In-vehicle device and time synchronization method

Abstract

To prevent the occurrence of time synchronization abnormalities in an on-vehicle network.SOLUTION: An on-vehicle device is used for an on-vehicle network. The on-vehicle device includes: a time synchronization unit that calculates a time difference with another on-vehicle device by transmitting and receiving time synchronization information, which is information for time synchronization, between its own device, which is the on-vehicle device, and the other on-vehicle device, and performs time synchronization with the other on-vehicle device based on the calculated time difference; a detection unit that monitors first transmission information, which is information transmitted from the other on-vehicle device to the own device, and detects an abnormality regarding contents of the first transmission information; and an abnormality processing unit that performs a stop process for stopping time synchronization in the on-vehicle network using the time synchronization information transmitted from the other on-vehicle device if an abnormality is detected by the detection unit.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device and a time synchronization method.

Background Art

[0002] Conventionally, a technique has been developed in which, in an in-vehicle network, each in-vehicle device in the in-vehicle network performs time synchronization using a time held by a certain in-vehicle device as a reference time. For example, Japanese Patent Application Laid-Open No. 2020-167616 (Patent Document 1) discloses the following time synchronization system. That is, in a time synchronization system that synchronizes the time of the slave side with the grandmaster clock, a device that functions as a grandmaster, one or more devices that function as adjacent repeaters, and one or more devices that function as terminals are connected via a network. The grandmaster transmits a signal including a clock onto the network, the terminal corrects the time based on the clock, integrates the time correction amount into the correction integration value α that the terminal has, and when α exceeds a predetermined threshold value, transmits a grandmaster abnormality notification message onto the network. The adjacent repeater corrects its own time based on the clock, integrates the time correction amount into α that the own device has, and when α exceeds a predetermined threshold value and a grandmaster abnormality notification message is received from one or more devices under its control, transmits a message indicating that the grandmaster should be determined again onto the network.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Patent Document 2

Patent Document 3

Patent Document 4

Patent Document 5

[0004] However, when the grand master receives an unauthorized attack via the network, there arises a problem that time synchronization in the in-vehicle network is not performed normally.

[0005] This invention has been made to solve the above-described problems, and an object thereof is to provide an in-vehicle device and a time synchronization method capable of suppressing the occurrence of abnormalities in time synchronization in an in-vehicle network. [Means for Solving the Problems]

[0006] The in-vehicle device of the present disclosure is an in-vehicle device used in an in-vehicle network, and calculates a time difference with another in-vehicle device by transmitting and receiving time synchronization information, which is information for time synchronization, between the own device, which is the in-vehicle device, and the other in-vehicle device, and performs time synchronization with the other in-vehicle device based on the calculated time difference. The in-vehicle device also includes a detection unit that monitors first transmission information, which is information transmitted from the other in-vehicle device to the own device, and detects an abnormality regarding the content of the first transmission information, and an abnormality processing unit that performs a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device when an abnormality is detected by the detection unit.

[0007] One aspect of the present disclosure can be realized not only as an in-vehicle device including such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing. Further, one aspect of the present disclosure can be realized as a semiconductor integrated circuit that realizes part or all of the in-vehicle device, or can be realized as a system including the in-vehicle device. [Effects of the Invention]

[0008] According to the present disclosure, it is possible to suppress the occurrence of anomalies in time synchronization in an in-vehicle network.

Brief Description of the Drawings

[0009]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Embodiments for Carrying Out the Invention

[0010] First, the contents of the embodiments of the present disclosure will be listed and described. (1) The in-vehicle device according to the embodiment of the present disclosure is an in-vehicle device used for an in-vehicle network, and calculates a time difference with another in-vehicle device by transmitting and receiving time synchronization information, which is information for time synchronization, between the own device, which is the in-vehicle device, and the other in-vehicle device, and performs time synchronization with the other in-vehicle device based on the calculated time difference. A time synchronization unit, a detection unit that monitors first transmission information, which is information transmitted from the other in-vehicle device to the own device, and detects an abnormality regarding the content of the first transmission information, and when an abnormality is detected by the detection unit, an abnormality processing unit that performs a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device.

[0011] With such a configuration, an abnormality regarding another in-vehicle device can be detected, and for example, time synchronization using the time synchronization information transmitted from the other in-vehicle device can be stopped in advance. Therefore, the occurrence of an abnormality in time synchronization in the in-vehicle network can be suppressed.

[0012] (2) In the above (1), the first transmission information may be the time synchronization information.

[0013] In this way, by having a configuration that determines whether or not there is an abnormality in the content of the time synchronization information, it is possible to more effectively stop the time synchronization with the other in-vehicle device.

[0014] (3) In the above (1), the first transmission information may indicate the source of the reference information that serves as the basis for the time of the other in-vehicle device.

[0015] In this way, by having a configuration that determines whether or not there is an abnormality related to the source of the reference information that serves as the basis for the time of the other in-vehicle device, it is possible to more effectively stop the time synchronization with the other in-vehicle device. Further, when the above abnormality is detected, it is possible to take measures such as switching the source in the in-vehicle network.

[0016] (4) In any one of (1) to (3) above, the abnormality processing unit may perform the stop processing of notifying the other in-vehicle device that calculates the time difference from the own device using the time synchronization information transmitted by the own device that the abnormality has been detected.

[0017] In this way, by having a configuration that shares the fact that an abnormality has been detected with other in-vehicle devices in the in-vehicle network, it is possible to suppress the occurrence of an abnormality in time synchronization between the other in-vehicle device and the own device, and thus it is possible to more reliably suppress the occurrence of an abnormality in time synchronization in the in-vehicle network.

[0018] (5) In any one of (1) to (4) above, the abnormality processing unit may perform the stop processing of stopping the time synchronization by the time synchronization unit.

[0019] With such a configuration, it is possible to stop the time synchronization in the own device that is highly likely to be affected by the transmission information in which an abnormality has been detected, and thus it is possible to more reliably suppress the occurrence of an abnormality in time synchronization in the in-vehicle network.

[0020] (6) In any of (1) to (5) above, the abnormality processing unit may perform the stop processing of stopping the transmission of the time synchronization information to another in-vehicle device that calculates the time difference from the own device using the time synchronization information transmitted by the own device.

[0021] Thus, by adopting a configuration that stops the transmission of time synchronization information to another in-vehicle device that performs time synchronization with the own device, it is possible to suppress the occurrence of abnormalities in time synchronization between the other in-vehicle device and the own device, and thus it is possible to more reliably suppress the occurrence of abnormalities in time synchronization in the in-vehicle network.

[0022] (7) In any of (1) to (6) above, a first reference device and a second reference device, which are other in-vehicle devices that perform time synchronization with the own device, are provided in the in-vehicle network. The second reference device monitors second transmission information, which is information transmitted from the first reference device to the second reference device, detects an abnormality regarding the content of the second transmission information, and when an abnormality is detected by the second reference device, the time synchronization unit calculates the time difference from the second reference device by transmitting and receiving time synchronization information, which is information for time synchronization, with the second reference device instead of the first reference device, and performs time synchronization with the second reference device based on the calculated time difference.

[0023] Thus, when an abnormality regarding the first reference device is detected, by adopting a configuration that switches the time synchronization destination from the first reference device to the second reference device, the own device can perform time synchronization with the second reference device, and thus more stable time synchronization can be realized in the in-vehicle network.

[0024] (8) In any of the above (1) to (6), a first reference device and a second reference device, which are the other in-vehicle devices, are provided in the in-vehicle network. When an abnormality is detected by the detection unit, the time synchronization unit may calculate a time difference with the second reference device by transmitting and receiving time synchronization information, which is information for time synchronization, to and from the second reference device instead of the first reference device, and perform time synchronization with the second reference device based on the calculated time difference.

[0025] As described above, when an abnormality related to the first reference device is detected, since the time synchronization destination can be switched from the first reference device to the second reference device, and the own device can perform time synchronization with the second reference device, more stable time synchronization can be realized in the in-vehicle network.

[0026] (9) In the above (2), the time synchronization information may be at least one of a Sync message and a follow-up message used for time synchronization.

[0027] As described above, by configuring to monitor at least one of a Sync message and a follow-up message generally used for time synchronization, for example, by checking information indicating an ID or a timestamp stored in a received Ethernet frame, the presence or absence of an abnormality can be easily determined.

[0028] (10) The time synchronization method according to an embodiment of the present disclosure is a time synchronization method in an in-vehicle device. By transmitting and receiving time synchronization information, which is information for time synchronization, between the own device, which is the in-vehicle device, and other in-vehicle devices, a time difference from the other in-vehicle devices is calculated, and time synchronization with the other in-vehicle devices is performed based on the calculated time difference. Also, it includes monitoring first transmission information, which is information transmitted from the other in-vehicle device to the own device, and detecting an abnormality regarding the content of the first transmission information. When an abnormality is detected, a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device is performed.

[0029] By such a method, an abnormality regarding another in-vehicle device can be detected, and for example, time synchronization using the time synchronization information transmitted from the other in-vehicle device can be stopped in advance. Therefore, the occurrence of an abnormality in time synchronization in the in-vehicle network can be suppressed.

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals and their description will not be repeated. Also, at least a part of the embodiments described below may be arbitrarily combined.

[0031] <First Embodiment> [In-Vehicle Communication System] FIG. 1 is a diagram showing the configuration of an in-vehicle communication system according to the first embodiment of the present disclosure.

[0032] Referring to FIG. 1, the in-vehicle communication system 301 includes, for example, a plurality of switch devices 111, one master function unit 121, and a plurality of end function units 131.

[0033] In FIG. 1, as an example of a plurality of switch devices 111 and a plurality of end function units 131, two switch devices 111A and 111B and two end function units 131A and 131B are shown. The in-vehicle communication system 301 is mounted on the vehicle 1. The switch device 111, the master function unit 121, and the end function unit 131 constitute the in-vehicle network 101.

[0034] The switch device 111, the master function unit 121, and the end function unit 131 are examples of in-vehicle devices, for example, an ECU (Electronic Control Unit).

[0035] The switch device 111 is connected to a plurality of in-vehicle devices by, for example, an Ethernet (registered trademark) cable 10, and can communicate with the plurality of in-vehicle devices connected to itself.

[0036] More specifically, the switch device 111 performs a relay process of relaying information from the master function unit 121 or the end function unit 131 to other end function units 131. For example, the switch device 111 receives time synchronization information (hereinafter, also referred to as "time synchronization information T") transmitted from the master function unit 121, and transmits the received time synchronization information T to other switch devices 111 or end function units 131.

[0037] Between the switch device 111 and the master function unit 121, and between the switch device 111 and the end function unit 131, for example, information exchange is performed using an Ethernet frame (hereinafter, simply referred to as "frame") storing an IP (Internet Protocol) packet.

[0038] The master function unit 121 and the end function unit 131 may be an in-vehicle communication ECU, a sensor, an in-vehicle camera, a navigation device, an automatic driving processing ECU, an engine control device, an AT (Automatic Transmission) control device, an HEV (Hybrid Electric Vehicle) control device, a brake control device, a chassis control device, a steering control device, an instrument display control device, or the like.

[0039] The master function unit 121 (hereinafter also referred to as "GM (Grand Master)") holds the reference time in the in-vehicle network 101. Here, the reference time is, for example, the time generated by the master function unit 121 using a VCXO (Voltage Controlled Xtal Oscillator) and a counter (not shown). Note that, as will be described later, the reference time may be a time synchronized with the time notified to the master function unit 121 from another device. The master function unit 121 periodically or irregularly transmits time synchronization information T to other in-vehicle devices. The master function unit 121 transmits the time synchronization information T at a transmission cycle of, for example, 125 milliseconds. Here, the time synchronization information T is, for example, a Sync message and a follow-up message described later.

[0040] Each in-vehicle device in the in-vehicle communication system 301 receives time synchronization information T, which is an example of transmission information (hereinafter also referred to as "first transmission information") transmitted from the master function unit 121.

[0041] More specifically, the switch device 111A directly receives the time synchronization information T from the master function unit 121. The switch device 111B receives the time synchronization information T via the switch device 111A.

[0042] The end function unit 131A receives the time synchronization information T via the switch device 111A. The end function unit 131B receives the time synchronization information T via the switch devices 111A and 111B.

[0043] The switch device 111 performs time synchronization with the master function unit 121 based on the time synchronization information T. More specifically, the switch device 111 calculates the time difference from the master function unit 121 using the time synchronization information T transmitted by the master function unit 121. The switch device 111 corrects its own time using the calculated time difference.

[0044] The end function unit 131 performs time synchronization with the switch device 111 based on the time synchronization information T. More specifically, the end function unit 131 calculates the time difference from the switch device 111 using the time synchronization information T transmitted by the switch device 111. The end function unit 131 corrects its own time using the calculated time difference.

[0045] [Switch Device and Master Function Unit] (Configuration of Switch Device) FIG. 2 is a diagram showing the configuration of the switch device according to the first embodiment of the present disclosure. In FIG. 2, the configuration of the switch device 111A is shown.

[0046] Referring to FIG. 2, the switch device 111A includes a relay unit 21, a processing unit 22, a storage unit 23, and a plurality of communication ports 24.

[0047] One or both of the relay unit 21 and the processing unit 22 are realized by, for example, a processing circuit (Circuitry) including one or more processors. The storage unit 23 is, for example, a non-volatile memory included in the processing circuit. The relay unit 21 includes a switch unit 31 and an information processing unit 32. The processing unit 22 includes a time synchronization unit 41, a detection unit 42, and an abnormality processing unit 43.

[0048] (Relay Processing by Switch Device) Communication port 24 is a terminal to which, for example, Ethernet cable 10 can be connected. Note that communication port 24 may be a terminal of an integrated circuit. Each of the plurality of communication ports 24 is connected to any one of the plurality of in-vehicle devices in in-vehicle network 101 via Ethernet cable 10. In this example, communication port 24A is connected to master function unit 121, communication port 24B is connected to switch device 111B, and communication port 24C is connected to end function unit 131A.

[0049] In storage unit 23, an address table showing the correspondence between the port numbers of communication ports 24 and the MAC (Media Access Control) addresses of the destination devices is stored.

[0050] Relay unit 21 relays data between other in-vehicle devices by communicating with the other in-vehicle devices. That is, when relay unit 21 receives an Ethernet frame transmitted from master function unit 121 or end function unit 131 via the corresponding communication port 24, relay unit 21 performs relay processing on the received Ethernet frame.

[0051] More specifically, switch unit 31 in relay unit 21 refers to the address table stored in storage unit 23 and specifies the port number corresponding to the destination MAC address included in the received Ethernet frame. Then, switch unit 31 transmits the received Ethernet frame from communication port 24 with the specified port number.

[0052] The time synchronization unit 41 performs time synchronization between the switch device 111, which is its own in-vehicle device (hereinafter also referred to as the "own device"), and the master function unit 121, which is another in-vehicle device. More specifically, the time synchronization unit 41 transmits and receives time synchronization information T between the switch device 111 and the master function unit 121. Then, the time synchronization unit 41 calculates the time difference between the time of the switch device 111 and the time of the master function unit 121, and performs time synchronization with the master function unit 121 based on the calculated time difference. The functions of the detection unit 42 and the abnormality processing unit 43 will be described later. Also, in FIG. 2, the configuration of the switch device 111A is described as an example, but the switch device 111B is, for example, the same as the configuration of the switch device 111A. Note that the switch device 111B can be realized even if it does not include the detection unit 42 and the abnormality processing unit 43 described later.

[0053] (Configuration of Master Function Unit) FIG. 3 is a diagram showing the configuration of the master function unit according to the first embodiment of the present disclosure.

[0054] Referring to FIG. 3, the master function unit 121 includes a communication unit 51, a time synchronization unit 52, a storage unit 53, and a communication port 54. One or both of the communication unit 51 and the time synchronization unit 52 are realized by a processing circuit including, for example, one or more processors. The storage unit 53 is, for example, a non-volatile memory included in the above processing circuit. The communication port 54 is a terminal to which, for example, the Ethernet cable 10 can be connected. Note that the communication port 54 may be a terminal of an integrated circuit or the like. The communication port 54 is connected to the switch device 111A via the Ethernet cable 10.

[0055] FIG. 4 is a diagram for explaining a method for updating the propagation delay time by the switch device according to the first embodiment of the present disclosure.

[0056] Referring to FIGS. 2 to 4, the switch device 111A updates the propagation delay time Td1 of data between the master function unit 121 and the switch device 111A by transmitting and receiving time synchronization information T to and from the master function unit 121, for example, in accordance with the IEEE (registered trademark) 802.1 standard. More specifically, the time synchronization unit 41 transmits request information (Pdelay_Req) for requesting time information used for updating the propagation delay time Td1 to the master function unit 121 via the relay unit 21 and the communication port 24A. Hereinafter, the request information is also referred to as a "request message".

[0057] The communication unit 51 in the master function unit 121 receives the request message transmitted from the switch device 111A via the communication port 54, and outputs the received request message to the time synchronization unit 52.

[0058] Upon receiving the request message from the communication unit 51, the time synchronization unit 52 outputs time information (Pdelay_Resp), which is an example of the time synchronization information T, for the request message to the communication unit 51. The communication unit 51 transmits the time information received from the time synchronization unit 52 to the switch device 111A via the communication port 54. At this time, the time synchronization unit 52 transmits the time information including the reception time t2 of the request message. Hereinafter, the time information is also referred to as a "response message".

[0059] Further, after transmitting the response message, the time synchronization unit 52 outputs a follow-up message (Pdelay_Resp_Follow_Up) including the transmission time t3 of the response message to the communication unit 51. The communication unit 51 transmits the follow-up message received from the time synchronization unit 52 to the switch device 111A via the communication port 54.

[0060] The information processing unit 32 in the switch device 111A receives the response message and the follow-up message transmitted from the master function unit 121 via the communication port 24A. Then, the information processing unit 32 notifies the time synchronization unit 41 of the time t2 included in the response message and the time t3 included in the follow-up message.

[0061] In addition, the information processing unit 32 notifies the time synchronization unit 41 of the transmission time t1 of the request message and the reception time t4 of the response message. More specifically, the switch device 111A includes a counter (not shown). The information processing unit 32 notifies the time synchronization unit 41 of the count value of the counter at the transmission timing of the request message as the transmission time t1. Further, the information processing unit 32 notifies the time synchronization unit 41 of the count value of the counter at the reception timing of the response message as the reception time t4.

[0062] Based on the times t1, t2, t3, and t4 notified by the information processing unit 32, the time synchronization unit 41 calculates the propagation delay time Td1 of the data between the master function unit 121 and the switch device 111A. Specifically, the time synchronization unit 41 calculates the propagation delay time Td1 = ((t4 - t1) - (t3 - t2)) / 2. Then, the time synchronization unit 41 updates the propagation delay time Td1 stored in the storage unit 23 with the newly calculated propagation delay time Td1.

[0063] (Time correction in the switch device) The time synchronization unit 52 of the master function unit 121 outputs, periodically or aperiodically, a Sync message which is an example of the time synchronization information T to the communication unit 51. The communication unit 51 transmits the Sync message received from the time synchronization unit 52 to the switch device 111A via the communication port 54. The master function unit 121 transmits the Sync message, for example, at a transmission cycle of 125 milliseconds.

[0064] In addition, after transmitting the Sync message, the time synchronization unit 52 in the master function unit 121 outputs a follow-up message (Follow_Up) including the transmission time tm of the Sync message to the communication unit 51. The communication unit 51 transmits the follow-up message received from the time synchronization unit 52 to the switch device 111A via the communication port 54.

[0065] The time synchronization unit 41 in the switch device 111A receives, via the communication port 24A, the frame storing the Sync message transmitted from the master function unit 121 and the frame storing the follow-up message. Then, the time synchronization unit 41 stores, for example, the Sync message stored in the received frame in the storage unit 23.

[0066] Also, for example, the information processing unit 32 checks the transmission source of the frame by referring to the domain ID included in the message header part of the received frame.

[0067] When the information processing unit 32 confirms that it has received the frame storing the Sync message from the master function unit 121 which is the GM, it notifies the time synchronization unit 52 of the count value of the counter at the reception timing of the frame as the reception time tx of the Sync message.

[0068] The time synchronization unit 41 performs time synchronization with the master function unit 121 based on the times tm, tx notified from the information processing unit 32 and the propagation delay time Td1 stored in the storage unit 23. More specifically, the time synchronization unit 41 calculates the time difference Tx1 = tm - Td1 - tx between the time of the master function unit 121 and the time of the switch device 111A based on the times tm, tx and the propagation delay time Td1.

[0069] Then, the time synchronization unit 52 corrects the time in its own switch device 111A using the calculated time difference Tx1. Thereby, time synchronization between the master function unit 121 which is the GM and the switch device 111A is established.

[0070] [End Function Unit] (Configuration of End Function Unit) FIG. 5 is a diagram showing the configuration of the end function unit according to the first embodiment of the present disclosure. FIG. 5 shows the configuration of the end function unit 131A. The configuration of the end function unit 131B is the same as that of the end function unit 131A.

[0071] Referring to FIG. 5, the end function unit 131A includes a communication unit 61, a time synchronization unit 62, a memory unit 63, and a communication port 64. One or both of the communication unit 61 and the time synchronization unit 62 are realized by a processing circuit including, for example, one or more processors. The memory unit 63 is, for example, a non-volatile memory included in the processing circuit. The communication port 64 is a terminal to which, for example, the Ethernet cable 10 can be connected. Note that the communication port 64 may be a terminal of an integrated circuit or the like. The communication port 64 is connected to the switch device 111A via the Ethernet cable 10.

[0072] (Update of Propagation Delay Time of Data between Switch Device and End Function Unit) The end function unit 131A updates the propagation delay time Td2 of data between the switch device 111A and the end function unit 131A.

[0073] FIG. 6 is a diagram for explaining a method for updating the propagation delay time by the end function unit according to the first embodiment of the present disclosure.

[0074] Specifically, referring to FIGS. 5 and 6, the time synchronization unit 62 in the end function unit 131A updates the propagation delay time Td2 of data between the switch device 111A and the end function unit 131A regularly or irregularly, similar to the time synchronization unit 41 in the switch device 111A shown in FIG. 2. More specifically, the time synchronization unit 62 transmits a request message for requesting time information used for updating the propagation delay time Td2 to the switch device 111A via the communication unit 61 and the communication port 64.

[0075] When the information processing unit 32 in the switch device 111A receives the request message transmitted from the end function unit 131A via the communication port 24C, it outputs the request message to the time synchronization unit 41.

[0076] When the time synchronization unit 41 receives a request message from the information processing unit 32, it transmits a response message for the request message to the end function unit 131A via the relay unit 21 and the communication port 24C. At this time, the time synchronization unit 41 transmits the response message including the reception time t12 of the request message.

[0077] Also, after transmitting the response message, the time synchronization unit 41 transmits a follow-up message including the transmission time t13 of the response message to the end function unit 131A via the relay unit 21 and the communication port 24C.

[0078] The communication unit 61 in the end function unit 131A receives the response message and the follow-up message transmitted from the switch device 111A via the communication port 64. Then, the communication unit 61 notifies the time synchronization unit 62 of the time t12 included in the response message and the time t13 included in the follow-up message.

[0079] Also, the communication unit 61 notifies the time synchronization unit 62 of the transmission time t11 of the request message and the reception time t14 of the response message. More specifically, the end function unit 131A includes a counter (not shown). The communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the transmission timing of the request message as the transmission time t11. Also, the communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the reception timing of the response message as the reception time t14.

[0080] Based on the times t11, t12, t13, and t14 notified by the communication unit 61, the time synchronization unit 62 calculates the propagation delay time Td2 of the data between the switch device 111A and the end function unit 131A. Specifically, the time synchronization unit 62 calculates the propagation delay time Td2 = ((t14 - t11) - (t13 - t12)) / 2. Then, the time synchronization unit 62 updates the propagation delay time Td2 stored in the storage unit 63 with the newly calculated propagation delay time Td2.

[0081] (Time Correction in the End Function Unit) The time synchronization unit 41 in the switch device 111A periodically or irregularly transmits a Sync message to the end function unit 131A. Also, after transmitting the Sync message, the time synchronization unit 41 transmits a follow-up message including the transmission time ty of the Sync message to the end function unit 131A.

[0082] The end function unit 131A performs time synchronization based on the Sync message and the follow-up message transmitted from the switch device 111A. More specifically, the communication unit 61 in the end function unit 131A receives the frame storing the Sync message transmitted from the switch device 111A and the frame storing the follow-up message via the communication port 64. Then, the communication unit 61 confirms the transmission source of the frame, for example, by referring to the domain ID included in the message header part of the frame storing the received Sync message.

[0083] When the communication unit 61 confirms that it has received the frame storing the Sync message from the master function unit 121 which is the GM, for example, it notifies the time synchronization unit 62 of the time ty included in the follow-up message received immediately after the frame. Also, the communication unit 61 notifies the time synchronization unit 62 of the count value of the counter at the reception timing of the Sync message stored in the frame as the reception time ts of the Sync message.

[0084] The time synchronization unit 62 performs time synchronization with the switch device 111A based on the times ty, ts notified by the communication unit 61 and the propagation delay time Td2 stored in the storage unit 63. More specifically, the time synchronization unit 62 calculates the time difference Tx2 = ty - Td2 - ts which is the difference between the time of the switch device 111A and the time of the end function unit 131A. Then, the time synchronization unit 62 corrects the time in its own end function unit 131A using the calculated time difference Tx2.

[0085] Here, when time synchronization is established between the master function unit 121 and the switch device 111A, the time ty included in the follow-up message transmitted from the switch device 111A to the end function unit 131A is the time synchronized with the master function unit 121. Therefore, by the time synchronization unit 62 in the end function unit 131A performing time correction, time synchronization is established between the end function unit 131A and the switch device 111A, and as a result, time synchronization is established between the end function unit 131A and the master function unit 121.

[0086] The switch device 111B and the end function unit 131B establish time synchronization with the master function unit 121, which is a GM, in the same manner as the switch device 111A and the end function unit 131A.

[0087] [Description of the problem] By the way, the master function unit 121 shown in FIG. 1 may not be able to recognize the reference time due to being subjected to an unauthorized attack from inside or outside the vehicle 1, and there is a possibility that time synchronization among a plurality of in-vehicle devices cannot be performed normally.

[0088] Also, when the reference time held in the master function unit 121 is tampered with due to an unauthorized attack, there is a possibility that the in-vehicle communication system 301 may not operate normally. For example, when the two end function units 131A and 131B shown in FIG. 1 are in-vehicle cameras mounted on the front and rear of the vehicle 1, image displacement may occur between the end function units 131A and 131B due to the tampering of the reference time.

[0089] Also, when an abnormality occurs in the content of the time synchronization information T due to the master function unit 121 being subjected to an unauthorized attack, the absolute value of the time difference between a plurality of in-vehicle devices increases, and there is a possibility that the in-vehicle communication system 301 may not operate normally.

[0090] In contrast, the switch device 111 in the in-vehicle network 101 according to the first embodiment of the present disclosure solves such problems by the following configuration and operation.

[0091] [Detection of Abnormality Regarding Content of Time Synchronization Information] The detection unit 42 in the switch device 111A shown in FIG. 2 monitors the transmission information transmitted from the master function unit 121 to its own switch device 111A, and detects an abnormality regarding the content of the transmission information (hereinafter, also referred to as "abnormality E1"). Abnormality E1 is an abnormality regarding the content of the time synchronization information T, which is an example of the transmission information. For example, the time synchronization information T is at least one of a Sync message and a follow-up message used for time synchronization. Note that the time synchronization information T is not limited to the Sync message and the follow-up message, and may be other messages used for time synchronization. The detection unit 42 outputs information indicating the detection result to the abnormality processing unit 43.

[0092] When the abnormality E1 is detected by the detection unit 42, the abnormality processing unit 43 performs a stop process for stopping the time synchronization using the time synchronization information T transmitted from the master function unit 121.

[0093] FIG. 7 is a diagram showing an example of the stop process by the switch device in the in-vehicle network according to the first embodiment of the present disclosure.

[0094] Referring to FIGS. 2, 5, and 7, when the abnormality E1 is detected by the detection unit 42, the abnormality processing unit 43 in the switch device 111A performs a stop process P1 of notifying the end function unit 131 that performs time synchronization with its own switch device 111A that the abnormality E1 has been detected. More specifically, when the abnormality E1 is detected, the abnormality processing unit 43 transmits a notification indicating that the abnormality E1 has been detected (hereinafter, also referred to as "abnormality notification N1") to the end function unit 131 via the relay unit 21 and the communication port 24. Here, the abnormality processing unit 43 transmits the abnormality notification N1 to the end function unit 131B via the switch device 111B. Note that the abnormality processing unit 43 may transmit the abnormality notification N1 to the end function unit 131A.

[0095] The communication unit 61 in the end function unit 131, for example, after receiving the abnormality notification N1, discards the time synchronization information T received from the switch device 111A and does not store the time synchronization information T in the storage unit 63. As a result, the time synchronization information T is not output from the communication unit 61 to the time synchronization unit 62, and the time synchronization between the end function unit 131 and the switch device 111A stops.

[0096] Note that the abnormality processing unit 43 in the switch device 111A may transmit the abnormality notification N1 to the master function unit 121. The master function unit 121, for example, after receiving the abnormality notification N1, stops transmitting the time synchronization information T to the switch device 111A. As a result, the time synchronization between the switch device 111A and the master function unit 121 stops.

[0097] In addition, when the abnormality E1 is detected, the abnormality processing unit 43 in the switch device 111A may perform a stop process by the time synchronization unit 41, that is, a stop process P2 for stopping the time synchronization with the master function unit 121. More specifically, when the abnormality E1 is detected, the abnormality processing unit 43 outputs the abnormality notification N1 to the relay unit 21. After receiving the abnormality notification N1, the relay unit 21 discards the time synchronization information T received from the master function unit 121 via the communication port 24A and does not store the time synchronization information T in the storage unit 23. As a result, the time synchronization information T is not output from the relay unit 21 to the time synchronization unit 41, and the time synchronization between the switch device 111A and the master function unit 121 stops.

[0098] In addition, when the abnormality E1 is detected, the abnormality processing unit 43 in the switch device 111A may perform a stop process P3 for stopping the transmission of the time synchronization information T to the end function unit 131. More specifically, as described above, after receiving the abnormality notification N1 from the abnormality processing unit 43, the relay unit 21 discards the time synchronization information T received from the master function unit 121 via the communication port 24A and does not store the time synchronization information T in the storage unit 23. As a result, the time synchronization information T is not transmitted from the relay unit 21 to the end function unit 131 via the communication port 24C, and the time synchronization between the end function unit 131 and the switch device 111A stops.

[0099] [Sequence of Operations] FIG. 8 is a diagram showing an example of a sequence of monitoring time synchronization information and stopping time synchronization processing by a switch device in an in-vehicle communication system according to a first embodiment of the present disclosure.

[0100] Referring to FIG. 8, first, the master function unit 121 transmits a Sync message to the switch device 111A (step S101).

[0101] Next, the master function unit 121 transmits a follow-up message including the transmission time tm of the Sync message as the time of the timestamp (step S102).

[0102] Next, the detection unit 42 in the switch device 111A performs a detection process for detecting an abnormality E1.

[0103] More specifically, for example, the detection unit 42 determines whether the sequence IDs included in the header part of the frame in which the Sync message is stored are consecutive in the sequence of sequentially received Sync messages. If the sequence IDs are not consecutive, the detection unit 42 detects an abnormality of the Sync message as the abnormality E1. Note that the detection unit 42 may detect the abnormality E1 based not only on the sequence ID but also on other information included in the frame in which the Sync message is stored, for example, the continuity of the domain ID. Further, the detection unit 42 may detect, for example, an abnormality in the order of the timestamps included in the follow-up message as the abnormality E1 (step S103).

[0104] Next, when the abnormality processing unit 43 in the switch device 111A detects an abnormality E1 by the detection unit 42 (in step S103, "YES"), it transmits an abnormality notification N1 to the end function unit 131. The abnormality notification N1 is transmitted independently of, for example, the Sync message and the follow-up message transmitted from the switch device 111 to the end function unit 131. Note that the abnormality notification N1 may be included in the frame storing the Sync message or the frame storing the follow-up message (step S104).

[0105] Next, the end function unit 131 performs a process of stopping time synchronization with the switch device 111A, that is, a process of stopping time synchronization by the time synchronization unit 62 (step S105).

[0106] On the other hand, when the detection unit 42 does not detect the abnormality E1 in the switch device 111A (in step S103, "NO"), the information processing unit 32 in the switch device 111A receives the Sync message and the follow-up message from the master function unit 121 via the communication port 24A, and notifies the time synchronization unit 41 of the time tm (see FIG. 4) included in the follow-up message and the reception time tx of the Sync message (step S106).

[0107] Next, the time synchronization unit 41 calculates the above-described time difference Tx1 based on the time tm, tx notified from the information processing unit 32, and the propagation delay time Td1 stored in the storage unit 23.

[0108] Then, the time synchronization unit 41 corrects the time in its own switch device 111A using the calculated time difference Tx1. Thereby, the switch device 111A can perform time synchronization with the master function unit 121 (step S107).

[0109] In this way, the switch device 111 can detect the abnormality E1 related to the master function unit 121 and stop the time synchronization in advance using the time synchronization information T transmitted from the master function unit 121. Therefore, the occurrence of an abnormality in time synchronization in the in-vehicle network 101 can be suppressed.

[0110] [Another example of the configuration of the end function unit] The in-vehicle communication system 301 is not limited to the configuration in which the detection unit 42 and the abnormality processing unit 43 are provided in the switch device 111, and may be a configuration in which the detection unit 42 and the abnormality processing unit 43 are provided in the end function unit 131. That is, the end function unit 131 may have a function of monitoring the time synchronization information T.

[0111] [Another example of abnormality E1] In the above example, the switch device 111 detects an abnormality regarding the content of the time synchronization information T, which is an example of the transmission information, as the abnormality E1. In the following example, the master function unit 121 holds the time notified from other devices regularly or irregularly as the reference time. More specifically, the master function unit 121 holds, for example, the time synchronized with the time notified from a GPS (Global Positioning System), a navigation device, etc. as the reference time, and transmits transmission information (hereinafter, also referred to as "time provider information") indicating the provider of the reference information that is the basis of the time of the master function unit 121 to the switch device 111. In this case, the detection unit 42 in the switch device 111 may detect an abnormality regarding the content of the time provider information as the abnormality E1 by monitoring the time provider information. In the following description, the device that notifies the time to the master function unit 121 is also referred to as a "time notification device".

[0112] Referring again to FIG. 2, in the storage unit 23 of the switch device 111, the MAC address or IP address of the time notification device (hereinafter also referred to as "reference address") is stored in advance. Further, for example, the reference address of the time notification device is also included in the time source information transmitted from the master function unit 121. The detection unit 42 compares, for example, the reference address included in the time source information received from the master function unit 121 with the reference address stored in the storage unit 23. When the reference address included in the time source information is different from the reference address stored in the storage unit 23, the detection unit 42 determines that the abnormality E1 has occurred.

[0113] FIG. 9 is a diagram showing another example of a sequence of monitoring time source information and stopping time synchronization by a switch device in an in-vehicle communication system according to the first embodiment of the present disclosure.

[0114] Referring to FIG. 9, first, the time notification device transmits time information indicating the current time of its own device, that is, reference information that is the source of the time of the master function unit 121, to the master function unit 121 (step S111).

[0115] Next, the master function unit 121 updates the value of the above-described counter, for example, based on the reference information. Thereby, the master function unit 121 can acquire the time of its own device based on the reference information provided from the time notification device (step S112).

[0116] Next, the master function unit 121 transmits the time source information to the switch device 111 (step S113).

[0117] Next, the detection unit 42 in the switch device 111 performs a detection process for detecting the abnormality E1 (step S114).

[0118] Next, when the detection unit 42 detects the abnormality E1 in the switch device 111A (YES in step S114), the abnormality processing unit 43 in the switch device 111A transmits an abnormality notification N1 for stopping the time synchronization to the end function unit 131 (step S115).

[0119] Next, the end function unit 131 performs a process of stopping time synchronization with the switch device 111A, that is, a process of stopping time synchronization by the time synchronization unit 62 (step S116).

[0120] On the other hand, when the detection unit 42 does not detect the abnormality E1 (NO in step S114), the abnormality processing unit 43 does not transmit the abnormality notification N1 to the end function unit 131.

[0121] Next, another embodiment of the present disclosure will be described with reference to the drawings. The same or corresponding parts in the drawings are denoted by the same reference numerals and their description will not be repeated.

[0122] <Second Embodiment> This embodiment relates to an in-vehicle communication system 401 including a plurality of master function units 221A and 221B that monitor each other's time synchronization information Ta and Tb, as compared with the in-vehicle communication system 301 according to the first embodiment. It is the same as the in-vehicle communication system 301 according to the first embodiment except for the content described below.

[0123] [In-vehicle communication system] FIG. 10 is a diagram showing the configuration of an in-vehicle communication system according to the second embodiment of the present disclosure.

[0124] Referring to FIG. 10, the in-vehicle communication system 401 includes, for example, a plurality of switch devices 211, a plurality of master function units 221, and a plurality of end function units 131.

[0125] In FIG. 10, as an example of a plurality of master function units 221, two master function units 221A and 221B provided in the in-vehicle network 201 are shown. The in-vehicle communication system 401 is mounted on the vehicle 1. The switch device 111, the master function unit 221, and the end function unit 131 constitute the in-vehicle network 201.

[0126] The two master functional units 221A and 221B are connected to each other by, for example, an Ethernet cable 10 and can communicate with other master functional units connected to themselves. The master functional unit 221A is an example of a "first reference device", and the master functional unit 221B is an example of a "second reference device".

[0127] Hereinafter, the time synchronization information transmitted from the master functional unit 221A is also referred to as "time synchronization information Ta", and the time synchronization information transmitted from the master functional unit 221B is also referred to as "time synchronization information Tb". Also, a Sync message and a follow-up message, which are examples of the time synchronization information Ta, are respectively referred to as a "first Sync message" and a "first follow-up message". Also, a Sync message and a follow-up message, which are examples of the time synchronization information Tb, are respectively referred to as a "second Sync message" and a "second follow-up message".

[0128] Each of the master functional units 221A and 221B holds the reference time in the in-vehicle network 201. The master functional unit 221A transmits the time synchronization information Ta to the master functional unit 221B and the switch device 111 regularly or irregularly. The master functional unit 221B transmits the time synchronization information Tb to the master functional unit 221A and the switch device 111 regularly or irregularly.

[0129] The switch device 111 receives both the time synchronization information Ta from the master functional unit 221A and the time synchronization information Tb from the master functional unit 221B. More specifically, the switch device 111A directly receives the time synchronization information Ta from the master functional unit 221A and receives the time synchronization information Tb via the switch device 111B. The switch device 111B directly receives the time synchronization information Tb from the master functional unit 221B and receives the time synchronization information Ta via the switch device 111A.

[0130] The end function unit 131A directly receives the time synchronization information Ta from the switch device 111A. The end function unit 131B receives the time synchronization information Ta via the switch device 111A and the switch device 111B.

[0131] Thus, in this embodiment, the second transmission information, which is the information transmitted from the master function unit 221A to the master function unit 221B, is, for example, the same time synchronization information Ta as the first transmission information transmitted from the master function unit 221A to the switch devices 111A and 111B. Note that the second transmission information may be information different from the first transmission information. For example, the second transmission information may be time source information indicating the time source of the master function unit 221.

[0132] FIG. 11 is a diagram showing the configuration of a switch device according to the twelfth embodiment of the present disclosure. The switch device 111A shown in FIG. 11 further includes a communication port 24D as compared with the switch device 111A shown in FIG. 2.

[0133] In FIG. 11, the communication port 24A is connected to the master function unit 221A, the communication port 24B is connected to the master function unit 221B, the communication port 24C is connected to the switch device 111B, and the communication port 24D is connected to the end function unit 131A.

[0134] The switch device 111 identifies the time synchronization information to be used for time synchronization during normal operation of the in-vehicle network 201. For example, the switch device 111 checks the domain ID attached to the header part of each of the frame storing the first follow-up message and the frame storing the second follow-up message. Here, in the storage unit 23 of the switch device 111, the domain ID of the time synchronization information (hereinafter, also referred to as "normal domain ID") to be used for time synchronization during normal operation of the in-vehicle network 201 is stored in advance. The switch device 111 checks the domain ID that matches the normal domain ID among the two checked domain IDs. Thereby, the switch device 111 can determine the time synchronization information to be used for time synchronization during normal operation of the in-vehicle network 201. Here, it is assumed that time synchronization during normal operation is performed based on the time synchronization information Ta. In FIG. 10, the switch device 111 transmits the time synchronization information Ta to the end function unit 131.

[0135] FIG. 12 is a diagram showing the configuration of the master function unit according to the second embodiment of the present disclosure. In FIG. 12, the configuration of the master function unit 221B is shown. The configuration of the master function unit 221A is the same as that of the master function unit 221B.

[0136] More specifically, the case where the master function unit 221B performs time synchronization with the master function unit 221A will be described. In this case, the master function unit 221B, which is the second reference device, performs time synchronization with the master function unit 221A in order to function as a backup system when the master function unit 221A, which is the first reference device, fails.

[0137] Referring to FIG. 12, the master functional unit 221B includes a processing unit 252 instead of the time synchronization unit 52 as compared with the master functional unit 121 shown in FIG. 3, and includes a plurality of communication ports 54. One or both of the communication unit 51 and the processing unit 252 are realized by a processing circuit including, for example, one or more processors. The storage unit 23 is, for example, a non-volatile memory included in the processing circuit. The communication port 54A is connected to the master functional unit 221A, and the communication port 54B is connected to the switch device 111B. The processing unit 252 includes a time synchronization unit 71, a detection unit 72, and an abnormality processing unit 73.

[0138] The time synchronization unit 71 performs time synchronization between its own master functional unit 221B and the master functional unit 221A. More specifically, the time synchronization unit 71 transmits and receives time synchronization information Ta between the master functional unit 221A and the master functional unit 221B. Then, the time synchronization unit 71 calculates the time difference between the time of the master functional unit 221A and the time of the master functional unit 221B, and performs time synchronization with the master functional unit 221A based on the calculated time difference.

[0139] The detection unit 72 in the master functional unit 221B monitors, for example, second transmission information which is information transmitted from the master functional unit 221A, and detects an abnormality (hereinafter, also referred to as "abnormality E2") regarding the content of the second transmission information. The abnormality E2 is an abnormality regarding the content of the time synchronization information Ta which is an example of the second transmission information. The time synchronization information Ta is at least one of a Sync message and a follow-up message used for time synchronization. Note that the time synchronization information Ta is not limited to the Sync message and the follow-up message, and may be other messages used for time synchronization. The detection unit 72 transmits information indicating the detection result to the abnormality processing unit 73.

[0140] When detecting the abnormality E2, the abnormality processing unit 73 performs a stop process for stopping time synchronization in the in-vehicle network 201 using the time synchronization information Ta received from the master functional unit 221A.

[0141] FIG. 13 is a diagram showing an example of a stop process by a master function unit and a switch device in an in-vehicle communication system according to a second embodiment of the present disclosure.

[0142] Referring to FIGS. 12 and 13, in in-vehicle network 201, when master function unit 221B detects abnormality E2, for example, it transmits a notification indicating that abnormality E2 has been detected by its own device (hereinafter, also referred to as "abnormality notification N2") to switch device 111.

[0143] More specifically, abnormality processing unit 73 in master function unit 221B multicasts abnormality notification N2, for example.

[0144] Switch device 111B transmits the abnormality notification N2 received from master function unit 221B to switch device 111A and end function unit 131B. Switch device 111A transmits the abnormality notification N2 received from switch device 111B to end function unit 131A.

[0145] In this way, master function unit 221B performs process P21 of notifying other in-vehicle devices in in-vehicle network 201 that abnormality E2 has been detected.

[0146] Referring to FIGS. 11, 12, and 13, when abnormality E2 is detected by master function unit 221B, switch device 111A performs a stop process by time synchronization unit 41, that is, a stop process P2 of stopping time synchronization with master function unit 221A. More specifically, after relay unit 21 in switch device 111A receives abnormality notification N2 from master function unit 221B, it discards time synchronization information Ta received from master function unit 221A via communication port 24A and does not store the time synchronization information Ta in storage unit 23. As a result, time synchronization information Ta is not output from relay unit 21 to time synchronization unit 41, and time synchronization between switch device 111A and master function unit 221A stops.

[0147] When the time synchronization unit 41 in the switch device 111A detects an abnormality E2, it transmits and receives time synchronization information Tb to and from the master function unit 221B instead of the master function unit 221A. Then, the time synchronization unit 41 calculates the time difference between the time of its own switch device 111A and the time of the master function unit 221B, and performs time synchronization with the master function unit 221B based on the calculated time difference. Note that the time synchronization unit 41 may transmit and receive time synchronization information Tb to and from the master function unit 221B instead of the master function unit 221A when the detection unit 42 in its own switch device 111A detects an abnormality E2.

[0148] Also, when the switch device 111A detects an abnormality E2, it may perform a stop process P3 of stopping the transmission of the time synchronization information Ta to the end function unit 131. More specifically, as described above, after receiving the abnormality notification N2, the relay unit 21 discards the time synchronization information Ta received from the master function unit 221A via the communication port 24A and does not store the time synchronization information Ta in the storage unit 23. As a result, the time synchronization information Ta is not transmitted from the relay unit 21 to the end function unit 131 via the communication port 24D, and the time synchronization between the end function unit 131 and the switch device 111A stops.

[0149] [Flow of operations] FIG. 14 is a diagram showing an example of a sequence of monitoring time synchronization information and switching time synchronization information by a master function unit in an in-vehicle communication system according to a second embodiment of the present disclosure.

[0150] Referring to FIG. 14, first, the master function unit 221A transmits a first Sync message to the switch device 111A (step S201).

[0151] Next, the master function unit 221A transmits a first follow-up message including the transmission time of the first Sync message to the switch device 111A (step S202).

[0152] Next, the master function unit 221B transmits the second Sync message to the switch device 111A via the switch device 111B (step S203).

[0153] Next, the master function unit 221B transmits a second follow-up message including the transmission time of the second Sync message to the switch device 111A via the switch device 111B (step S204).

[0154] Next, the switch device 111A checks the domain IDs attached to the header parts of each of the frame storing the first follow-up message and the frame storing the second follow-up message. Then, the switch device 111A determines the Sync message and the follow-up message used for time synchronization during normal times by checking the domain ID that matches the normal domain ID among the two confirmed domain IDs. In the example shown in FIG. 14, the Sync message and the follow-up message used for time synchronization during normal times are the first Sync message and the first follow-up message (step S205).

[0155] Next, the switch device 111A performs time synchronization with the master function unit 221A based on the first Sync message and the first follow-up message (step S206).

[0156] Next, the switch device 111A transmits the first Sync message received from the master function unit 221A to the master function unit 221B via the switch device 111B (step S207).

[0157] Next, the switch device 111A transmits the first follow-up message received from the master function unit 221A to the master function unit 221B, further including the reception time of the first Sync message (step S208).

[0158] Next, the switch device 111A transmits the second Sync message received from the master function unit 221B to the master function unit 221A (step S209).

[0159] Next, the switch device 111A transmits the second follow-up message received from the master function unit 221B to the master function unit 221A, further including the reception time of the second Sync message (step S210).

[0160] Next, the switch device 111A transmits the first Sync message received from the master function unit 221A to the end function unit 131 (step S211).

[0161] Next, the switch device 111A transmits the first follow-up message received from the master function unit 221A to the end function unit 131, further including the reception time of the first Sync message (step S212).

[0162] Next, the end function unit 131 performs time synchronization with the switch device 111A based on the first Sync message and the first follow-up message received from the switch device 111A (step S213).

[0163] Next, the master function unit 221B performs a detection process for detecting the abnormality E2. The detection process of the abnormality E2 is the same as the detection process of the abnormality E1 in step S103 shown in FIG. 8 above, for example (step S214).

[0164] Next, when the master function unit 221B detects the abnormality E2 (''YES'' in step S214), the master function unit 221B transmits the abnormality notification N2 to the switch device 111A via the switch device 111B (step S215).

[0165] Next, when the switch device 111A receives the abnormality notification N2 from the master function unit 221B, it switches the time synchronization destination from the master function unit 221A to the master function unit 221B (step S216).

[0166] Next, the master function unit 221B transmits the second Sync message to the switch device 111A via the switch device 111B (step S217).

[0167] Next, the master function unit 221B transmits a second follow-up message including the transmission time of the second Sync message to the switch device 111A via the switch device 111B (step S218).

[0168] Next, based on the second Sync message and the second follow-up message received from the master function unit 221B, the switch device 111A performs time synchronization with the master function unit 221B (step S219).

[0169] Next, the switch device 111A transmits the abnormality notification N2 received from the master function unit 221B to the end function unit 131 (step S220).

[0170] Next, upon receiving the abnormality notification N2 from the switch device 111A, the end function unit 131 switches the time synchronization destination from the master function unit 221A to the master function unit 221B (step S221).

[0171] Next, the switch device 111A transmits the second Sync message received from the master function unit 221B to the end function unit 131 (step S222).

[0172] Next, the switch device 111A transmits the second follow-up message received from the master function unit 221B to the end function unit 131 (step S223).

[0173] 、 Next, based on the second Sync message and the second follow-up message received from the switch device 111A, the end function unit 131 performs time synchronization with the master function unit 221B (step S224).

[0174] On the other hand, when the master function unit 221B does not detect the abnormality E2 (\"NO\" in step S214), the above-described abnormality notification N2 is not transmitted.

[0175] As described above, when the abnormality E2 related to the master function unit 221A is detected, the switch device 111A switches the time synchronization destination from the master function unit 221A to the master function unit 221B. As a result, time synchronization can be performed with the master function unit 221B, so that more stable time synchronization can be realized in the in-vehicle network 201.

[0176] [Another Example of Time Synchronization Information Switching Process] In the above example, in the normal state, each of the master function units 221A and 221B transmits time synchronization information to the switch device 111A. In the following example, in the normal state, one of the master function units 221A and 221B transmits time synchronization information to the switch device 111, and after an abnormality occurs, the other of the master function units 221A and 221B transmits time synchronization information to the switch device 111.

[0177] FIG. 15 is a diagram showing another example of a sequence of monitoring time synchronization information and switching the time synchronization information by a master function unit in an in-vehicle communication system according to a second embodiment of the present disclosure.

[0178] Referring to FIG. 15, first, the master function unit 221A transmits a first Sync message to the switch device 111A (step S301).

[0179] Next, the master function unit 221A transmits a first follow-up message including the transmission time of the first Sync message to the switch device 111A (step S302).

[0180] Next, the switch device 111A performs time synchronization with the master function unit 221A based on the first Sync message and the first follow-up message (step 303).

[0181] Next, the switch device 111A transmits the first Sync message received from the master function unit 221A to the master function unit 221B (step S304).

[0182] Next, the switch device 111A further includes the reception time of the first Sync message in the first follow-up message and transmits it to the master function unit 221B (step S305).

[0183] Next, the switch device 111A transmits the first Sync message received from the master function unit 221A to the end function unit 131 (step S306).

[0184] Next, the switch device 111A further includes the reception time of the first Sync message in the first follow-up message received from the master function unit 221A and transmits it to the end function unit 131 (step S307).

[0185] Next, the end function unit 131 performs time synchronization with the switch device 111A based on the first Sync message and the first follow-up message received from the switch device 111A (step S308).

[0186] Next, the master function unit 221B performs the detection process of the abnormality E2 in the same manner as the process of step S214 shown in FIG. 14 described above (step S309).

[0187] Next, when the master function unit 221B detects the abnormality E2 (''YES'' in step S309), the master function unit 221B transmits the abnormality notification N2 to the switch device 111A via the switch device 111B (step S310).

[0188] Next, the switch device 111A receives the abnormality notification N2 from the master function unit 221B and switches the time synchronization destination from the master function unit 221A to the master function unit 221B (step S311).

[0189] Next, the master function unit 221B transmits the second Sync message to the switch device 111A via the switch device 111B (step S312).

[0190] Next, the master function unit 221B transmits a second follow-up message including the transmission time of the second Sync message to the switch device 111A via the switch device 111B (step S313).

[0191] Next, the switch device 111A performs time synchronization with the master function unit 221B based on the second Sync message and the second follow-up message received from the master function unit 221B (step S314).

[0192] On the other hand, when the master function unit 221B does not detect the abnormality E2 (''NO'' in step S309), the above-described abnormality notification N2 is not transmitted.

[0193] The processes of steps S315 to S319 shown in FIG. 15 are the same as those of steps S220 to S224 shown in FIG. 14, respectively.

[0194] Each process (each function) of the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured by, in addition to the one or more processors, an integrated circuit in which one or more memories, various analog circuits, and various digital circuits are combined. The one or more memories store a program (instruction) for causing the one or more processors to execute each of the above processes. The one or more processors may execute each of the above processes according to the program read from the one or more memories, or may execute each of the above processes according to a logic circuit designed in advance to execute each of the above processes. The processor may be various processors suitable for controlling a computer, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the plurality of physically separated processors may cooperate with each other to execute each of the above processes. For example, the processors mounted on each of the plurality of physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet to execute each of the above processes. The program may be installed in the memory via the network from an external server device or the like, or may be distributed in a state stored in a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a semiconductor essential memory, and may be installed in the memory from the recording medium.

[0195] The above-described embodiments should be considered illustrative in all respects and not restrictive. The scope of the present invention is indicated by the scope of the claims rather than the above description, and it is intended that all modifications within the meaning and scope equivalent to the scope of the claims be included.

Explanation of Signs

[0196] 1 Vehicle 10 Ethernet Cable 21 Relay Unit 22, 252 Processing Unit 23, 53, 63 Storage Unit 24, 24A, 24B, 24C, 24D, 54, 64 Communication Port 31 Switch Unit 32 Information Processing Unit 41, 52, 62, 71 Time Synchronization Unit 42, 72 Detection Unit 43, 73 Abnormal Processing Unit 51, 61, 71 Communication Unit 101, 201 In-Vehicle Network 111, 111A, 111B, 211, 211A, 211B Switch Device 121, 221, 221A, 221B Master Function Unit 131, 131A, 131B End Function Unit 301, 401 In-Vehicle Communication System

Claims

1. An in-vehicle device used in an in-vehicle network, by transmitting and receiving time synchronization information, which is information for time synchronization, between the in-vehicle device itself and other in-vehicle devices, calculates a time difference with the other in-vehicle devices, and performs time synchronization with the other in-vehicle devices based on the calculated time difference with the other in-vehicle devices. A time synchronization unit; A detection unit that monitors first transmission information, which is information transmitted from the other in-vehicle device to the in-vehicle device itself, and detects an abnormality regarding the content of the first transmission information; When an abnormality regarding the content of the first transmission information is detected by the detection unit, an abnormality processing unit that performs a stop process for stopping time synchronization in the in-vehicle network using the time synchronization information transmitted from the other in-vehicle device. And, A first reference device and a second reference device, which are other in-vehicle devices that perform time synchronization with the in-vehicle device itself, are provided in the in-vehicle network, The second reference device monitors second transmission information, which is information transmitted from the first reference device to the second reference device, and detects an abnormality regarding the content of the second transmission information. When an abnormality regarding the content of the second transmission information is detected by the second reference device, the time synchronization unit transmits and receives time synchronization information, which is information for time synchronization, with the second reference device instead of the first reference device. By doing so, a time difference with the second reference device is calculated, and time synchronization with the second reference device is performed based on the calculated time difference with the second reference device. An in-vehicle device.

2. The in-vehicle device according to claim 1, wherein the first transmission information is the time synchronization information.

3. The in-vehicle device according to claim 1, wherein the first transmission information indicates a source of reference information that is the basis for the time of the other in-vehicle device.

4. The abnormality processing unit performs the stop process of notifying, to another in-vehicle device that calculates a time difference with the in-vehicle device itself using the time synchronization information transmitted from the in-vehicle device itself, that an abnormality regarding the content of the first transmission information has been detected. The in-vehicle device according to any one of claims 1 to 3.

5. The in-vehicle device according to any one of claims 1 to 3, wherein the abnormality processing unit performs the stop process of stopping the time synchronization by the time synchronization unit.

6. The in-vehicle device according to any one of claims 1 to 3, wherein the abnormality processing unit performs the stop processing of stopping the transmission of the time synchronization information to another in-vehicle device that calculates the time difference from the in-vehicle device using the time synchronization information transmitted by the in-vehicle device.

7. The time synchronization unit, when an abnormality regarding the content of the first transmission information is detected by the detection unit, transmits and receives time synchronization information, which is information for time synchronization, with the second reference device instead of the first reference device, calculates the time difference from the second reference device, and performs time synchronization with the second reference device based on the calculated time difference. The in-vehicle device according to any one of claims 1 to 3.

8. The in-vehicle device according to claim 2, wherein the time synchronization information is at least one of a Sync message and a follow-up message used for time synchronization.

9. A time synchronization method in an in-vehicle device, comprising: calculating a time difference from another in-vehicle device by transmitting and receiving time synchronization information, which is information for time synchronization, between the in-vehicle device as the own device and the other in-vehicle device, and performing time synchronization with the other in-vehicle device based on the calculated time difference from the other in-vehicle device; monitoring first transmission information, which is information transmitted from the other in-vehicle device to the own device, and detecting an abnormality regarding the content of the first transmission information; when an abnormality regarding the content of the first transmission information is detected, performing a stop process for stopping time synchronization in an in-vehicle network using the time synchronization information transmitted from the other in-vehicle device; a first reference device and a second reference device, which are other in-vehicle devices that perform time synchronization with the own device, are provided in the in-vehicle network; the second reference device monitors second transmission information, which is information transmitted from the first reference device to the second reference device, and detects an abnormality regarding the content of the second transmission information; the time synchronization method further comprises: When an abnormality regarding the content of the second transmission information is detected by the second reference device, instead of the first reference device, time synchronization information, which is information for time synchronization, is transmitted and received with the second reference device to calculate a time difference from the second reference device, and time synchronization with the second reference device is performed based on the calculated time difference from the second reference device. A time synchronization method including the steps thereof.

Images