On-board device, program, and information processing method

Abstract

This on-board device is communicably connected to each of a plurality of on-board ECUs mounted on a car, and comprises: a relay unit including communication ports to which the respective on-board ECUs are connected; a power distribution unit that includes power supply ports to which the respective on-board ECUs are connected, and distributes power supplied from a power supply device mounted on the car to each of the on-board ECUs; and a control unit that performs a process related to the relay unit and the power distribution unit. In accordance with supply states of power from the power supply device to the power supply ports, the control unit identifies the communication ports having connected thereto the on-board ECUs to which the power supply ports are connected.

Description

In-vehicle device, program, and information processing method

[0001] This application claims priority to Japanese Patent Application No. 2024-098244, filed on June 18, 2024, and incorporates by reference all of the contents of said Japanese application.

[0002] A vehicle is equipped with a power supply control device (see, for example, Patent Document 1) that controls power supply from a battery to a load. In the power supply control device described in Patent Document 1, a downstream semiconductor fuse is provided in a current path of a current flowing from the battery to the load, and the power supply from the battery to the load is controlled by switching the downstream semiconductor fuse on or off.

[0003] The downstream semiconductor fuse has a control end. For example, if the downstream semiconductor fuse is a field effect transistor (FET), the control end is a gate. The resistance value across the downstream semiconductor fuse varies depending on the voltage at the control end. By adjusting the voltage at the control end, the resistance value across the downstream semiconductor fuse is adjusted to a sufficiently small value, and the downstream semiconductor fuse is switched on. By adjusting the voltage at the control end, the resistance value across the downstream semiconductor fuse is adjusted to a sufficiently large value, and the downstream semiconductor fuse is switched off.

[0004] JP 2013-143905 A

[0005] An in-vehicle device according to one embodiment of the present disclosure is an in-vehicle device that is communicatively connected to each of a plurality of in-vehicle ECUs mounted on a vehicle, and includes a relay unit including a communication port to which each of the in-vehicle ECUs is connected, a power distribution unit including a power supply port to which each of the in-vehicle ECUs is connected and that distributes power supplied from a power supply device mounted on the vehicle to each of the in-vehicle ECUs, and a control unit that performs processing related to the relay unit and the power distribution unit, and the control unit identifies the communication port to which the in-vehicle ECU connected to the power supply port is connected depending on the state of power supply from the power supply device to the power supply port.

[0006] FIG. 1 is a schematic diagram illustrating the configuration of an in-vehicle system including an in-vehicle device according to a first embodiment; FIG. 2 is a block diagram illustrating the internal configuration of an in-vehicle device; FIG. 3 is a flowchart illustrating the processing (sequentially turned off) of a control unit of an in-vehicle device; FIG. 4 is an explanatory diagram showing a connection status table; FIG. 5 is a flowchart illustrating the processing (sequentially turned on) of a control unit of an in-vehicle device according to a second embodiment; and FIG. 6 is a flowchart illustrating the processing (abnormality determination) of a control unit of an in-vehicle device according to a third embodiment.

[0007] [Problem to be Solved by the Present Disclosure] The power supply control device described in Patent Document 1 does not take into consideration the identification of the communication port of the in-vehicle ECU connected to the power supply control device.

[0008] The present disclosure has been made in consideration of the above circumstances, and aims to provide an in-vehicle device or the like that can identify a communication port connected to an in-vehicle ECU to which a power supply port is connected.

[0009] Effect of the Present Disclosure According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that identifies a communication port connected to an in-vehicle ECU to which a power supply port is connected.

[0010] [Description of Embodiments of the Present Disclosure] First, embodiments of the present disclosure will be listed and described. In addition, at least some of the embodiments described below may be combined in any desired manner.

[0011] (1) An in-vehicle device according to one aspect of the present disclosure is an in-vehicle device that is communicatively connected to each of a plurality of in-vehicle ECUs mounted on a vehicle, and includes: a relay unit including a communication port to which each of the in-vehicle ECUs is connected; a power distribution unit including a power supply port to which each of the in-vehicle ECUs is connected and that distributes power supplied from a power supply device mounted on the vehicle to each of the in-vehicle ECUs; and a control unit that performs processing related to the relay unit and the power distribution unit, and the control unit identifies the communication port to which the in-vehicle ECU connected to the power supply port is connected depending on the supply status of power from the power supply device to the power supply port.

[0012] In this aspect, a vehicle is equipped with multiple on-board ECUs, a power supply device, and on-board devices. The multiple on-board ECUs and the on-board devices are communicatively connected via an on-board network configured with communication lines such as a CAN bus or Ethernet (registered trademark). Furthermore, the on-board devices are connected to a power line extending from the power supply device, and the power line branches into multiple branches, distributing power supplied from the power supply device to each of the on-board ECUs connected to the power line. In this manner, the on-board devices function as a relay device that relays communication data transmitted and received between the multiple on-board ECUs, and also function as a power distribution device that distributes power from the power supply device to each of the multiple on-board ECUs. Therefore, by integrating the functions of a relay device and a power distribution device into a single on-board device, costs and product weight can be reduced by reducing the number of devices installed in the vehicle, and flexibility in the placement of the devices can be improved. The on-board ECUs connected to the on-board devices are connected by communication lines via communication ports and by power lines (branched power lines) via power ports. The in-vehicle device includes a relay unit having multiple communication ports (CAN transceivers, Ethernet PHY units) compatible with, for example, CAN or Ethernet, and a power distribution unit having multiple power ports. The control unit of the in-vehicle device performs processes related to the relay unit, such as communication processing with the relay unit, relay processing at a layer higher than the relay unit, and verification processing of communication data transferred from the relay unit, and also controls power distribution processing using the power distribution unit, i.e., power supply processing for each in-vehicle ECU. In this case, the control unit identifies the communication port connected to the in-vehicle ECU to which any of the power ports included in the power distribution unit is connected, depending on the power supply status from the power supply device to that power port, and can therefore identify the power port and communication port connected to the same in-vehicle ECU. Therefore, for example, when a new in-vehicle ECU is added to a vehicle at an authorized dealer or during the vehicle manufacturing stage, the correspondence or association between the power port and the communication port to which the added in-vehicle ECU is connected can be efficiently or automatically identified, thereby improving work efficiency when adding in-vehicle ECUs, etc.In other words, when an on-board ECU is added to a vehicle by connecting it to an on-board device, it is not necessary for the worker performing the addition work to explicitly set the correspondence between the power port and the communication port.

[0013] (2) In one aspect of the in-vehicle device of the present disclosure, the power distribution unit includes opening / closing units connected to the respective power supply ports, and the control unit controls the supply of power to the in-vehicle ECU connected to the power supply port of the opening / closing unit by controlling the opening and closing of the opening / closing units.

[0014] In this aspect, the power distribution unit includes switching units connected to the respective power supply ports, each of which is configured as, for example, a mechanical relay or a semiconductor relay such as a field effect transistor (FET). The control unit controls the opening and closing (on / off) of each switching unit (relay) to control the supply or cut-off of power to an on-board ECU connected to the power supply port to which the switching unit is connected in series. A fuse corresponding to the rated value of the power line connected to the power supply port or the power consumption characteristic of the on-board ECU may be interposed between the series-connected switching units and the power supply port. The control unit may open (off) the switching unit depending on the current value flowing through the switching unit, for example, when an overcurrent exceeding a predetermined threshold flows for a predetermined period of time, thereby causing the switching unit to function as a semiconductor fuse. By controlling the opening and closing of the switching unit, the control unit controls the start or stop of power supply to the on-board ECU connected to the power supply port connected to the switching unit, thereby efficiently transitioning or changing the state of power supply from the power supply device to the power supply port. In other words, the control unit closes (turns on) the opening / closing unit to supply power from the power supply device to the power port, and opens (turns off) the opening / closing unit to cut off power from the power supply device to the power port.Therefore, based on the open / closed state of the opening / closing unit, the control unit can grasp (derive) the power supply state from the power supply device to the power port.

[0015] (3) In an in-vehicle device according to one aspect of the present disclosure, the control unit sequentially turns on or off each of the opening / closing units included in the power distribution unit to change the state of power supply from the power supply unit to the power port, and identifies the communication port to which the in-vehicle ECU connected to the power port is connected based on the communication state with the in-vehicle ECU in response to the change in the state of power supply.

[0016] In this aspect, communication data is periodically or steadily output (transmitted) from each of the on-board ECUs connected to the on-board device to the on-board device. Alternatively, the on-board device may periodically or steadily output (transmit) polling messages to each of the connected on-board ECUs and confirm communication with the on-board ECUs by receiving reply messages from the on-board ECUs in response to the polling messages. The control unit changes the state of power supply from the power supply device to the power port by sequentially turning on (closed) or off (open) each of the opening / closing units included in the power distribution unit. In this case, the control unit may first turn on (closed) all of the opening / closing units included in the power distribution unit, and then sequentially turn off (open) each of the opening / closing units one by one. The control unit may turn off (open) any of the opening / closing units to identify a communication port from which communication data is no longer being received (a communication port that has become unable to communicate), and associate or link the identified communication port with the power port connected to the opening / closing unit that has been turned off (open), and store the association information in a memory unit of the on-board device. Alternatively, the control unit may first turn off (open) all of the opening / closing units included in the power distribution unit, and then sequentially turn on (close) the opening / closing units one by one. The control unit may identify a communication port from which communication data can be received (a communication port that has become capable of communication) by turning on (closing) any of the opening / closing units, and then associate or link the identified communication port with the power supply port connected to the opening / closing unit that has been turned on (closed), and store the association in a memory unit of the in-vehicle device. In this way, the control unit identifies a communication port to which an in-vehicle ECU connected to any of the power supply ports is connected based on the communication state with the in-vehicle ECU in response to changes in the power supply state, thereby efficiently performing the process of identifying the communication port.

[0017] (4) In an in-vehicle device according to one aspect of the present disclosure, the control unit identifies, among the power ports included in the power distribution unit, power ports that are in an unused state and to which the in-vehicle ECU is not connected, and sequentially turns on or off each of the opening / closing units connected to each of the unused power ports, thereby changing the state of power supply from the power supply device to the unused power ports.

[0018] In this aspect, the control unit identifies an available power port among the power ports included in the power distribution unit that is not connected to an on-board ECU. Information about available power ports may be stored in a memory unit of the on-board device, and the control unit may identify the available power port by referencing the memory unit. The control unit sequentially turns on (closed) or off (open) each of the open / close units connected to each available power port to change the power supply state from the power device to each of these available power ports. The control unit then identifies a communication port whose communication state has changed in response to the change in the power supply state of each available power port. In this way, when a new on-board ECU is added to the vehicle, the control unit identifies a power port that was recognized as available immediately before the addition and performs an open / close operation on only the open / close unit for that power port (the power port recognized as available). Therefore, when a new vehicle ECU is added to a vehicle, the opening and closing operation of the opening / closing section to identify the communication port is not performed for the power port to which the vehicle ECU is already connected (the power port in a connected state), so the process of linking the communication port of the newly added vehicle ECU with the power port can be performed without affecting the operating state of the already connected vehicle ECU.

[0019] (5) In one aspect of the in-vehicle device of the present disclosure, connection status information regarding the connection status of the in-vehicle ECU to each of the power supply ports in the power distribution unit is stored in a memory area accessible to the control unit, and the control unit identifies the available power supply port to which the in-vehicle ECU is not connected by referring to the connection status information.

[0020] In this aspect, connection status information regarding the connection status of each onboard ECU to each power port in the power distribution unit is stored, for example, in a table format (connection status table) in a storage area accessible to the control unit, such as a storage unit of the onboard device. The connection status table stores communication ports and power ports that are linked to each other because they are connected to the same onboard ECU. In this case, the communication ports and power ports may be managed by identifiers that uniquely identify each communication port and power port, such as device numbers or port numbers. The connection status table may store combinations of identifiers for each of the linked and corresponding communication ports and power ports. In the connection status information (connection status table), no communication ports are linked to power ports that are recognized as not connected to an onboard ECU (unavailable power ports). Therefore, the control unit can identify unavailable power ports to which no onboard ECU is connected by referring to the connection status table.

[0021] (6) In an in-vehicle device according to one aspect of the present disclosure, the control unit associates the communication port identified based on the communication status with the in-vehicle ECU with the power supply port, and updates the connection status information.

[0022] In this aspect, the control unit changes the state of communication with the vehicle ECU by changing the state of power supply from the power supply device to the power port, thereby identifying the communication port. Then, when the control unit associates the identified communication port with the power port, it updates the connection status information (connection status table) by adding information related to the association. This allows the connection status information (connection status table) to be updated to the latest state upon the addition of a new vehicle ECU, thereby maintaining or ensuring the freshness of the information in the connection status information (connection status table). Therefore, even if another vehicle ECU is subsequently added, the connection status information (connection status table) kept up to date can be used to efficiently identify power ports that are recognized as not having a vehicle ECU connected (unused power ports) at the time of the new addition.

[0023] (7) In an in-vehicle device according to one aspect of the present disclosure, when the control unit detects that the in-vehicle ECU is connected to one of the communication ports provided in the relay unit, the control unit changes the state of power supply from the power supply device to the available power port, thereby changing the state of power supply from the power supply device to the available power port.

[0024] In this aspect, the relay unit having multiple communication ports functions as, for example, a CAN gateway or a Layer 2 Ethernet switch. When an onboard ECU is connected to the communication port via a communication line, the relay unit detects voltage fluctuations, such as carrier sense, and notifies the control unit that the onboard ECU is connected to a specific communication port in response to the detection. The notification from the relay unit may include an identifier, such as a device number or port number, that uniquely identifies the communication port to which the onboard ECU is detected to be connected. When the control unit acquires (receives) the notification from the relay unit, it detects that the onboard ECU has been connected to the communication port and identifies the identifier of the communication port (the communication port to which the onboard ECU is connected). The control unit, triggered by receiving the notification from the relay unit, performs a process of linking the communication port with the power supply port, such as changing the power supply state from the power supply device to the power port by changing the power supply state from the power supply device to the power port. In this way, the control unit starts the process of linking the communication port and the power port in conjunction with the addition of a new in-vehicle ECU, thereby reducing the amount of work required by the worker performing the addition work, and allowing the current connection status between the in-vehicle device and the in-vehicle ECU to be reflected in the connection status information (connection status table) in a timely manner.

[0025] (8) In an in-vehicle device according to one aspect of the present disclosure, the number of the power supply ports included in the power distribution unit is equal to or greater than the number of the communication ports included in the relay unit.

[0026] In this aspect, the in-vehicle device is connected to an in-vehicle ECU, which is connected to both the communication port and the power port, and to in-vehicle devices, such as actuators, which are connected only to the power port and whose operation is controlled by the in-vehicle device. The in-vehicle devices may be, for example, actuators for interior lamps, door mirrors, or seat drive devices, or various sensor devices such as LiDAR or cameras. The in-vehicle device controls the operation of these in-vehicle devices, such as driving or stopping, based on communication data received via the in-vehicle network or signals from sensors connected to the in-vehicle device (its own device). Even if there are in-vehicle devices connected only to the power port of the in-vehicle device, the number of power ports is equal to or greater than the number of communication ports, so that power ports corresponding to the communication ports can be secured, preventing the depletion of power ports.

[0027] (9) In an in-vehicle device according to one aspect of the present disclosure, the control unit determines whether the in-vehicle ECU is abnormal based on communication data transmitted from each of the in-vehicle ECUs connected to the respective communication ports. If the in-vehicle ECU is determined to be abnormal, the control unit identifies the communication port to which the in-vehicle ECU determined to be abnormal is connected, and, based on the identified communication port, identifies the power supply port to which the in-vehicle ECU determined to be abnormal is connected by referring to the connection status information. The control unit stops power supply to the in-vehicle ECU determined to be abnormal by turning off the opening / closing unit connected to the identified power supply port.

[0028] In this aspect, the control unit of the in-vehicle device may function as an intrusion detection system (IDS) that determines whether communication data acquired (received) via each communication port is unauthorized data, thereby detecting intrusions into the in-vehicle network by unauthorized programs or devices. Alternatively, communication data transmitted and received over the in-vehicle network may be assigned a message authentication code (MAC) or a digital signature indicating the legitimacy of the sender, and the control unit of the in-vehicle device may verify the MAC or other code assigned to the communication data acquired via the communication port to determine whether an abnormality exists in the in-vehicle ECU connected to the communication port. If the control unit of the in-vehicle device determines that the communication data acquired via the communication port is unauthorized and therefore determines that the in-vehicle ECU connected to the communication port is abnormal, the control unit of the in-vehicle device identifies the power port to which the abnormal in-vehicle ECU is connected. That is, the control unit of the in-vehicle device identifies the communication port to which the abnormal in-vehicle ECU is connected, and identifies the power port linked to the identified communication port by, for example, referring to connection status information (a connection status table) stored in a memory unit. The control unit stops power supply to the vehicle ECU determined to be abnormal by turning off (opening) the open / close unit connected to the identified power port, thereby preventing unauthorized communication data from being transmitted to the vehicle network from the vehicle ECU. When the control unit stops power supply to the vehicle ECU determined to be abnormal by turning off (opening) the open / close unit in this manner, the control unit may add a flag or the like to the connection status information (connection status table) indicating that the open / close unit of the power port connected to the vehicle ECU determined to be abnormal has been turned off (opened).

[0029] (10) An information processing method according to one aspect of the present disclosure includes a computer that performs processing related to a relay unit that is communicatively connected to each of a plurality of on-board ECUs mounted on a vehicle and includes a communication port to which each of the on-board ECUs is connected, and a power distribution unit that includes a power supply port to which each of the on-board ECUs is connected and distributes power supplied from a power supply device mounted on the vehicle to each of the on-board ECUs, and identifies the communication port to which the on-board ECU connected to the power supply port is connected depending on the power supply status from the power supply device to the power supply port.

[0030] In this aspect, it is possible to provide an information processing method that causes a computer to function as an on-board device that identifies a communication port connected to an on-board ECU to which a power port is connected.

[0031] (11) A program according to one aspect of the present disclosure includes a computer that performs processing related to a relay unit that is communicatively connected to each of a plurality of onboard ECUs mounted on a vehicle and includes a communication port to which each of the onboard ECUs is connected, and a power distribution unit that includes a power supply port to which each of the onboard ECUs is connected and distributes power supplied from a power supply device mounted on the vehicle to each of the onboard ECUs.The program identifies the communication port to which the onboard ECU connected to the power supply port is connected, depending on the power supply status from the power supply device to the power supply port.

[0032] In this aspect, it is possible to provide a program that causes a computer to function as an on-board device that identifies a communication port connected to an on-board ECU to which a power supply port is connected.

[0033] [Details of the embodiment of the present disclosure] The present disclosure will be specifically described with reference to the drawings showing the embodiment. An in-vehicle device 1 according to the embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0034] (Embodiment 1) Hereinafter, an embodiment will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the configuration of an in-vehicle system S including an in-vehicle device 1 according to embodiment 1. FIG. 2 is a block diagram illustrating the internal configuration of the in-vehicle device 1. The in-vehicle system S is composed of an in-vehicle device 1 mounted on a vehicle C, an in-vehicle ECU 2, and an in-vehicle network 3 that communicatively connects these. The in-vehicle network 3 is composed of a plurality of communication lines 31. When communication in the in-vehicle network 3 is performed according to a communication protocol such as CAN (Controller Area Network) or CAN-FD, the communication line 31 corresponds to a CAN bus. When the communication protocol is TCP / IP, the communication line 31 corresponds to an Ethernet cable.

[0035] The vehicle C is equipped with a power supply device 4 configured with a lead battery, an alternator, a secondary battery, or the like. The power supply device 4 and the in-vehicle device 1 are connected by a power line 41. The power supply device 4 and the in-vehicle device 1 are not limited to being directly connected by the power line 41, but may be indirectly connected via an electrical box (junction box) such as a relay box or a fuse box interposed between the power supply device 4 and the in-vehicle device 1.

[0036] In the in-vehicle device 1, a power line 41 extending from the power supply device 4 is branched into multiple lines, and the in-vehicle device 1 is connected to multiple in-vehicle ECUs 2 or in-vehicle devices 21 via each of the branched power lines 41. The in-vehicle device 1 distributes power supplied from the power supply device 4 to the multiple in-vehicle ECUs 2 or in-vehicle devices 21. In other words, the in-vehicle device 1 functions as a power distribution device that distributes power supplied from the power supply device 4 via the power line 41 to the multiple in-vehicle ECUs 2 or in-vehicle devices 21 arranged downstream in the direction of current flow.

[0037] The in-vehicle ECU 2 is connected to the in-vehicle device 1 by a communication line 31 and a power line 41. The in-vehicle devices 21 that do not have a communication function using CAN, Ethernet, or the like are connected to the in-vehicle device 1 only by the power line 41. The in-vehicle ECU 2 includes a microcomputer or the like with a communication function, and performs predetermined arithmetic processing based on detection values ​​from connected sensors or output values ​​from various switches, and generates communication data including the processing results and transmits it via the in-vehicle network 3. The in-vehicle devices 21 may be, for example, an actuator for an interior lamp, a door mirror, or a seat drive device, or may be various sensor devices such as LiDAR or a camera.

[0038] The in-vehicle device 1 functions as a relay device that relays communication data transmitted and received between multiple in-vehicle ECUs 2 and also functions as a power distribution device that distributes power from a power supply device 4 to multiple in-vehicle ECUs 2 or in-vehicle devices 21. The in-vehicle device 1 functions as a power supply control device that controls the activation and shutdown of the in-vehicle ECUs 2 and may be a device having a relay function, such as a CAN gateway, a Layer 2 Ethernet switch, or a Layer 3 Ethernet switch. Alternatively, the in-vehicle device 1 may be an integrated ECU (vehicle computer) that comprehensively controls the entire vehicle C and has a relay function. Alternatively, the in-vehicle device 1 may be individual ECUs connected to the integrated ECU and disposed in each area of ​​the vehicle C. Alternatively, the in-vehicle device 1 may be configured as a body ECU or the like that controls body actuators of the vehicle C. Alternatively, the in-vehicle device 1 may be a PLB (Power LAN Box) that, in addition to relaying communication, also functions as a power distribution device that distributes and relays power output from a power supply device 4, such as a lead battery or a secondary battery, and supplies power to in-vehicle devices such as actuators. The in-vehicle device 1 may be connected to in-vehicle devices 21 such as various switches, sensors, or actuators.

[0039] The in-vehicle device 1 includes a control unit 11, a storage unit 12, an input / output I / F 15, a relay unit 13, and a power distribution unit 14. The control unit 11 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit), and performs various control processes and arithmetic processes by reading and executing a control program P (program product) and data stored in advance in the storage unit 12.

[0040] The storage unit 12 is configured with a volatile memory element such as a random access memory (RAM), a non-volatile memory element such as a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory, or a combination of these storage devices, and stores a control program P (program product) and data to be referenced during processing. The control program P (program product) stored in the storage unit 12 may be a control program P (program product) read from a recording medium M readable by the in-vehicle device 1. Alternatively, the control program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the storage unit 12. The storage unit 12 also stores a connection status table (described later).

[0041] The input / output I / F 15 is, for example, a communication interface for serial communication. The input / output I / F 15 includes a plurality of terminals (output terminals), and each terminal is connected to a signal line 151 extending to each of the opening / closing units 142. The signal line 151 is, for example, a serial cable, a wire harness, or a conductive cable (direct wire) that transmits only one signal.

[0042] The relay unit 13 is configured with a microcomputer, a field programmable gate array (FPGA), a system on chip (SOC), a system in package (SIP), or the like. The relay unit 13 and the control unit 11 are communicatively connected via an internal bus or the like using a serial peripheral interface (SPI) or the like. The relay unit 13 has multiple communication ports 131 (four in this embodiment) and performs relay processing of communication data transmitted and received between the in-vehicle ECUs 2 connected to each of these communication ports 131. The relay unit 13 configured in this manner functions as a CAN gateway when the in-vehicle network 3 supports CAN or CAN-FD, and functions as a Layer 2 Ethernet switch or a Layer 3 Ethernet switch when the in-vehicle network 3 supports Ethernet. When the relay unit 13 functions as a Layer 2 Ethernet switch, the control unit 11 may function as a Layer 3 Ethernet switch. Alternatively, the relay unit 13 and the control unit 11 may be substantially integrated. That is, the control unit 11 may function as a relay device by, for example, performing software processing.

[0043] The communication port 131 provided in the relay unit 13 is configured with a communication unit corresponding to the communication protocol. When the communication protocol is CAN or CAN-FD, the communication port 131 is configured with a CAN transceiver. When the communication protocol is Ethernet, the communication port 131 is configured with an Ethernet PHY unit (Ethernet physical layer transceiver). A communication line 31 (CAN bus, Ethernet cable) corresponding to the communication protocol is connected to the communication port 131.

[0044] A power line 41 extending from the power supply device 4 is connected to the power distribution unit 14. In the power distribution unit 14, the power line 41 extending from the power supply device 4 is branched into a plurality of lines, and a power port 141 is disposed (connected) at each end of the branched power line 41. The power port 141 is connected to the power line 41 extending to the in-vehicle ECU 2 or the in-vehicle device 21.

[0045] An open / close unit 142 is interposed between a branch point where the power line 41 extending from the power supply device 4 branches into multiple lines and a power port 141 located at the end of each of the branched power lines 41. In this manner, the power distribution unit 14 includes multiple (seven in this embodiment) open / close units 142 and power ports 141 connected in series. In this case, it is desirable that the number of power ports 141 included in the power distribution unit 14 is equal to or greater than the number of communication ports 131 included in the relay unit 13.

[0046] The switching units 142 are configured, for example, by mechanical relays or semiconductor relays such as FETs (Field Effect Transistors). Alternatively, the switching units 142 may be configured by IPDs (Intelligent Power Devices). Signal lines 151 extending from the input / output I / F 15 are connected to the respective switching units 142. The switching units 142 are turned on (closed) or off (open) in response to control signals output from the control unit 11 via the signal lines 151. That is, the switching units 142 are connected to the control unit 11 via the input / output I / F 15 and the respective signal lines 151. When the switching units 142 are configured, for example, by semiconductor relays such as FETs, the signal lines 151 are connected to the gate terminals of the FETs.

[0047] 3 is a flowchart illustrating the process (sequentially turned off) of the control unit 11 of the in-vehicle device 1. The control unit 11 of the in-vehicle device 1 steadily performs the following process when the vehicle C is stopped or started.

[0048] The control unit 11 of the in-vehicle device 1 determines whether or not a notification indicating that an in-vehicle ECU 2 has been added to the communication port 131 has been received from the relay unit 13 (S101). The control unit 11 of the in-vehicle device 1 is constantly waiting for a notification indicating that an in-vehicle ECU 2 has been added to the communication port 131 from the relay unit 13. For example, the relay unit 13, which functions as a CAN gateway or a Layer 2 Ethernet switch, is configured with a microcomputer, etc., and the relay unit 13 and the control unit 11 are connected to each other so as to be able to communicate with each other via an internal bus, etc.

[0049] When an in-vehicle ECU 2 is newly connected to a communication port 131 via the communication line 31, the relay unit 13 receives communication data from the newly connected in-vehicle ECU 2, thereby notifying the control unit 11 that the in-vehicle ECU 2 has been connected to the communication port 131. Alternatively, when an in-vehicle ECU 2 is newly connected to a communication port 131 via the communication line 31, the relay unit 13 may detect a voltage fluctuation, such as a carrier sense, and notify the control unit 11 in response to the detection that the in-vehicle ECU 2 has been connected to a specific communication port 131. In this way, the control unit 11 can detect that an in-vehicle ECU 2 has been newly added to any of the communication ports 131 by receiving a notification from the relay unit 13.

[0050] The relay unit 13 may store the communication port number of the communication port 131 to which the newly connected (added) in-vehicle ECU 2 is connected in the notification, and then transmit the notification to the control unit 11. By receiving the notification from the relay unit 13, the control unit 11 of the in-vehicle device 1 can obtain the communication port number of the communication port 131 to which the newly connected (added) in-vehicle ECU 2 is connected at the time of the notification. If the notification has not been received (S101: NO), the control unit 11 of the in-vehicle device 1 continues the process of waiting for a notification from the relay unit 13 by performing a loop process to execute the process of S101 again.

[0051] When the notification is received (S101: YES), the control unit 11 of the in-vehicle device 1 identifies an available power supply port 141 (S102). When the control unit 11 of the in-vehicle device 1 receives the notification from the relay unit 13, the control unit 11 extracts the communication port number (the identifier of the communication port 131 to which the newly connected in-vehicle ECU 2 is connected) included in the notification, and stores the extracted communication port number in the storage unit 12 in association with the time of reception.

[0052] The control unit 11 of the in-vehicle device 1 identifies an available power port 141 by, for example, referring to the connection status table stored in the storage unit 12. The available power port 141 indicates a power port 141 that is recognized as not being connected to the in-vehicle ECU 2 at the time the in-vehicle ECU 2 to be processed is newly added, and is based on the information stored in the connection status table. That is, at the time the in-vehicle ECU 2 to be processed is newly added, the in-vehicle ECU 2 is physically connected to the communication port 131 and the power port 141, but information indicating that the in-vehicle ECU 2 is connected to these ports has not yet been reflected in the connection status table at that time (the time the in-vehicle ECU 2 is newly added). Therefore, by referring to the connection status table, the control unit 11 of the in-vehicle device 1 identifies a power port 141 that is recognized as not being connected to the in-vehicle ECU 2 from the perspective of the information stored (registered) in the connection status table at the time the in-vehicle ECU 2 to be processed is newly added as an available power port 141. Therefore, among the one or more identified free power ports 141, the vehicle ECU 2 that is the target of this processing (the newly added vehicle ECU 2) is connected to one of the free power ports 141.

[0053] 4 is an explanatory diagram showing a connection status table. Connection status information regarding the connection status of the on-board ECU 2 to each of the power supply port 141 and the communication port 131 is stored, for example, in a table format (connection status table) in a storage area accessible by the control unit 11 of the on-board device 1, such as the storage unit 12 of the on-board device 1. By referring to the connection status table, the control unit 11 of the on-board device 1 can obtain connection status information regarding the connection status of the on-board ECU 2, such as whether or not the on-board ECU 2 is connected to each of the power supply port 141 and the communication port 131.

[0054] The connection status table includes management items (fields) such as a power supply port number and a communication port number, and may further include a connected device. The management item for the power supply port number stores an identifier such as a device number that uniquely identifies each of all power supply ports 141 included in the power distribution unit 14. In this embodiment, the power distribution unit 14 has seven power supply ports 141, and the connection status table stores (preserves) records for power supply port numbers 1 to 7.

[0055] The device number (opening / closing unit number) of the opening / closing unit 142 may be associated with the power supply port number and stored in the storage unit 12. Alternatively, the association of the opening / closing unit number may also be defined, saved, and managed in a connection status table. In this way, the association between the power supply port number and the opening / closing unit number is stored in the storage unit 12 or in the connection status table as an indication of the connection between the power supply port 141 and the opening / closing unit 142. Therefore, when controlling the supply or cutoff of power to any of the power supply ports 141, the control unit 11 of the in-vehicle device 1 can efficiently identify the opening / closing unit 142 connected in series to that power supply port 141.

[0056] The communication port number management item stores an identifier such as a device number that uniquely identifies the communication port 131 to which the in-vehicle ECU 2 connected to the power supply port 141 of the power supply port number in the same record is connected. In this embodiment, the relay unit 13 has four communication ports 131, and therefore any number from 1 to 4 is stored (saved) in the communication port number management item. In this way, when the same in-vehicle ECU 2 is connected to the power supply port number and communication port number in the same record, the numbers of the corresponding power supply port 141 and communication port 131 ([power supply port 141:4, communication port 131:2], [power supply port 141:7, communication port 131:3]) are stored, and thus an association (association) between the power supply port 141 and the communication port 131 is established.

[0057] The connected device management item stores an identifier that uniquely identifies the in-vehicle ECU 2, such as the ID (ECU-ID) of the in-vehicle ECU 2 connected to the power supply port 141 of the power supply port number of the same record. The identifier may be, for example, an identifier corresponding to the communication protocol, and when the communication protocol is CAN, the ECU-ID may be used, and when the communication protocol is Ethernet, the IP address or MAC address may be used as the identifier.

[0058] Furthermore, the management item for connected devices may store the device number of the in-vehicle device 21, such as an actuator, connected to the power supply port 141 of the power supply port number of the same record. It is assumed that not only the in-vehicle ECU 2 requiring the power supply port 141 and the communication port 131 but also the in-vehicle device 21, such as an actuator or a sensor requiring only the power supply port 141, will be connected to the in-vehicle device 1, and the connection status of the in-vehicle device 21 can also be managed using the connection status table.

[0059] As described above, when the in-vehicle ECU 2 that is the subject of this process is newly added, that is, immediately after the newly added in-vehicle ECU 2 is physically connected to the power supply port 141 and the communication port 131, information indicating that the in-vehicle ECU 2 has been newly added is not reflected in the connection status table. Therefore, the control unit 11 of the in-vehicle device 1 can identify an unused power supply port 141 (a power supply port 141 that is recognized as not having an in-vehicle ECU 2 connected thereto) by referring to the connection status table at that time and acquiring the power supply port number of a record in which, for example, "empty" or "blank (null)" is stored in the management field for the communication port number.

[0060] At this time, the control unit 11 of the in-vehicle device 1 may also refer to the management items of the connected devices, and even if an available communication port number is stored in the management item of the connected device, if the identifier of any in-vehicle device 21 is stored in the management item of the connected device, the control unit 11 may determine that the power port 141 of the power port number corresponding to the connected device is not an available power port 141 and exclude it from the list of available power ports 141. By performing such processing, in this implementation determination, the control unit 11 of the in-vehicle device 1 identifies the power ports 141 of power port numbers 1, 2, 3, and 5 as available power ports 141.

[0061] The control unit 11 of the in-vehicle device 1 sequentially turns off the opening / closing units 142 connected to the identified unused power supply ports 141 (S103). In this embodiment, the opening / closing units 142 connected to all of the power supply ports 141 provided in the power distribution unit 14 are always on (closed), and therefore voltage is applied to all of these power supply ports 141 from the power supply device 4. The control unit 11 of the in-vehicle device 1 sequentially turns off the opening / closing units 142 connected to the identified unused power supply ports 141 by referring to the connection status table. The control unit 11 of the in-vehicle device 1 turns off the opening / closing units 142 of any of the identified one or more unused power supply ports 141 based on the ascending order of the power supply port numbers defined in the connection status table.

[0062] The control unit 11 of the in-vehicle device 1 determines whether communication from the newly connected in-vehicle ECU 2 has been interrupted (S104). The newly connected in-vehicle ECU 2 is connected to the communication port 131 corresponding to the communication port number included in the notification from the relay unit 13. The control unit 11 of the in-vehicle device 1 periodically or steadily communicates with the newly connected in-vehicle ECU 2 via the communication port 131, and determines whether the communication has been interrupted. Alternatively, the control unit 11 of the in-vehicle device 1 may periodically or steadily output (transmit) a polling message via the communication port 131 corresponding to the communication port number extracted from the notification, and receive a reply message from the in-vehicle ECU 2 in response to the polling message, thereby confirming communication with the in-vehicle ECU 2.

[0063] If the communication is not interrupted (S104: NO), the control unit 11 of the in-vehicle device 1 performs a loop process to execute the process of S103 again, thereby turning off the opening / closing unit 142 that is next in order to the opening / closing unit 142 that was turned off this time, and continues the process of sequentially turning off the opening / closing units 142 connected to the identified, available power supply ports 141. In this way, the control unit 11 of the in-vehicle device 1 continues to perform the process of checking the communication status with the newly connected in-vehicle ECU 2 in a sequential manner every time it turns off any of the identified, available power supply ports 141.

[0064] If the communication is interrupted (S104: YES), the control unit 11 of the in-vehicle device 1 identifies the power supply port 141 connected to the currently turned-off opening / closing unit 142 (S105). The control unit 11 of the in-vehicle device 1 identifies the power supply port 141 connected to the currently turned-off opening / closing unit 142 as the power supply port 141 corresponding to the communication port 131 to which the newly connected in-vehicle ECU 2 is connected.

[0065] The control unit 11 of the in-vehicle device 1 executes a process of linking the identified power port 141 and the communication port 131 (S106). The control unit 11 of the in-vehicle device 1 links the power port number of the power port 141 connected to the currently turned-off opening / closing unit 142 with the communication port number included in the notification from the relay unit 13 as numbers (identifiers) that uniquely identify the power port 141 and the communication port 131 to which the newly connected in-vehicle ECU 2 is connected. The control unit 11 of the in-vehicle device 1 updates the connection status table by adding information indicating the linked power port number and communication port number to the connection status table. The connection status table updated in this way includes the connection status of the in-vehicle ECU 2 (the newly connected in-vehicle ECU 2) that is the target of this process, and reflects the latest connection status of the in-vehicle ECU 2 currently connected to the in-vehicle device 1.

[0066] 5 is a flowchart illustrating the processing (sequentially turned on) of the control unit 11 of the in-vehicle device 1 according to embodiment 2. The control unit 11 of the in-vehicle device 1 steadily performs the following processing when the vehicle C is stopped or started.

[0067] The control unit 11 of the in-vehicle device 1 determines whether or not a notification indicating that an in-vehicle ECU 2 has been added to the communication port 131 has been received from the relay unit 13 (S201). If the notification has not been received (S201: NO), the control unit 11 of the in-vehicle device 1 continues to wait for a notification from the relay unit 13 by performing a loop process to execute the process of S201 again. If the notification has been received (S201: YES), the control unit 11 of the in-vehicle device 1 identifies an available power supply port 141 (S202). The control unit 11 of the in-vehicle device 1 performs the processes from S201 to S202, similar to the processes S101 to S102 of the first embodiment.

[0068] The control unit 11 of the in-vehicle device 1 turns off the opening / closing units 142 connected to the unused power supply ports 141 (S203). The control unit 11 of the in-vehicle device 1 simultaneously turns off the opening / closing units 142 connected to the identified unused power supply ports 141. As a result, communication with the in-vehicle ECU 2 connected to the unused power supply ports 141 (the newly added in-vehicle ECU 2 that is the target of this processing) is cut off (communication is disabled).

[0069] The control unit 11 of the in-vehicle device 1 sequentially turns on the opening / closing units 142 connected to the identified available power supply ports 141 (S204). The control unit 11 of the in-vehicle device 1 turns on the opening / closing units 142 of any of the identified one or more available power supply ports 141 in ascending order of the power supply port numbers defined in the connection status table.

[0070] The control unit 11 of the in-vehicle device 1 determines whether the newly connected in-vehicle ECU 2 is able to communicate (S205). The newly connected in-vehicle ECU 2 is connected to the communication port 131 having the communication port number included in the notification from the relay unit 13. The control unit 11 of the in-vehicle device 1 may periodically or constantly output (transmit) a polling message via the communication port 131 having the communication port number extracted from the notification from the relay unit 13, and may confirm communication with the in-vehicle ECU 2 by receiving a reply message from the in-vehicle ECU 2 in response to the polling message. If communication is not possible (S205: NO), the control unit 11 of the in-vehicle device 1 performs a loop process to execute the process of S204 again, thereby turning on the opening / closing unit 142 that is next in order to the opening / closing unit 142 that was turned on this time, and continues the process of sequentially turning off the opening / closing units 142 connected to the identified unused power supply ports 141.

[0071] If communication is possible (S205: YES), the control unit 11 of the in-vehicle device 1 identifies the power supply port 141 connected to the currently turned-on opening / closing unit 142 (S206). The control unit 11 of the in-vehicle device 1 identifies the power supply port 141 connected to the currently turned-on opening / closing unit 142 as the power supply port 141 corresponding to the communication port 131 to which the newly connected in-vehicle ECU 2 is connected.

[0072] The control unit 11 of the in-vehicle device 1 executes a process of linking the identified power supply port 141 with the communication port 131 (S207). The control unit 11 of the in-vehicle device 1 executes the process of S207 in the same manner as the process of S106 in the first embodiment.

[0073] 6 is a flowchart illustrating the processing (abnormality determination) of the control unit 11 of the in-vehicle device 1 according to the third embodiment. The control unit 11 of the in-vehicle device 1 steadily performs the following processing when the vehicle C is stopped or started.

[0074] The control unit 11 of the in-vehicle device 1 determines whether the communication data received via the communication port 131 is abnormal (S301). The control unit 11 of the in-vehicle device 1 functions as an IDS (Intrusion Detection System) that determines whether the communication data acquired (received) via each communication port 131 is abnormal (illegal) data, and detects intrusion by an unauthorized program or device into the in-vehicle network 3. Alternatively, the control unit 11 of the in-vehicle device 1 may determine whether the in-vehicle ECU 2 connected to the communication port 131 is abnormal by verifying the MAC or digital signature attached to the received communication data.

[0075] When making an abnormality determination for the communication data, the control unit 11 acquires the communication data and the number (communication port number) of the communication port 131 that received the communication data from the relay unit 13. Alternatively, if the relay unit 13 makes the abnormality determination and determines that the communication data is abnormal, it may notify the control unit 11 of the determination result, including the number (communication port number) of the communication port 131 that received the communication data that is determined to be abnormal. If it is determined that there is no abnormality (S301: NO), the control unit 11 of the in-vehicle device 1 continues the process of determining whether the received communication data is abnormal by performing a loop process to execute the process of S301 again.

[0076] If it is determined that the communication data is abnormal (S301: YES), the control unit 11 of the in-vehicle device 1 identifies the communication port 131 that received the communication data determined to be abnormal (S302). If it is determined that the communication data is abnormal, the control unit 11 of the in-vehicle device 1 identifies the number (communication port number) of the communication port 131 that received the communication data determined to be abnormal based on communication with the relay unit 13, and stores the number in the storage unit 12 in association with the time of reception of the communication data determined to be abnormal. At this time, the control unit 11 of the in-vehicle device 1 may determine that the in-vehicle ECU 2 connected to the communication port 131 that received the communication data determined to be abnormal is the abnormal in-vehicle ECU 2.

[0077] The control unit 11 of the in-vehicle device 1 identifies the power supply port 141 linked to the communication port 131 that received the communication data determined to be abnormal (S303). The control unit 11 of the in-vehicle device 1 identifies the number of the power supply port 141 (power supply port number) linked to the identified communication port number by referring to the connection status table. That is, the control unit 11 of the in-vehicle device 1 identifies the number of the power supply port 141 (power supply port number) to which the in-vehicle ECU 2 connected to the communication port 131 of the identified communication port number is connected. The connection status table stores and manages the latest connection status of the in-vehicle ECU 2 to the in-vehicle device 1, so the control unit 11 of the in-vehicle device 1 can efficiently identify the power supply port number.

[0078] The control unit 11 of the in-vehicle device 1 turns off the opening / closing unit 142 connected to the identified power port 141 (S304). By turning off the opening / closing unit 142 connected to the number (power port number) of the power port 141, the control unit 11 of the in-vehicle device 1 cuts off the supply of power to the power port 141. This stops the power supply to the in-vehicle ECU 2 connected to the power port 141 of the turned-off opening / closing unit 142, so it is possible to stop the operation of the in-vehicle ECU 2. This makes it possible to stop unauthorized communication data from the abnormal in-vehicle ECU 2 from being transmitted to the in-vehicle network 3.

[0079] The embodiments disclosed herein are to be considered as illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0080] Multiple claims may be combined with each other regardless of the form of reference. The claims may contain multiple dependent claims that depend on multiple claims. Multiple dependent claims may be contained that depend on multiple dependent claims. If multiple dependent claims that depend on multiple dependent claims are not contained, this does not limit the number of multiple dependent claims that depend on multiple dependent claims.

[0081] C Vehicle S In-vehicle system 1 In-vehicle device 11 Control unit 12 Storage unit M Recording medium P Control program (program product) 13 Relay unit 131 Communication port 14 Power distribution unit 141 Power supply port 142 Opening / closing unit 15 Input / output I / F 151 Signal line 2 In-vehicle ECU 21 In-vehicle device 3 In-vehicle network 31 Communication line 4 Power supply device 41 Power line

Claims

1. An on-board device communicatively connected to each of a plurality of on-board ECUs mounted on a vehicle, the on-board device comprising: a relay unit including a communication port to which each of the on-board ECUs is connected; a power distribution unit including a power supply port to which each of the on-board ECUs is connected, and distributing power supplied from a power supply device mounted on the vehicle to each of the on-board ECUs; and a control unit that performs processing related to the relay unit and the power distribution unit, wherein the control unit identifies the communication port to which the on-board ECU connected to the power supply port is connected, depending on the supply status of power from the power supply device to the power supply port.

2. The in-vehicle device according to claim 1, wherein the power distribution unit includes opening / closing units connected to the respective power supply ports, and the control unit controls the supply of power to the in-vehicle ECU connected to the power supply port of the opening / closing unit by controlling the opening / closing of the opening / closing units.

3. The vehicle-mounted device according to claim 2, wherein the control unit changes the state of power supply from the power supply device to the power supply port by sequentially turning on or off each of the opening / closing units included in the power distribution unit, and identifies the communication port to which the vehicle-mounted ECU connected to the power supply port is connected based on the communication state with the vehicle-mounted ECU in response to the change in the state of power supply.

4. The vehicle-mounted device according to claim 3, wherein the control unit identifies, from among the power supply ports included in the power distribution unit, an unused power supply port to which the vehicle-mounted ECU is not connected, and sequentially turns on or off each of the opening / closing units connected to each of the unused power supply ports, thereby changing the state of power supply from the power supply device to the unused power supply port.

5. The in-vehicle device according to claim 4, wherein connection status information regarding the connection status of the in-vehicle ECU to each of the power supply ports in the power distribution unit is stored in a memory area accessible by the control unit, and the control unit identifies the available power supply port to which the in-vehicle ECU is not connected by referring to the connection status information.

6. The in-vehicle device according to claim 5, wherein the control unit associates the communication port identified based on the communication state with the in-vehicle ECU with the power supply port, and updates the connection state information.

7. The vehicle-mounted device according to claim 4, wherein when the control unit detects that the vehicle-mounted ECU is connected to one of the communication ports provided in the relay unit, the control unit changes the state of power supply from the power supply device to the power port by changing the state of power supply from the power supply device to the unused power port.

8. The in-vehicle device according to any one of claims 1 to 7, wherein the number of power supply ports included in the power distribution unit is equal to or greater than the number of communication ports included in the relay unit.

9. The vehicle-mounted device according to claim 5, wherein the control unit: determines whether the vehicle-mounted ECUs are abnormal based on communication data transmitted from the vehicle-mounted ECUs connected to the respective communication ports; if the vehicle-mounted ECUs are determined to be abnormal, identifies the communication port to which the vehicle-mounted ECU determined to be abnormal is connected; based on the identified communication port, identifies the power supply port to which the vehicle-mounted ECU determined to be abnormal is connected by referring to the connection status information; and stops power supply to the vehicle-mounted ECU determined to be abnormal by turning off the opening / closing unit connected to the identified power supply port.

10. An information processing method that causes a computer that performs processing related to a relay unit that is communicatively connected to each of a plurality of on-board ECUs mounted on a vehicle and includes a communication port to which each of the on-board ECUs is connected, and a power distribution unit that includes a power supply port to which each of the on-board ECUs is connected and distributes power supplied from a power supply device mounted on the vehicle to each of the on-board ECUs, to execute processing to identify the communication port to which the on-board ECU connected to the power supply port is connected, depending on the state of power supply from the power supply device to the power supply port.

11. A program that causes a computer that performs processing related to a relay unit that is communicatively connected to each of a plurality of vehicle-mounted ECUs mounted on a vehicle and includes a communication port to which each of the vehicle-mounted ECUs is connected, and a power distribution unit that includes a power supply port to which each of the vehicle-mounted ECUs is connected and distributes power supplied from a power supply device mounted on the vehicle to each of the vehicle-mounted ECUs, to execute processing to identify the communication port to which the vehicle-mounted ECU connected to the power supply port is connected, depending on the supply status of power from the power supply device to the power supply port.

Images