Communication control system, communication control method, and communication control program

Abstract

To notify a user that communication that does not conform to predetermined communication conditions has been made when a communication device connected to a network makes a communication that does not conform to the predetermined communication conditions after network settings have been changed.SOLUTION: An ECU 10 includes a setting unit 102 that performs a process on an ECU 200 for changing network settings by following instructions from an OTA server 20, a determination unit 104 that determines whether the communication of the ECU 200 conforms to predetermined communication conditions after the execution of the process, and an output unit 105 that notifies the OTA server 20 of an error when a determination unit 204 determines that the communication of the ECU 200 does not conform to the predetermined communication conditions.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a communication control system, a communication control method, and a communication control program.

Background Art

[0002] The use of SDN (Software Defined Networking), which changes the network configuration by software settings without changing the hardware configuration, is progressing. For example, Patent Document 1 discloses a setting device that contributes to updating the settings of communication devices that configure the network while the network is operating.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] After changing the network settings, a communication device connected to the network may perform communication that does not meet a predetermined communication condition.

[0005] In view of the above points, the present invention has been made, and when a communication device connected to a network performs communication that does not meet a predetermined communication condition after changing the network settings, a communication control system, a communication control method, and a communication control program for notifying that communication that does not meet the communication condition has been performed are provided.

Means for Solving the Problems

[0006] The communication control system according to the first aspect of the present invention includes a setting unit that performs processing related to changing the network settings on a communication device according to an instruction from an external device, a determination unit that determines whether the communication of the communication device conforms to a predetermined communication condition after the execution of the processing, and a notification unit that notifies the external device of an error when the determination unit determines that the communication of the communication device does not conform to the predetermined communication condition.

[0007] According to the first aspect of the present invention, when a communication device connected to a network performs communication that does not conform to a predetermined communication condition after changing the network settings, it is possible to notify the external device that communication that does not conform to the communication condition has been performed.

[0008] The communication control system according to the second aspect of the present invention includes a setting unit that performs processing related to changing the network settings on a communication device according to an instruction from an external device, a determination unit that determines whether the communication of the communication device conforms to a predetermined communication condition after the execution of the processing, and a control unit that returns the network settings to the state before the change when the determination unit determines that the communication of the communication device does not conform to the predetermined communication condition.

[0009] According to the second aspect of the present invention, when a communication device connected to a network performs communication that does not conform to a predetermined communication condition after changing the network settings, the network settings can be returned to the state before the change.

[0010] The communication control system according to the third aspect of the present invention is the communication control system according to the first aspect, and further includes a control unit that returns the network settings to the state before the change when the determination unit determines that the communication of the communication device does not conform to a predetermined communication condition.

[0011] According to the third aspect of the present invention, when a communication device connected to a network performs communication that does not conform to a predetermined communication condition after changing the network settings, the network settings can be returned to the state before the change.

[0012] The communication control system according to the fourth aspect of the present invention is the communication control system according to any one of the first to third aspects, and the determination unit determines whether communication is being performed by the communication device at a predetermined period. According to the fourth aspect of the present invention, the occurrence of communication not performed at a predetermined period can be notified to an external device.

[0013] The communication control system according to the fifth aspect of the present invention is the communication control system according to any one of the first to fourth aspects, and the determination unit determines whether communication is being performed by the communication device using a predetermined protocol. According to the fifth aspect of the present invention, the occurrence of communication not performed using a predetermined protocol can be notified to an external device.

[0014] The communication control system according to the sixth aspect of the present invention is the communication control system according to any one of the first to fifth aspects, and the determination unit determines whether communication is being performed by the communication device within a range of a predetermined communication volume. According to the sixth aspect of the present invention, the occurrence of communication not performed within a range of a predetermined communication volume can be notified to an external device.

[0015] The communication control system according to the seventh aspect of the present invention is the communication control system according to any one of the first to sixth aspects, and the determination unit determines whether communication is being performed by the communication device with a predetermined service. According to the seventh aspect of the present invention, the fact that communication with a predetermined service is not being performed can be notified to an external device.

[0016] The communication control system according to the eighth aspect of the present invention is the communication control system according to any one of the first to seventh aspects, and the determination unit determines whether communication is being performed by the communication device using a predetermined communication profile. According to the eighth aspect of the present invention, the fact that communication using a predetermined communication profile is not being performed can be notified to an external device.

[0017] The communication control system according to the ninth aspect of the present invention is a communication control system according to any one of the first aspect to the eighth aspect, and the determination unit determines whether communication of a predetermined message is being performed by the communication device. According to the ninth aspect of the present invention, it is possible to notify an external device that communication of a predetermined message is not being performed.

[0018] The communication control system according to the tenth aspect of the present invention is a communication control system according to any one of the first aspect to the ninth aspect, and the determination unit determines whether communication is being performed by the communication device with a predetermined data length. According to the tenth aspect of the present invention, it is possible to notify an external device that communication with a predetermined data length is not being performed.

[0019] The communication control system according to the eleventh aspect of the present invention is a communication control system according to any one of the first aspect to the tenth aspect, and the determination unit determines whether a communication abnormality of the network has occurred. According to the eleventh aspect of the present invention, it is possible to notify an external device that a communication abnormality of the network has occurred.

[0020] The communication control system according to the twelfth aspect of the present invention is a communication control system according to any one of the first aspect to the eleventh aspect, and the determination unit determines whether the information of the communication device of the transmission source is correct. According to the twelfth aspect of the present invention, it is possible to notify an external device that communication has occurred in which the information of the communication device of the transmission source is incorrect.

[0021] The communication control system according to the thirteenth aspect of the present invention is a communication control system according to any one of the first aspect to the twelfth aspect, and the determination unit determines whether the information of the communication device of the destination is correct. According to the thirteenth aspect of the present invention, it is possible to notify an external device that communication has occurred in which the information of the communication device of the destination is incorrect.

[0022] The communication control system according to the 14th aspect of the present invention is the communication control system according to any one of the 1st to 13th aspects, and the determination unit determines whether communication is being performed in a predetermined network segment. According to the 14th aspect of the present invention, it is possible to notify an external device that communication not performed in a predetermined network segment has occurred.

[0023] The communication control system according to the 15th aspect of the present invention is the communication control system according to any one of the 1st to 14th aspects, and the determination unit verifies the integrity of the communication data transmitted from the communication device and determines whether the communication data is complete. According to the 15th aspect of the present invention, it is possible to notify an external device that communication with incomplete communication data has occurred.

[0024] The communication control system according to the 16th aspect of the present invention is the communication control system according to any one of the 1st, 3rd to 15th aspects, and when the determination unit does not determine that the communication of the communication device does not meet a predetermined communication condition for a predetermined time from the change in the network settings, the notification unit notifies the external device that the change in the network settings is effective. According to the 16th aspect of the present invention, if communication that does not meet a predetermined communication condition does not occur for a predetermined time, it is possible to notify an external device that the change in the network settings is effective.

[0025] The communication control system according to the 17th aspect of the present invention is the communication control system according to any one of the 1st to 16th aspects, and the network is an in-vehicle network. According to the 17th aspect of the present invention, when a communication abnormality occurs in a communication device connected to an in-vehicle network, the network settings can be restored to the state before the change.

[0026] In the communication control method according to the 18th aspect of the present invention, a processor performs processing related to changing the network settings on a communication device according to an instruction from an external device, and after executing the processing, determines whether the communication of the communication device meets a predetermined communication condition, and when it is determined that the communication of the communication device does not meet the predetermined communication condition, executes a process of notifying the external device of an error.

[0027] According to the 18th aspect of the present invention, when a communication device connected to a network performs communication that does not meet a predetermined communication condition after changing the network settings, it is possible to notify the external device that communication that does not meet the communication condition has been performed.

[0028] The communication control program according to the 19th aspect of the present invention causes a computer to perform processing related to changing the network settings on a communication device according to an instruction from an external device, and after executing the processing, determines whether the communication of the communication device meets a predetermined communication condition, and when it is determined that the communication of the communication device does not meet the predetermined communication condition, executes a process of notifying the external device of an error.

[0029] According to the 19th aspect of the present invention, when a communication device connected to a network performs communication that does not meet a predetermined communication condition after changing the network settings, it is possible to notify the external device that communication that does not meet the communication condition has been performed.

Effects of the Invention

[0030] According to the present invention, when a communication device connected to a network performs communication that does not meet a predetermined communication condition after changing the network settings, it is possible to provide a communication control system, a communication control method, and a communication control program for notifying that communication that does not meet the communication condition has been performed.

Brief Description of the Drawings

[0031]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Embodiments for Carrying Out the Invention

[0032] Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings. In the drawings, the same or equivalent components and parts are given the same reference numerals. Also, the dimensional ratios in the drawings are exaggerated for the convenience of explanation and may be different from the actual ratios.

[0033] FIG. 1 is a diagram showing the schematic configuration of the communication system according to the present embodiment. The communication system shown in FIG. 1 has a configuration in which the vehicle 1 and the OTA (Over The Air) server 20 are connected via the network 30. The vehicle 1 includes an antenna 2 and an in-vehicle network which is an example of the network of the present invention and includes ECUs (Electronic Control Units) 10, 200A, 200B, 200C, 200D, and switches 210A, 210B. The ECUs 10, 200A, 200B, 200C, 200D and the switches 210A, 210B are each connected by Ethernet (registered trademark). Note that the number of ECUs and switches is not limited to the example shown in FIG. 1, and the connection form between the ECUs and the switches is also not limited to the example shown in FIG. 1.

[0034] ECU 10 is an ECU that controls the entire in-vehicle network. ECU 10 communicates with the OTA server 20 via the antenna 2 and exchanges various data with the OTA server 20. ECUs 200A, 200B, 200C, and 200D are ECUs for controlling each part of the vehicle 1. For example, ECUs 200A, 200B, 200C, and 200D control the operations of devices mounted on the vehicle 1 such as the engine, motor, brakes, camera, and lights.

[0035] Also, without changing the hardware configuration of the in-vehicle network, ECU 10 changes the configuration of the in-vehicle network by software settings using SDN technology. That is, when changing the configuration of the in-vehicle network, instead of unplugging and plugging cables or individually setting the individual switches 210A and 210B, the switches 210A and 210B are operated by software control using OpenFlow or the like. Specifically, ECU 10 sets the destination of the packets transmitted from each ECU to the switches 210A and 210B by software control. The switches 210A and 210B pass or discard the packets based on the content set by ECU 10.

[0036] The OTA server 20 is an example of an external device and is a server for updating the software for each ECU of the vehicle 1. When an update occurs to the software stored in each ECU of the vehicle 1, the updated software is transmitted from the OTA server 20 to the vehicle 1. When updating the software stored in each ECU of the vehicle 1, the software may be automatically transmitted from the OTA server 20 to the vehicle 1, or the software may be transmitted from the OTA server 20 to the vehicle 1 based on an instruction from the user riding in the vehicle 1.

[0037] When an update occurs to the software of an ECU connected to a vehicle network, it may be specified by the updated software to establish new communication with another ECU on the vehicle network. For example, as a result of software update in ECU200A, there may be a case where ECU200A newly starts communication with ECU200C via switches 210A and 210B. When an update occurs to the software of an ECU connected to the vehicle network, ECU10 changes the communication settings of switches 210A and 210B.

[0038] However, as a result of software update, there may be an ECU200 that conducts communication not meeting predetermined communication conditions. For example, software is updated so that ECU200A starts communication with ECU200D, and the communication settings of switches 210A and 210B are changed by ECU10, but it is conceivable that ECU200A conducts communication not meeting the predetermined communication conditions with ECU200D.

[0039] Here, the predetermined communication conditions refer to that communication is conducted at a predetermined period, that communication is conducted according to a predetermined protocol, that communication is conducted within a range of a predetermined communication volume, that communication is conducted with a predetermined service, etc. Detailed examples of the communication conditions will be described later.

[0040] Therefore, when, as a result of changing the communication settings of switches 210A and 210B by software, there is an ECU that conducts communication not meeting the predetermined communication conditions, the ECU10 according to this embodiment returns the communication settings of switches 210A and 210B to the state before the change. Then, ECU10 instructs the OTA server 20 to roll back the software. When there is an ECU that conducts communication not meeting the predetermined communication conditions, the ECU10 according to this embodiment can stop the ECU from conducting communication not meeting the predetermined communication conditions by returning the communication settings of switches 210A and 210B to the state before the change.

[0041] Subsequently, the hardware configuration of ECU10 will be described. FIG. 2 is a block diagram showing the hardware configuration of ECU10.

[0042] As shown in FIG. 2, the ECU 10 includes a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a storage 14, a first communication interface (I / F) 15, and a second communication interface 16. Each component is communicably connected to each other via a bus 19.

[0043] The CPU 11 is a central processing unit that executes various programs and controls each part. That is, the CPU 11 reads a program from the ROM 12 or the storage 14 and executes the program using the RAM 13 as a work area. The CPU 11 performs control of each of the above components and various arithmetic processes according to the program recorded in the ROM 12 or the storage 14. In the present embodiment, a communication control program for controlling communication of the in-vehicle network of the vehicle 1 is stored in the ROM 12 or the storage 14.

[0044] The ROM 12 stores various programs and various data. The RAM 13 temporarily stores a program or data as a work area. The storage 14 is composed of a storage device such as a flash memory and stores various programs including an operating system and various data.

[0045] The first communication interface 15 is an interface for communicating with the OTA server 20, and for example, wireless communication standards such as 4G, 5G, or Wi-Fi (registered trademark) are used. The second communication interface 16 is an interface for communicating with other devices such as the ECUs 200A to 200D, and for example, a wired communication standard such as Ethernet (registered trademark) is used.

[0046] When executing the above communication control program, the ECU 10 realizes various functions using the above hardware resources. The functional configuration realized by the ECU 10 will be described.

[0047] FIG. 3 is a block diagram showing an example of the functional configuration of the ECU 10.

[0048] As shown in FIG. 3, the ECU 10 includes, as functional components, an acquisition unit 101, a setting unit 102, a control unit 103, a determination unit 104, an output unit 105, and a storage unit 106. Each functional component is realized by the CPU 11 reading and executing a communication control program stored in the ROM 12 or the storage 14. Note that the functions of the acquisition unit 101, the setting unit 102, the control unit 103, the determination unit 104, the output unit 105, and the storage unit 106 may be realized in a plurality of ECUs.

[0049] The acquisition unit 101 acquires data from the OTA server 20 and the ECUs 200A to 200D of the in-vehicle network. Specifically, the acquisition unit 101 acquires new software from the OTA server 20 when an update occurs in the software executed by the ECUs 200A to 200D. Further, when necessary in response to an update of the software of the ECUs 200A to 200D, the acquisition unit 101 acquires data for changing the communication settings of the switches 210A and 210B.

[0050] The setting unit 102 performs communication settings for the in-vehicle network by software. For example, when necessary in response to an update of the software of the ECUs 200A to 200D, the setting unit 102 changes the communication settings of the switches 210A and 210B. That is, the setting unit 102 changes the configuration of the in-vehicle network by software-based settings. The changes in communication settings performed by the setting unit 102 include, for example, setting a path for communicating with the communication partner of the ECU 200, opening or closing a port, setting the priority of packets to be passed, setting the size of the packet queue, setting the bandwidth, setting packet filtering, etc. For example, when the ECU 200D is newly added to the in-vehicle network, the setting unit 102 performs settings on the switches 210A and 210B for the other ECUs 200A to 200C that communicate with the ECU 200D so that communication can be performed with the ECU 200D.

[0051] The switches 210A and 210B hold communication settings in a table format, for example. The switches 210A and 210B refer to the table and process frames or packets flowing through the in-vehicle network.

[0052] The control unit 103 controls the operation of the ECU 10 and the in-vehicle network. Specifically, when an update occurs in the software executed by the ECUs 200A to 200D, the control unit 103 controls the output unit 105 to output the new software acquired by the acquisition unit 101. Also, when necessary in response to the software update of the ECUs 200A to 200D, the control unit 103 controls the output unit 105 to output to the switches 210A and 210B the data necessary for the communication setting change process in the setting unit 102.

[0053] The determination unit 104 monitors the communication status in the in-vehicle network and determines whether communication that satisfies a predetermined communication condition is being performed. When the determination unit 104 determines that communication that satisfies the predetermined communication condition is not being performed, it notifies the output unit 105 that communication that satisfies the predetermined communication condition is not being performed.

[0054] Specifically, the determination unit 104 determines whether communication is being performed at a predetermined cycle by each ECU connected to the in-vehicle network. When the predetermined cycle is 10 ms, if a message that should be transmitted at a 10-ms cycle is at 5 ms or 15 ms, if there is extra communication outside the 10-ms cycle, if extra communication is occurring in addition to the predetermined cycle, or if there is a gap in the predetermined cycle, etc., the determination unit 104 notifies the output unit 105 that communication is not being performed at the predetermined cycle.

[0055] Also, the determination unit 104 determines whether communication is being performed by each ECU connected to the in-vehicle network according to a predetermined protocol. And when TCP communication or ICMP communication is being performed from the ECU 200 that communicates only via UDP, or when the ECU 200 using SOME / IP is not using SOME / IP, the determination unit 104 notifies the output unit 105 that communication is not being performed according to the predetermined protocol.

[0056] Also, the determination unit 104 determines whether communication is being performed by each ECU connected to the in-vehicle network within a range of a predetermined communication volume. And when the ECU 200 is performing communication exceeding the range of the predetermined communication volume, the determination unit 104 notifies the output unit 105 that communication is not being performed within the range of the predetermined communication volume.

[0057] Also, the determination unit 104 determines whether communication with a predetermined service is being performed by each ECU connected to the in-vehicle network. To give a detailed example, although all ECUs 200 in the vehicle prohibit the TELNET service (port: 23), communication by FTP is being attempted; when a specific ECU 200 should communicate with a SOME / IP service id of 0x0001 but is communicating with 0x0002; when a specific ECU 200 should communicate with a SOME / IP method id of 0x0001 but is communicating with 0x0002; when, in http communication, a specific ECU should communicate with a SOME / IP method id of 0x0001 but is communicating with 0x0002, etc., if such communication has occurred, the determination unit 104 notifies the output unit 105 that communication with the predetermined service is not being performed.

[0058] Further, the determination unit 104 determines whether communication is being performed in a predetermined communication profile by each ECU connected to the in-vehicle network. For example, for a flag regarding a Partial Network, which is a network in which only some ECUs can wake up within one bus, it should always be 0 (indicating that it is not a bus adopting the Partial Network), but if it is 1 (indicating that it is a bus adopting the Partial Network), the determination unit 104 notifies the output unit 105 that communication is not being performed in the predetermined communication profile.

[0059] Further, the determination unit 104 determines whether communication is being performed with a predetermined message by each ECU connected to the in-vehicle network. For example, the MSG ID permitted at port A of a certain ECU200 is from 0x0000 to 0x8FFF, but if that ECU200 uses 0xFFFF as the MSG ID, the determination unit 104 notifies the output unit 105 that communication is not being performed with the predetermined message.

[0060] Further, the determination unit 104 determines whether communication is being performed with a predetermined data length by each ECU connected to the in-vehicle network. For example, the data length (Length) should always be 0x05dc (1500 bytes), but if a certain ECU200 is communicating with a data length of 0xffff, or for another example, although the query length of http is at most 100 bytes, if ECU200 is communicating exceeding that length, the determination unit 104 notifies the output unit 105 that communication is not being performed with the predetermined data length.

[0061] Further, the determination unit 104 determines whether a communication abnormality has occurred in the in-vehicle network. For example, when an ICMP error is received from the switch 210A, the determination unit 104 determines that a communication abnormality has occurred in the in-vehicle network. More specifically, for example, when ECU200A transmits to a non-existent partner across the switches 210A and 210B and receives a non-existence response from the second-stage switch 210B, the determination unit 104 determines that a communication abnormality has occurred in the in-vehicle network.

[0062] Further, the determination unit 104 determines whether the data source transmitted by each ECU or switch connected to the in-vehicle network is correct. For example, the IP address of port 1 of switch 210A should be any one of 192.168.0.2 to 192.168.0.10. However, if the IP address is outside that range, or for another example, the MAC address of port 1 of switch 210A should be AA:AA:AA:AA:AA:AA, but if it is a different MAC address, the determination unit 104 notifies the output unit 105 that the data source is incorrect.

[0063] Also, the determination unit 104 determines whether the data destination transmitted by each ECU or switch connected to the in-vehicle network is correct. For example, the address of the data destination should be such that the destination IP address is 192.168.0.XXX (XXX is any number between 0 and 255). However, if the IP address is outside that range, the determination unit 104 notifies the output unit 105 that the data destination is incorrect.

[0064] Furthermore, the determination unit 104 determines whether each ECU connected to the in-vehicle network is communicating within a predetermined network segment. For example, in the case of the VID of the VLAN Tag, if a value other than those defined, such as a value of 0x0FF or less, is used, the determination unit 104 notifies the output unit 105 that communication is not being performed within the predetermined network segment.

[0065] In addition, the determination unit 104 verifies the integrity of the communication data transmitted from each ECU connected to the in-vehicle network and determines whether the communication data is complete. For example, the determination unit 104 performs MAC (Message Authentication Code) verification on the communication data transmitted from an ECU added by plug-and-play or OTA. If there is an abnormality, it notifies the output unit 105 that the communication data is incomplete.

[0066] Of course, the content determined by the determination unit 104 is not limited to the above-described example. The content determined by the determination unit 104 can be added or changed by the distribution of update data from the OTA server 20.

[0067] The output unit 105 outputs data to each device of the OTA server 20 and the in-vehicle network. The output of data from the output unit 105 is performed under the control from the control unit 103. The output unit 105 functions as an example of the notification unit of the present invention. When it is determined by the determination unit 104 that the communication of the ECU 200 does not satisfy the predetermined communication conditions, the output unit 105 notifies the OTA server 20 of the occurrence of an error.

[0068] The storage unit 106 stores various information such as information referred to during the operation of the ECU 10 and information used for the control of the in-vehicle network. Specifically, after changing the communication settings of the switches 210A and 210B, when it is determined by the determination unit 104 that the communication of the ECU 200 does not satisfy the predetermined communication conditions, the storage unit 106 stores the communication settings before the change in order to return the communication settings of the switches 210A and 210B to the original state.

[0069] After changing the settings of the in-vehicle network for the switches 210A and 210B, the control unit 103 may determine that the change in the settings of the in-vehicle network is effective when the determination unit 104 does not determine for a predetermined time that the communication of the ECU 200 does not satisfy the predetermined communication conditions. Then, the control unit 103 may notify the OTA server 20 that the change in the in-vehicle network is effective. By receiving the notification that the change in the in-vehicle network is effective from the vehicle 1, the OTA server 20 can recognize that the software update has been completed normally.

[0070] By having the configuration shown in FIG. 3, when the determination unit 104 determines that the communication of the ECU 200 does not satisfy the predetermined communication conditions, the ECU 10 can notify the OTA server 20 of an error. Also, by having the configuration shown in FIG. 3, when the determination unit 104 determines that the communication of the ECU 200 does not satisfy the predetermined communication conditions, the ECU 10 can return the communication settings before the change to the switches 210A and 210B that are the targets of the network setting change. The ECU 10 can prevent communication that does not satisfy the predetermined communication conditions from occurring by returning the communication settings before the change to the switches 210A and 210B.

[0071] Subsequently, the hardware configurations of the ECUs 200A to 200D will be described. Hereinafter, the ECUs 200A to 200D are collectively referred to as the ECU 200. FIG. 4 is a block diagram showing the hardware configuration of the ECU 200.

[0072] As shown in FIG. 4, the ECU 200 includes a CPU 201, a ROM 202, a RAM 203, a storage 204, and a communication interface (I / F) 205. Each component is communicably connected to each other via a bus 209.

[0073] The CPU 201 is a central processing unit that executes various programs and controls each part. That is, the CPU 201 reads a program from the ROM 202 or the storage 204 and executes the program using the RAM 203 as a work area. The CPU 201 performs control of the above components and various arithmetic processes according to the program recorded in the ROM 202 or the storage 204.

[0074] The ROM 202 stores various programs and various data. The RAM 203 temporarily stores a program or data as a work area. The storage 204 is composed of a storage device such as a flash memory and stores various programs including an operating system and various data.

[0075] The communication interface 205 is an interface for communicating with other devices such as the ECU 10 and other ECUs 200. For example, a standard for wired communication such as Ethernet (registered trademark) is used.

[0076] When executing the above communication control program, the ECU 200 realizes various functions by using the above hardware resources. The functional configuration realized by the ECU 200 will be described.

[0077] FIG. 5 is a block diagram showing an example of the functional configuration of the ECU 200.

[0078] As shown in FIG. 5, the ECU 200 has an acquisition unit 211, a control unit 212, an output unit 213, and a storage unit 214 as functional configurations. Each functional configuration is realized by the CPU 201 reading and executing a program stored in the ROM 202 or the storage 204.

[0079] The acquisition unit 211 acquires data from the ECU 10 of the in-vehicle network and other ECUs 200. Specifically, the acquisition unit 211 acquires new software from the ECU 10 when an update occurs in the software executed by the ECU 200.

[0080] The control unit 212 controls the operation of the ECU 200. Specifically, when an update occurs in the software executed by the ECU 200, the control unit 212 performs a process of updating the software of its own device with the new software acquired by the acquisition unit 211.

[0081] The output unit 213 outputs data to the ECU 10 of the in-vehicle network and other ECUs 200. The output of data from the output unit 213 is performed under the control of the control unit 212.

[0082] The storage unit 214 stores various information such as information referred to during the operation of the ECU 10 and information used for the control of the in-vehicle network. Specifically, the storage unit 214 stores the software executed by the ECU 200 and the data referred to by the software.

[0083] Next, the operation of the communication system will be described.

[0084] FIG. 6 is a sequence diagram for explaining the operation of each device of the communication system. In ECU10, the CPU11 reads out a communication control program from the ROM12 or the storage 14, expands it in the RAM13, and executes it, whereby communication control processing is performed.

[0085] The sequence diagram shown in FIG. 6 shows the operation of each device when the software executed by the ECU200 of the in-vehicle network is updated and the communication settings of the switches 210A and 210B are changed according to the software update. FIG. 6 is a sequence diagram assuming that communication between the ECU200A and the ECU200C is started according to the communication settings of the switches 210A and 210B before the software update.

[0086] When updating the software executed by the ECU200 of the in-vehicle network, first, in step S101, the OTA server 20 transmits software data to the vehicle 1. The software data transmitted from the OTA server 20 is first acquired by the ECU10. The ECU10 outputs the software data acquired from the OTA server 20 to the ECU200 to be updated. Here, it is assumed that the ECU200A and 200C are the software update targets. In steps S102 and S104, the ECU10 outputs software data to the ECU200A and 200C that are the software update targets. In step S103, the ECU200A updates the software using the software data sent from the ECU10. Similarly, in step S105, the ECU200C updates the software using the software data sent from the ECU10.

[0087] In addition, in response to software updates, the ECU 10 outputs information on new communication settings in step S106 in order to update the communication settings of switches 210A and 210B. In step S107, switches 210A and 210B reflect the communication settings using the information on the communication settings sent from the ECU 10. For example, when the software of the ECU 200A and 200C is updated, the ECU 10 updates the communication settings of the switches 210A and 210B so that communication is possible between the ECU 200A and the ECU 200C.

[0088] When the software update and the communication setting update are completed, in step S108, the ECU 10 monitors the content of the in-vehicle network communication and determines whether the communication from the ECU 200 meets the predetermined communication conditions.

[0089] If it is determined that the communication from the ECU 200 does not meet the predetermined communication conditions, in step S109, the ECU 10 updates the software of the ECU 200A and 200C and transmits to the OTA server 20 that a communication error has occurred as a result of changing the communication settings of the switches 210A and 210B.

[0090] Upon receiving that a communication error has occurred, in step S110, the OTA server 20 transmits an instruction to roll back to the vehicle 1. Rollback means returning to the software before the update. When an instruction to roll back is transmitted from the OTA server 20, the ECU 200A and 200C return the software to the state before the update using the data of the software before the update that they have retained.

[0091] When the ECU 10 receives a rollback instruction from the OTA server 20, it outputs a rollback instruction to the ECU 200 to be rolled back. Here, the ECUs 200A and 200C are the targets for software rollback. The ECU 10 outputs a rollback instruction to the ECUs 200A and 200C that are the targets for software rollback in steps S111 and S113. The ECU 200A rolls back the software based on the instruction from the ECU 10 in step S112. Similarly, the ECU 200C rolls back the software based on the instruction from the ECU 10 in step S114. Also, along with the software rollback, the ECU 10 instructs the switches 210A and 210B to return the communication settings to the state before the change in step S115. The switches 210A and 210B return the communication settings to the state before the change in step S116.

[0092] When the OTA server 20 receives the occurrence of a communication error from the ECU 10, based on the content of the communication error, it transmits the software that has been corrected so that the communication error does not occur to the vehicle 1 again. Here, the distribution target of the corrected software is not limited to the ECUs 200A and 200C, and may include the ECU 200D that has nothing to do with the communication error. Since the flow from the transmission of the software from the OTA server 20 to the update of the software in the ECU 200 is the same as that from step S101 to step S105 described above, detailed description is omitted. Also, the ECU 10 executes a process for updating the communication settings of the switches 210A and 210B in response to the software update.

[0093] As described above, according to the embodiment of the present invention, when an ECU causes a communication error after the change of the network settings, the communication settings of the switch that is the target of the network settings change can be returned to the state before the change. By returning the communication settings of the switch that is the target of the network settings change to the state before the change, the ECU 10 can prevent the ECU from causing a communication error.

[0094] In the above-described embodiment, the case where the OTA server 20 distributes software has been shown. However, when the OTA server 20 does not distribute software, when the ECU 10 acquires the detection of communication abnormality by the ECU 200, the ECU 10 executes a process of returning the communication settings of the switches 210A and 210B to the state before the change.

[0095] The present invention is applicable to a change in communication settings for enabling a newly connected ECU to communicate with other ECUs when a new ECU is newly connected to an in-vehicle network. Further, in the above-described embodiment, an example regarding a change in communication settings in an in-vehicle network, which is a network constructed in a vehicle, has been shown. However, the present invention is not limited to such an example. The present invention can be applied to networks in general whose configurations are changed by software-based settings.

[0096] Note that the communication control process in which the CPU reads and executes software (program) in each of the above embodiments may be executed by various processors other than the CPU. Examples of the processor in this case include a PLD (Programmable Logic Device) whose circuit configuration can be changed after manufacturing, such as an FPGA (Field-Programmable Gate Array), and a dedicated electric circuit which is a processor having a circuit configuration dedicated to executing a specific process, such as an ASIC (Application Specific Integrated Circuit). Further, the communication control process may be executed by one of these various processors, or may be executed by a combination of two or more processors of the same type or different types (for example, a combination of a plurality of FPGAs, and a combination of a CPU and an FPGA, etc.). Further, the hardware structure of these various processors is, more specifically, an electric circuit combining circuit elements such as semiconductor elements.

[0097] In addition, in each of the above embodiments, the mode in which the program for communication control processing is pre-stored (installed) in the ROM or the storage has been described, but the present invention is not limited thereto. The program may be provided in a form recorded on a non-transitory recording medium such as a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a USB (Universal Serial Bus) memory. Further, the program may be in a form downloaded from an external device via a network.

Description of Reference Numerals

[0098] 1 Vehicle 2 Antenna 10 ECU 20 OTA Server (External Device) 30 Network 200A, 200B, 200C, 200D ECU (Communication Device) 210A, 210B Switch

Claims

1. A setting unit that, in accordance with an instruction from an external device, performs a first process related to software update on a control device and performs a second process related to a change in network settings related to the software update on a communication device, a determination unit that determines whether communication of the communication device meets a predetermined communication condition after execution of the first process and the second process, a control unit that, when the determination unit determines that the communication of the communication device does not meet the predetermined communication condition, returns the software to the state before the update and returns the network settings to the state before the change, a notification unit that notifies the external device of an error when the determination unit determines that the communication of the communication device does not meet the predetermined communication condition, A communication control system comprising the above.

2. The communication control system according to claim 1, wherein the determination unit determines whether communication is being performed by the communication device at a predetermined period.

3. The communication control system according to claim 1 or 2, wherein the determination unit determines whether communication is being performed by the communication device according to a predetermined protocol.

4. The communication control system according to any one of claims 1 to 3, wherein the determination unit determines whether communication is being performed by the communication device within a range of a predetermined communication volume.

5. The communication control system according to any one of claims 1 to 4, wherein the determination unit determines whether communication with a predetermined service is being performed by the communication device.

6. The communication control system according to any one of claims 1 to 5, wherein the determination unit determines whether communication is being performed by the communication device according to a predetermined communication profile.

7. The communication control system according to any one of claims 1 to 6, wherein the determination unit determines whether communication of a predetermined message is being performed by the communication device.

8. The communication control system according to any one of claims 1 to 7, wherein the determination unit determines whether communication is being performed by the communication device with a predetermined data length.

9. The communication control system according to any one of claims 1 to 8, wherein the determination unit determines whether a communication abnormality of the network has occurred.

10. The communication control system according to any one of claims 1 to 9, wherein the determination unit determines whether information of the communication device of the transmission source is correct.

11. The determination unit determines whether the information of the destination communication device is correct. The communication control system according to any one of claims 1 to 10.

12. The determination unit determines whether communication is being performed in a predetermined network segment. The communication control system according to any one of claims 1 to 11.

13. The determination unit verifies the integrity of the communication data transmitted from the communication device and determines whether the communication data is complete. The communication control system according to any one of claims 1 to 12.

14. When the determination unit does not determine that the communication of the communication device does not meet the predetermined communication conditions for a predetermined time from the change of the network settings, the notification unit notifies the external device that the change of the network settings is effective. The communication control system according to any one of claims 1 to 13.

15. The network is an in-vehicle network. The communication control system according to any one of claims 1 to 14.

16. A processor In accordance with an instruction from an external device, performs a first process related to software update on a control device and performs a second process related to a change in network settings related to the software update on a communication device, After execution of the first process and the second process, determines whether the communication of the communication device meets predetermined communication conditions, When it is determined that the communication of the communication device does not meet the predetermined communication conditions, returns the software to the state before the update and returns the network settings to the state before the change, When it is determined that the communication of the communication device does not meet the predetermined communication conditions, notifies the external device of an error A communication control method for executing the process.

17. On a computer, In accordance with an instruction from an external device, performs a first process related to software update on a control device and performs a second process related to a change in network settings related to the software update on a communication device, After execution of the first process and the second process, determines whether the communication of the communication device meets predetermined communication conditions, When it is determined that the communication of the communication device does not meet the predetermined communication conditions, returns the software to the state before the update and returns the network settings to the state before the change, When it is determined that the communication of the communication device does not meet the predetermined communication conditions, notifies the external device of an error A communication control program for causing processing to be executed.

Images