On-board device, on-board system, relay method, and computer program

Abstract

This on-board device comprises: a relay processing unit that relays a frame between a plurality of processing devices; and a control unit that controls the relay processing unit. The control unit includes a processing unit that executes: a process for generating a second frame directed to a transmission destination processing device, among the plurality of processing devices, on the basis of a first frame from a first transmission source processing device among the plurality of processing devices; and a process for, when an abnormality in the first frame is detected, generating, instead of the second frame, an alternative frame directed to the transmission destination processing device. The alternative frame is generated on the basis of a related frame which includes related data related to data in the first frame and which is transmitted from a second transmission source processing device among the plurality of processing devices.

Description

In-vehicle device, in-vehicle system, relay method, and computer program

[0001] This application claims priority to Japanese Patent Application No. 2024-107772 filed on July 3, 2024, and incorporates by reference all of the contents of that application.

[0002] Patent Document 1 discloses a technology relating to a conversion device for connecting an ECU (Electronic Control Unit) connected to an Ethernet (registered trademark) network and an ECU connected to a CAN (Controller Area Network) bus in an in-vehicle network system so that information can be transmitted between them.

[0003] Japanese Patent Application Laid-Open No. 2021-119724

[0004] An embodiment of an in-vehicle device includes a relay processing unit that relays frames between a plurality of processing devices, and a control unit that controls the relay processing unit. The control unit has a processing unit that executes a process of generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices, and a process of generating a substitute frame addressed to the destination processing device in place of the second frame when an abnormality in the first frame is detected. The substitute frame is generated based on an associated frame that is transmitted from a second source processing device among the plurality of processing devices and includes associated data related to the data in the first frame.

[0005] Fig. 1 is a diagram showing an example of the configuration of an in-vehicle system according to an embodiment. Fig. 2 is a block diagram showing an example of the configuration of an in-vehicle device. Fig. 3 is a flowchart showing an example of a relay process. Fig. 4 is a flowchart showing an example of a detection process for detecting an abnormality. Fig. 5 is a diagram showing an example of a substitution table. Fig. 6 is a diagram showing a state when CAN frame A includes an abnormality.

[0006] [Problem to be Solved by the Present Disclosure] In the above-described conversion device, even if a frame from a transmission source contains an abnormality, the frame containing the abnormality is protocol converted and relayed. As a result, the frame containing the abnormality is transmitted to the destination ECU. There is a risk that the normal operation of the ECU receiving the frame containing the abnormality may be impaired.

[0007] Effect of the Present Disclosure According to the present disclosure, it is possible to suppress transmission of frames containing an abnormality.

[0008] First, the contents of the embodiment will be listed and explained.

[0009] (1) An embodiment of an in-vehicle device includes a relay processing unit that relays frames between multiple processing devices and a control unit that controls the relay processing unit. The control unit has a processing unit that executes the following processes: generating a second frame addressed to a destination processing device among the multiple processing devices based on a first frame from a first source processing device among the multiple processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device in place of the second frame. The substitute frame is generated based on an associated frame that is transmitted from a second source processing device among the multiple processing devices and includes associated data related to the data in the first frame. According to the above configuration, the substitute frame is generated based on an associated frame that includes associated data related to the data in the first frame, so that an appropriate substitute frame is transmitted to the destination processing device. This prevents the generation of a second frame based on an abnormal frame and prevents an abnormal frame from being transmitted to the destination processing device.

[0010] (2) In the in-vehicle device of (1) above, the type of data in the first frame and the type of the related data may be the same, in which case an alternative frame containing the same type of data as the data in the second frame is obtained.

[0011] (3) In the in-vehicle device of (1) above, the related data may be data that directly or indirectly indicates the data in the first frame, in which case an alternative frame is obtained that includes data that directly or indirectly indicates the data in the second frame.

[0012] (4) In the in-vehicle device of (1), when an abnormality in the first frame is detected, the processing unit may further execute a lookup process in which the processing unit looks up a table in which identification information of the first frame and identification information of the related frame are registered in association with each other, and a process in which the processing unit identifies the related frame based on a result of looking up the table. In this case, the processing unit can easily identify the related frame by looking up the table.

[0013] (5) In the in-vehicle device of (4) above, if the table stores identification information of multiple candidate frames that are candidates for the relevant frame and the priorities of the multiple candidate frames in association with each other, the process of identifying the relevant frame may include a process of selecting a candidate frame to be identified as the relevant frame from the multiple candidate frames based on the priorities. In this case, the relevant frame can be selected from the multiple candidate frames. Therefore, even if some of the multiple candidate frames are not provided or are missing, they can be supplemented with other candidate frames.

[0014] (6) In the in-vehicle device according to any one of (1) to (5), the processing unit may further perform the following processes: referencing data included in the first frame; and determining whether or not there is an abnormality in the first frame based on a comparison result between the data included in the first frame and data immediately preceding the data included in the first frame. In this case, it is possible to determine that there is an abnormality in the first frame when, for example, there is a very large fluctuation in the data included in the first frame.

[0015] (7) In addition, in any one of the in-vehicle devices described above in (1) to (6), the detection process may include a process of determining whether or not there is an abnormality in the first frame based on the reception interval of the first frame.

[0016] (8) In the in-vehicle device of (4), when there are a plurality of tables and the plurality of tables each stores identification information of the first frame and identification information of the related frame in association with each other according to a state of the vehicle, the processing unit may further perform a process of selecting a table to be referenced in the reference process from the plurality of tables based on the state of the vehicle. In this case, it is possible to select a table according to the state of the vehicle.

[0017] (9) In the in-vehicle device described in any one of (1) to (8) above, when an abnormality in the first frame is detected, the processing unit may further execute a process of saving the detection result, in which case the detection result can be saved as a log.

[0018] (10) In the in-vehicle device according to any one of (1) to (8), the communication protocol of the first frame may be different from the communication protocols of the second frame and the alternative frame. In this case, the in-vehicle device can convert the communication protocol while suppressing transmission of frames containing an abnormality.

[0019] (11) Another embodiment is an in-vehicle system including a plurality of processing devices mounted on a vehicle and the in-vehicle device (1) that relays frames provided from the plurality of processing devices.

[0020] (12) Another embodiment is a relay method for relaying frames between a plurality of processing devices. The relay method includes: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device among the plurality of processing devices in place of the second frame. The substitute frame is generated based on an associated frame that includes associated data related to the data in the first frame and is transmitted from a second source processing device among the plurality of processing devices.

[0021] (13) An embodiment from another perspective is a computer program causing a computer to execute relay control of an in-vehicle device that relays frames between a plurality of processing devices. The computer program causes the computer to execute the steps of: generating a second frame addressed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame addressed to the destination processing device among the plurality of processing devices in place of the second frame. The substitute frame is generated based on an associated frame that is transmitted from a second source processing device among the plurality of processing devices and includes associated data related to the data in the first frame.

[0022] [Details of the embodiment] Preferred embodiments will now be described with reference to the drawings. Note that at least some of the embodiments described below may be combined in any desired manner. [Overall configuration of the in-vehicle system] FIG. 1 is a diagram showing an example configuration of an in-vehicle system according to an embodiment. The in-vehicle system 1 is a network system mounted on a vehicle V such as an automobile. The in-vehicle system 1 includes a first network N1 over which frames are transmitted in accordance with a CAN (Controller Area Network) communication protocol, and a second network N2 over which frames are transmitted in accordance with an Ethernet (registered trademark) communication protocol.

[0023] The in-vehicle system 1 includes an in-vehicle device 2 , a central gateway (CGW) 4 , a plurality of CAN-ECUs (Electronic Control Units) 6 , and a plurality of Ethernet ECUs 8 .

[0024] The CAN-ECUs 6 are connected to the in-vehicle device 2 via the CAN bus 10 and the CGW 4. The CAN-ECUs 6 communicate using the CAN communication protocol. Thus, the CAN-ECUs 6 and the CGW 4 constitute a first network N1.

[0025] The plurality of Ethernet ECUs 8 communicate using the Ethernet communication protocol. The plurality of Ethernet ECUs 8 are connected to the in-vehicle device 2 via an Ethernet cable 12. The plurality of Ethernet ECUs 8 communicate using the Ethernet communication protocol. Thus, the plurality of Ethernet ECUs 8 and the in-vehicle device 2 constitute a second network N2.

[0026] The multiple CAN-ECUs 6 are processing devices mounted in various parts of the vehicle V. The multiple CAN-ECUs 6 include, for example, ECUs (operation system ECUs) that control various parts of the vehicle V (for example, the engine, steering device, braking device, doors, battery, air conditioner, etc.).

[0027] The plurality of Ethernet ECUs 8 are processing devices mounted in various parts of the vehicle V. The plurality of Ethernet ECUs 8 include an ECU (cognition ECU) that monitors the state of various parts of the vehicle V using on-board sensors, an ECU having a TCU (Telematics Control Unit) function, and an ECU having a function related to ADAS (Advanced Driver-Assistance Systems).

[0028] The in-vehicle device 2 is a relay device that relays frames transmitted and received between multiple Ethernet ECUs 8. The in-vehicle device 2 is also connected to the CGW 4 and has the function of relaying frames between multiple CAN-ECUs 6 and multiple Ethernet ECUs 8. Therefore, the in-vehicle device 2 has the function of performing protocol conversion between frames that comply with the CAN communication protocol and frames that comply with the Ethernet communication protocol. Furthermore, the in-vehicle device 2 has the function of detecting whether or not there is an abnormality in a frame from the transmission source, and if an abnormality is detected, performing protocol conversion to generate a substitute frame in place of the frame in which the abnormality was detected, and generating a frame addressed to the transmission destination.

[0029] [Configuration of the In-Vehicle Device] Fig. 2 is a block diagram showing an example of the configuration of the in-vehicle device 2. The in-vehicle device 2 includes a control unit 16 and a relay processing unit 18. The CAN bus 14 extending from the CGW 4 is connected to the relay processing unit 18. Therefore, the relay processing unit 18 can receive CAN frames transmitted from multiple CAN-ECUs 6. Fig. 2 shows a state in which six CAN-ECUs 6 are connected. In Fig. 2, the six CAN-ECUs 6 are indicated as CAN-ECUs 6a, 6b, 6c, 6d, 6e, and 6f.

[0030] In this embodiment, the CAN-ECU 6a, the CAN-ECU 6b, and the CAN-ECU 6c are ECUs that output data related to the speed of the vehicle V. The CAN-ECU 6d and the CAN-ECU 6e are ECUs that output data related to the steering angle of the vehicle V.

[0031] The CAN-ECU 6a is an ECU that performs processing related to the meter display of the vehicle V. The CAN-ECU 6a transmits CAN frame A. The reception interval of CAN frame A is 5 μsec. The data contained in CAN frame A is the speed value Va of the vehicle V. The speed value Va is a value used for the meter display of the vehicle V. The resolution of the speed value Va is, for example, 1 km / h. The CAN-ECU 6b is an ECU that performs processing related to stability control of the vehicle V. The CAN-ECU 6b transmits CAN frame B. The reception interval of CAN frame B is 1 μsec. The data contained in CAN frame B is the speed value Vb of the vehicle V. The speed value Vb is a value used to calculate the average vehicle speed of the vehicle V. The resolution of the speed value Vb is, for example, 0.01 km / h. Therefore, the accuracy of the speed value Vb is higher than the accuracy of the speed value Va.

[0032] The CAN-ECU 6c is an ECU that performs processing related to stability control of the vehicle V. The CAN-ECU 6c transmits a CAN frame C. The reception interval of the CAN frame C is 1 μs. The data contained in the CAN frame C is the integrated value of pulses output by the vehicle speed sensor of the vehicle V. The integrated value of pulses is information that can be processed to obtain the speed of the vehicle V. Therefore, the integrated value of pulses is information that indirectly indicates the speed of the vehicle V. The accuracy of the speed obtained from the integrated value of pulses is higher than the accuracy of the speed value Vb.

[0033] The CAN-ECU 6d is an ECU that performs processing related to the meter display of the vehicle V. The CAN-ECU 6d transmits a CAN frame D. The reception interval of the CAN frame D is 5 μsec. The data contained in the CAN frame D is the steering angle Rd of the vehicle V. The steering angle Rd is, for example, a value used for the meter display of the vehicle V. The resolution of the steering angle Rd is, for example, 5 degrees. The CAN-ECU 6e is an ECU that controls the steering angle sensor of the vehicle V. The CAN-ECU 6e transmits a CAN frame E. The reception interval of the CAN frame E is 1 μsec. The data contained in the CAN frame E is the output value of the steering angle sensor. The output value of the steering angle sensor is information that can be processed to obtain the steering angle. Therefore, the output value of the steering angle sensor is information that indirectly indicates the steering angle. The accuracy of the output value of the steering angle sensor is higher than the accuracy of the steering angle Rd.

[0034] In this way, CAN-ECU 6a, CAN-ECU 6b, and CAN-ECU 6c output data indicating the speed of vehicle V. That is, the data included in CAN Frame A, CAN Frame B, and CAN Frame C are data indicating the speed of vehicle V and are related to each other. Furthermore, the data included in CAN Frame A and CAN Frame B include the same type of data, the speed of vehicle V. Furthermore, CAN-ECU 6d and CAN-ECU 6e output data indicating the steering angle of vehicle V. That is, the data included in CAN Frame D and CAN Frame E are data indicating the steering angle of vehicle V and are related to each other.

[0035] The CAN-ECU 6f is an ECU that controls the ignition switch of the vehicle V. The CAN-ECU 6f transmits a signal indicating whether the state of the ignition switch is on or off.

[0036] The relay processing unit 18 is also connected to Ethernet cables 12 extending from the multiple Ethernet ECUs 8. The relay processing unit 18 has a function of relaying Ethernet frames between the multiple Ethernet ECUs 8. The relay processing unit 18 also has a function of protocol-converting CAN frames from the multiple CAN-ECUs 6 into Ethernet frames and generating Ethernet frames destined for the Ethernet ECUs 8 that are predetermined destinations. Note that, for the sake of simplicity, only one Ethernet ECU 8 is shown in FIG. 2. In the following description, processing for one Ethernet ECU 8a will be described.

[0037] The control unit 16 has a function of controlling the relay processing unit 18. As shown in Fig. 2, the control unit 16 has a processing unit 20, a memory 22, an input / output interface 24, a storage unit 26, and a bus 28. The bus 28 connects the respective units to each other.

[0038] The processing unit 20 includes a circuit configuration such as a processor. The processor included in the processing unit 20 may be a GPU. In this case, the processing unit 20 can read out programs stored in the storage unit 26 and perform various calculations and controls described below. The processing unit 20 may also be a processor that includes programs pre-programmed therein. For example, the processing unit 20 may be an integrated circuit such as a CPLD (Complex Programmable Logic Device), an FPGA (Field-Programmable Gate Array), or an ASIC (Application Specific Integrated Circuit). In this case, the processing unit 20 executes various processes based on pre-programmed programs.

[0039] The memory 22 includes a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The storage unit 26 includes, for example, a flash memory, a hard disk, an SSD (Solid State Drive), etc. The storage unit 26 stores computer programs to be executed by the processing unit 20 and necessary information. The computer programs stored in the storage unit 26, which is a computer-readable non-transitory recording medium, are loaded into the memory 22, and the computer programs loaded into the memory 22 are executed by the processing unit 20, thereby realizing various processing functions of the processing unit 20. The storage unit 26 also stores an alternative table 27 and a destination table 29.

[0040] The destination table 29 is a table that associates the CAN-ID of a CAN frame with the MAC address of the Ethernet ECU 8, and is used to identify the Ethernet ECU 8 that is the destination of the CAN frame. The substitution table 27 is information used in the relay process executed by the in-vehicle device 2. The substitution table 27 will be described later.

[0041] The processing unit 20 executes a relay process that causes the relay processing unit 18 to generate an Ethernet frame, based on the CAN frame (first frame), for the destination Ethernet ECU 8. The relay process will be described later.

[0042] The relay processing unit 18 is connected to the input / output interface 24. The processing unit 20 controls the relay processing unit 18 via the input / output interface 24. The processing unit 20 can also acquire information indicating the state of the vehicle V from the CAN-ECU 6 and the Ethernet ECU 8 via the input / output interface 24. As described above, the CAN-ECU 6f is an ECU that controls the ignition switch of the vehicle V. The processing unit 20 of this embodiment can acquire, via the input / output interface 24, a signal indicating the state of the ignition switch of the vehicle V, which is transmitted from the CAN-ECU 6f, as the state of the vehicle V.

[0043] [Regarding Relay Processing] Fig. 3 is a flowchart showing an example of relay processing. In the following, a case where the CAN-ECU 6a and the CAN-ECU 6d in Fig. 2 are first source processing devices, and one of the multiple Ethernet ECUs 8, the Ethernet ECU 8a, is a destination processing device, will be described.

[0044] In the relay process, the processing unit 20 monitors CAN Frame A and CAN Frame D (step S1). The processing unit 20 monitors the reception intervals of CAN Frame A and CAN Frame D. The processing unit 20 also references the data contained in CAN Frame A and CAN Frame D. Next, the processing unit 20 performs abnormality detection for CAN Frame A and CAN Frame D (step S2).

[0045] 4 is a flowchart showing an example of a detection process for detecting an abnormality. The processing unit 20 first determines whether CAN Frame A and CAN Frame D have been received within the predetermined reception interval (step S11). If it is determined that at least one of CAN Frame A and CAN Frame D has not been received within the predetermined reception interval, the processing unit 20 proceeds to step S13, determines that an abnormal frame exists (step S13), and ends the process. If CAN Frame A and CAN Frame D are not received within the predetermined reception interval, there is a risk of a communication abnormality, such as a communication interruption. Therefore, the processing unit 20 determines that a CAN frame that is not received within the predetermined reception interval is abnormal.

[0046] On the other hand, if it is determined that both CAN Frame A and CAN Frame D have been received at the predetermined reception interval, the processing unit 20 determines whether the difference Δd between the current data of each of CAN Frame A and CAN Frame D and the most recent past data is equal to or greater than a preset threshold Th (step S12). The threshold Th is a value that is set individually for CAN Frame A and CAN Frame D. The threshold Th is a threshold for determining abnormal fluctuations occurring in the data. The threshold Th is set to a value that can determine that there is an abnormality in the data. As a result, if there is very large fluctuation in the data contained in CAN Frame A and CAN Frame D, it can be determined that there is an abnormality in these CAN frames.

[0047] If the processing unit 20 determines that the difference Δd between at least one of CAN frame A and CAN frame D is equal to or greater than the threshold value Th, the processing unit 20 proceeds to step S13, determines that an abnormal frame exists (step S13), and ends the processing. The processing unit 20 determines that a CAN frame having data with a difference Δd equal to or greater than the threshold value Th is an abnormal frame. On the other hand, if the processing unit 20 determines that the difference Δd between both CAN frame A and CAN frame D is not equal to or greater than the threshold value Th (the difference Δd is smaller than the threshold value Th), the processing unit 20 proceeds to step S14, determines that no abnormal frame exists (step S13), and ends the processing.

[0048] If it is determined in the detection process that an abnormal frame exists, the processing unit 20 may execute a process of saving the detection results, such as the data included in the abnormal frame and the time. The detection results are saved in the storage unit 26. In this case, the detection results can be saved as a log and can be used later to identify the cause of the abnormality.

[0049] As shown in FIG. 3 , upon completion of the detection process, the processing unit 20 proceeds to step S3. If the detection process determines that there are no abnormal frames, the processing unit 20 generates a normal frame (step S9). After generating the normal frame, the processing unit 20 returns to step S1 and monitors CAN Frame A and CAN Frame D. A normal frame (second frame) is a frame generated based on CAN Frame A and CAN Frame D (first frame), which are frames without abnormalities. A normal frame is an Ethernet Frame directed to the Ethernet ECU 8a. The processing unit 20 generates a normal frame by packing CAN Frame A and CAN Frame D. In other words, the processing unit 20 protocol-converts CAN Frame A and CAN Frame D into Ethernet Frames to obtain a normal frame.

[0050] On the other hand, if the detection process determines that an abnormal frame is present, the processing unit 20 refers to the state of the vehicle V (step S4). The processing unit 20 refers to the signal indicating the state of the ignition switch of the vehicle V, which is transmitted from the CAN-ECU 6f, as the state of the vehicle V. In step S4, the processing unit 20 determines whether the state of the ignition switch is on or off.

[0051] After referring to the state of the vehicle V, the processing unit 20 proceeds to step S5 and selects an alternative table 27 (step S5). Fig. 5 is a diagram showing an example of the alternative table 27. As shown in Fig. 5, the alternative table 27 of this embodiment includes a first table 27a and a second table 27b. The first table 27a is a table corresponding to the state of the vehicle V when the ignition switch is in the on state. The second table 27b is a table corresponding to the state of the ignition switch when the ignition switch is in the off state.

[0052] The processing unit 20 selects either the first table 27a or the second table 27b depending on the state of the ignition switch. Thus, the processing unit 20 can select a table depending on the state of the vehicle V.

[0053] After selecting the table, the processing unit 20 identifies related frames (step S6). Related frames are frames that include related data related to the data included in CAN frame A and CAN frame D.

[0054] 5, the alternative table 27 stores the CAN-IDs of vehicle speed-related CAN frames, the CAN-IDs of steering angle-related CAN frames, and priorities, all associated with one another. The alternative table 27 stores the CAN-IDs of multiple candidate frames. A candidate frame is a frame that can become an associated frame. The above-mentioned CAN Frame A, CAN Frame B, and CAN Frame C are registered as vehicle speed-related candidate frames. The above-mentioned CAN Frame D and CAN Frame E are registered as steering angle-related candidate frames. The processing unit 20 selects an associated frame from the multiple candidate frames based on the priority.

[0055] Looking at the vehicle speed-related items, CAN Frame A has the highest priority, followed by CAN Frame B and CAN Frame C. CAN Frame A is the CAN frame being monitored, and is adopted with the highest priority if no abnormalities are detected. For this reason, CAN Frame A has the highest priority. CAN Frames A, B, and C are associated with CAN Frames D and E, respectively. In this way, the substitution table 27 registers multiple combinations of vehicle speed-related CAN frames and steering angle-related CAN frames. Priorities (priority levels) are assigned to the multiple combinations.

[0056] For example, if both CAN frame A and CAN frame D are abnormal, the combination of CAN frame B and CAN frame E, which has a priority of 4, is selected as the associated frames. CAN frame B is the associated frame of CAN frame A. CAN frame E is the associated frame of CAN frame D. Furthermore, if only CAN frame D is abnormal, the combination of CAN frame A and CAN frame E, which has a priority of 2, is selected as the associated frames.

[0057] 3, once the related frames have been selected and identified, the processing unit 20 identifies the destinations of CAN Frame A and CAN Frame D (step S7). The processing unit 20 references the destination table 29 stored in the storage unit 26, acquires the MAC address of the Ethernet ECU 8a, and identifies the destinations of CAN Frame A and CAN Frame D.

[0058] Next, the processing unit 20 generates an alternative frame based on the identified associated frame (step S8). An alternative frame is an Ethernet Frame that is generated in place of a normal frame when an abnormality is detected in at least one of CAN frame A and CAN frame D. The processing unit 20 generates an alternative frame in which the associated frame is packed. In other words, the processing unit 20 converts the protocol of the associated frame, which is a CAN frame, into an Ethernet Frame to obtain the alternative frame.

[0059] After generating the alternative frame, the processing unit 20 returns to step S1 and monitors the CAN frame A and the CAN frame D. The normal frame and the alternative frame generated as described above are transmitted to the Ethernet ECU 8a.

[0060] FIG. 6 is a diagram showing a situation where CAN Frame A contains an abnormality. In FIG. 6, it is assumed that the ignition switch is in the ON state. It is also assumed that CAN Frames B, C, D, and E are transmitted normally. If all CAN frames are normal, the in-vehicle device 2 packs CAN Frame A and CAN Frame D into a single Ethernet Frame. As a result, CAN Frame A and CAN Frame D are protocol-converted into Ethernet Frames. The converted Ethernet Frame is received by the Ethernet ECU 8a as a normal frame.

[0061] On the other hand, if only CAN Frame A is abnormal among the CAN Frames, the in-vehicle device 2 selects the combination of CAN Frame B and CAN Frame D, which has a priority of 3, from the substitution table 27. The in-vehicle device 2 packs CAN Frame B and CAN Frame D into a single Ethernet Frame. As a result, CAN Frame B and CAN Frame D are protocol-converted into an Ethernet Frame. The converted Ethernet Frame is received by the Ethernet ECU 8a as a substitution frame.

[0062] Here, CAN frame B is a related frame of CAN frame A. As described above, CAN frame A stores the speed value Va of vehicle V. The speed value Va is a value used for meter display of vehicle V. CAN frame B stores the speed value Vb of vehicle V. The speed value Vb is a value used to calculate the average vehicle speed of vehicle V. The accuracy of the speed value Vb is higher than the accuracy of the speed value Va. Therefore, even if CAN frame B is transmitted instead of CAN frame A, there is a risk of a high processing load on the destination Ethernet ECU 8a due to the high accuracy, but no data will be lost. This prevents the Ethernet ECU 8a from hindering normal operation.

[0063] According to the above configuration, an alternative frame is generated based on CAN frame B, which is an associated frame containing data related to the data in CAN frame A (first frame), and an appropriate alternative frame is transmitted to the Ethernet ECU 8a (destination processing device). This prevents the generation of a normal frame (second frame) based on an abnormal frame, and prevents an abnormal frame from being transmitted to the destination ECU.

[0064] As described above, the in-vehicle device 2 of this embodiment executes a process (step S9) of generating a normal frame (second frame) directed to the Ethernet ECU 8a (destination processing device) based on CAN frame A (first frame) from the CAN-ECU 6a (first source processing device), and a process (step S8) of generating an alternative frame in place of the normal frame when an abnormality in CAN frame A is detected. The alternative frame is generated based on CAN frame B or CAN frame C, which is a related frame containing data related to the data in CAN frame A and is transmitted from at least one of the CAN-ECU 6b and CAN-ECU 6c (second source processing device). This makes it possible to prevent frames containing an abnormality from being transmitted to the destination ECU.

[0065] Furthermore, in the above embodiment, when an abnormality in CAN frame A is detected, the processing unit 20 performs a reference process (step S5) to refer to the alternative table 27 in which the identification information of CAN frame A is associated with the identification information of the related frames CAN frame B and CAN frame C and is registered, and then performs a process (step S6) to identify the related frame based on the reference result of the alternative table 27, so that the processing unit 20 can easily identify the related frame.

[0066] Furthermore, in the above embodiment, the substitution table 27 stores the identification information of multiple candidate frames (CAN frame B and CAN frame C) that are candidates for the associated frame of CAN frame A, in association with the priority of the multiple candidate frames, and an associated frame is selected from the multiple candidate frames based on the priority. This makes it possible to select an associated frame from among the multiple candidate frames. Therefore, even if some of the multiple candidate frames are not provided or are missing, they can be supplemented by other candidate frames.

[0067] Furthermore, in the above embodiment, the case where the transmission destination is only the Ethernet ECU 8a has been exemplified, but multiple Ethernet ECUs 8 are connected to the in-vehicle device 2. Therefore, the in-vehicle device 2 can perform the same relay processing for the multiple Ethernet ECUs 8 as the above-mentioned Ethernet ECU 8a. Therefore, the in-vehicle device 2 can centrally suppress the transmission of abnormal frames to the multiple Ethernet ECUs 8. This eliminates the need to provide multiple Ethernet ECUs 8 with a configuration for processing abnormal frames. As a result, the configuration of the in-vehicle system 1 as a whole can be simplified.

[0068] [Others] It should be noted that the embodiments disclosed herein are illustrative in all respects and should not be considered limiting. In the above embodiment, the case was exemplified where the data of CAN frame B, which is an associated frame of CAN frame A, is the same type of data (speed of vehicle V) as the data of CAN frame A, but the data held by the associated frame may be any data that indirectly indicates the speed of vehicle V. For example, the accelerator opening, engine speed, etc. may be used as data that indirectly indicates the speed of vehicle V.

[0069] For example, in the above embodiment, the state of the ignition switch is used as the state of the vehicle V, but the vehicle speed, an operation mode preset in the vehicle V, or the like may also be used as the state of the vehicle V. In this case, multiple tables are prepared according to the vehicle speed and the operation mode.

[0070] In the above embodiment, the difference Δd between the current data and the most recent data is used to determine whether or not a CAN frame has an abnormality. However, the same type of data can be acquired from another CAN frame and the current data can be compared to determine whether or not a CAN frame has an abnormality. In this case, acquiring multiple pieces of data of the same type and comparing them, including the current data, allows for accurate determination of whether the data is correct.

[0071] For example, when determining whether CAN frame A is abnormal, data from CAN frame A (speed value Va) is acquired, as well as data from CAN frame B (speed value Vb) and data from CAN frame C (integrated pulse value), and the three vehicle speeds are compared. If the speed value Va of CAN frame A is significantly different from the other two pieces of data, it can be determined that CAN frame A has an abnormality. If it can be determined that the speed value Va of CAN frame A is the same as the value of at least one of the other two pieces of data, it can be determined that the speed value Va of CAN frame A is not abnormal.

[0072] Furthermore, in the above embodiment, the case where the sender of CAN frame A is different from the sender of CAN frame B and CAN frame C, which are related frames of CAN frame A, is exemplified. However, there are cases where the sender of CAN frame A and the sender of the related frames of CAN frame A are the same CAN-ECU 6.

[0073] The scope of the present invention is defined by the claims, not by the meaning described above, and is intended to include all modifications within the scope and meaning equivalent to the claims.

[0074] REFERENCE SIGNS LIST 1 In-vehicle system 2 In-vehicle device 4 Central gateway 6, 6a, 6b, 6c, 6d, 6e, 6f CAN-ECU 8, 8a Ethernet ECU 10 CAN bus 12 Ethernet cable 14 CAN bus 16 Control unit 18 Relay processing unit 20 Processing unit 22 Memory 24 Input / output interface 26 Storage unit 27 Alternate table 27a First table 27b Second table 28 Bus 29 Destination table N1 First network N2 Second network V Vehicle

Claims

1. An in-vehicle device comprising: a relay processing unit that relays frames between a plurality of processing devices; and a control unit that controls the relay processing unit, wherein the control unit has a processing unit that executes the following processes: generating a second frame directed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame directed to the destination processing device in place of the second frame, wherein the substitute frame is generated based on an associated frame that is sent from a second source processing device among the plurality of processing devices and includes associated data related to the data in the first frame.

2. The in-vehicle device according to claim 1, wherein the type of data in the first frame and the type of the related data are the same.

3. The in-vehicle device according to claim 1, wherein the associated data is data that directly or indirectly indicates the data in the first frame.

4. The in-vehicle device according to claim 1, wherein the processing unit further executes the following steps when an abnormality in the first frame is detected: a reference process in which the processing unit references a table in which identification information of the first frame and identification information of the related frame are registered in correspondence with each other; and a process in which the related frame is identified based on the result of the reference to the table.

5. The in-vehicle device according to claim 4, wherein the table registers identification information of a plurality of candidate frames that are candidates for the related frame and priorities for the plurality of candidate frames in correspondence with each other, and the process of identifying the related frame includes a process of selecting the candidate frame to be identified as the related frame from among the plurality of candidate frames based on the priorities.

6. The in-vehicle device according to any one of claims 1 to 5, wherein the processing unit further executes the following processes: a process of referencing the data included in the first frame; and a process of determining whether or not there is an abnormality in the first frame based on a comparison result between the data included in the first frame and the data immediately preceding the data included in the first frame.

7. The in-vehicle device according to any one of claims 1 to 6, wherein the processing unit further executes a process of determining whether or not there is an abnormality in the first frame based on the reception interval of the first frame.

8. The in-vehicle device according to claim 4, wherein there are a plurality of tables, and each of the plurality of tables stores identification information of the first frame and identification information of the related frame in association with each other according to the state of the vehicle, and the processing unit further executes a process of selecting a table to be referenced in the reference process from the plurality of tables based on the state of the vehicle.

9. The in-vehicle device according to any one of claims 1 to 8, wherein the processing unit further executes a process of storing a detection result when an abnormality in the first frame is detected.

10. The in-vehicle device according to any one of claims 1 to 8, wherein the communication protocol of the first frame is different from the communication protocols of the second frame and the alternative frame.

11. An in-vehicle system comprising: a plurality of processing devices mounted on a vehicle; and the in-vehicle device according to claim 1, which relays frames provided from said plurality of processing devices.

12. A relay method for relaying frames between a plurality of processing devices, comprising: a step of generating a second frame directed to a destination processing device among the plurality of processing devices based on a first frame from a first source processing device among the plurality of processing devices; and a step of generating, when an abnormality in the first frame is detected, a substitute frame directed to the destination processing device among the plurality of processing devices in place of the second frame, wherein the substitute frame is generated based on an associated frame sent from a second source processing device among the plurality of processing devices, the associated frame including associated data related to the data in the first frame.

13. A computer program for causing a computer to execute relay control of an in-vehicle device that relays frames between multiple processing devices, the computer program causing the computer to execute the following steps: generating a second frame directed to a destination processing device among the multiple processing devices based on a first frame from a first source processing device among the multiple processing devices; and, when an abnormality in the first frame is detected, generating a substitute frame directed to the destination processing device among the multiple processing devices in place of the second frame, wherein the substitute frame is generated based on an associated frame that is sent from a second source processing device among the multiple processing devices and includes associated data related to the data in the first frame.

Images