-B), stores the data of ASIL-B transmitted from the zone ECU 22 in the data area allocated to the zone ECU 22 in the level integration frame F22, stores the data of ASIL-B transmitted from the zone ECU 23 in the data area allocated to the zone ECU 23 in the level integration frame F22, and stores the data of ASIL-B transmitted from the zone ECU 24 in the data area allocated to the zone ECU 24 in the level integration frame F22.

[0035] 9, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​ASIL-C into a level integration frame F23 having the destination ID of the ASIL-C ECU 33. At this time, the signal integration unit 41 stores, for example, the ASIL-C data transmitted from the zone ECU 21 in the data area allocated to the zone ECU 21 in the level integration frame F23 (destination ID: ASIL-C ECU 33), stores the ASIL-C data transmitted from the zone ECU 22 in the data area allocated to the zone ECU 22 in the level integration frame F23, stores the ASIL-C data transmitted from the zone ECU 23 in the data area allocated to the zone ECU 23 in the level integration frame F23, stores the ASIL-C data transmitted from the zone ECU 23 in the data area allocated to the zone ECU 23 in the level integration frame F23, and stores the ASIL-C data transmitted from the zone ECU 24 in the data area allocated to the zone ECU 24 in the level integration frame F23.

[0036] 9, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​ASIL-D into a level integration frame F24 having the ASIL-D ECU 34 as a destination ID. At this time, the signal integration unit 41 stores, for example, the ASIL-D data transmitted from the zone ECU 21 in the data area allocated to the zone ECU 21 in the level integration frame F24 (destination ID: ASIL-D ECU 34), stores the ASIL-D data transmitted from the zone ECU 22 in the data area allocated to the zone ECU 22 in the level integration frame F24, stores the ASIL-D data transmitted from the zone ECU 23 in the data area allocated to the zone ECU 23 in the level integration frame F24, and stores the ASIL-D data transmitted from the zone ECU 24 in the data area allocated to the zone ECU 24 in the level integration frame F24.

[0037] In this way, the signal integration unit 41 integrates data extracted for each level (ASIL-A to ASIL-D) from the data contained in multiple input frames F1 constituting the input signal S1 from the equipment E transmitted from the multiple zone ECUs 21 to 24, for each level, to generate a level integrated frame F2 (F21 to F24) for each level.

[0038] Next, an example will be described in which the signal integrating unit 41 integrates data included in a plurality of frames constituting the output signal S3 transmitted from the ASIL ECUs 31-34. For example, the signal integrating unit 41 integrates data extracted for each of the destination zone ECUs 21-24 from the data included in a plurality of output frames F3 constituting the output signal S3 transmitted from the plurality of ASIL ECUs 31-34 for each of the destination zone ECUs 21-24 to generate a destination integrated frame F4 for each of the destination zone ECUs 21-24. Here, the destination zone ECUs 21-24 are the zone ECUs 21-24 that transmitted the input signal S1 from the device E that was the target of the confirmation process.

[0039] The multiple output frames F3 (F31 to F34) constituting the output signal S3 from the ASIL ECUs 31 to 34 are configured to include multiple data areas, as shown in Fig. 11. Specifically, each output frame F3 is configured to include a data area indicating "frame start" indicating the start of the frame, "source ID: ECU for ASIL-0" indicating the identifier of the source, "destination ID: network branch" indicating the identifier of the source, "zone ECU 21", "zone ECU 22", "zone ECU 23", and "zone ECU 24" indicating the data area from zone ECU 21 to zone ECU 24, "error detection and correction area" indicating the error detection and correction area, and "frame end" indicating the end of the frame. The data area of ​​"zone ECU 21" stores data whose destination is zone ECU 21, the data area of ​​"zone ECU 22" stores data whose destination is zone ECU 22, the data area of ​​"zone ECU 23" stores data whose destination is zone ECU 23, and the data area of ​​"zone ECU 24" stores data whose destination is zone ECU 24. Note that Fig. 11 illustrates four output frames F3 (F31 to F34), and each of the output frames F3 (F31 to F34) corresponds to a frame transmitted from each of the ASIL ECUs 31 to 34. For example, output frame F31 whose source ID is ECU31 for ASIL-A corresponds to a frame transmitted from ECU31 for ASIL-A, output frame F32 whose source ID is ECU32 for ASIL-B corresponds to a frame transmitted from ECU32 for ASIL-B, output frame F33 whose source ID is ECU33 for ASIL-C corresponds to a frame transmitted from ECU33 for ASIL-C, and output frame F34 whose source ID is ECU34 for ASIL-D corresponds to a frame transmitted from ECU34 for ASIL-D.

[0040] The signal integrating unit 41 extracts data for each of the zone ECUs 21-24 from a data area included in a plurality of output frames F3 (F31-F34) transmitted from a plurality of ASIL ECUs 31-34. Then, the signal integrating unit 41 integrates the extracted data for each of the zone ECUs 21-24 to generate an integrated destination frame F4 (F41-F44) for each of the zone ECUs 21-24. Here, the integrated destination frame F4 (F41-F44) is configured to include a plurality of data areas as shown in FIG. Specifically, destination integrated frame F4 is composed of a data area indicating "frame start" which indicates the start of the frame, "source ID: network branch" which indicates the identifier of the source, "destination ID: zone ECU 〇〇" which indicates the identifier of the destination, "ASIL-A", "ASIL-B", "ASIL-C", and "ASIL-D" which indicate the data area from ASIL-A to ASIL-D, "error detection and correction area" which indicates the error detection and correction area, and "frame end" which indicates the end of the frame.

[0041] 11, the signal integrating unit 41 extracts data included in the data area of ​​the zone ECU 21, data included in the data area of ​​the zone ECU 22, data included in the data area of ​​the zone ECU 23, and data included in the data area of ​​the zone ECU 24, distinguishing between the data areas for each of the zone ECUs 21 to 24. Then, as shown in FIG 12, the signal integrating unit 41 integrates the data extracted for each of the zone ECUs 21 to 24 for the same destination to generate an integrated destination frame F4 (F41 to F44) for each of the destinations.

[0042] 11, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​the zone ECU 21 into a destination integrated frame F41 having the destination ID of the zone ECU 21. At this time, the signal integration unit 41 stores the data addressed to the zone ECU 21 transmitted from each of the ASIL ECUs 31-34 in the corresponding data area in the destination integrated frame F41, which is divided into data areas for ASIL-A to ASIL-D. For example, the signal integration unit 41 stores zone ECU 21 data transmitted from ASIL-A ECU 31 in a data area segmented for ASIL-A in the destination integrated frame F41 (destination ID: zone ECU 21), stores zone ECU 21 data transmitted from ASIL-B ECU 32 in a data area segmented for ASIL-B in the destination integrated frame F41, stores zone ECU 21 data transmitted from ASIL-C ECU 33 in a data area segmented for ASIL-C in the destination integrated frame F41, and stores zone ECU 21 data transmitted from ASIL-D ECU 34 in a data area segmented for ASIL-D in the destination integrated frame F41.

[0043] 11, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​the zone ECU 22 into a destination integrated frame F42 whose destination ID is the zone ECU 22. At this time, the signal integration unit 41 stores the data addressed to the zone ECU 22 transmitted from each of the ASIL ECUs 31-34 in the corresponding data area in the destination integrated frame F42, which is divided into data areas for ASIL-A to ASIL-D. For example, the signal integration unit 41 stores zone ECU 22 data transmitted from ASIL-A ECU 31 in a data area segmented for ASIL-A in the destination integrated frame F42 (destination ID: zone ECU 22), stores zone ECU 22 data transmitted from ASIL-B ECU 32 in a data area segmented for ASIL-B in the destination integrated frame F42, stores zone ECU 22 data transmitted from ASIL-C ECU 33 in a data area segmented for ASIL-C in the destination integrated frame F42, and stores zone ECU 22 data transmitted from ASIL-D ECU 34 in a data area segmented for ASIL-D in the destination integrated frame F42.

[0044] 11, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​the zone ECU 23 into a destination integrated frame F43 whose destination ID is the zone ECU 23. At this time, the signal integration unit 41 stores the data addressed to the zone ECU 23 transmitted from each of the ASIL ECUs 31-34 in the corresponding data area in the destination integrated frame F43, which is divided for each of the ASILs A-D. For example, the signal integration unit 41 stores zone ECU 23 data transmitted from ASIL-A ECU 31 in a data area segmented for ASIL-A in the destination integrated frame F43 (destination ID: zone ECU 23), stores zone ECU 23 data transmitted from ASIL-B ECU 32 in a data area segmented for ASIL-B in the destination integrated frame F43, stores zone ECU 23 data transmitted from ASIL-C ECU 33 in a data area segmented for ASIL-C in the destination integrated frame F43, and stores zone ECU 23 data transmitted from ASIL-D ECU 34 in a data area segmented for ASIL-D in the destination integrated frame F43.

[0045] 11, the signal integration unit 41 integrates (aggregates) all data included in the data area of ​​the zone ECU 24 into a destination integrated frame F44 whose destination ID is the zone ECU 24. At this time, the signal integration unit 41 stores the data addressed to the zone ECU 24 transmitted from each of the ASIL ECUs 31-34 in the corresponding data areas in the destination integrated frame F44, which are divided for each of the ASILs A-D. For example, the signal integration unit 41 stores zone ECU 24 data transmitted from ASIL-A ECU 31 in a data area segmented for ASIL-A in the destination integrated frame F44 (destination ID: zone ECU 24), stores zone ECU 24 data transmitted from ASIL-B ECU 32 in a data area segmented for ASIL-B in the destination integrated frame F44, stores zone ECU 24 data transmitted from ASIL-C ECU 33 in a data area segmented for ASIL-C in the destination integrated frame F44, and stores zone ECU 24 data transmitted from ASIL-D ECU 34 in a data area segmented for ASIL-D in the destination integrated frame F44.

[0046] In this way, the signal integration unit 41 integrates data extracted for each destination zone ECU 21-24 from the data contained in multiple output frames F3 constituting the output signals S3 from the multiple ASIL ECUs 31-34, for each destination zone ECU 21-24, to generate a destination integrated frame F4 for each destination zone ECU 21-24.

[0047] Next, the signal distribution unit 42 will be described. The signal distribution unit 42 distributes and transmits signals according to their destinations. For example, the signal distribution unit 42 distributes and transmits input signals S1 from the equipment E transmitted from the multiple zone ECUs 21-24 to the ASIL ECUs 31-34 to which a level corresponding to the function of the equipment E is assigned. In this example, the signal distribution unit 42 distributes and transmits each level-integrated frame F2 (F21-F24) generated by the signal integration unit 41 based on the input signal S1 to the ASIL ECUs 31-34 to which the corresponding level is assigned. For example, the signal distribution unit 42 distributes and transmits the level-integrated frame F21 (destination ID: ASIL-A ECU 31) generated by the signal integration unit 41 to the ASIL-A ECU 31 to which ASIL-A is assigned as a confirmation process related to the safety standard. The signal distribution unit 42 distributes and transmits the level integrated frame F22 (destination ID: ASIL-B ECU 32) generated by the signal integration unit 41 to the ASIL-B ECU 32 to which ASIL-B has been assigned as a confirmation process related to the safety standard. The signal distribution unit 42 distributes and transmits the level integrated frame F23 (destination ID: ASIL-C ECU 33) generated by the signal integration unit 41 to the ASIL-C ECU 33 to which ASIL-C has been assigned as a confirmation process related to the safety standard. The signal distribution unit 42 distributes and transmits the level integrated frame F24 (destination ID: ASIL-D ECU 34) generated by the signal integration unit 41 to the ASIL-D ECU 34 to which ASIL-D has been assigned as a confirmation process related to the safety standard. When transmitting the level integration frames F21 to F24, the signal distribution unit 42 prioritizes transmitting the input signal S1 for the ASIL ECUs 33, 34 having a relatively high assigned level, i.e., the level integration frames F23, F24 based on the input signal S1, over the input signal S1 for the ASIL ECUs 31, 32 having a relatively low assigned level, i.e., the level integration frames F21, F22 based on the input signal S1.

[0048] Furthermore, the signal distribution unit 42 distributes and transmits the output signals S3 from the ASIL ECUs 31-34 to the zone ECUs 21-24 that transmitted the input signal S1 from the device E that was the target of the confirmation process. In this example, the signal distribution unit 42 distributes and transmits each destination integrated frame F4 (F41-F44) generated by the signal integrating unit 41 to the corresponding destination zone ECUs 21-24. For example, the signal distribution unit 42 distributes and transmits the destination integrated frame F41 (destination ID: zone ECU 21) generated by the signal integrating unit 41 to the zone ECU 21 that transmitted the input signal S1 from the device E that was the target of the confirmation process. The signal distribution unit 42 distributes and transmits the destination integrated frame F42 (destination ID: zone ECU 22) generated by the signal integration unit 41 to the zone ECU 22 that transmitted the input signal S1 from the device E that was the target of the confirmation process. The signal distribution unit 42 distributes and transmits the destination integrated frame F43 (destination ID: zone ECU 23) generated by the signal integration unit 41 to the zone ECU 23 that transmitted the input signal S1 from the device E that was the target of the confirmation process. The signal distribution unit 42 distributes and transmits the destination integrated frame F44 (destination ID: zone ECU 24) generated by the signal integration unit 41 to the zone ECU 24 that transmitted the input signal S1 from the device E that was the target of the confirmation process.

[0049] Each of the zone ECUs 21-24 controls the equipment E connected thereto based on each of the destination integrated frames F41-44 transmitted from the signal distribution unit 42. For example, the zone ECU 21 controls the equipment E connected to the zone ECU 21, i.e., the equipment E that realizes the function set by ASIL-A to ASIL-D, based on the data (the confirmation process result according to the level of the safety standard, i.e., ASIL-A to ASIL-D) stored in the data area of ​​the destination integrated frame F41. The zone ECU 22 controls the equipment E connected to the zone ECU 22 based on the data (the confirmation process result according to the level of the safety standard) stored in the data area of ​​the destination integrated frame F42. The zone ECU 23 controls the equipment E connected to the zone ECU 23 based on the data (the confirmation process result according to the level of the safety standard) stored in the data area of ​​the destination integrated frame F43. The zone ECU 24 controls the equipment E connected to the zone ECU 24 based on the data (the confirmation process result according to the level of the safety standard) stored in the data area of ​​the destination integrated frame F44.

[0050] Next, a communication example of each frame will be described. FIG. 13 is a diagram showing a communication example of each frame according to the embodiment. In the upstream communication, the signal integration unit 41 of the network branching unit 40 receives each input frame F11-F14 transmitted from each zone ECU 21-24. The signal integration unit 41 integrates data extracted for each level from data included in each input frame F11-F14 received at a predetermined fixed period for each level to generate level-integrated frames F21-F24 for each level. In this example, the signal integration unit 41 receives four input frames F11-F14 at a predetermined fixed period as shown in FIG. 13. However, for example, if only three input frames F11-F13 are received at a predetermined fixed period, the signal integration unit 41 may integrate data extracted for each level from data included in the three input frames F11-F13 for each level to generate level-integrated frames F21-F24 for each level. Next, the signal distributing unit 42 distributes and transmits each of the level-integrated frames F21 to F24 generated by the signal integrating unit 41 to the ASIL ECUs 31 to 34 to which the corresponding levels are assigned. At this time, when transmitting the level-integrated frames F21 to F24, the signal distributing unit 42 transmits the level-integrated frames F23, F24 to be transmitted to the ASIL ECUs 33, 34 to which the assigned levels are relatively high, preferentially over the level-integrated frames F21, F22 to be transmitted to the ASIL ECUs 31, 32 to which the assigned levels are relatively low. For example, the signal distributing unit 42 transmits the level-integrated frames F24 in order starting from the level-integrated frame F24 to be transmitted to the ASIL-D ECU 34 to which the assigned level is the highest. Specifically, the signal distribution unit 42 first transmits the level integration frame F24 to be sent to the ASIL-D ECU 34, which has the highest assigned level, then transmits the level integration frame F23 second to be sent to the ASIL-C ECU 33, which has the second highest assigned level, then transmits the level integration frame F22 third to be sent to the ASIL-B ECU 32, which has the third highest assigned level, and finally transmits the level integration frame F21 to be sent to the ASIL-A ECU 31, which has the lowest assigned level.In the above embodiment, the signal distributor 42 transmits the level integration frames F24 in order starting from the level integration frame F24 to be transmitted to the ASIL-D ECU 34 having the highest assigned level. However, the present invention is not limited to this.

[0051] In downstream communication, the signal integrating unit 41 receives each output frame F31-F34 transmitted from each ASIL ECU 31-34. The signal integrating unit 41 integrates data extracted for each destination zone ECU 21-24 from data included in each output frame F31-F34 received at a predetermined fixed period, for each zone ECU 21-24, to generate destination integrated frames F41-F44 for each zone ECU 21-24. In this example, the signal integration unit 41 receives four output frames F31-F34 at a predetermined fixed period as shown in Fig. 13. However, if only three output frames F31-F34 are received at a predetermined fixed period, data extracted from the data included in the three output frames F31-F34 for each of the zone ECUs 21-24 that are destinations may be integrated for each of the zone ECUs 21-24 to generate destination integrated frames F41-F44 for each of the zone ECUs 21-24. Next, the signal distribution unit 42 distributes and transmits each of the destination integrated frames F41-F44 generated by the signal integration unit 41 to the corresponding zone ECUs 21-24 that are destinations. In this way, by using the level integrated frame F2 and the destination integrated frame F4, the vehicle system 1 can reduce the number of frames by half compared to when these integrated frames are not used, and can suppress an increase in communication traffic.

[0052] Next, an operation example of the vehicle system 1 will be described. FIG. 14 is a flowchart showing an operation example of the vehicle system 1 according to the embodiment. In the vehicle system 1, the zone ECUs 21-24 transmit input frames F1 (F11-F14) constituting the input signal S1 from each device E to the network branching unit 40 (step ST1). Next, the signal integration unit 41 of the network branching unit 40 integrates data extracted for each level from data included in the multiple input frames F1 to generate a level integration frame F2 (step ST2). For example, the signal integration unit 41 extracts data for each safety standard level (ASIL-A to ASIL-D) from a data area included in the multiple input frames F1 (F11-F14) transmitted from the multiple zone ECUs 21-24. Then, the signal integration unit 41 integrates the data extracted for each safety standard level for each level to generate a level integration frame F2 (F21-F24) for each level. Next, the ASIL ECUs 31 to 34 execute a confirmation process related to safety standards for data included in the level integration frame F2 (F21 to F24) (step ST3). For example, the ASIL-A ECU 31 executes a confirmation process related to ASIL-A for data included in the data area of ​​the level integration frame F21. Similarly, the ASIL-B ECU 32 executes a confirmation process related to ASIL-B for data included in the data area of ​​the level integration frame F22, the ASIL-C ECU 33 executes a confirmation process related to ASIL-C for data included in the data area of ​​the level integration frame F23, and the ASIL-D ECU 34 executes a confirmation process related to ASIL-D for data included in the data area of ​​the level integration frame F24. Next, the ASIL ECUs 31 to 34 transmit an output frame F3 (F31 to F34) including the confirmation process result to the network branching unit 40 (step ST4). Next, the signal integrating unit 41 integrates the data extracted for each destination from the data included in the multiple output frames F3 to generate an integrated destination frame F4 (step ST5).For example, the signal integration unit 41 integrates data extracted for each of the destination zone ECUs 21-24 from the data included in each of the output frames F31-F34 transmitted from each of the ASIL ECUs 31-34 for each of the destination zone ECUs 21-24 to generate destination integrated frames F41-F44 for each of the destination zone ECUs 21-24. Next, the zone ECUs 21-24 control each device E based on the data in the destination integrated frame F4 (step ST6). For example, the zone ECU 21 controls the power-train device E based on the data included in the data area of ​​the destination integrated frame F41 transmitted from the network branching unit 40. For example, when the confirmation result data included in the data area of ​​the destination integrated frame F41 transmitted from the network branching unit 40 indicates normality, the zone ECU 21 normally operates the power-train device E. On the other hand, if the confirmation result data included in the data field of the destination integrated frame F41 transmitted from the network branching unit 40 indicates an abnormality, the zone ECU 21 displays an error on the powertrain device E and performs degenerate operation.

[0053] As described above, the vehicle system 1 according to the embodiment includes a plurality of devices E, a plurality of zone ECUs 21-24, a central ECU 30, and a network branching unit 40. The plurality of devices E are mounted on the vehicle V, and a predetermined level of safety standard is set for each of the functions to be realized. The plurality of zone ECUs 21-24 each control the device E divided into control systems. The central ECU 30 is capable of executing a confirmation process related to the safety standard for the plurality of devices E. The network branching unit 40 relays an input signal S1 related to the confirmation process from the device E and an output signal S3 related to the confirmation process from the central ECU 30 between the plurality of zone ECUs 21-24 and the central ECU 30. Here, the central ECU 30 includes ASIL ECUs 31-34 that are assigned to each level of the safety standard and are capable of executing a confirmation process for the device E according to the assigned level. The network branching unit 40 distributes and transmits input signals S1 from equipment E transmitted from multiple zone ECUs 21-24 to ASIL ECUs 31-34 to which a level corresponding to the function of the equipment E is assigned, and distributes and transmits output signals S3 transmitted from the ASIL ECUs 31-34 to the zone ECUs 21-24 that transmitted the input signals S1 from equipment E that was the subject of confirmation processing.

[0054] With this configuration, the vehicle V system 1 does not require the ASIL ECUs 31-34 to execute processes related to multiple levels of safety standards, and when multiple levels of safety standards are present in the same system as in the past, it is no longer necessary to apply the process of a high-level safety standard to those that process a low-level safety standard, and it is possible to avoid providing the ASIL ECUs 31-34 with excessive performance. As a result, the vehicle system 1 can reduce the number of steps required to build a system and suppress development costs. In addition, since the ASIL ECUs 31-34 of the central ECU 30 are assigned one for each level of the safety standard, the vehicle system 1 can aggregate the central ECUs 30 according to the number of levels of the safety standard. As a result, the vehicle system 1 can appropriately build a system that ensures safety.

[0055] In the vehicle system 1, the network branching unit 40 integrates data extracted for each level from data included in a plurality of input frames F1 constituting an input signal S1 from the device E transmitted from a plurality of zone ECUs 21-24 for each level, generates a level integrated frame F2 for each level, and distributes and transmits each generated level integrated frame F2 to the ASIL ECUs 31-34 to which the corresponding level is assigned. In addition, the network branching unit 40 integrates data extracted for each destination zone ECU 21-24 from data included in a plurality of output frames F3 constituting an output signal S3 from the ASIL ECUs 31-34 transmitted from the ASIL ECUs 31-34 for each destination zone ECU 21-24 to generate a destination integrated frame F4 for each destination zone ECU 21-24, and distributes and transmits each generated destination integrated frame F4 to the corresponding destination zone ECU 21-24. With this configuration, the vehicle system 1 can reduce the number of frames by integrating the frames, thereby suppressing an increase in communication traffic in the communication network.

[0056] In the vehicle system 1, the network branching unit 40 preferentially transmits the input signal S1 to the ASIL ECUs 33 and 34, which are assigned a relatively high level of safety standard, over the input signal S1 to the ASIL ECUs 31 and 32, which are assigned a relatively low level of safety standard. With this configuration, the vehicle system 1 can prioritize the confirmation process for a relatively high level of safety standard, such as an antilock brake function or an electric power steering function, and can quickly transmit the result of the confirmation process to the device E that realizes these functions with a relatively high level of safety standard. This allows the vehicle system 1 to quickly operate the device E with a relatively high level of importance, such as an antilock brake function or an electric power steering function.

[0057] In the vehicle system 1, the processing related to a safety standard with a relatively high level includes at least a part of the processing related to a safety standard with a relatively low level. With this configuration, the vehicle system 1 can share a part of the processing related to the safety standards, thereby reducing the amount of work required. Even if the vehicle system 1 shares a part of the processing related to the safety standards, the vehicle system 1 executes the processing related to the safety standards according to the individual safety standard levels, and does not execute the processing related to the safety standards according to different safety standard levels, thereby preventing a malfunction occurring in the processing with a low safety standard from affecting the processing with a high safety standard. As a result, the vehicle system 1 can properly construct a system that ensures safety.

[0058] [Modifications] Next, a modified example of the embodiment will be described. In the modified example, the same components as those in the embodiment will be denoted by the same reference numerals, and detailed description thereof will be omitted.

[0059] The central ECU 30 may be provided for each ECU (ASIL-A ECU 31, ASIL-B ECU 32, ASIL-C ECU 33, ASIL-D ECU 34) as shown in FIG. 2, or the central ECU 30A may be provided for each board (ASIL-A board 31A, ASIL-B board 32A, ASIL-C board 33A, ASIL-D board 34A) as shown in FIG. 15, or the central ECU 30B may be provided for each CPU (microcomputer) (ASIL-A microcomputer 31B, ASIL-B microcomputer 32B, ASIL-C microcomputer 33B, ASIL-D microcomputer 34B) as shown in FIG. 16. The central ECU 30A is provided with a communication I / F circuit 35A connected to the network branching unit 40 and the CPUs of each board, and the central ECU 30B is provided with a communication I / F circuit 35B connected to the network branching unit 40 and each CPU.

[0060] An example has been described in which the network branching unit 40 generates a level integration frame F2 integrated for each level of the safety standard, and also generates a destination integration frame F4 integrated for each destination zone ECU 21-24, and integrates the frames, distributes the frames, and transmits them, but this is not limited to this, and the frames may be individually distributed and transmitted without being integrated.

[0061] An example has been described in which the network branch unit 40 gives priority to transmitting the input signal S1 to the ASIL ECUs 33, 34, which are assigned a relatively high level of safety standard, over the input signal S1 to the ASIL ECUs 31, 32, which are assigned a relatively low level of safety standard. However, transmission may be performed without giving priority based on the level of such safety standards.

[0062] Although an example has been described in which the processing related to the relatively high level safety standard at least partially includes processing related to the relatively low level safety standard, the processing related to the safety standard may be configured in other ways without being limited thereto.

[0063] Although an example in which the multiple areas D are divided into four has been described, the present invention is not limited to this and the areas may be divided into other numbers.

[0064] The multiple device control units 20 are typically divided into areas / zones, but the division into areas / zones is merely an example, and they may be provided for each domain representing a system that controls the vehicle V. When multiple device control units 20 are provided for each domain, the multiple devices E connected to each device control unit 20 are devices E in the same domain (control system).

[0065] The safety standards have been described in terms of ASIL defined by the ISO26262 standard, but are not limited to this and may be other standards.

[0066] Although an example has been described in which the I / O 211c to I / O 214c are connected to devices E that realize functions with different ASILs set thereto, the present invention is not limited to this, and for example, devices E among the I / O 211c to I / O 214c may have different ASILs. For example, the I / O 211c may be connected to a mixture of devices E with ASIL-A to ASIL-D. [Explanation of symbols]

[0067] 1 Vehicle Systems 20 Multiple device control units 30 Central ECU (Central Control Unit) 31 ASIL-A ECU (single level control unit) 32 ASIL-B ECU (single level control unit) 33 ASIL-C ECU (single level control unit) 34 ASIL-D ECU (single level control unit) 40 Network branching section (relay section) E Multiple devices F1 Input frame (frame) F2 level integrated frame F3 Output Frame (Frame) F4 Destination Integration Frame S1 Input signal S3 Output Signal V Vehicle

Claims

1. A plurality of devices are installed in a vehicle and have predetermined safety standards set for the functions they realize; A plurality of device control units each controlling the devices divided into control systems; a central control unit capable of executing a confirmation process regarding the safety standards for the plurality of devices; a relay unit that relays an input signal related to the confirmation process from the devices and an output signal related to the confirmation process from the central control unit between the plurality of device control units and the central control unit, the central control unit includes a plurality of single-level control units that are assigned to the levels of the safety standards and that are capable of executing the confirmation process for the equipment according to the assigned levels; The relay unit distributes and transmits the input signals from the equipment transmitted from the multiple equipment control units to the single-level control unit to which the level corresponding to the function of the equipment is assigned, and distributes and transmits the output signals from the single-level control units transmitted from the multiple single-level control units to the equipment control unit that sent the input signal from the equipment that was the subject of the confirmation process.

2. the relay unit integrates data extracted for each level from data included in a plurality of frames constituting the input signals from the devices transmitted from the plurality of device control units for each level, generates a level integrated frame for each level, distributes and transmits each of the generated level integrated frames to the single-level control units to which the corresponding level is assigned, and also integrates data extracted for each of the device control units to be destinations from data included in a plurality of frames constituting the output signals from the single-level control units transmitted from the plurality of single-level control units for each of the device control units to be destinations, generates a destination integrated frame for each of the device control units to be destinations, and distributes and transmits each of the generated destination integrated frames to the corresponding device control units to be destinations. The vehicle system of claim 1 .

3. 3. The vehicle system according to claim 1, wherein the relay unit transmits the input signal to the single-level control unit having a relatively high assigned level in preference to the input signal to the single-level control unit having a relatively low assigned level.

4. 4. The vehicle system according to claim 1, wherein the process related to the safety standard having a relatively high level at least partially includes a process related to the safety standard having a relatively low level.

Images