In-vehicle communication system, switch device, anomaly detection method, and anomaly detection program

Abstract

This vehicle-mounted communication system is provided with a vehicle-mounted device group including at least four vehicle-mounted devices, wherein: a specific vehicle-mounted device group, which is part of the vehicle-mounted device group and which includes at least three specific vehicle-mounted devices among the vehicle-mounted devices, circulates a specific target packet; and a first vehicle-mounted device, from among the specific vehicle-mounted devices, performs detection processing to detect an abnormality of the specific vehicle-mounted devices, other than the first vehicle-mounted device itself, in the specific vehicle-mounted device group, on the basis of a reception status of the target packet.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle communication system, a switch device, an abnormality detection method, and an abnormality detection program. This application claims priority based on Japanese Patent Application No. 2021-56355 filed on March 30, 2021, and incorporates all of the disclosure thereof herein.

Background Art

[0002] Japanese Unexamined Patent Application Publication No. 2018-174480 (Patent Document 1) discloses the following relay device in an in-vehicle network. That is, the relay device is a relay device that performs a relay process for relaying data between a plurality of functional units mounted on a vehicle, and in the relay process, a count unit that counts the number of relay packets, which is the number of packets relayed to target functional units that are a plurality of the same type of functional units, respectively, and a detection unit that monitors the count value of the count unit and detects unauthorized communication to the target functional unit based on the maximum value and the minimum value of each of the relay packet numbers counted by the count unit.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

[0004] <s The in-vehicle communication system of the present disclosure is an in-vehicle communication system including a group of in-vehicle devices including four or more in-vehicle devices, and a specific group of in-vehicle devices including three or more specific in-vehicle devices that are part of the group of in-vehicle devices circulates a specific target packet, and a first in-vehicle device that is the specific in-vehicle device performs a detection process for detecting an abnormality of the specific in-vehicle devices other than the first in-vehicle device itself in the specific group of in-vehicle devices based on the reception status of the target packet.

[0005] The switch device of this disclosure is a switch device in an in-vehicle communication system comprising an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, comprising: a relay unit that relays packets between the in-vehicle devices; and a detection unit that detects abnormalities of specific in-vehicle devices other than the switch device in the specific in-vehicle device group based on the reception status of specific target packets circulating among a specific in-vehicle device group which is part of the in-vehicle device group and comprises three or more specific in-vehicle devices which are in-vehicle devices.

[0006] The anomaly detection method of this disclosure is an anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, comprising the steps of: a specific group of in-vehicle devices, which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices that are in-vehicle devices, circulating a specific target packet; and a first in-vehicle device, which is one of the specific in-vehicle devices, performing a detection process to detect an anomaly in one of the specific in-vehicle devices other than its own first in-vehicle device in the specific group of in-vehicle devices, based on the reception status of the target packet.

[0007] The anomaly detection method of this disclosure is an anomaly detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, and includes the steps of relaying packets between the in-vehicle devices and detecting an anomaly in a specific in-vehicle device other than the switch device in the specific in-vehicle device group, based on the reception status of a specific target packet circulating through a specific in-vehicle device group which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices which are in-vehicle devices.

[0008] The anomaly detection program of this disclosure is an anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, and is a program that causes a computer to function as a relay unit that relays packets between the in-vehicle devices, and a detection unit that detects anomalies in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating among a specific group of in-vehicle devices that are part of the group of in-vehicle devices and include three or more specific in-vehicle devices that are in-vehicle devices.

[0009] One aspect of this disclosure can be implemented not only as an in-vehicle communication system equipped with such characteristic processing, but also as a program for causing a computer to perform such characteristic processing.

[0010] Furthermore, one aspect of this disclosure can be realized not only as a switch device equipped with such characteristic processing units, but also as a semiconductor integrated circuit that realizes part or all of the switch device. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a diagram showing the configuration of an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 2] Figure 2 shows the configuration of a switch device according to an embodiment of the present disclosure. [Figure 3] Figure 3 shows an example of rule information stored in a switch device according to an embodiment of the present disclosure. [Figure 4] Figure 4 is a diagram illustrating the flow of target packets relayed by a switch device according to an embodiment of the present disclosure. [Figure 5] Figure 5 shows an example of an address table stored in a switch device according to an embodiment of the present disclosure. [Figure 6] Figure 6 is a diagram showing the configuration of the target functional unit according to the embodiment of this disclosure. [Figure 7]Figure 7 shows a modified configuration of the in-vehicle communication system according to the embodiment of this disclosure. [Figure 8] Figure 8 shows an example of a sequence of target packet cyclic processing in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 9] Figure 9 is a flowchart illustrating an example of the operation procedure when a switch device that generates target packets relays target packets in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 10] Figure 10 is a flowchart illustrating an example of the operation procedure when a switch device that does not generate target packets relays target packets in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 11] Figure 11 is a flowchart illustrating an example of the operation procedure when the target function unit in the in-vehicle communication system according to the embodiment of this disclosure performs cyclic processing of target packets. [Figure 12] Figure 12 is a flowchart illustrating an example of the operation procedure when a switch device in an in-vehicle communication system according to an embodiment of the present disclosure performs detection processing. [Figure 13] Figure 13 is a flowchart illustrating an example of the operation procedure when the target function unit performs detection processing in an in-vehicle communication system according to an embodiment of the present disclosure. [Figure 14] Figure 14 shows an example of a sequence of threshold update processing due to the addition of a specific in-vehicle device in Modification 3 of the in-vehicle communication system according to the embodiment of this disclosure. [Modes for carrying out the invention]

[0012] Conventionally, technologies related to in-vehicle networks equipped with multiple in-vehicle devices have been developed.

[0013] [Issues this disclosure aims to address] Beyond the technology described in Patent Document 1 as described above, there is a need for a technology that can more reliably detect an abnormality in an in-vehicle device in an in-vehicle communication system using a simpler method.

[0014] The present disclosure has been made to solve the above-described problems, and an object thereof is to provide an in-vehicle communication system, a switch device, an abnormality detection method, and an abnormality detection program that can more reliably detect an abnormality in an in-vehicle device in an in-vehicle communication system using a simpler method.

[0015] [Effect of the Present Disclosure] According to the present disclosure, an abnormality in an in-vehicle device in an in-vehicle communication system can be more reliably detected using a simpler method.

[0016] [Description of Embodiment of the Present Disclosure] First, the contents of the embodiment of the present disclosure will be listed and described. (1) An in-vehicle communication system according to an embodiment of the present disclosure is an in-vehicle communication system including an in-vehicle device group including four or more in-vehicle devices, and a specific in-vehicle device group including three or more specific in-vehicle devices that are part of the in-vehicle device group and are the in-vehicle devices circulates a specific target packet, and a first in-vehicle device that is the specific in-vehicle device performs a detection process of detecting an abnormality of the specific in-vehicle devices other than the first in-vehicle device itself in the specific in-vehicle device group based on the reception status of the target packet.

[0017] With such a configuration, when an abnormality has occurred in at least one of the plurality of specific in-vehicle devices in the specific in-vehicle device group, the other specific in-vehicle devices can detect the abnormality. That is, since abnormalities can be detected from each other among the plurality of specific in-vehicle devices in the specific in-vehicle device group, the detection of abnormalities can be performed more reliably.

[0018] Furthermore, since each specific in-vehicle device can detect abnormalities in a specific group of in-vehicle devices by monitoring its own reception status of target packets circulating within that group, for example, it is not necessary to monitor packets for each in-vehicle device that is communicating with the other party, and detection processing can be performed with a simpler configuration. Therefore, abnormalities in in-vehicle devices in an in-vehicle communication system can be detected more reliably using a simpler method.

[0019] (2) The specified group of in-vehicle devices includes a plurality of the first in-vehicle devices, and at least one of the plurality of the first in-vehicle devices is a switch device that relays packets between the plurality of in-vehicle devices, and if one or more of the first in-vehicle devices other than the switch device in the specified group of in-vehicle devices detect an abnormality in the in-vehicle device during the detection process, it may change the processing other than the detection process performed by its own first in-vehicle device to a lower-load processing or stop it.

[0020] For example, in an in-vehicle communication system, multiple specific in-vehicle devices within a specific group of devices work together to realize functions such as vehicle operation or the provision of various services. Therefore, if a malfunction occurs in at least one of these multiple specific in-vehicle devices, even if the other devices that are not malfunctioning perform their normal operations, there is a high probability that the above functions cannot be realized.

[0021] Therefore, as described above, if a first in-vehicle device other than the switch device in the group of specific in-vehicle devices detects an abnormality in any other specific in-vehicle device in the group, the processing load on the first in-vehicle device can be appropriately reduced by changing or stopping any processing that is likely to become unnecessary, which is being performed by the first in-vehicle device.

[0022] (3) All of the specified in-vehicle devices in the specified in-vehicle device group may be the first in-vehicle device.

[0023] For example, in a configuration where one specific in-vehicle device in a group of specific in-vehicle devices performs detection processing, if an abnormality occurs in that specific in-vehicle device, it may not be possible to accurately detect the abnormality in that device. In contrast, as described above, a configuration in which multiple specific in-vehicle devices perform detection processing makes it possible to detect abnormalities more reliably.

[0024] (4) The specified in-vehicle device group may include a switch device that relays packets between a plurality of in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device, and the switch device may hold rule information indicating the routing rules for the target packets, and based on the rule information, transmit the target packets received from the second in-vehicle device to the third in-vehicle device.

[0025] With this configuration, the second in-vehicle device in a specific group of in-vehicle devices can transmit the target packet without being aware of the destination of the third in-vehicle device to which the target packet will be sent. Therefore, even if the vendors of multiple specific in-vehicle devices are different, anomaly detection by circulating the target packet can be performed more reliably.

[0026] (5) The specified in-vehicle device group may include a switch device that relays packets between a plurality of the in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device, and the second in-vehicle device may rewrite the destination address of the target packet received from the switch device to the address of the third in-vehicle device and transmit it to the switch device.

[0027] This configuration eliminates the need for the switch device to store information indicating the routing rules for target packets, thus simplifying the switch device's configuration.

[0028] (6) The first in-vehicle device may determine that an abnormality has occurred if, in the detection process, the elapsed time since the transmission of the target packet exceeds a predetermined threshold, but the circulating of the target packet cannot be confirmed. The first in-vehicle device may also perform an update process to update the predetermined threshold if a new specific in-vehicle device is added to the specific in-vehicle device group.

[0029] With this configuration, when a new specific in-vehicle device is added to the in-vehicle network, the threshold can be updated in accordance with the addition of the specific in-vehicle device, and abnormalities in the new group of specific in-vehicle devices can be detected.

[0030] (7) The first in-vehicle device that performs the update processing may notify other first in-vehicle devices in the specific group of in-vehicle devices of the updated threshold value, and the other first in-vehicle devices may perform the detection processing using the notified updated threshold value value.

[0031] This configuration allows for the detection of abnormalities in a new specific group of in-vehicle devices in each of the first in-vehicle devices, and enables more efficient updating of thresholds in each of the first in-vehicle devices.

[0032] (8) The first in-vehicle device performing the update processing may notify other first in-vehicle devices in the specific group of in-vehicle devices of the correction value of the threshold, and the other first in-vehicle devices may update the threshold based on the notified correction value and perform the detection processing using the updated threshold.

[0033] This configuration allows each of the first in-vehicle devices to detect abnormalities in a new specific group of in-vehicle devices, and also allows each of the first in-vehicle devices to correctly update the threshold values ​​if, for example, the threshold calculation method differs among the first in-vehicle devices.

[0034] (9) The specified in-vehicle device group may include three or more of the specified in-vehicle devices that are essential for the vehicle to perform autonomous driving.

[0035] This configuration allows for more reliable detection of abnormalities occurring in at least one of the multiple specific in-vehicle devices used in autonomous driving.

[0036] (10) The switch device according to the embodiment of the present disclosure is a switch device in an in-vehicle communication system comprising an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, comprising: a relay unit that relays packets between the in-vehicle devices; and a detection unit that detects abnormalities of specific in-vehicle devices other than the switch device in the specific in-vehicle device group based on the reception status of specific target packets circulating among a specific in-vehicle device group which is part of the in-vehicle device group and comprises three or more specific in-vehicle devices which are in-vehicle devices.

[0037] With this configuration, if an abnormality occurs in at least one of the multiple specific in-vehicle devices in a specific group of in-vehicle devices, the switch device can detect that abnormality.

[0038] Furthermore, since the switch device can detect abnormalities in a specific group of in-vehicle devices by monitoring the reception status of target packets circulating among that group, it is not necessary to monitor packets for each individual in-vehicle device that is communicating with it, for example, and detection processing can be performed with a simpler configuration. Therefore, abnormalities in in-vehicle devices in an in-vehicle communication system can be detected more reliably using a simpler method.

[0039] (11) An anomaly detection method according to an embodiment of the present disclosure is an anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, comprising the steps of: a specific group of in-vehicle devices, which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices that are in-vehicle devices, circulating a specific target packet; and a first in-vehicle device, which is one of the specific in-vehicle devices, performing a detection process to detect an anomaly in one of the specific in-vehicle devices other than its own first in-vehicle device in the group of specific in-vehicle devices, based on the reception status of the target packet.

[0040] This method allows other specific in-vehicle devices to detect an abnormality if at least one of several specific in-vehicle devices in a group of specific in-vehicle devices is malfunctioning. In other words, since abnormalities can be detected by each other among multiple specific in-vehicle devices in a group of specific in-vehicle devices, abnormality detection can be made more reliable.

[0041] Furthermore, since each specific in-vehicle device can detect abnormalities in a specific group of in-vehicle devices by monitoring its own reception status of target packets circulating within that group, for example, it is not necessary to monitor packets for each in-vehicle device that is communicating with the other party, and detection processing can be performed with a simpler configuration. Therefore, abnormalities in in-vehicle devices in an in-vehicle communication system can be detected more reliably using a simpler method.

[0042] (12) An anomaly detection method according to an embodiment of the present disclosure is an anomaly detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, the method comprising the steps of relaying packets between the in-vehicle devices and detecting an anomaly in a specific in-vehicle device other than the switch device in the specific in-vehicle device group, based on the reception status of a specific target packet circulating through a specific in-vehicle device group which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices which are in-vehicle devices.

[0043] By this method, if an abnormality occurs in at least one of the multiple specific in-vehicle devices in a specific group of in-vehicle devices, the switch device can detect that abnormality.

[0044] Furthermore, since the switch device can detect abnormalities in a specific group of in-vehicle devices by monitoring the reception status of target packets circulating among that group, it is not necessary to monitor packets for each individual in-vehicle device that is communicating with it, for example, and detection processing can be performed with a simpler configuration. Therefore, abnormalities in in-vehicle devices in an in-vehicle communication system can be detected more reliably using a simpler method.

[0045] (13) An anomaly detection program according to an embodiment of the present disclosure is an anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, and is a program that causes a computer to function as a relay unit that relays packets between the in-vehicle devices and a detection unit that detects anomalies in specific in-vehicle devices other than the switch device in the specific in-vehicle device group based on the reception status of specific target packets circulating among a specific group of in-vehicle devices which are part of the group of in-vehicle devices and include three or more specific in-vehicle devices which are in-vehicle devices.

[0046] With this configuration, if an abnormality occurs in at least one of the multiple specific in-vehicle devices in a specific group of in-vehicle devices, the switch device can detect that abnormality.

[0047] Furthermore, since the switch device can detect abnormalities in a specific group of in-vehicle devices by monitoring the reception status of target packets circulating among that group, it is not necessary to monitor packets for each individual in-vehicle device that is communicating with it, for example, and detection processing can be performed with a simpler configuration. Therefore, abnormalities in in-vehicle devices in an in-vehicle communication system can be detected more reliably using a simpler method.

[0048] Embodiments of this disclosure will be described below with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and their descriptions will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any way.

[0049] <Configuration and Basic Operation> [Overall structure] Figure 1 is a diagram showing the configuration of an in-vehicle communication system according to an embodiment of the present disclosure.

[0050] Referring to Figure 1, the in-vehicle communication system 301 is mounted on the vehicle 1 and comprises a group of in-vehicle devices including four or more in-vehicle devices. More specifically, the in-vehicle communication system 301 comprises one or more switch devices 101 and a group of functional units 111, which are examples of in-vehicle devices.

[0051] Figure 1 shows, as an example, two switch devices 101A and 101B, which constitute the switch device 101, and eight functional units 111A to 111H, which constitute the functional unit 111. Each switch device 101 and each functional unit 111 is, for example, an ECU (Electronic Control Unit).

[0052] The switch device 101 is connected to multiple functional units 111 and other switch devices 101 by, for example, an Ethernet® cable 10, and is capable of communicating with the multiple functional units 111 and other switch devices 101 connected to it.

[0053] Specifically, the switch device 101 performs relay processing, forwarding packets from the functional unit 111 to other functional units 111 or other switch devices 101. Between the switch device 101 and the functional unit 111, or between two switch devices 101, information is exchanged, for example, using Ethernet frames containing IP packets.

[0054] The functional unit 111 is, for example, a target functional unit that is essential for the vehicle 1 to perform autonomous driving, or a non-target functional unit other than the target functional unit. Target functional units include, for example, an external communication ECU, sensors, cameras, LiDAR (Light Detection and Ranging), and an autonomous driving processing ECU. Non-target functional units include, for example, an air conditioning control unit and audio equipment. Note that the target functional unit may also be used in applications other than autonomous driving.

[0055] Here, the four functional units 111A to 111D are designated as "target functional units," and the four functional units 111E to 111H are designated as "non-target functional units." In Figure 1, the four target functional units and the two switch devices 101 are hatched. Hereafter, the group containing the six specific in-vehicle devices, which consist of the four target functional units and the two switch devices 101, will be referred to as the "Specific In-Vehicle Device Group GP." The Specific In-Vehicle Device Group includes multiple specific in-vehicle devices, and includes one or more first in-vehicle devices that perform the detection processing described later. The first in-vehicle device that performs the detection processing may be a target functional unit or a switch device 101.

[0056] Furthermore, the specific in-vehicle device group GP is not limited to a configuration that includes six specific in-vehicle devices, consisting of four target functional units and two switch devices 101. For example, the specific in-vehicle device group GP may include three to five, or even seven or more, specific in-vehicle devices. Also, the specific in-vehicle device group GP may include one or three or more switch devices, or, as shown in Modification Example 2 described later, may not include any switch devices 101.

[0057] A specific in-vehicle device group GP, which is part of a group of in-vehicle devices, circulates specific target packets used to detect abnormalities in specific in-vehicle devices within the specific in-vehicle device group GP. In other words, the target packets pass through each specific in-vehicle device in the specific in-vehicle device group GP in sequence.

[0058] For example, when a target packet is transmitted from switch device 101A, the target packet circulates in the following order, as shown by arrow X1 in Figure 1: switch device 101B, functional unit 111A, switch device 101B, functional unit 111B, switch device 101B, switch device 101A, functional unit 111C, switch device 101A, functional unit 111D, and then returns to switch device 101A.

[0059] The first in-vehicle device in the specified in-vehicle device group GP performs detection processing to detect abnormalities in specified in-vehicle devices other than the first in-vehicle device in the specified in-vehicle device group GP, based on the reception status of target packets circulating within the specified in-vehicle device group GP.

[0060] Here, as an example, each of the specific in-vehicle devices in the specific in-vehicle device group GP, namely the four target function units and the two switch devices 101, acts as a first in-vehicle device and performs detection processing to detect abnormalities in other specific in-vehicle devices. The detailed configuration of the switch devices 101 and the target function units will be described below.

[0061] [Configuration of the switch device and target functional unit] (Switching device) Figure 2 shows the configuration of a switch device according to an embodiment of the present disclosure. Here, the configuration of switch device 101A will be described. Switch device 101B has the same configuration as switch device 101A.

[0062] Referring to Figure 2, the switch device 101 comprises a relay unit 51, a processing unit 52, a storage unit 53, a plurality of communication ports Ps, a notification unit 55, and a timer 56. The relay unit 51, the processing unit 52, and the notification unit 55 are implemented by processors such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor). The storage unit 53 is, for example, a non-volatile memory. The processing unit 52 includes an information processing unit 63 and a detection unit 64.

[0063] A communication port Ps is, for example, a terminal to which an Ethernet cable 10 can be connected. Note that a communication port Ps may also be a terminal of an integrated circuit. Each of the multiple communication ports Ps is connected to one of the multiple functional units 111 via an Ethernet cable 10.

[0064] In this example, communication port Ps1 is connected to the functional unit 111G, and communication port Ps2 is connected to the functional unit 111C. Additionally, communication port Ps3 is connected to the functional unit 111H, and communication port Ps4 is connected to the functional unit 111D. Furthermore, communication port Ps5 is connected to the switch device 101B.

[0065] (a) Relay processing The relay unit 51 relays packets between in-vehicle devices. Specifically, when the relay unit 51 receives an Ethernet frame transmitted from the functional unit 111 or the switch device 101B via the communication port Ps corresponding to the functional unit 111 or the switch device 101B, it performs relay processing on the received Ethernet frame and transmits the Ethernet frame back to the functional unit 111 or the switch device 101B.

[0066] The relay unit 51 performs relay processing for target packets and non-target packets, taking into consideration, for example, the congestion state in the in-vehicle communication system 301. The relay unit 51 may also prioritize the relay processing of target packets over, for example, the relay processing of non-target packets.

[0067] The memory unit 53 stores rule information that indicates a patrol rule specifically for the target packet. Based on this rule information, the relay unit 51 transmits the target packet received from the second in-vehicle device, which is a specific in-vehicle device, to the third in-vehicle device, which is also a specific in-vehicle device.

[0068] Figure 3 shows an example of rule information stored in a switch device according to an embodiment of the present disclosure. Figure 4 is a diagram illustrating the flow of target packets relayed by a switch device according to an embodiment of the present disclosure.

[0069] For more details, please refer to Figures 3 and 4. The storage unit 53 stores, as an example of rule information, a port table Tb1 that shows the correspondence between the communication port Ps that receives the target packet and the communication port Ps that is the output destination of the target packet.

[0070] Specifically, port table Tb1 indicates that if a target packet is received from communication port Ps2, the target packet should be output to communication port Ps4; if a target packet is received from communication port Ps4, the target packet should be output to communication port Ps5; and if a target packet is received from communication port Ps5, the target packet should be output to communication port Ps2.

[0071] When the relay unit 51 receives an Ethernet frame from any one of the multiple communication ports Ps, it checks, for example, the value of the type field in the header portion of the Ethernet frame to determine whether the packet stored in the Ethernet frame is the target packet.

[0072] Then, if the packet is a target packet, the relay unit 51 refers to the port table Tb1 stored in the storage unit 53 to identify the communication port Ps to which the packet will be output. The relay unit 51 then transmits the Ethernet frame containing the packet from the identified communication port Ps.

[0073] As the relay unit 51 performs relay processing of target packets in the manner described above, for example, as shown in Figure 4, target packets transmitted from the functional unit 111C are transmitted to the functional unit 111D via the switch device 101A. Target packets transmitted from the functional unit 111D are transmitted to the switch device 101B via the switch device 101A. Target packets transmitted from the switch device 101B are transmitted to the functional unit 111C via the switch device 101A.

[0074] Note that the rule information stored in the memory unit 53 is not limited to the port table Tb1 shown in Figure 3. The rule information may, for example, be information indicating the correspondence between the MAC (Media Access Control) address of the target functional unit that is the source of the target packet and the MAC address of the target functional unit that is the destination of the target packet.

[0075] Furthermore, the memory unit 53 stores an address table Tb2 that shows the correspondence between the communication port Ps and the MAC address of the connected functional unit 111 or switch device 101B.

[0076] Figure 5 shows an example of an address table stored in a switch device according to an embodiment of the present disclosure.

[0077] Referring to Figure 5, if the relay unit 51 receives a packet from any one of the multiple communication ports Ps that is not the target packet, it checks the destination MAC address contained in the Ethernet frame that stores the packet. Then, the relay unit 51 refers to the address table Tb2 stored in the storage unit 53 to identify the communication port Ps corresponding to the destination MAC address and transmits the Ethernet frame from the identified communication port Ps.

[0078] (b) Detection process Referring again to Figures 2 and 4, the information processing unit 63, for example, when the switch device 101A starts up, generates a target packet and sends the generated target packet to the switch device 101B via the relay unit 51 and the communication port Ps5. As described above, the target packet circulates in the following order: switch device 101B, function unit 111A, switch device 101B, function unit 111B, switch device 101B, switch device 101A, function unit 111C, switch device 101A, function unit 111D, and then reaches the switch device 101A again.

[0079] The target packet is generated by one of several specific in-vehicle devices in the specific in-vehicle device group GP. Therefore, as described above, if the information processing unit 63 in switch device 101A generates the target packet, the information processing unit 63 in switch device 101B does not generate the target packet.

[0080] Furthermore, the generation of the target packets may be performed by a specific in-vehicle device other than the switch device 101A within the specific in-vehicle device group GP.

[0081] The detection unit 64 performs detection processing to detect abnormalities in specific in-vehicle devices other than the switch device 101A in the specific in-vehicle device group GP, based on the reception status of the target packet at the switch device 101A. For example, if the detection unit 64 cannot confirm that the target packet transmitted from the switch device 101A has completed a circuit even after a predetermined time has elapsed, that is, if the target packet has not completed a circuit of the specific in-vehicle device group GP and returned, it determines that an abnormality has occurred in the specific in-vehicle device in the specific in-vehicle device group GP.

[0082] A state in which a specific in-vehicle device is malfunctioning includes, for example, a state in which the device is unable to process data due to a software freeze or similar issue.

[0083] More specifically, the relay unit 51 starts the timer 56 count operation at the timing when it transmits the target packet generated by the information processing unit 63 from the communication port Ps5. Furthermore, when the relay unit 51 receives the target packet that has circled the specific in-vehicle device group GP, that is, when it receives the target packet via the communication port Ps4, it resets the timer 56 count value.

[0084] The detection unit 64 measures the patrol time in the switch device 101A, which is the time from the transmission timing of the target packet to the timing of the completion of the patrol of the target packet, by checking the count value of the timer 56.

[0085] The memory unit 53 stores a threshold value for the cycle time. This threshold value is set in advance, taking into consideration, for example, the data propagation delay time between specific in-vehicle devices and the data processing time in each specific in-vehicle device.

[0086] The detection unit 64 refers to a threshold value stored in the memory unit 53 and determines that if the timer 56 count value exceeds the threshold value, an abnormality has occurred in one or more specific in-vehicle devices in the specific in-vehicle device group GP, making autonomous driving of vehicle 1 difficult. In this case, the detection unit 64 outputs judgment information indicating the judgment result to the notification unit 55.

[0087] When the notification unit 55 receives judgment information from the detection unit 64, it notifies the user, for example, by displaying the content of the judgment information on a monitor installed in the vehicle 1, and stores the judgment information in the storage unit 53, associating it with the current time, etc.

[0088] Furthermore, the notification unit 55 transmits the decision information to one or more specific in-vehicle devices in the specific in-vehicle device group GP, for example, via the relay unit 51 and the corresponding communication port Ps. That is, the notification unit 55 transmits the decision information directly or via the switch device 101B to the target functional units 111A, 111B, 111C, and 111D.

[0089] Furthermore, the detection unit 64 may use a method other than the method of checking the patrol time as described above as a method for detecting abnormalities in specific in-vehicle devices in the specific in-vehicle device group GP. For example, the detection unit 64 may be configured to detect abnormalities in specific in-vehicle devices in the specific in-vehicle device group GP by checking whether the payload portion of the Ethernet frame received by the relay unit 51 is normal as a reception status of the target packet.

[0090] (Target Functional Unit) Figure 6 is a diagram showing the configuration of the target functional unit according to the embodiment of this disclosure. Here, the configuration of the functional unit 111A, which is the target functional unit, will be described. The other target functional units, functional units 111B, 111C, and 111D, have the same configuration as functional unit 111A.

[0091] Referring to Figure 6, the functional unit 111A comprises a communication unit 81, a processing unit 82, a storage unit 83, a timer 84, and a communication port Pe. The processing unit 82 is implemented by a processor such as a CPU and a DSP. The communication unit 81 is implemented by a processor or a communication circuit such as a communication IC (Integrated Circuit). The storage unit 83 is, for example, a non-volatile memory. The processing unit 82 includes an information processing unit 91 and a detection unit 92.

[0092] The communication port Pe is, for example, a terminal to which an Ethernet cable 10 can be connected. The communication port Pe may also be a terminal of an integrated circuit, etc. Furthermore, the communication port Pe is connected to the switch device 101B via the Ethernet cable 10.

[0093] (a) Cyclic processing When the communication unit 81 receives an Ethernet frame transmitted from the switch device 101B via the communication port Pe, it checks, for example, the value of the type field in the header portion of the Ethernet frame to determine whether the packet stored in the Ethernet frame is the target packet.

[0094] Then, if the packet is a target packet, the communication unit 81 sends the Ethernet frame containing the packet to the switch device 101B via the communication port Pe.

[0095] On the other hand, if the packet is not the target packet, the communication unit 81 extracts information contained in the packet and outputs the extracted information to the information processing unit 91. The information processing unit 91 receives the information output from the communication unit 81 and performs normal information processing using that information.

[0096] (b) Detection process The detection unit 92 performs detection processing in the same manner as the detection unit 64 in the switch device 101 described above. That is, the detection unit 92 performs detection processing to detect abnormalities in other specific in-vehicle devices in the specific in-vehicle device group GP based on the reception status of the target packet in the functional unit 111A.

[0097] More specifically, when the communication unit 81 receives a target packet, for example, at the time when the target packet is transmitted from the communication port Pe, it starts the timer 84 counting operation. Furthermore, when the communication unit 81 receives the target packet that has circled the specific in-vehicle device group GP, that is, when the target packet is received via the communication port Pe, it resets the timer 84 count value.

[0098] The detection unit 92 checks the count value of the timer 56 to measure the patrol time in the functional unit 111A, which is the time from the transmission timing of the target packet to the timing of the completion of the patrol of the target packet.

[0099] The memory unit 83 stores a threshold value for the patrol time. The detection unit 92 refers to the threshold value stored in the memory unit 83 and determines that if the count value of the timer 84 exceeds the threshold value, an abnormality has occurred in one or more specific in-vehicle devices in the specific in-vehicle device group GP, making autonomous driving of vehicle 1 difficult. In this case, the detection unit 92 outputs judgment information indicating the judgment result to the information processing unit 91.

[0100] When the information processing unit 91 receives judgment information from the detection unit 92, it changes the processing other than the detection processing performed by the functional unit 111A to a less resource-intensive process or stops the processing. For example, if the functional unit 111A is a sensor, the information processing unit 91 stops the measurement process. Also, for example, if the functional unit 111A is a camera, the information processing unit 91 performs processing to reduce the image resolution. Also, for example, if the information processing unit 91 receives judgment information from the switch device 101 via the communication unit 81, it performs similar processing.

[0101] Furthermore, the configuration is not limited to the detection unit 92 outputting judgment information to the information processing unit 91, and the information processing unit 91 changing processes other than the detection process performed by its own functional unit 111A to processes with a lower load or stopping the process. For example, if the detection unit 92 determines that an abnormality has occurred, it may transmit the judgment information to the switch device 101B via the communication unit 81 and communication port Pe without outputting it to the information processing unit 91. In this case, the functional unit 111A continues the processing it normally performs.

[0102] When the relay unit 51 in the switch device 101B receives decision information from the functional unit 111A, it outputs the decision information to the notification unit 55, for example. The notification unit 55 then notifies the user of the content indicated by the decision information received from the relay unit 51 by displaying it on a monitor mounted on the vehicle 1, for example, and also stores the decision information in the storage unit 53 in association with the current time, etc.

[0103] Furthermore, the in-vehicle communication system 301 is not limited to a configuration in which all specific in-vehicle devices in the specific in-vehicle device group GP perform detection processing as the first in-vehicle device. It may also be a configuration in which one or more specific in-vehicle devices that are part of the specific in-vehicle device group GP perform detection processing as the first in-vehicle device. In this case, the specific in-vehicle device that circulates the target packets may be the first in-vehicle device that performs detection processing, or it may be a specific in-vehicle device that does not perform detection processing.

[0104] Furthermore, the specific in-vehicle device group GP may also include, in addition to the target function unit and the switch device 101, one or more non-target function units as specific in-vehicle devices.

[0105] [Example 1] The switch device 101 may be configured not to retain rule information such as the port table Tb1. In this case, for example, the storage unit 83 in each target function unit has in advance stored destination information for a specific in-vehicle device other than the switch devices 101A and 101B that will be the destination of the target packet.

[0106] When the communication unit 81 in each target functional unit (second in-vehicle device) receives an Ethernet frame containing the target packet, it rewrites the destination address of the Ethernet frame to the MAC address indicated by the destination information stored in the storage unit 83, and transmits it to the switch devices 101A and 101B via the communication port Pe.

[0107] When the relay unit 51 in the switch device 101 receives an Ethernet frame transmitted from the target functional unit, it refers to the address table Tb2 shown in Figure 5 to identify the communication port Ps corresponding to the destination MAC address contained in the Ethernet frame. The relay unit 51 then transmits the Ethernet frame from the identified communication port Ps to the target functional unit (third in-vehicle device).

[0108] [Differentiation 2] The in-vehicle communication system 301 may be configured without a switch device 101. Figure 7 shows a modified configuration of the in-vehicle communication system according to the embodiment of this disclosure.

[0109] Referring to Figure 7, the in-vehicle communication system 301 includes, for example, a group of in-vehicle devices including four functional units 111, namely 111J to 111M. Let's assume that functional units 111J, 111K, and 111L, which are part of this group of in-vehicle devices, are the target functional units, and functional unit 111M is the non-target functional unit. These four functional units 111 are connected to each other, for example, via a CAN bus 11 that conforms to the CAN (Controller Area Network) (registered trademark) standard.

[0110] In the example shown in Figure 7, the specific in-vehicle device group GP includes the target functional units 111J, 111K, and 111L as specific in-vehicle devices. Each target functional unit pre-stores, for example, ID information indicating the CAN-ID corresponding to its own target functional unit, and destination information indicating the CAN-ID corresponding to other target functional units to which the target packet will be sent.

[0111] Each target function unit, for example, when it receives a data frame containing a target packet, determines that the data frame was sent to it if the CAN-ID included in the data frame is the CAN-ID corresponding to itself. The target function unit then transmits the data frame including the CAN-ID indicating the destination information. As a result, each of the function units 111J, 111K, and 111L can circulate the target packet within the specific in-vehicle device group GP, as shown by arrow X2 in Figure 7.

[0112] Furthermore, as described above, each target functional unit can detect abnormalities in other target functional units based on its own reception status of the target packet.

[0113] <Operation Flow> Next, the operation of each in-vehicle device in the in-vehicle communication system 301 according to the embodiment of this disclosure when performing detection processing will be explained with reference to the drawings.

[0114] Each device in the in-vehicle communication system 301 is equipped with a computer including memory, and the processing unit such as the CPU in the computer reads and executes a program from the memory that includes some or all of the steps in the following flowchart and sequence. The programs for each of these devices can be installed externally. The programs for each of these devices are distributed either stored on a recording medium or via a communication line.

[0115] [Procedure for performing cyclic processing on target packets] (Overall operation) Figure 8 shows an example of a sequence of target packet cyclic processing in an in-vehicle communication system according to an embodiment of the present disclosure.

[0116] Referring to Figures 1 and 8, first, the switch device 101A generates the target packet after startup, for example, and starts the timer 56 count operation (step S11).

[0117] Next, switch device 101A sends the generated target packet to switch device 101B (step S12).

[0118] Next, when the switch device 101B receives the target packet transmitted from the switch device 101A, it starts the timer 56 count operation (step S13) and transmits the target packet to the functional unit 111A (step S14).

[0119] Next, when the functional unit 111A receives the target packet transmitted from the switch device 101B, it starts the timer 84 count operation (step S15) and transmits the target packet to the switch device 101B (step S16).

[0120] Next, when the switch device 101B receives the target packet transmitted from the functional unit 111A, it transmits the target packet to the functional unit 111B (step S17).

[0121] Next, when the functional unit 111B receives the target packet transmitted from the switch device 101B, it starts the timer 84 count operation (step S18) and transmits the target packet to the switch device 101B (step S19).

[0122] Next, when the switch device 101B receives the target packet transmitted from the functional unit 111B, it transmits the target packet to the switch device 101A (step S20).

[0123] Next, when the switch device 101A receives the target packet transmitted from the switch device 101B, it transmits the target packet to the functional unit 111C (step S21).

[0124] Next, when the functional unit 111C receives the target packet transmitted from the switch device 101A, it starts the timer 84 count operation (step S22) and transmits the target packet to the switch device 101A (step S23).

[0125] Next, when the switch device 101A receives the target packet transmitted from the functional unit 111C, it transmits the target packet to the functional unit 111D (step S24).

[0126] Next, when the functional unit 111D receives the target packet transmitted from the switch device 101A, it starts the timer 84 count operation (step S25) and transmits the target packet to the switch device 101A (step S26).

[0127] Next, when the functional unit 111A receives the target packet transmitted from the functional unit 111D, that is, the target packet that has circled the specific in-vehicle device group GP, it resets the count value of the timer 56 (step S27) and transmits the target packet to the switch device 101B (step S28).

[0128] Next, when the switch device 101B receives the target packet transmitted from the switch device 101A, that is, the target packet that has circled the specific in-vehicle device group GP, it resets the count value of the timer 56 (step S29) and transmits the target packet to the function unit 111A (step S30).

[0129] Next, when the functional unit 111A receives the target packet transmitted from the switch device 101B, it resets the count value of the timer 84 (step S31) and transmits the target packet to the switch device 101B (step S32).

[0130] Next, when the switch device 101B receives the target packet transmitted from the functional unit 111A, it transmits the target packet to the functional unit 111B (step S33).

[0131] Next, when the functional unit 111B receives the target packet transmitted from the switch device 101B, it resets the count value of the timer 84 (step S34) and transmits the target packet to the switch device 101B (step S35).

[0132] Next, when the switch device 101B receives the target packet transmitted from the functional unit 111B, it transmits the target packet to the switch device 101A (step S36).

[0133] Next, when the switch device 101A receives the target packet transmitted from the switch device 101B, it transmits the target packet to the functional unit 111C (step S37).

[0134] Next, when the functional unit 111C receives the target packet transmitted from the switch device 101A, it resets the count value of the timer 84 (step S38) and transmits the target packet to the switch device 101A (step S39).

[0135] Next, when the switch device 101A receives the target packet transmitted from the functional unit 111C, it transmits the target packet to the functional unit 111D (step S40).

[0136] Next, when the functional unit 111D receives the target packet transmitted from the switch device 101A, it resets the count value of the timer 84 (step S41) and transmits the target packet to the switch device 101A (step S42).

[0137] Thus, when the functional units 111A, 111B, 111C, and 111D receive a target packet after transmitting it, they reset the counter value of timer 84 and transmit the target packet.

[0138] Furthermore, when the switch device 101A receives a target packet from a functional unit 111D, which is a predetermined specific in-vehicle device, it resets the counter value of the timer 56 and transmits the target packet. When the switch device 101B receives a target packet from the switch device 101A, which is a predetermined specific in-vehicle device, it resets the counter value of the timer 56 and transmits the target packet.

[0139] In this way, when each specific in-vehicle device in the specific in-vehicle device group GP receives a target packet that has circulated within the specific in-vehicle device group GP, it resets the count value of timer 56 or timer 84 and transmits the target packet to another specific in-vehicle device, thereby causing the target packet to circulate continuously.

[0140] (Relay processing by switch device 101A) Figure 9 is a flowchart illustrating an example of the operation procedure when a switch device that generates target packets relays target packets in an in-vehicle communication system according to an embodiment of the present disclosure.

[0141] Referring to Figure 9, first, when the switch device 101A starts up (step S51), the information processing unit 63 generates the target packet (step S52).

[0142] Next, the relay unit 51 transmits the target packet generated by the information processing unit 63 to the switch device 101B via the communication port Ps5 and starts the timer 56's counting operation. This starts the detection process by the detection unit 64, which will be described later (step S53).

[0143] Next, the relay unit 51 waits until it receives an Ethernet frame (NO in step S54). Then, when the relay unit 51 receives an Ethernet frame (YES in step S54), it checks whether the Ethernet frame contains the target packet (step S55).

[0144] Next, if the Ethernet frame contains the target packet (YES in step S55), the relay unit 51 checks whether the Ethernet frame was transmitted from a predetermined specific in-vehicle device (step S56).

[0145] Next, if the Ethernet frame is, for example, an Ethernet frame from the functional unit 111D which is the destination of the target packet immediately preceding the switch device 101A (YES in step S56), the relay unit 51 resets the count value of the timer 56 (step S57).

[0146] Next, the relay unit 51 either resets the timer 56 count value (step S57) or, if it receives an Ethernet frame from an in-vehicle device other than the functional unit 111D (NO in step S56), it refers to the port table Tb1 stored in the storage unit 53 to identify the communication port Ps to which the Ethernet frame will be output. Then, the relay unit 51 transmits the Ethernet frame from the identified communication port Ps (step S58).

[0147] Then, the relay unit 51 waits until it receives another Ethernet frame (step S54).

[0148] On the other hand, if the relay unit 51 receives an Ethernet frame containing packets other than the target packet (NO in step S55), it refers to, for example, the address table Tb2 stored in the storage unit 53 to identify the communication port Ps corresponding to the destination MAC address contained in the Ethernet frame. The relay unit 51 then performs relay processing to transmit the Ethernet frame from the identified communication port Ps (step S59).

[0149] Then, the relay unit 51 waits until it receives another Ethernet frame (step S54).

[0150] In addition, as in the modified example 1 described above, the switch device 101A is configured not to maintain the port table Tb1. In this case, during the relaying of the target packet (step S58), the switch device 101A refers to, for example, the address table Tb2 to identify the communication port Ps corresponding to the destination MAC address contained in the received Ethernet frame. The switch device 101A then transmits the Ethernet frame from the identified communication port Ps.

[0151] (Relay processing by switch device 101B) Figure 10 is a flowchart illustrating an example of the operation procedure when a switch device that does not generate target packets relays target packets in an in-vehicle communication system according to an embodiment of the present disclosure.

[0152] Referring to Figure 10, first, when the switch device 101B starts up (step S61), the relay unit 51 waits until it receives an Ethernet frame ("NO" in step S62). Then, when the relay unit 51 receives an Ethernet frame ("YES" in step S62), it checks whether the Ethernet frame contains the target packet (step S63).

[0153] Next, if the Ethernet frame contains the target packet (YES in step S63), the relay unit 51 checks whether the Ethernet frame was transmitted from a predetermined specific in-vehicle device (step S64).

[0154] Next, let's assume that the Ethernet frame in question is, for example, an Ethernet frame transmitted from switch device 101A, which is the destination of the target packet immediately preceding switch device 101B (YES in step S64). In this case, the relay unit 51 starts the counting operation of timer 56. This starts the detection process by the detection unit 64, which will be described later. Also, if the timer 56 has already started counting operation, the relay unit 51 resets the count value (step S65).

[0155] Next, the relay unit 51 either starts the timer 56's counting operation or resets the count value (step S65), or, if it receives an Ethernet frame from an in-vehicle device other than the switch device 101A (NO in step S64), it refers to the port table Tb1 stored in the storage unit 53 to identify the communication port Ps to which the received Ethernet frame will be output. Then, the relay unit 51 transmits the Ethernet frame from the identified communication port Ps (step S66).

[0156] Then, the relay unit 51 waits until it receives another Ethernet frame (step S62).

[0157] On the other hand, if the relay unit 51 receives an Ethernet frame containing packets other than the target packet (NO in step S63), it refers to the address table Tb2 stored in the storage unit 53, for example, to identify the communication port Ps corresponding to the destination MAC address contained in the Ethernet frame. The relay unit 51 then performs relay processing to transmit the Ethernet frame from the identified communication port Ps (step S67).

[0158] Then, the relay unit 51 waits until it receives another Ethernet frame (step S62).

[0159] Furthermore, as in the modified example 1 described above, let's assume that the switch device 101B does not maintain the port table Tb1. In this case, during the relaying of the target packet (step S66), the switch device 101B refers to, for example, the address table Tb2 to identify the communication port Ps corresponding to the destination MAC address contained in the received Ethernet frame. The switch device 101B then transmits the Ethernet frame from the identified communication port Ps.

[0160] (Circular processing by the target function unit) Figure 11 is a flowchart illustrating an example of the operation procedure when the target function unit performs cyclic processing of target packets in an in-vehicle communication system according to an embodiment of this disclosure. Here, the operation of the function unit 111A, which is the target function unit, will be described. The operation of the other target function units, function units 111B, 111C, and 111D, is the same as the operation of function unit 111A.

[0161] Referring to Figure 11, first, when the functional unit 111A is activated (step S71), the communication unit 81 waits until it receives an Ethernet frame ("NO" in step S72). Then, when the communication unit 81 receives an Ethernet frame ("YES" in step S72), it checks whether the Ethernet frame contains the target packet (step S73).

[0162] Next, if the Ethernet frame contains the target packet (YES in step S73), the communication unit 81 starts the timer 84 counting operation. This starts the detection process by the detection unit 92, which will be described later. Also, if the timer 84 has already started counting, the communication unit 81 resets the count value (step S74).

[0163] Next, the relay unit 51 transmits the received Ethernet frame from the communication port Pe (step S75) and waits until it receives another Ethernet frame (step S72).

[0164] On the other hand, if the relay unit 51 receives an Ethernet frame containing packets other than the target packet (NO in step S73), it extracts the information contained in the packet and performs normal information processing using the extracted information (step S76). Then, the relay unit 51 waits until it receives another Ethernet frame (step S72).

[0165] Furthermore, as in the modified example 1 described above, the functional unit 111A pre-stores destination information for other target functional units that will be the destination of the target packet. In this case, when transmitting the target packet (step S75), the functional unit 111A, for example, refers to the stored destination information and rewrites the destination of the received Ethernet frame to the MAC address indicated by the said destination information before transmitting it.

[0166] [Procedure for performing detection and reprocessing] (Detection processing by switch devices 101A and 101B) Figure 12 is a flowchart illustrating an example of the operation procedure when a switch device in an in-vehicle communication system according to an embodiment of the present disclosure performs detection processing.

[0167] Referring to Figure 12, first, the detection unit 64 measures the patrol time of the target packet by checking the count value of the timer 56, and monitors whether the count value exceeds a threshold (step S81).

[0168] Then, if the detection unit 64 is reset before the count value exceeds the threshold (NO in step S81), it monitors the count value again after the reset (step S81).

[0169] On the other hand, if the count value exceeds a threshold (YES in step S81), the detection unit 64 determines that an abnormality has occurred in one or more specific in-vehicle devices in the specific in-vehicle device group GP, and that autonomous driving of vehicle 1 is difficult, and outputs judgment information indicating the judgment result to the notification unit 55 (step S82).

[0170] When the notification unit 55 receives judgment information from the detection unit 64, it notifies the user of the content indicated by the judgment information and stores the judgment information in the storage unit 53, associating it with the current time, etc. The notification unit 55 also notifies the content of the judgment information to other specific in-vehicle devices in the specific in-vehicle device group GP, namely the function units 111A, 111B, 111C, and 111D (step S83).

[0171] (Detection processing by the target function unit) Figure 13 is a flowchart illustrating an example of the operation procedure when the target function unit performs detection processing in an in-vehicle communication system according to an embodiment of this disclosure. Here, the operation of the function unit 111A, which is the target function unit, will be described. The operation of the other target function units, function units 111B, 111C, and 111D, is the same as the operation of function unit 111A.

[0172] Referring to Figure 13, first, the detection unit 92 measures the patrol time of the target packet by checking the count value of the timer 84, and monitors whether the count value exceeds a threshold (step S91).

[0173] Then, if the detection unit 92 is reset before the count value exceeds the threshold (NO in step S91), it monitors the count value again after the reset (step S91).

[0174] On the other hand, if the count value exceeds a threshold (YES in step S91), the detection unit 92 determines that an abnormality has occurred in one or more specific in-vehicle devices in the specific in-vehicle device group GP, and that autonomous driving of vehicle 1 is difficult. It then outputs judgment information indicating the judgment result to the information processing unit 91 (step S92).

[0175] Then, when the information processing unit 91 receives the judgment information from the detection unit 92, it changes, for example, the processing other than the detection processing performed by the functional unit 111A to a less demanding process or stops the processing (step S93).

[0176] [Difference 3] The in-vehicle communication system 301 may be configured to accommodate the addition of new specific in-vehicle devices to the in-vehicle network. Figure 14 shows an example of a sequence of threshold update processing due to the addition of a specific in-vehicle device in Modification 3 of the in-vehicle communication system according to the embodiment of this disclosure.

[0177] As described above, in the detection process, the first in-vehicle device in the specific in-vehicle device group GP determines that an abnormality has occurred if the elapsed time since the transmission of the target packet exceeds a predetermined threshold, i.e., the circulating time threshold, but the circulating of the target packet cannot be confirmed, that is, if the target packet does not complete a full circuit of the specific in-vehicle device group GP and return. The first in-vehicle device may be configured to perform an update process to update the threshold when a new specific in-vehicle device is added to the specific in-vehicle device group GP.

[0178] For example, if there are other first in-vehicle devices performing detection processing in the specific in-vehicle device group GP, the first in-vehicle device that performs update processing will notify the other first in-vehicle device of the updated threshold. The other first in-vehicle device will then perform detection processing using the notified updated threshold.

[0179] For more details, refer to Figure 14. First, the functional unit 111N is added to the vehicle 1 network (step S101), and the functional unit 111N sends a connection request to the switch device 101A (step S102).

[0180] Next, the switch device 101A receives a connection request, detects the functional unit 111N, and determines, for example, that the functional unit 111N is the target functional unit based on the ID included in the connection request (step S103).

[0181] Next, the switch device 101A updates the patrol time threshold. More specifically, the detection unit 64 in the switch device 101A changes the threshold in its own storage unit 53 based on, for example, a correction value included in the connection request from the function unit 111N. For example, a correction value that takes into account the data propagation delay time between in-vehicle devices and the data processing time in the function unit 111N is stored in advance in the storage unit 83 of the function unit 111N (step S104).

[0182] Next, the switch device 101A sends an update request indicating the updated threshold to the function units 111A, 111B, 111N and the switch device 101B (steps S105 to S107).

[0183] Next, the switch device 101B transmits the update request received from the switch device 101A to the functional units 111C and 111D (step S108).

[0184] Next, the switch device 101B updates the threshold value in its own memory unit 53 to the threshold value indicated in the received update request (step S109). Also, the functional units 111A, 111B, 111C, 111D, and 111N update the threshold value in their own memory unit 83 to the threshold value indicated in the received update request (steps S110 to S112).

[0185] The specific in-vehicle device group GP may have the following configuration: The first in-vehicle device that performs update processing notifies the other first in-vehicle device that performs detection processing in the specific in-vehicle device group GP of the threshold correction value. The other first in-vehicle device updates the threshold based on the notified correction value and performs detection processing using the updated threshold.

[0186] More specifically, in the sequence shown in Figure 14, the switch device 101A sends an update request indicating the above correction value to the functional units 111A, 111B, 111N and the switch device 101B (steps S105 to S107).

[0187] Next, the switch device 101B transmits the update request received from the switch device 101A to the functional units 111C and 111D (step S108).

[0188] Next, the switch device 101B updates the threshold value in its own memory unit 53 based on the correction value indicated by the received update request (step S109). Also, the functional units 111A, 111B, 111C, 111D, and 111N update the threshold value in their own memory unit 83 based on the correction value indicated by the received update request (steps S110 to S112).

[0189] Furthermore, the configuration is not limited to one in which correction values ​​are included in the connection request from the additional function unit 111N, but may also be one in which correction values ​​corresponding to the additional function unit are pre-stored in the storage unit 53. In addition, the storage unit 53 may be configured to store separate correction values ​​for the switch device and the target function unit, or correction values ​​for each type of target function unit, or it may be configured to store a common correction value for various target function units. In addition, the correction values ​​may be registered or updated by an operator using a maintenance tool or the like.

[0190] Furthermore, as described above, if one or more first in-vehicle devices that are part of the specific in-vehicle device group GP perform detection processing, the switch device 101A may be configured to selectively send an update request to the first in-vehicle device that performs the detection processing.

[0191] Furthermore, in the case of the modified configuration 2 shown in Figure 7, in which the in-vehicle communication system 301 does not have a switch device 101, some or all of the target functional units detect the functional unit 111N, which is the target functional unit, and perform threshold updates and transmit update requests as shown in Figure 14.

[0192] Each process (each function) of the above-described embodiment is implemented by a processing circuit (Circuitry) including one or more processors. The processing circuit may consist of one or more memories, various analog circuits, various digital circuits, etc., in addition to the one or more processors, as well as an integrated circuit. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the above processes. The one or more processors may execute each of the above processes according to the programs read from the one or more memories, or they may execute each of the above processes according to logic circuits that have been pre-designed to execute each of the above processes. The processors may be various processors suitable for computer control, such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), DSP (Digital Signal Processor), FPGA (Field Programmable Gate Array), and ASIC (Application Specific Integrated Circuit). Furthermore, the physically separated multiple processors may cooperate with each other to execute each of the above processes. For example, the processors installed in each of several physically separate computers may cooperate with each other via a network such as a LAN (Local Area Network), WAN (Wide Area Network), and the Internet to perform the above-mentioned processes.

[0193] As described above, the in-vehicle communication system 301, switch device 101, and anomaly detection method according to the embodiments of this disclosure can detect anomalies in the in-vehicle device of the in-vehicle communication system 301 more reliably using a simpler method, through the above configuration and method.

[0194] The embodiments described above should be considered in all respects to be illustrative and not restrictive. The scope of the present invention is indicated by the claims rather than the above description, and all modifications within the meaning and scope of the claims are intended to be included. [Explanation of Symbols]

[0195] 1 vehicle 10 Ethernet cables 11 CAN bus 51 Relay section 52,82 Processing Unit 53,83 Storage part 55 Notification Department 56,84 timers 63,91 Information Processing Department 64,92 Detection unit 81 Communications Department 101, 101A, 101B Switching device (Specific in-vehicle device) 111 Functional Section 111A~111D, 111J~111L, 111N Functional Units (Target Functional Units, Specific In-Vehicle Devices) 111E~111H,111M Functional Unit (Non-Suitable Functional Unit) 301 In-vehicle communication system GP specific in-vehicle equipment group Pe, Ps, Ps1~Ps5 communication ports Tb1 Port Table Tb2 Address Table X1, X2 arrows

Claims

1. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The specified group of in-vehicle devices includes a plurality of the first in-vehicle devices, and at least one of the plurality of the first in-vehicle devices is a switch device that relays packets between the plurality of in-vehicle devices. An in-vehicle communication system in which, if one or more of the first in-vehicle devices other than the switch device in the specified group of in-vehicle devices detect an abnormality in the detection process, changes or stops any processing other than the detection process performed by its own first in-vehicle device to a low-load process.

2. The in-vehicle communication system according to claim 1, wherein all of the specified in-vehicle devices in the specified group of in-vehicle devices are the first in-vehicle devices.

3. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned specific in-vehicle device group includes a switch device that relays packets between multiple in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device. The in-vehicle communication system includes a switch device that holds rule information indicating the routing rules for the target packets, and transmits the target packets received from the second in-vehicle device to the third in-vehicle device based on the rule information.

4. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned specific in-vehicle device group includes a switch device that relays packets between multiple in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device. The second in-vehicle device is an in-vehicle communication system that rewrites the destination address of the target packet received from the switch device to the address of the third in-vehicle device and transmits it to the switch device.

5. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The first in-vehicle device, in the detection process, determines that an abnormality has occurred if it cannot confirm the circulation of the target packet even if the elapsed time since the transmission of the target packet exceeds a predetermined threshold, The first in-vehicle device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The first in-vehicle device that performs the update process notifies the other first in-vehicle devices in the specific group of in-vehicle devices of the updated threshold value. The other first in-vehicle device is an in-vehicle communication system that performs the detection process using the notified updated threshold.

6. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The first in-vehicle device, in the detection process, determines that an abnormality has occurred if it cannot confirm the circulation of the target packet even if the elapsed time since the transmission of the target packet exceeds a predetermined threshold, The first in-vehicle device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The first in-vehicle device that performs the update processing notifies the other first in-vehicle devices in the specific group of in-vehicle devices of the correction value of the threshold, The other first in-vehicle device is an in-vehicle communication system that updates the threshold based on the notified correction value and performs the detection process using the updated threshold.

7. An in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect abnormalities in the specified in-vehicle devices other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned group of specific in-vehicle devices is an in-vehicle communication system that includes three or more of the aforementioned specific in-vehicle devices that are essential for the vehicle to perform autonomous driving.

8. In an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, the switch device is: A relay unit that relays packets between the aforementioned in-vehicle devices, The system includes a detection unit that detects abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating through the specific in-vehicle device group, which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, The aforementioned specific in-vehicle device group includes the switch device, the second in-vehicle device, and the third in-vehicle device as the aforementioned specific in-vehicle device. The switch device holds rule information indicating the routing rules for the target packets, and transmits the target packets received from the second in-vehicle device to the third in-vehicle device based on the rule information.

9. In an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, the switch device is: A relay unit that relays packets between the aforementioned in-vehicle devices, The system includes a detection unit that performs detection processing to detect abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating through the specific in-vehicle device group, which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The switch device performs an update process to update the predetermined threshold when a new specific vehicle device is added to the specific vehicle device group. The switch device that performs the update processing is a switch device that notifies other specific in-vehicle devices in the specific in-vehicle device group of the updated threshold value.

10. In an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, the switch device is: A relay unit that relays packets between the aforementioned in-vehicle devices, The system includes a detection unit that performs detection processing to detect abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating through the specific in-vehicle device group, which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The switch device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The switch device that performs the update processing is a switch device that notifies other specific in-vehicle devices in the specific in-vehicle device group of the correction value of the threshold.

11. In an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices including a switch device, the switch device is: A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The aforementioned group of specific in-vehicle devices includes the aforementioned switch device, A relay unit that relays packets between the aforementioned in-vehicle devices, The system includes a detection unit that detects abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group based on the reception status of the target packet in the switch device, The group of specified in-vehicle devices includes the switch device and three or more of the specified in-vehicle devices that are essential for the vehicle to perform autonomous driving.

12. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The specified group of in-vehicle devices includes a plurality of the first in-vehicle devices, and at least one of the plurality of the first in-vehicle devices is a switch device that relays packets between the plurality of in-vehicle devices. The aforementioned anomaly detection method further includes, An abnormality detection method comprising the step of changing or stopping any processing other than the detection processing performed by one or more of the first in-vehicle devices other than the switch device in the specified group of in-vehicle devices when the first in-vehicle device detects an abnormality in the detection processing.

13. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned specific in-vehicle device group includes a switch device that relays packets between multiple in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device. The switch device holds rule information indicating the routing rules for the target packets, An anomaly detection method comprising the step of circulating the target packets, wherein the switch device transmits the target packets received from the second in-vehicle device to the third in-vehicle device based on the rule information.

14. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned specific in-vehicle device group includes a switch device that relays packets between multiple in-vehicle devices, a second in-vehicle device, and a third in-vehicle device as the specified in-vehicle device. An anomaly detection method in which, in the step of circulating the target packet, the second in-vehicle device rewrites the destination address of the target packet received from the switch device to the address of the third in-vehicle device and transmits it to the switch device.

15. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The first in-vehicle device, in the detection process, determines that an abnormality has occurred if it cannot confirm the circulation of the target packet even if the elapsed time since the transmission of the target packet exceeds a predetermined threshold, The aforementioned anomaly detection method further includes, The first in-vehicle device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The first in-vehicle device performing the update process notifies other first in-vehicle devices in the specific group of in-vehicle devices of the updated threshold value. An anomaly detection method comprising the step of the other first in-vehicle device performing the detection process using the notified updated threshold.

16. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The first in-vehicle device, in the detection process, determines that an abnormality has occurred if it cannot confirm the circulation of the target packet even if the elapsed time since the transmission of the target packet exceeds a predetermined threshold, The aforementioned anomaly detection method further includes, The first in-vehicle device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The first in-vehicle device performing the update processing notifies other first in-vehicle devices in the specific group of in-vehicle devices of the correction value of the threshold; An anomaly detection method comprising the steps of the other first in-vehicle device updating the threshold based on the notified correction value and performing the detection process using the updated threshold.

17. An anomaly detection method in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, A group of specific in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices, circulates specific target packets. The first in-vehicle device, which is the specified in-vehicle device, performs a detection process to detect an abnormality in a specified in-vehicle device other than its own first in-vehicle device within the group of specified in-vehicle devices, based on the reception status of the target packet. The aforementioned group of specific in-vehicle devices includes three or more such specific in-vehicle devices that are essential for the vehicle to perform autonomous driving, and is an abnormality detection method.

18. An abnormality detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, The steps include relaying packets between the in-vehicle devices, The step includes detecting an abnormality in a specific in-vehicle device other than the switch device in the specific in-vehicle device group, based on the reception status of a specific target packet circulating through the specific in-vehicle device group, which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices that are in-vehicle devices, The aforementioned specific in-vehicle device group includes the switch device, the second in-vehicle device, and the third in-vehicle device as the aforementioned specific in-vehicle device. The switch device holds rule information indicating the routing rules for the target packets, The aforementioned anomaly detection method further includes, An anomaly detection method comprising the step of transmitting the target packet received from the second in-vehicle device to the third in-vehicle device based on the rule information.

19. An abnormality detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, The steps include relaying packets between the in-vehicle devices, The process includes the step of performing a detection operation to detect an abnormality in a specific in-vehicle device other than the switch device in the specific in-vehicle device group, based on the reception status of a specific target packet circulating through the specific in-vehicle device group, which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices that are in-vehicle devices, In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The aforementioned anomaly detection method further includes, When a new specified in-vehicle device is added to the specified in-vehicle device group, the update process is performed to update the predetermined threshold. An anomaly detection method comprising the step of notifying other specific in-vehicle devices in the specific in-vehicle device group of the updated threshold.

20. An abnormality detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, The steps include relaying packets between the in-vehicle devices, The process includes the step of performing a detection operation to detect an abnormality in a specific in-vehicle device other than the switch device in the specific in-vehicle device group, based on the reception status of a specific target packet circulating through the specific in-vehicle device group, which is part of the group of in-vehicle devices and includes three or more specific in-vehicle devices that are in-vehicle devices, In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The aforementioned anomaly detection method further includes, When a new specified in-vehicle device is added to the specified in-vehicle device group, the update process is performed to update the predetermined threshold. An anomaly detection method comprising the step of notifying other specific in-vehicle devices in the specific in-vehicle device group of the correction value of the threshold.

21. An abnormality detection method in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The aforementioned group of specific in-vehicle devices includes the aforementioned switch device, The steps include relaying packets between the in-vehicle devices, The step includes detecting an abnormality in a specific in-vehicle device other than the switch device in the specific in-vehicle device group based on the reception status of the target packet in the switch device, The aforementioned group of specific in-vehicle devices includes the switch device and three or more of the aforementioned specific in-vehicle devices that are essential for the vehicle to perform autonomous driving, and is used as an abnormality detection method.

22. An anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, Computers, A relay unit that relays packets between the aforementioned in-vehicle devices, A detection unit that detects abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating in a specific in-vehicle device group which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, It is a program designed to function as such. The aforementioned specific in-vehicle device group includes the switch device, the second in-vehicle device, and the third in-vehicle device as the aforementioned specific in-vehicle device. The switch device holds rule information indicating the circulating rules for the target packets, and transmits the target packets received from the second in-vehicle device to the third in-vehicle device based on the rule information; this is an anomaly detection program.

23. An anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, Computers, A relay unit that relays packets between the aforementioned in-vehicle devices, A detection unit that performs detection processing to detect abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating in a specific in-vehicle device group which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, It is a program designed to function as such. In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The switch device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The switch device performing the update process is an anomaly detection program that notifies other specific in-vehicle devices in the specific in-vehicle device group of the updated threshold value.

24. An anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, Computers, A relay unit that relays packets between the aforementioned in-vehicle devices, A detection unit that performs detection processing to detect abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group, based on the reception status of specific target packets circulating in a specific in-vehicle device group which is part of the aforementioned in-vehicle device group and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, It is a program designed to function as such. In the detection process, if the time elapsed since the transmission of the target packet exceeds a predetermined threshold, but the circuit of the target packet cannot be confirmed, the switch device determines that an abnormality has occurred. The switch device performs an update process to update the predetermined threshold when a new specific in-vehicle device is added to the specific in-vehicle device group. The switch device performing the update processing includes an anomaly detection program that notifies other specific in-vehicle devices in the specific in-vehicle device group of the correction value of the threshold.

25. An anomaly detection program used in a switch device in an in-vehicle communication system comprising a group of in-vehicle devices including four or more in-vehicle devices, including a switch device, A specific group of in-vehicle devices, which is part of the aforementioned group of in-vehicle devices and includes three or more specific in-vehicle devices that are the aforementioned in-vehicle devices, circulates specific target packets. The aforementioned group of specific in-vehicle devices includes the aforementioned switch device, Computers, A relay unit that relays packets between the aforementioned in-vehicle devices, A detection unit detects abnormalities in specific in-vehicle devices other than the switch device in the specific in-vehicle device group based on the reception status of the target packet in the switch device. It is a program designed to function as such. The aforementioned group of specific in-vehicle devices includes the switch device and an anomaly detection program that includes three or more of the aforementioned specific in-vehicle devices essential for the vehicle to perform autonomous driving.

Images