JP7593867B2 - Communication network system, monitoring device, and monitoring program - Google Patents

Description

The present invention relates to a communication network system, a monitoring device, and a monitoring program.

As an example of a conventional communication network system mounted on a vehicle, Patent Document 1 discloses a switch device mounted on the vehicle. The switch device includes a holding unit, a switch unit, and a control unit. The holding unit holds communication data to be relayed. The switch unit relays the communication data. When communication data to be transmitted to a device in which an abnormality is detected is held in the holding unit, the control unit transmits stop request data to at least one communication device mounted on the vehicle and on a path from its own switch device to the source of the communication data, requesting the stop of transmission of communication data to its own switch device and the retention of the communication data to be transmitted to its own switch device.

JP 2018-113505 A

However, there is still room for improvement in such switch devices, for example in terms of recovery from communication failures.

The present invention has been made in consideration of the above circumstances, and aims to provide a communication network system, monitoring equipment, and monitoring program that can properly restore communications.

In order to achieve the above object, the communication network system of the present invention comprises a network capable of communication, a plurality of communication devices connected to the network, and a monitoring device connected to the network, which performs connection checks on the plurality of communication devices, detects an abnormal device from the plurality of communication devices, and is capable of executing a process of restricting communication involving the abnormal device for the other communication devices other than the abnormal device, and the monitoring device is characterized in that it is capable of executing a process of lifting the restriction on communication for the other communication devices based on the planned failure recovery period set for the abnormal device out of the planned failure recovery period expected for failure recovery, which is a period that is individually set in advance for the plurality of communication devices.

In order to achieve the above object, the monitoring device of the present invention comprises a communication connection unit connected to a network, and a processing unit capable of executing a process of performing connection checks on a plurality of communication devices connected to the network, detecting an abnormal device from the plurality of communication devices, and restricting communications involving the abnormal device for the other communication devices other than the abnormal device, and the processing unit is capable of executing a process of lifting the restriction on communications for the other communication devices based on the planned failure recovery period set for the abnormal device out of the planned failure recovery period expected for failure recovery, which is a period that is individually set in advance for the plurality of communication devices.

To achieve the above object, the monitoring program of the present invention is characterized in that it causes a computer to execute each process of performing connection checks for multiple communication devices connected to a network, detecting an abnormal device from the multiple communication devices, restricting communications involving the abnormal device for the other communication devices other than the abnormal device, and lifting the restriction on communications for the other communication devices based on the planned failure recovery period set for the abnormal device out of the planned failure recovery period expected for failure recovery, which is a period that is individually set in advance for the multiple communication devices.

The communication network system, monitoring device, and monitoring program of the present invention check the connections of multiple communication devices connected to the network and detect abnormal devices from the multiple communication devices. When the communication network system, monitoring device, and monitoring program detect an abnormal device, they restrict communications involving the abnormal device with other communication devices other than the abnormal device. Thereafter, the communication network system, monitoring device, and monitoring program lift the restriction on communications with other communication devices based on a planned failure recovery period that is individually set in advance for the abnormal device. As a result, the communication network system, monitoring device, and monitoring program have the effect of being able to properly restore communications.

FIG. 1 is a block diagram showing a schematic configuration of a communication network system according to a first embodiment. FIG. 2 is a block diagram showing a schematic configuration of the monitoring device according to the first embodiment. FIG. 3 is a flowchart illustrating an example of a process performed by the communication network system according to the first embodiment. FIG. 4 is a time chart illustrating an example of the operation of the communication network system according to the comparative example. FIG. 5 is a time chart illustrating an example of the operation of the communication network system according to the first embodiment. FIG. 6 is a flowchart illustrating an example of a process performed by the communication network system according to the second embodiment. FIG. 7 is a time chart illustrating an example of the operation of the communication network system according to the comparative example. FIG. 8 is a time chart illustrating an example of the operation of the communication network system according to the second embodiment. FIG. 9 is a block diagram showing a schematic configuration of a monitoring device according to the third embodiment. FIG. 10 is a flowchart illustrating an example of a process performed by the communication network system according to the third embodiment. FIG. 11 is a time chart illustrating an example of the operation of the communication network system according to the comparative example. FIG. 12 is a time chart illustrating an example of the operation of the communication network system according to the third embodiment.

Below, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. Furthermore, the components in the following embodiment include those that are easily replaceable by a person skilled in the art, or those that are substantially the same.

[Embodiment 1]
The communication network system 1 of the present embodiment shown in Fig. 1 is, for example, mounted on a vehicle and constitutes an in-vehicle network system that connects in-vehicle devices provided on the vehicle so that they can communicate with each other. The communication network system 1 is realized by mounting the components shown in Fig. 1 on a vehicle.

In recent years, in-vehicle network systems such as the communication network system 1 have seen the development and spread of in-vehicle applications related to autonomous driving and ADAS (Advanced Driver-Assistance Systems). Such in-vehicle network systems are required to have higher real-time capabilities and reliability.

In light of this background, the communication network system 1 of this embodiment is a system that identifies abnormal devices from among multiple communication devices 2 connected to a network N and regulates communications involving the abnormal devices, and achieves faster recovery of communications based on various periods that are individually set in advance for each communication device 2. The configuration of the communication network system 1 will be described in detail below with reference to the various figures.

Specifically, the communication network system 1 includes a network N, a plurality of communication devices 2, and a monitoring device 3.

Network N constitutes a communication network that connects multiple devices so that they can communicate with each other. Network N enables communication using various known communication methods that are applicable to this system.

The communication device 2 is an electronic device connected to the network N. The multiple communication devices 2 include, for example, an ECU (Electronic Control Unit) 2A constituting an in-vehicle device and a HUB 2B constituting a network device. The ECU 2A is an electronic control unit that controls the in-vehicle devices mounted on the vehicle to realize various functions. Here, multiple ECUs 2A are connected to the HUB 2B and the monitoring device 3 via the network N. The HUB 2B is a relay device that relays mutual communication between the multiple communication devices 2 and the monitoring device 3 on the network N. The HUB 2B is a concentrator that is interposed between the monitoring device 3 and the multiple communication devices 2 (here, the ECU 2A) and consolidates the connection destinations of the multiple communication devices 2, and relays signals (information). Each communication device 2 is configured to be able to transmit a response to the connection confirmation to the monitoring device 3 via the network N when it receives a connection confirmation (request) from the monitoring device 3 via the network N.

The monitoring device 3 is an electronic device that is connected to the network N and monitors communication failures in the network N and regulates communication as necessary. In general terms, the monitoring device 3 checks the connection of each communication device 2 via the network N at regular intervals or at any timing to detect failures, and instructs communication devices 2 other than the abnormal device in which a failure has been detected to regulate communications involving the abnormal device. The monitoring device 3 in this embodiment is configured by a gateway that constitutes a network device. In other words, the monitoring device 3 has a network monitoring function as well as a GW function that performs protocol conversion.

Specifically, as shown in FIG. 2, the monitoring device 3 includes a communication connection unit 31, a memory unit 32, and a processing unit 33. The communication connection unit 31, the memory unit 32, and the processing unit 33 are connected to each other so that they can communicate with each other and can exchange various information with each other.

The communication connection unit 31 is a communication interface that is connected to the network N and communicates with the communication device 2 on the network N by sending and receiving signals (information).

The memory unit 32 is a storage device that stores various data (information). The memory unit 32 is realized, for example, by a semiconductor memory element such as a RAM or a flash memory, a hard disk, an optical disk, etc. The memory unit 32 stores, for example, programs for the surveillance device 3 to realize various functions. The programs stored in the memory unit 32 include a program that causes the communication connection unit 31 to function, a program that causes the processing unit 33 to function, etc. The memory unit 32 also stores various data such as data necessary for various processes in the processing unit 33. These various data are read out of the memory unit 32 by the processing unit 33, etc. as needed.

The processing unit 33 is a computing device that realizes various processing functions in the monitoring device 3. The processing unit 33 is composed of an electronic circuit that mainly includes a well-known microcomputer including a central processing unit such as a CPU (Central Processing Unit). The processing unit 33 realizes each processing function, for example, by executing a program read from the memory unit 32.

The above describes an overview of the overall configuration of the communication network system 1 and the monitoring device 3 according to this embodiment. With this configuration, the processing unit 33 of the monitoring device 3 according to this embodiment has the function of detecting a communication failure in the network N, restricting communication, and executing various processes for lifting the communication restriction based on various periods that are individually set in advance for each communication device 2. In addition, the memory unit 32 of the monitoring device 3 according to this embodiment has a memory area for storing various data.

Specifically, as shown in FIG. 2, the memory unit 32 in this embodiment is conceptually configured to include a planned failure recovery period memory area 32A in order to realize various processing functions by the processing unit 33.

The planned failure recovery period storage area 32A is a storage area that stores a planned failure recovery period used in the process of lifting communication restrictions by the processing unit 33. The planned failure recovery period is a period that is individually set in advance for multiple communication devices 2 (each ECU 2A, each HUB 2B, etc.), and is the period expected for recovery from a communication failure when the communication failure occurs.

The communication failure referred to here refers to a software failure such as a buffer write error that can be restored to a normal state by resetting the software, and does not include hardware failures such as disconnection or physical failure. In other words, this planned failure recovery period typically corresponds to the period required for software resetting of the communication device 2 or devices on the communication path, and is set in advance individually according to each communication device 2, for example, based on an actual device evaluation, etc.

The planned failure recovery period may be registered in advance in the planned failure recovery period storage area 32A, or may be notified from the communication device 2 to the monitoring device 3 when communication with each communication device 2 is started, and may be registered in the planned failure recovery period storage area 32A. In addition, the planned failure recovery period may be determined by learning the time from the actual occurrence of the failure to recovery.

The processing unit 33 of this embodiment is conceptually configured to include a GW processing unit 33A, a monitoring processing unit 33B, and a communication restriction processing unit 33C in order to realize the various processing functions described above, as shown in FIG. 2. The processing unit 33 realizes each of the processing functions of the GW processing unit 33A, the monitoring processing unit 33B, and the communication restriction processing unit 33C, for example, by executing a program read from the storage unit 32.

The GW processing unit 33A is a part that has a function capable of executing protocol conversion processing. The GW processing unit 33A executes protocol conversion processing to convert between different protocols used in the network N when relaying communications between devices on the network N.

The monitoring processing unit 33B is a part that has a function capable of executing monitoring processing. The monitoring processing executed by the monitoring processing unit 33B is a process of checking the connection to multiple communication devices 2 via the network N and detecting abnormal devices from the multiple communication devices 2.

More specifically, in the monitoring process, the monitoring processing unit 33B transmits a connection confirmation (request) to each of the multiple communication devices 2 from the communication connection unit 31 via the network N, and executes a process to confirm the existence of each communication device 2. The connection confirmation (request) is, for example, Ethernet (registered trademark) OAM (Operations Administration Maintenance) or ping, and is a command that can confirm a connection in a communication network. The monitoring processing unit 33B may identify the destination communication device 2 based on various addresses, etc., and may transmit a connection confirmation at regular intervals or at any timing.

In the monitoring process, the monitoring processing unit 33B executes a process of receiving a response to the connection confirmation from each communication device 2 via the network N. The monitoring processing unit 33B judges the presence or absence of a response from each communication device 2 for each control period, and judges whether or not there has been a response to the connection confirmation for each communication device 2 based on various addresses, identifiers, etc. contained in the response. The monitoring processing unit 33B judges a communication device 2 that has responded to the connection confirmation to be in a normal state (a state in which survival is confirmed). On the other hand, the monitoring processing unit 33B judges a communication device 2 that does not respond to the connection confirmation to be in an abnormal state (a state in which survival is not confirmed), and detects the communication device 2 as an abnormal device in which a communication failure (a failure in which a response cannot be made to a request) has occurred. The monitoring processing unit 33B identifies the abnormal device in which a communication failure has occurred based on various addresses, identifiers, etc.

In this way, the monitoring processing unit 33B uses monitoring processing to identify an abnormal device in which a communication failure has occurred from among multiple communication devices 2.

The communication restriction processing unit 33C is a part that has the function of executing communication restriction processing and communication restriction release processing.

The communication restriction process executed by the communication restriction processing unit 33C is a process that restricts communications involving the abnormal device other than the abnormal device detected by the above-mentioned monitoring process.

More specifically, in this communication restriction process, the communication restriction processing unit 33C transmits a communication restriction instruction from the communication connection unit 31 via the network N to the other communication devices 2 other than the abnormal device in which the communication failure occurred, and executes a process to restrict communication between the abnormal device and the other communication devices 2. This communication restriction process enables the communication network system 1 to prevent communication to the abnormal device from being repeated unnecessarily, and for example, to prevent the communication bandwidth in the network N from being used unnecessarily.

On the other hand, the communication restriction release process executed by the communication restriction processing unit 33C is a process for releasing the communication restriction on communication devices 2 other than the abnormal device executed by the above-mentioned communication restriction process.

In the communication restriction release process, the communication restriction processing unit 33C of this embodiment executes a process of releasing the restriction on communication with other communication devices 2 based on the planned failure recovery period set for the abnormal device among the planned failure recovery periods that are individually set in advance for the multiple communication devices 2. In this case, the communication restriction processing unit 33C reads out the planned failure recovery period set for the abnormal device detected by the above-mentioned monitoring process from the planned failure recovery periods of each communication device 2 stored in the planned failure recovery period storage area 32A, and uses it for the communication restriction release process. In addition, the communication restriction processing unit 33C executes the communication restriction release process for the communication device 2 whose communication with the abnormal device is restricted by the above-mentioned communication restriction process.

More specifically, after the monitoring processing unit 33B detects an abnormal device, the communication restriction processing unit 33C of this embodiment executes a process to lift the restriction on communication with the other communication device 2 when the planned failure recovery period set for the abnormal device has elapsed, without performing another connection check for the abnormal device. In this case, the communication restriction processing unit 33C transmits a communication restriction lift instruction from the communication connection unit 31 via the network N to the communication device 2 for which communication restriction is being performed, and executes a process to lift the restriction on communication with the communication device 2. This communication restriction lift process enables the communication network system 1 to lift the restriction on communication with the other communication device 2 without waiting for the next control period for connection check when the planned failure recovery period for the abnormal device has elapsed since the abnormal device was detected, thereby restoring communication.

Next, the processing steps of the monitoring method in the communication network system 1 will be described with reference to the flowchart in FIG.

The monitoring method in the communication network system 1 shown in FIG. 3 includes monitoring steps (S1 to S3), a communication restriction step (S4), and a communication restriction release step (S5 to S6). Here, the processing related to each of the above steps is executed by the processing unit 33 of the monitoring device 3.

First, the monitoring processing unit 33B of the processing unit 33 executes a step (S1) of transmitting a connection confirmation (request) from the communication connection unit 31 to each of the multiple communication devices 2 via the network N. In this example, the monitoring processing unit 33B transmits the connection confirmation at regular intervals.

Next, the monitoring processing unit 33B executes a step (S2) of determining whether or not a response to the connection confirmation has been received from each communication device 2 via the network N, i.e., whether or not a response has been received.

When the monitoring processing unit 33B determines that a response has been received from the communication device 2, i.e., when it determines that a response has been received (S2: Yes), it determines that the communication device 2 is in a normal state, ends the current control cycle, and transitions to the next control cycle.

If the monitoring processing unit 33B determines that no response has been received from the communication device 2, i.e., that there has been no response (S2: No), it executes a step (S3) of detecting the communication device 2 as an abnormal device in which a communication failure has occurred.

The above-mentioned steps (S1 to S3) correspond to a monitoring step in which connection checks are performed on multiple communication devices 2 connected to the network N and abnormal devices are detected from the multiple communication devices 2, and are executed on all communication devices 2 on the network N.

Then, the communication restriction processing unit 33C of the processing unit 33 executes a step (S4) of transmitting a communication restriction instruction from the communication connection unit 31 via the network N to the communication devices 2 other than the abnormal device detected in the above-mentioned monitoring steps (S1 to S3).

This step (S4) corresponds to a communication restriction step that restricts communications involving the abnormal device other than the communication device 2 detected in the above-mentioned monitoring steps (S1 to S3), and is executed for all communication devices 2 other than the abnormal device.

Then, the communication restriction processing unit 33C reads out the planned fault recovery period of the abnormal device detected in the above-mentioned monitoring steps (S1 to S3) from the planned fault recovery period storage area 32A, and executes a step (S5) of determining whether the planned fault recovery period has elapsed since the abnormal device was detected.

If the communication restriction processing unit 33C determines that the planned failure recovery period has not elapsed, it repeats step (S5).

When the communication restriction processing unit 33C determines that the planned failure recovery period has elapsed, it executes a step (S6) of sending a communication restriction release instruction from the communication connection unit 31 via the network N to the communication device 2 on which communication restriction was executed in the above-mentioned communication restriction step (S4), ends the current control cycle, and transitions to the next control cycle.

The above-mentioned steps (S5 to S6) correspond to a communication restriction release step that releases the communication restriction for other communication devices 2 based on the planned failure recovery period set for the abnormal device, and are executed for all communication devices 2 for which communication restrictions have been implemented.

The above-mentioned monitoring method can be realized by executing a prepared monitoring program on the computer constituting the monitoring device 3. This monitoring program causes the computer to execute each process such as the above-mentioned monitoring steps (S1 to S3), communication restriction step (S4), and communication restriction release step (S5 to S6).

Next, an example of the operation of the communication network system 1 configured as above will be described. Here, in order to easily explain the operation of the communication network system 1, first, the operation of the communication network system according to the comparative example will be described with reference to FIG. 4, and then the operation of the communication network system 1 according to the present embodiment will be described with reference to FIG. 5. The monitoring device 1003 of the communication network system according to the comparative example described in FIG. 4 does not perform the process of lifting communication restrictions based on the planned failure recovery period as described above, but instead performs connection confirmation and lifts the communication restrictions after actually confirming that the abnormal device has been restored.

In the explanation of Figures 4 and 5, for convenience, one of the ECUs 2A connected to the monitoring device (GW) 3, 1003 without going through the HUB 2B will be referred to as "ECU 2A-1", and one of the ECUs 2A connected to the HUB 2B will be referred to as "ECU 2A-2". In addition, in this explanation, the first ECU 2A, "ECU 2A-1", is the communication device 2 subject to communication restrictions, and the second ECU 2A, "ECU 2A-2", is the abnormal device.

The monitoring device 1003 according to the comparative example illustrated in Figure 4 transmits a connection confirmation to each of ECU2A-1, ECU2A-2, and HUB2B at a period T, and confirms the survival of each communication device 2 (ECU2A-1, ECU2A-2, HUB2B). When a communication failure occurs in ECU2A-2 at time t11, the monitoring device 1003 detects that a communication failure has occurred in ECU2A-2 at time t12 due to the absence of a response to the connection confirmation sent to ECU2A-2 at the next period T, and detects the ECU2A-2 as an abnormal device. The monitoring device 1003 then transmits a communication restriction instruction to ECU2A-1 at time t13, and restricts communication involving ECU2A-2 with the ECU2A-1. If there is no response to the connection confirmation sent to the ECU 2A-2 in the next period T, the monitoring device 1003 determines that the communication failure of the ECU 2A-2 is still ongoing.

If the ECU 2A-2 recovers from the communication failure immediately thereafter at time t14, the monitoring device 1003 does not transmit a connection confirmation to the ECU 2A-2 until the next cycle T, and is therefore unable to detect the recovery of the ECU 2A-2 from the communication failure until then. The monitoring device 1003 can finally detect the recovery of the ECU 2A-2 from the communication failure at time t15, based on the response to the connection confirmation transmitted to the ECU 2A-2 in the next cycle T. In other words, in the communication network system of the comparative example, depending on the timing of the connection confirmation, a delay T0 of up to the cycle T may occur between the actual recovery of the ECU 2A-2 from the communication failure (time t14) and the detection of the recovery (time t15).

Then, when the monitoring device 1003 detects that the ECU 2A-2 has recovered from the communication failure, it transmits a communication restriction release instruction to the ECU 2A-1 that is implementing the communication restriction at time t16, and lifts the communication restriction for that ECU 2A-1.

As described above, in the communication network system of the comparative example, the period from time t11 to time t16 is the period T1 required from the occurrence of a communication failure in ECU2A-2 to the restoration of communication in the entire system.

In contrast, the monitoring device 3 according to this embodiment illustrated in FIG. 5 detects that a communication failure has occurred in the ECU 2A-2 at time t12, detects the ECU 2A-2 as an abnormal device, and then does not check the connection to the ECU 2A-2 again. Then, at time t14-1, which is the time when the planned failure recovery period TA set for the ECU 2A-2 has elapsed from time 12 when the monitoring device 3 detected that a communication failure has occurred in the ECU 2A-2, the monitoring device 3 sends a communication restriction release instruction to the ECU 2A-1 that is implementing the communication restriction, and releases the communication restriction for the ECU 2A-1.

As a result, in the communication network system 1 according to this embodiment, the period from time t11 to time t14-1 is the period T2 required from the occurrence of a communication failure in ECU2A-2 to the restoration of communication in the entire system, which is a relatively short period compared to the above-mentioned period T1.

In addition, in the communication network system 1, if the failure in the communication device 2 is due to a hardware failure such as a broken wire or physical breakdown, the detection of the communication failure, the restriction of communication, and the release of the restriction of communication will be repeated even if the above-mentioned processing is performed. In such a case, the monitoring device 3 can determine that it is a hardware failure and move on to other processing.

The communication network system 1, monitoring device 3, and monitoring program described above perform connection checks on multiple communication devices 2 connected to the network N and detects abnormal devices from the multiple communication devices 2. When the monitoring device 3 detects an abnormal device, it restricts communications involving the abnormal device to other communication devices 2 other than the abnormal device. Through this process, the communication network system 1 can prevent unnecessary repetition of communications to the abnormal device, and can, for example, prevent the communication bandwidth in the network N from being wasted.

Then, the monitoring device 3 lifts the restriction on communications with other communication devices 2 based on the planned failure recovery period that is individually set in advance for the abnormal device. With this process, the communication network system 1 can automatically lift the restriction on communications with other communication devices 2 and restore communications according to the planned failure recovery period expected in advance for the communication device 2 that has become the abnormal device, thereby restoring communications. As a result, the communication network system 1 can relatively shorten the period required from the occurrence of a communication failure, through communication restriction, to the lifting of the communication restriction. This allows the communication network system 1 to achieve faster communication recovery at reduced costs, without having to implement additional functions, such as a self-diagnosis function or a function for notifying recovery from a communication failure.

As described above, the communication network system 1, the monitoring device 3, and the monitoring program can properly restore communications, for example, shortening the time that communications are suppressed in the event of a network failure, and achieving faster restoration of communications.

More specifically, the communication network system 1, the monitoring device 3, and the monitoring program can lift the communication restriction on the other communication devices 2 and restore communication without waiting for the next connection confirmation cycle when the planned fault recovery period for the abnormal device has elapsed from the time when the abnormal device is detected. This process allows the communication network system 1 to suppress delays between the recovery of the actual communication fault of the abnormal device and the lifting of the communication restriction on the other communication devices 2, regardless of the timing of the connection confirmation. As a result, the communication network system 1, the monitoring device 3, and the monitoring program can properly restore communication as described above.

[Embodiment 2]
The communication network system, monitoring device, and monitoring program according to the second embodiment differ from those of the first embodiment in the execution conditions of the communication restriction process. In the following, the same components as those in the above-mentioned embodiments are given the same reference numerals, and duplicated explanations of the common configurations, actions, and effects are omitted as much as possible (the same applies below).

As shown in FIG. 6, the communication network system 1, monitoring device 3, and monitoring program of this embodiment differ from those of the first embodiment described above in terms of the execution conditions for the communication restriction process. The other configurations of the communication network system 1, monitoring device 3, and monitoring program of this embodiment are substantially the same as those of the first embodiment described above.

In this embodiment, the communication restriction processing unit 33C of the monitoring device 3 does not restrict communication with other communication devices 2 if the planned failure recovery period set for the abnormal device is shorter than the first judgment period set in advance.

For example, as shown in the flowchart of FIG. 6, after detecting an abnormal device (S3), the communication restriction processing unit 33C reads out the planned failure recovery period of the detected abnormal device from the planned failure recovery period storage area 32A. Then, the communication restriction processing unit 33C executes a step (S4A) of determining whether the planned failure recovery period set for the abnormal device is shorter than a first judgment period set in advance. If the communication restriction processing unit 33C determines that the planned failure recovery period is equal to or longer than the first judgment period (S4A: No), it proceeds to step (S4) and executes communication restriction processing on communication devices 2 other than the abnormal device. On the other hand, if the communication restriction processing unit 33C determines that the planned failure recovery period is shorter than the first judgment period (S4A: Yes), it does not execute communication restriction processing on communication devices 2 other than the abnormal device, does not restrict communication, ends the current control period, and transitions to the next control period.

As described above, in the communication restriction process, a communication restriction instruction is sent to the other communication devices 2 other than the abnormal device, and a process of restricting communication is executed. For example, the monitoring device 1003 according to the comparative example in FIG. 7 executes a communication restriction process on the other communication devices 2 after detecting the abnormal device. In this case, in the communication network system according to the comparative example, if the planned failure recovery period of the abnormal device is relatively short compared to the connection confirmation period T, the communication restriction may be performed even though the abnormal device has already recovered, which may result in a longer period required for communication recovery in the entire system. For example, in the communication network system according to the comparative example illustrated in FIG. 7, the communication failure of ECU2A-2 has already been recovered at time t22, immediately after the abnormal device is detected at time t21. Therefore, in the communication network system according to this comparative example, by performing the communication restriction process thereafter, the period T3 required for communication recovery in the entire system is relatively longer by the period T00 from time t22 when the communication failure of ECU2A-2 is actually recovered to time t23 when the communication restriction release process is performed.

In contrast, the communication restriction processing unit 33C of this embodiment does not restrict communication with other communication devices 2 when the planned failure recovery period set for the abnormal device is shorter than the first judgment period. In other words, the communication restriction processing unit 33C does not perform the communication restriction process when the planned failure recovery period is relatively short and it is highly likely that the failure has already been recovered by the time the communication restriction process is performed. With this process, the communication network system 1 can set the period T4 required from the occurrence of a communication failure in ECU 2A-2 to communication recovery in the entire system to a relatively short period compared to the above-mentioned period T3 in cases where restricting communication would actually lengthen the period required for communication recovery in the entire system, as exemplified in FIG. 8.

Here, the first judgment period described above is a judgment threshold value that is preset for the planned fault recovery period of the abnormal device in order to determine whether or not to execute the communication restriction process. For example, in the communication network system 1, if the planned fault recovery period of the abnormal device is shorter than the connection confirmation period T, communication restriction may not be performed. For example, in the communication network system 1, if the connection confirmation period T is 300 msec and the planned fault recovery period of the abnormal device is 200 msec, communication restriction will stop communication for at least 300 msec, but communication will resume in at most 200 msec if communication restriction is not performed. From the above perspective, the first judgment period is preset as a sufficiently short period based on actual device evaluation, etc., taking into account the allowable range of unnecessary communication to the abnormal device due to not restricting communication, for example, based on the connection confirmation period T, etc.

The communication network system 1, monitoring device 3, and monitoring program of this embodiment described above can properly restore communications, similar to embodiment 1.

Furthermore, the communication network system 1, monitoring device 3, and monitoring program of this embodiment do not restrict communication with other communication devices 2 if the planned failure recovery period set for the abnormal device is shorter than the first judgment period. This process enables the communication network system 1 to prevent communication restriction from lengthening the time required to restore communication in the entire system. As a result, the communication network system 1, monitoring device 3, and monitoring program of this embodiment can restore communication more appropriately.

[Embodiment 3]
The communication network system, the monitoring device, and the monitoring program according to the third embodiment differ from those of the second embodiment in the execution conditions of the communication restriction process.

The communication network system 1, monitoring device 3, and monitoring program of this embodiment shown in FIG. 9 differ from those of the above-described embodiment 2 in terms of the execution conditions for the communication restriction process, as shown in FIG. 10. The other configurations of the communication network system 1, monitoring device 3, and monitoring program of this embodiment are substantially the same as those of the above-described embodiment 2.

In terms of function and concept, the memory unit 32 in this embodiment is configured to include a storage area 232B for the period required for lifting communication restrictions in addition to a storage area 32A for the planned period for recovery from a failure.

The communication restriction lifting period memory area 232B is a memory area that stores the communication restriction lifting period used by the processing unit 33 to determine whether or not to implement communication restriction. The communication restriction lifting period is a period that is individually set in advance for multiple communication devices 2 (each ECU 2A, each HUB 2B, etc.), and is the period expected from the transmission of a communication restriction lifting instruction until the restriction on communication is lifted when communication restriction is implemented. The communication restriction lifting period is individually set in advance as a period corresponding to each communication device 2, for example, based on actual device evaluation, etc.

The period required for lifting the communication restriction may be registered in advance in the period required for lifting the communication restriction storage area 232B, or may be notified to the monitoring device 3 from the communication device 2 when communication with each communication device 2 is started, and registered in the period required for lifting the communication restriction storage area 232B. In addition, the period required for lifting the communication restriction may be learned by learning the time from the transmission of an actual instruction to lift the communication restriction to the lifting of the restriction.

The communication restriction processing unit 33C of the monitoring device 3 in this embodiment does not restrict communication with the other communication devices 2 if the communication restriction lifting period set for the other communication devices 2 other than the abnormal device, among the communication restriction lifting periods set individually in advance for the multiple communication devices 2, is longer than the second judgment period set in advance.

For example, as shown in the flowchart of FIG. 10, when the communication restriction processing unit 33C determines that the planned failure recovery period is equal to or longer than the first judgment period (S4A: No), it reads out the communication restriction lifting period required for the communication devices 2 other than the abnormal device from the communication restriction lifting period required storage area 232B. Then, the communication restriction processing unit 33C executes a step (S4B) of determining whether the communication restriction lifting period set for the communication devices 2 that may be subject to communication restriction is longer than the second judgment period set in advance. When the communication restriction processing unit 33C determines that the communication restriction lifting period is equal to or shorter than the second judgment period (S4B: No), it proceeds to step (S4) and executes communication restriction processing for the communication devices 2 other than the abnormal device. On the other hand, when the communication restriction processing unit 33C determines that the communication restriction lifting period is longer than the second judgment period (S4B: Yes), it does not execute communication restriction processing for the communication devices 2 other than the abnormal device, does not perform communication restriction itself, ends the current control period, and transitions to the next control period. The communication restriction processing unit 33C performs the determination of step (S4B) individually for all communication devices 2 that may be subject to communication restriction, and executes steps subsequent to step (S4) individually as necessary.

As described above, in the communication restriction release process, a communication restriction release instruction is sent to the communication device 2 that is performing the communication restriction, and a process for releasing the communication restriction is executed. For example, the monitoring device 1003 according to the comparative example in FIG. 11 detects the recovery of the abnormal device, and then transmits a communication restriction release instruction to the other communication device 2 and executes the communication restriction release process. In this case, in the communication network system according to the comparative example, if the period required for the communication restriction release of the communication device 2 is relatively long, the period required for the communication recovery of the entire system may be longer by restricting the communication. For example, in the communication network system according to the comparative example illustrated in FIG. 11, the period T000 (corresponding to the above-mentioned communication restriction release period) from the time t31 when the communication restriction release instruction is sent to the communication device 2 to the time t32 when the communication of the communication device 2 is actually resumed tends to be relatively long. Therefore, in the communication network system according to this comparative example, the period T4 required for the communication recovery of the entire system may be relatively longer depending on the length of the period T000 by performing the communication restriction process.

In contrast, the communication restriction processing unit 33C of this embodiment does not restrict communication with other communication devices 2 if the period required to lift the communication restriction set for the communication devices 2 other than the abnormal device is longer than the second judgment period. In other words, the communication restriction processing unit 33C does not perform the communication restriction process for a communication device 2 that requires a relatively long period to lift the communication restriction. With this process, the communication network system 1 can set the period T6 required from the occurrence of a communication failure in ECU 2A-2 to the recovery of communication in the entire system to a relatively short period compared to the above-mentioned period T5 when there is a communication device 2 that requires a relatively long period to lift the communication restriction, as illustrated in FIG. 12.

The second determination period described above is a determination threshold that is set in advance for the period required to lift the communication restriction on the communication device 2 in order to determine whether or not to execute the communication restriction process. The second determination period is set, for example, according to the allowable communication interruption time due to a communication failure in the entire system.

For example, assume that in communication network system 1, the connection confirmation period T is 50 msec, the planned fault recovery period for an abnormal device is 150 msec, the period required to lift the communication restriction for communication device 2 that may be subject to communication restriction is 70 msec, and the allowable communication cutoff time due to a communication failure in the entire system is 250 msec. In this case, in communication network system 1, if communication restriction is imposed on communication device 2 that may be subject to communication restriction, the period required from the occurrence of the communication failure to communication recovery in the entire system is [planned fault recovery period: 150 msec] + [time required to lift communication restriction: 70 msec] = 220 msec, and recovery is possible within the allowable communication cutoff time, so communication restriction processing is allowable.

On the other hand, for example, assume that in communication network system 1, the connection confirmation period T is 50 msec, the planned fault recovery period for the abnormal device is 150 msec, the period required to lift the communication restriction for communication device 2 that may be subject to communication restriction is 120 msec, and the allowable communication cutoff time due to communication failure in the entire system is 250 msec. In this case, in communication network system 1, if communication restriction is imposed on communication device 2 that may be subject to communication restriction, the period required from the occurrence of the communication failure to communication recovery in the entire system will be [planned fault recovery period: 150 msec] + [time required to lift communication restriction: 120 msec] = 270 msec, and recovery within the allowable communication cutoff time is not possible, so communication restriction processing is not executed.

The second judgment period is set in advance from the above perspective, for example, based on the allowable time for communication interruption due to communication failure in the entire system, taking into account the allowable range of unnecessary communication to abnormal devices due to not restricting communication, etc., through evaluation of the actual device, etc.

The communication network system 1, monitoring device 3, and monitoring program of this embodiment described above can properly restore communications, similar to embodiment 2.

Furthermore, the communication network system 1, monitoring device 3, and monitoring program of this embodiment do not restrict communication for other communication devices 2 other than the abnormal device if the period required for lifting the communication restriction set for the other communication devices 2 is longer than the second judgment period. This process enables the communication network system 1 to prevent the period required for communication recovery in the entire system from being lengthened by restricting communication. As a result, the communication network system 1, monitoring device 3, and monitoring program of this embodiment can restore communication more appropriately.

The communication network system, monitoring device, and monitoring program according to the above-described embodiments of the present invention are not limited to the above-described embodiments, and various modifications are possible within the scope of the claims.

In the above explanation, the monitoring device 3 is configured by a gateway that constitutes a network device, and has a network monitoring function as well as a GW function that performs protocol conversion, but this is not limited to this. The monitoring device 3 may also be configured separately from the gateway.

In the above description, the communication network system 1 is described as being mounted on a vehicle and constituting an in-vehicle network system, but this is not limited thereto.

The processing unit 33 described above has been described as having each processing function realized by a single electronic circuit, but this is not limited to the above. The processing unit 33 may be realized by combining multiple independent electronic circuits and having each electronic circuit execute a program to realize each processing function. Furthermore, the processing functions possessed by the processing unit 33 may be realized by being appropriately distributed or integrated into a single or multiple processing circuits. Furthermore, all or any part of the processing functions possessed by the processing unit 33 may be realized by a program, or may be realized as hardware using wired logic or the like.

The program executed by the processing unit 33 described above is provided by being pre-installed in the storage unit 32 or the like. This program may be provided by being recorded on a computer-readable storage medium in a format that can be installed on these devices or in a format that can be executed. This program may also be provided or distributed by being stored on a computer connected to a network such as the Internet and downloaded via the network.

The communication network system, monitoring device, and monitoring program according to this embodiment may be configured by appropriately combining the components of the embodiments and variations described above.

1 Communication network system 2 Communication equipment 2A, 2A-1, 2A-2 ECU
2B HUB
3 Monitoring device 31 Communication connection unit 32 Storage unit 32A Fault recovery planned period storage area 232B Communication restriction release period storage area 33 Processing unit 33A GW processing unit 33B Monitoring processing unit 33C Communication restriction processing unit N Network TA Fault recovery planned period

Claims (6)

A network capable of communicating;
A plurality of communication devices connected to the network;
a monitoring device connected to the network, performing connection confirmation for the plurality of communication devices, detecting an abnormal device from the plurality of communication devices, and executing a process of restricting communications involving the abnormal device for the other communication devices other than the abnormal device;
The monitoring device is capable of executing a process of releasing the restriction on communication with the other communication devices based on a planned failure recovery period set for the abnormal device among planned failure recovery periods that are individually set in advance for the plurality of communication devices and are expected to be required for failure recovery.
Communication network system. After detecting the abnormal device, the monitoring device executes a process of lifting the restriction on communication with the other communication devices when the planned failure recovery period set for the abnormal device has elapsed without performing the connection check for the abnormal device again.
The communication network system according to claim 1 . When the planned failure recovery period set for the abnormal device is shorter than a first determination period set in advance, the monitoring device does not restrict the communication with the other communication devices.
3. The communication network system according to claim 1 or 2. the monitoring device does not restrict communication with the other communication device when the communication restriction lift required period set for the other communication device among periods that are individually set in advance for the multiple communication devices and are expected to be lifted for the restriction on communication, is longer than a second determination period set in advance;
The communication network system according to any one of claims 1 to 3. A communication connection unit connected to a network;
a processing unit capable of executing a process of performing a connection check for a plurality of communication devices connected to the network, detecting an abnormal device from the plurality of communication devices, and restricting communications involving the abnormal device for the communication devices other than the abnormal device,
The processing unit is capable of executing a process of releasing the restriction on communication with the other communication devices based on a planned failure recovery period set for the abnormal device among planned failure recovery periods that are individually set in advance for the multiple communication devices and are expected to be required for failure recovery.
Surveillance equipment. A connection check is performed for multiple communication devices connected to the network, and an abnormal device is detected from the multiple communication devices.
Restricting communications involving the abnormal device with respect to other communication devices other than the abnormal device;
lifting the restriction on communication with the other communication devices based on a planned failure recovery period set for the abnormal device among planned failure recovery periods that are individually set in advance for the plurality of communication devices and are expected to be required for failure recovery;
Each process is executed by a computer.
Surveillance program.

Images