In-vehicle system and in-vehicle ECU
An in-vehicle system includes: a first in-vehicle device installed in a vehicle; a second in-vehicle device controlled in accordance with a signal output from the first in-vehicle device; a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by signal lines; and a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by the signal lines. The first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a type different from a type of the signal lines, and a communication path from the first in-vehicle device to the second in-vehicle device includes a first path relayed by the first in-vehicle ECU and a second path relayed by the second in-vehicle ECU.
1. An in-vehicle system comprising:
a first in-vehicle device installed in a vehicle;
a second in-vehicle device controlled in accordance with a signal output from the first in-vehicle device;
a first in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by signal lines; and
a second in-vehicle ECU communicably connected to the first in-vehicle device and the second in-vehicle device by the signal lines,
wherein the first in-vehicle ECU and the second in-vehicle ECU are connected by a communication line of a type different from a type of the signal lines, and
a communication path including a first path and a second path independent of the first path, wherein the first in-vehicle ECU relays the first path from the first in-vehicle device to the second in-vehicle device, and the second in-vehicle ECU relays the second path from the first in-vehicle device to the second in-vehicle device so as to provide a redundant path for the signal output from the first in-vehicle device to the second in-vehicle device.
2. The in-vehicle system according to claim 1 , wherein the first in-vehicle ECU and the second in-vehicle ECU each includes a control unit that obtains a signal from the first in-vehicle device over the signal line and generates control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device,
each of the control units of the first in-vehicle ECU and the second in-vehicle ECU is configured to determine, based on a result of communication between the first in-vehicle ECU and the second in-vehicle ECU over the communication line, whether the other in-vehicle ECU is normal or is malfunctioning,
when the first in-vehicle ECU is determined to be malfunctioning, the second in-vehicle ECU substitutes for the first in-vehicle ECU, and
when the second in-vehicle ECU is determined to be malfunctioning, the first in-vehicle ECU substitutes for the second in-vehicle ECU.
3. The in-vehicle system according to claim 2 , wherein the control unit of the second in-vehicle ECU is configured to substitute for the first in-vehicle ECU by outputting the control data to the second in-vehicle device through the second path when the control unit of the second in-vehicle ECU determines that the first in-vehicle ECU is malfunctioning, and
the control unit of the first in-vehicle ECU is configured to substitute for the second in-vehicle ECU by outputting the control data to the second in-vehicle device through the first path when the control unit of the first in-vehicle ECU determines that the second in-vehicle ECU is malfunctioning.
4. The in-vehicle system according to claim 2 , wherein when both the first in-vehicle ECU and the second in-vehicle ECU are determined to be normal, communication from the first in-vehicle device to the second in-vehicle device is performed via the first in-vehicle ECU and the second in-vehicle ECU.
5. The in-vehicle system according to claim 2 , wherein the control unit of the second in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a signal output from the first in-vehicle ECU is not obtained within a predetermined period, that the first in-vehicle ECU is malfunctioning; and
determine, when the signal output from the first in-vehicle ECU is obtained within the predetermined period, that the first in-vehicle ECU is normal.
6. The in-vehicle system according to claim 2 , wherein the control unit of the first in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a response from the second in-vehicle device is not obtained within a predetermined period, that the second in-vehicle ECU is malfunctioning; and
determine, when the response from the second in-vehicle device is obtained within the predetermined period, that the second in-vehicle ECU is normal.
7. The in-vehicle system according to claim 2 , wherein the control unit of the first in-vehicle ECU is configured to:
further output, when a response to the signal is not obtained from the second in-vehicle device within a predetermined period, a confirmation signal to the second in-vehicle ECU over the communication line;
determine, when a response to the confirmation signal is not obtained from the second in-vehicle ECU, that the second in-vehicle ECU is malfunctioning; and
determine, when a response to the confirmation signal is obtained from the second in-vehicle ECU, that the second in-vehicle ECU is normal.
8. The in-vehicle system according to claim 1 , further comprising:
a third in-vehicle ECU connected to the first in-vehicle ECU and the second in-vehicle ECU by communication lines,
wherein a control unit of the third in-vehicle ECU is configured to determine, based on a result of communication with the first in-vehicle ECU and the second in-vehicle ECU over the communication lines, whether the first in-vehicle ECU and the second in-vehicle ECU are normal or are malfunctioning,
when the first in-vehicle ECU is determined to be malfunctioning, the second in-vehicle ECU substitutes for the first in-vehicle ECU, and
when the second in-vehicle ECU is determined to be malfunctioning, the first in-vehicle ECU substitutes for the second in-vehicle ECU.
9. The in-vehicle system according to claim 8 , wherein the control unit of the third in-vehicle ECU is configured to determine whether the first in-vehicle ECU and the second in-vehicle ECU are normal or are malfunctioning based on a result of obtaining signal detection data output from the first in-vehicle ECU and the second in-vehicle ECU in accordance with a signal output by the first in-vehicle device.
10. The in-vehicle system according to claim 8 ,
wherein the third in-vehicle ECU is connected to the first in-vehicle device and the second in-vehicle device via the first in-vehicle ECU or the second in-vehicle ECU rather than being directly connected by the signal lines.
11. An in-vehicle ECU communicably connected along a first path of a communication path, by signal lines, to a first in-vehicle device and a second in-vehicle device installed in a vehicle, the in-vehicle ECU configured to relay the first path from the first in-vehicle device to the second in-vehicle device,
wherein the in-vehicle ECU is connected, by a communication line of a type different from a type of the signal lines, to another in-vehicle ECU communicably connected along a second path of the communication path to the first in-vehicle device and the second in-vehicle device by the signal lines, the other in-vehicle ECU configured to relay the second path from the first in-vehicle device to the second in-vehicle device,
the in-vehicle ECU comprises a control unit configured to obtain a signal from the first in-vehicle device over the signal line and generate control data for controlling the second in-vehicle device based on the signal output from the first in-vehicle device, and
the control unit is configured to:
determine whether the other in-vehicle ECU is normal or is malfunctioning based on a result of communication with the other in-vehicle ECU; and
when the other in-vehicle ECU is determined to be malfunctioning, perform processing substituting for the other in-vehicle ECU.
12. The in-vehicle system according to claim 3 , wherein when both the first in-vehicle ECU and the second in-vehicle ECU are determined to be normal, communication from the first in-vehicle device to the second in-vehicle device is performed via the first in-vehicle ECU and the second in-vehicle ECU.
13. The in-vehicle system according to claim 3 , wherein the control unit of the second in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a signal output from the first in-vehicle ECU is not obtained within a predetermined period, that the first in-vehicle ECU is malfunctioning; and
determine, when the signal output from the first in-vehicle ECU is obtained within the predetermined period, that the first in-vehicle ECU is normal.
14. The in-vehicle system according to claim 4 , wherein the control unit of the second in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a signal output from the first in-vehicle ECU is not obtained within a predetermined period, that the first in-vehicle ECU is malfunctioning; and
determine, when the signal output from the first in-vehicle ECU is obtained within the predetermined period, that the first in-vehicle ECU is normal.
15. The in-vehicle system according to claim 3 , wherein the control unit of the first in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a response from the second in-vehicle device is not obtained within a predetermined period, that the second in-vehicle ECU is malfunctioning; and
determine, when the response from the second in-vehicle device is obtained within the predetermined period, that the second in-vehicle ECU is normal.
16. The in-vehicle system according to claim 4 , wherein the control unit of the first in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a response from the second in-vehicle device is not obtained within a predetermined period, that the second in-vehicle ECU is malfunctioning; and
determine, when the response from the second in-vehicle device is obtained within the predetermined period, that the second in-vehicle ECU is normal.
17. The in-vehicle system according to claim 5 , wherein the control unit of the first in-vehicle ECU is configured to, after obtaining the signal from the first in-vehicle device:
determine, when a response from the second in-vehicle device is not obtained within a predetermined period, that the second in-vehicle ECU is malfunctioning; and
determine, when the response from the second in-vehicle device is obtained within the predetermined period, that the second in-vehicle ECU is normal.
18. The in-vehicle system according to claim 3 , wherein the control unit of the first in-vehicle ECU is configured to:
further output, when a response to the signal is not obtained from the second in-vehicle device within a predetermined period, a confirmation signal to the second in-vehicle ECU over the communication line;
determine, when a response to the confirmation signal is not obtained from the second in-vehicle ECU, that the second in-vehicle ECU is malfunctioning; and
determine, when a response to the confirmation signal is obtained from the second in-vehicle ECU, that the second in-vehicle ECU is normal.
19. The in-vehicle system according to claim 4 , wherein the control unit of the first in-vehicle ECU is configured to:
further output, when a response to the signal is not obtained from the second in-vehicle device within a predetermined period, a confirmation signal to the second in-vehicle ECU over the communication line;
determine, when a response to the confirmation signal is not obtained from the second in-vehicle ECU, that the second in-vehicle ECU is malfunctioning; and
determine, when a response to the confirmation signal is obtained from the second in-vehicle ECU, that the second in-vehicle ECU is normal.
20. The in-vehicle system according to claim 5 , wherein the control unit of the first in-vehicle ECU is configured to:
further output, when a response to the signal is not obtained from the second in-vehicle device within a predetermined period, a confirmation signal to the second in-vehicle ECU over the communication line;
determine, when a response to the confirmation signal is not obtained from the second in-vehicle ECU, that the second in-vehicle ECU is malfunctioning; and
determine, when a response to the confirmation signal is obtained from the second in-vehicle ECU, that the second in-vehicle ECU is normal.