JP7077920B2 - Communication device - Google Patents

Description

The present disclosure relates to a communication device configured to be able to communicate with another communication device.

It is known that a vehicle is equipped with the above communication device. For example, Patent Document 1 below discloses a technique for limiting the functions of an application mounted on a vehicle according to the content of an abnormality when an abnormality is detected in a communication port for transmitting and receiving data in a communication device. Has been done.

Japanese Unexamined Patent Publication No. 2018-062320

By the way, in the above-mentioned communication device, there is a demand that an application can be freely added like a smartphone. However, the technique of Patent Document 1 does not assume the addition of an application to a vehicle. Simply allowing applications to be added freely increases the possibility of limiting functions such as autonomously stopping multiple added applications at the same time when some abnormality is detected in the vehicle.

When an application restricts functions, it is considered necessary for the user to take over the functions of the restricted application in many cases. However, as a result of detailed examination by the inventor, it has been found that when a plurality of applications simultaneously limit the functions, it becomes difficult for the user to take over all the functions of the application.

One aspect of the present disclosure is that in a communication device configured to be able to communicate with another communication device, even if an application is added, the user can improve the functions of the plurality of applications in the event of a vehicle abnormality. It is to be able to take over.

One aspect of the present disclosure is a communication device (10) mounted on a vehicle and configured to be able to communicate with at least one other communication device, the acquisition unit (S210, S220) and the order setting unit (S310, S270) and a restriction indicator (S370) are provided. Each time an application is added to at least one communication device having a plurality of applications of the communication device and other communication devices, the acquisition unit determines the degree of influence on the other application when the function of the application is restricted. It is configured to get the degree of influence it represents.

The order setting unit is configured to set a restriction order indicating an order for restricting the function of at least one of a plurality of applications according to the degree of influence when a preset function restriction condition is satisfied. .. The restriction instruction unit is configured to sequentially instruct at least one application whose function is restricted to restrict the function according to the restriction order.

According to such a configuration, a restriction order, which is an order for restricting the functions of an application, is set according to the degree of influence indicating the degree of influence on other applications when the function is restricted, and the restriction order is set according to the restriction order. The functions of the application are sequentially restricted. At this time, the degree of influence is acquired each time an application is added, and even when an application is added, the restriction order can be set each time.

Therefore, it is possible to prevent a large number of applications from being restricted in function at the same time. Then, even when an application is added, the user can satisfactorily take over the functions of the plurality of applications when an abnormality occurs, that is, the user can manually execute the functions of the plurality of applications.

It is a block diagram which shows the structure of a communication system. It is a flowchart of influence degree transmission processing. It is a figure which shows an example of the influence degree information transmitted by each application. It is a flowchart of influence degree recording processing. It is a figure which shows an example of the contents of an influence degree database. It is a flowchart of an order setting process. It is a figure which shows an example of the setting procedure of a restriction order. It is a flowchart of restriction instruction processing. It is a flowchart of the restriction execution process. It is a sequence diagram which shows the execution time of each process.

Hereinafter, embodiments of one aspect of the present disclosure will be described with reference to the drawings.
[1. background]
In recent years, in a vehicle, an arbitrary device outside the vehicle and a communication device inside the vehicle are configured to communicate using the communication port of the communication device inside the vehicle. It is expected that applications (hereinafter, also referred to as applications or APPs) will be added after the vehicle is shipped like smartphones. In such a case, in the vehicle, it is required to realize advanced functions related to safety such as automatic driving by dynamically linking a plurality of applications.

In this case, it is expected that the vehicle will continuously communicate with any device outside the vehicle while the vehicle is traveling. If a communication error such as a communication port occurs while the vehicle is running and each application autonomously restricts functions such as stopping, it may not be possible to successfully take over the functions that restrict functions to the user, especially the driver. There is sex. For example, in an automatic driving application, if the brake control application and the steering application are stopped at the same time, the driver who should manually execute the functions of these applications is burdened. Therefore, it is preferable to prepare in advance what kind of function restrictions each app will perform in relation to other apps, but each app will give to other apps depending on what kind of app the user installs. Since the impact changes dynamically, it is not possible to prepare a program that limits the functions in an appropriate order for all cases.

Also, if multiple apps are affected at the same time, the driver may be notified of a large number of warnings from each app and panic. In view of these circumstances, it is recognized that in a vehicle system that dynamically links applications, it is necessary to have a mechanism to safely limit functions in an appropriate order even if a communication error such as a communication port occurs. Obtained, and the configuration of this embodiment has been conceived in order to realize this mechanism.

[1-1. Constitution]
The communication system 1 shown in FIG. 1 is mounted on a vehicle such as a passenger car, and even when an application is added to an arbitrary device such as an ECU constituting the communication system 1, the driver or the like of the vehicle is used when an abnormality occurs. It is devised so that a person can take over the functions of multiple apps well.

The communication system 1 shown in FIG. 1 includes a gateway ECU 10. ECU is an abbreviation for Electronic Control Unit. The communication system 1 may include an external communication device 20, a first ECU 30, and a second ECU 40.

Each of the ECUs 10, 30, 40 such as the gateway ECU 10, the first ECU 30, and the second ECU 40 are communication devices configured to be able to communicate with each other via a communication line. The communication system 1 is a master-slave system in which the gateway ECU 10 is the master and the first ECU 30 and the second ECU 40 are the slaves, and manages the function restrictions of the application and the communication port.

That is, the gateway ECU 10 instructs the function limitation of the application and the communication port, and the external communication device 20, the first ECU 30, and the second ECU 40 operate according to this instruction. The function limitation means that the gateway ECU 10 mainly stops at least a part of the functions of the application or the device.

Each ECU 10, 30, 40 includes a microcomputer having CPUs 11, 31, 41, and a semiconductor memory such as, for example, RAM or ROM (hereinafter, memory 12, 32, 42), respectively. Each ECU 10, 30, 40 includes communication units 13, 33, 43 configured as communication modules for communicating with other connected devices, respectively.

Each function of each ECU 10, 30, 40 is realized by the CPU 11, 31, 41 executing a program stored in a non-transitional substantive recording medium. In this example, the memories 12, 32, and 42 correspond to the non-transitional substantive recording medium in which the program is stored. In addition, when this program is executed, the method corresponding to the program is executed.

The non-transitional substantive recording medium means that electromagnetic waves are excluded from the recording media. Further, each of the ECUs 10, 30 and 40 may be provided with one microcomputer or may be provided with a plurality of microcomputers.

The gateway ECU 10 includes a master control unit 15 and each functional unit of an arbitrary application 19. The master control unit 15 further includes each function unit of the order setting unit 16, the influence degree recording unit 17, and the restriction instruction unit 18.

The order setting unit 16 carries out the order setting process described later. The influence degree recording unit 17 carries out the influence degree recording process described later. The restriction instruction unit 18 carries out the restriction instruction processing described later.
The first ECU 30 and the second ECU 40 include slave control units 35, 45, and functional units of arbitrary applications 38, 39, 48, 49. The slave control units 35 and 45 further include functional units of the influence level transmission units 36 and 46 and the restriction execution units 37 and 47.

The influence degree transmission units 36 and 46 carry out the influence degree transmission process described later. The restriction execution units 37 and 47 execute the restriction instruction processing described later. The apps 19, 38, 39, 48, and 49 perform arbitrary operations that differ depending on the installed apps.

The method for realizing the functions of each part included in the ECUs 10, 30 and 40 is not limited to software, and some or all of the functions may be realized by using one or a plurality of hardware. For example, when the above function is realized by an electronic circuit which is hardware, the electronic circuit may be realized by a digital circuit, an analog circuit, or a combination thereof.

The external communication device 20 is a communication device that is different from the communication line to which the first ECU 30 and the second ECU 40 are connected and is configured to be able to communicate with the gateway ECU 10. However, the external communication device 20 may be connected to other devices such as the first ECU 30 and the second ECU 40 so as to be communicable as long as it is configured to be communicable with the gateway ECU 10. Further, the external communication device 20 includes a plurality of communication ports 24A and 24B for communicating with external devices of the vehicle such as the base station 61, and wirelessly using any of the communication ports 24A and 24B. It is configured to be capable of wireless communication with the base station 61 that mediates the data communication of.

The external communication device 20 is configured to be able to communicate with an arbitrary server device 63 via the Internet network 62 and the wireless base station 61 connected to the Internet network 62. The server device 63 provides, for example, a function of providing arbitrary information such as map information required for a vehicle equipped with a communication system 1 to perform automatic driving, and information on the security of communication ports 24A and 24B of the external communication device 20. It has a function of transmitting to the communication system 1 and the like.

The external communication device 20 includes a microcomputer having a CPU 21 and a semiconductor memory 22 such as RAM or ROM. The external communication device 20 further includes a communication unit 23 configured as a communication module for communicating with the gateway ECU 10.

The external communication device 20 includes each functional unit of the failure determination unit 26 and the communication port control unit 27. The failure determination unit 26 detects the presence or absence of a failure in the plurality of communication ports 24A and 24B. The presence or absence of a failure may be determined, for example, by whether or not the communication using the communication ports 24A and 24B is completed within a preset time. Further, when it is received from the server device 63 or the like that there is a problem in the security of the communication ports 24A and 24B, it may be determined that there is a failure. When the failure determination unit 26 determines that there is a failure, the external communication device 20 sends a failure notification to the gateway ECU 10.

When the communication port control unit 27 receives a restriction instruction from the gateway ECU 10, the communication port control unit 27 limits the operation of the designated communication ports 24A and 24B. The restriction on the operation of the communication ports 24A and 24B includes a case where the transmission / reception of data using the communication ports 24A and 24B is stopped and a case where only the reception or transmission of the data is stopped.

[1-2. process]
[1-2-1. Impact transmission process]
Next, the influence degree transmission processing executed by the CPUs 31 and 41 of the slave ECUs 30 and 40 will be described with reference to the flowchart of FIG. The influence transmission process is, for example, a process that is started when the power of the vehicle is turned on and the slave ECUs 30 and 40 are activated, and is then repeatedly executed in parallel with other processes executed by the slave ECUs 30 and 40.

In the influence transmission process, as shown in FIG. 2, first, in S110, whether or not the slave ECUs 30 and 40 have started the apps 38, 39, 48, 49 mounted on the slave ECUs 30 and 40 or changed the operation mode of the apps. Is determined. The operation mode indicates an individual function that can be selected when the application has a plurality of functions and at least one of the plurality of functions is selectively executed.

For example, when the application performs different processing according to the surrounding environment such as the speed and time of the vehicle, each processing is shown. More specifically, in the case of an application that displays a navigation device, a daytime display mode and a nighttime display mode are selectively executed, and these display modes correspond to the respective operation modes.

When it is determined in S110 that the application has been started or the operation mode of the application has been changed, the process proceeds to S120, and the slave ECUs 30 and 40 acquire the influence degree information from the application. The impact degree information is information indicating the operation content when the function of a certain application is restricted and the degree of influence on another application when the function is restricted.

The impact information corresponds to the impact and operation details of the present disclosure. The influence degree information includes the range affected, the part affected, the communication content affected, and the like when the function of the application is restricted. More specifically, the impact information includes data as shown in FIG. 3, ie, safety rank, app type, affected communication ID and communication port, app action, port action indicating action on the communication port, impact. Contains a communication ID that gives. The affected communication ID corresponds to the input ID in the present disclosure, and the influencing communication ID corresponds to the output ID in the present disclosure.

The safety rank divides the danger level of the vehicle into a plurality of categories when the function is restricted such as when the application is stopped, and indicates which of the plurality of categories the application belongs to. The degree of danger of a vehicle indicates the degree of influence on the safety of the vehicle when the function of the application is restricted. Here, the higher the degree of danger of the vehicle, the higher the value of the safety rank is set, the lowest value of the safety rank is set to 1, and the highest value of the safety rank is set to 4. The safety rank is preset for each application.

The affected communication ID represents a value that specifies the type of data that the application cannot receive when the function of the application is restricted. The application action and the port action indicate the operation contents when the function of the application and the communication port are restricted. The operation content describes the target for which the function is restricted and the degree of the restriction. Details are shown below.

As an application procedure, in the example shown in FIG. 3, sending a message by sound or image to the user is described as "notification". In addition, stopping some functions of the application is described as "degenerate", and stopping all functions of the application is described as "stop".

As the port measures, in the example shown in FIG. 3, the measures for disabling the communication ports 24A and 24B, that is, the measures for setting the communication ports 24A and 24B so that data can not be transmitted and received are described as "invalid". is doing. It should be noted that a measure for permitting the transmission of data and restricting only reception may be implemented as, for example, "degenerate".

The affecting communication ID represents the type of data that cannot be transmitted by this application when the function of the application is restricted. The influence degree information includes data for at least one row in the table shown in FIG. 3 for each application, and when there are a plurality of operation modes of the application, data for the number of rows for the number of operation modes is included.

Subsequently, in S130, the slave ECUs 30 and 40 transmit the acquired influence degree information to the gateway ECU 10, and then end the influence degree transmission process of FIG. The influence degree information transmitted in this process is recorded in the gateway ECU 10.

On the other hand, if it is determined in S110 that the application is not started or the operation mode of the application is not changed, the process proceeds to S140, and the slave ECUs 30 and 40 determine whether or not the application is terminated.

When it is determined in S140 that the application has ended, the process proceeds to S150, and the slave ECUs 30 and 40 transmit a deletion request, which is a request for deleting the influence degree information related to the application, to the gateway ECU 10, and then the influence of FIG. Ends the transmission process. According to the deletion request transmitted in this process, the gateway ECU 10 deletes the influence degree information related to the application.

On the other hand, if it is determined in S140 that the application has not ended, the influence degree transmission process of FIG. 2 is terminated.
[1-2-2. Impact recording process]
Next, the influence degree recording process executed by the gateway ECU 10 will be described with reference to the flowchart of FIG. The influence degree recording process is, for example, a process that is started when the gateway ECU 10 is activated and then repeatedly executed in parallel with other processes executed by the gateway ECU 10.

In the influence degree recording process, first, in S210, the gateway ECU 10 determines whether or not the influence degree information or the deletion request is received from the slave ECUs 30 and 40.
If it is determined in S210 that the influence degree information or the deletion request has been received, the process proceeds to S220, and the gateway ECU 10 updates the influence degree database. Here, the influence degree database is a database in which a plurality of influence degree information is recorded in the memory 12, and for example, as shown in FIG. 5, the influence degree information collected from the plurality of slave ECUs 30 and 40 is included. ..

In this process, when the gateway ECU 10 receives the influence degree information, the influence degree information is added to the influence degree database, and when the deletion request is received, the influence degree information about the corresponding application is added from the influence degree database. delete. When this process is completed, the impact recording process of FIG. 4 is completed.

When the gateway ECU 10 determines that the influence degree information or the deletion request has not been received in S210, the gateway ECU 10 ends the influence degree recording process of FIG.
[1-2-3. Order setting process]
Next, the order setting process executed by the gateway ECU 10 will be described with reference to the flowchart of FIG. The order setting process is, for example, a process that is started when the gateway ECU 10 is activated and then repeatedly executed in parallel with other processes executed by the gateway ECU 10.

In the order setting process, first, in S260, the gateway ECU 10 determines whether or not the order calculation request has been received. The order calculation request is a request sent in the restriction instruction processing described later, and is a request to calculate the restriction order, which is the order when the functions of a plurality of applications are restricted, and to respond to the calculation result of the restriction order. be. The sequence calculation request is received with the number of the communication port where the failure occurred.

If it is determined in S260 that the order calculation request has not been received, the order setting process of FIG. 6 is terminated. Further, when it is determined that the order calculation request is received in S260, the process proceeds to S270, and the gateway ECU 10 sets the restricted order of the application based on the influence degree database. In this process, (1) a tree showing the relationship between multiple apps that propagate the failure according to the location where the failure occurred is generated based on the impact database, and (2) the failure propagates from the application with the lower impact. Set the order in which the apps are arranged as the restricted order.

For example, it is assumed that the external communication device 20 includes port10001 and port10002 as communication ports 24A and 24B. In this case, assuming that a communication failure has occurred in port10001 as the number of the communication port where the failure has occurred, the following processing is performed. As a process of generating the tree of (1) above, when an application that is directly affected by the failure of port10001 is searched, as shown in [A] of FIG. 5, the application that uses port10001 as a receiving port is "automatic". "Driving map" is specified.

Next, search for an application that inputs the data output by the "map for autonomous driving". That is, since the communication IDs that affect the "map for automatic driving" are 0x01 and 0x04, the application whose communication ID is 0x01 or 0x04 is searched from the influence degree database. As a result, apps that are indirectly affected by the failure of port10001 are searched.

Then, the "navigation display" in which 0x01 is the affected communication ID and the "automatic operation" in which 0x04 is the affected communication ID are searched. In this way, a tree is generated by repeating the process of sequentially tracing the applications whose "affecting communication ID" is the "affected communication ID" and indirectly searching for the application affected by the failure.

Stop generating the tree until the impact of the failure is no longer propagated to any app, or when an app that has already been extracted as an app affected by the failure is extracted again. Then, a tree as shown in FIG. 7 is obtained. In this tree, apps that propagate the effects of port10001 failures are arranged in order by safety rank.

Next, in the process of setting the restriction order in (2) above, the process is performed according to the following procedure.
<< 1 >> {Safety rank 1 app}, {Safety rank 2 app}, ..., {Safety rank 4 app}, and so on, the apps that limit the safety rank to the maximum value in ascending order. select.

<< 2 >> The restriction order between apps with the same safety rank is determined as follows.
(a) The restriction order of apps that directly affects the suspension of higher-ranked apps shall be at the end. If there are multiple apps at the end, the one with the most influence when this app is restricted will be ranked later.

(b) The restriction order of apps that directly affects the restrictions of higher-ranked apps shall be immediately before the apps that meet the conditions of (a). If there are multiple apps that fall under (b), the one with the most influence when this app is restricted will be ranked later.

(c) The restriction order of apps that directly affects the notifications of higher-ranked apps shall be immediately before the apps that meet the conditions of (b). If there are multiple apps that fall under (c), the one with the most influence when this app is restricted will be ranked later.

(d) Repeat steps (a) to (c) above until the app has the lowest rank.
In the example when a communication failure occurs in port10001, the restriction order of the application is 1. Navigation display, 2. Map for autonomous driving, 3. Automatic operation, 4. Engine control, 5. Brake control is set. By implementing the above steps (a) to (d), the function restrictions for apps that have a greater impact on safety are delayed, and the functions are not restricted at the same time as other apps, thereby ensuring safety for the entire vehicle. The effect on is less likely to reach.

Returning to FIG. 6, subsequently, in S280, the gateway ECU 10 (order setting unit 16) transmits the restriction order to the restriction instruction unit 18, and then ends the order setting process of FIG.
[1-2-4. Restriction instruction processing]
The restriction instruction processing executed by the gateway ECU 10 will be described with reference to the flowchart of FIG. The restriction instruction process is, for example, a process that is started when the gateway ECU 10 is activated and then repeatedly executed in parallel with other processes executed by the gateway ECU 10.

In the restriction instruction process, first, in S310, the gateway ECU 10 determines whether or not there is a failure notification from the failure determination unit 26 of the external communication device 20. When it is determined in S310 that there is no failure notification from the failure determination unit 26, the restriction instruction process of FIG. 8 is terminated.

On the other hand, when it is determined in S310 that there is a failure notification from the failure determination unit 26, the process proceeds to S320, and the gateway ECU 10 (restriction instruction unit 18) receives the number of the communication port where the failure occurred and the order calculation request. Is transmitted to the order setting unit 16.

Subsequently, in S330, the gateway ECU 10 determines whether or not the restricted order has been received. If it is determined in S330 that the restricted order has not been received, the process returns to S330. On the other hand, if it is determined that the restriction order has been received in S330, the process proceeds to S340, and the gateway ECU 10 determines whether or not the restriction for all applications has been completed. Note that the restrictions here include notifications given to the user.

When it is determined in S340 that the restriction on all the applications is completed, the restriction instruction process of FIG. 8 is terminated. On the other hand, if it is determined in S340 that the restrictions on all the applications have not been completed, the process proceeds to S350, the gateway ECU 10 selects the application whose function is restricted, and asks the user for consent to restrict the function. Send a consent request, which is a request for. The consent request is displayed as a message asking for consent on the display in the vehicle, and the user operates the preset switch in the vehicle to input to the gateway ECU 10 that the user has consented.

Subsequently, in S360, the gateway ECU 10 determines whether or not consent has been obtained for the function restriction of the selected application. It is not necessary to ask for consent for all of the selected apps, and S350 and S360 may be omitted for apps that do not need to ask for consent. Further, when a preset time (for example, about 10 seconds) has elapsed after requesting consent, it may be considered that consent has been obtained without the consent of the user, and the process may proceed.

Further, for example, the consent may be requested for the application having a high safety rank, and the consent may be omitted for the application having a low safety rank. In addition, it is not necessary to ask for consent when only notifying as the operation content. By doing so, it is possible to reduce complicated procedures for the user for function restrictions that have little effect on safety.

If the gateway ECU 10 determines that consent has not been obtained in S360, the gateway ECU 10 returns to S360. On the other hand, if it is determined that consent has been obtained in S360, the process proceeds to S370, and the gateway ECU 10 designates the application and transmits a restriction instruction. The restriction instruction includes the case of giving only a notification. The details of S370 will be described later.

Subsequently, in S380, the gateway ECU 10 sets the application as a restricted application and returns to S340. The setting of whether or not the application is restricted is managed, for example, by setting a flag in a predetermined area in the memory 12.

[1-2-5. Restricted execution processing]
The limit execution process executed by the slave ECUs 30 and 40 will be described with reference to the flowchart of FIG. The restriction execution process is, for example, a process that is started when the slave ECUs 30 and 40 are activated, and is then repeatedly executed in parallel with other processes executed by the slave ECUs 30 and 40.

In the restriction execution process, first, in S410, the slave ECUs 30 and 40 determine whether or not they have received the restriction instruction specifying the application installed in themselves.
When it is determined in S410 that the restriction instruction for specifying the own application is received, the process proceeds to S420, and the operation of the specified application is restricted according to the operation content included in the restriction instruction. When this process is completed, the restricted execution process of FIG. 9 is completed.

On the other hand, if it is determined in S410 that the restriction instruction for which the own application is specified has not been received, the restriction execution process of FIG. 9 is terminated.
[1-2-6. Implementation time of each process]
The implementation time of each of the above processes will be briefly described with reference to the sequence diagram of FIG.

As shown in S1 of FIG. 10, first, in preparation for limiting the functions of the applications, the slave ECUs 30 and 40 transmit the influence degree information of each application to the gateway ECU 10, and the gateway ECU 10 receiving the influence degree information receives the influence degree information. Have the database record impact information.

Then, as shown in S2 of FIG. 10, when the gateway ECU 10 receives the notification of the failure of the communication port from the external communication device 20, the gateway ECU 10 refers to the influence degree database based on the number of the communication port in which the failure has occurred, and limits the order. To set. Subsequently, the process corresponding to the above-mentioned S370 is carried out. That is, as shown in S3 of FIG. 10, the operation content of the function restriction for the application having the first restriction order is acquired by referring to the influence degree database, and the restriction instruction including the operation content is sent to the slave ECUs 30 and 40. Send. Then, the slave ECUs 30 and 40 implement the function limitation. The slave ECUs 30 and 40 may transmit to the gateway ECU 10 that the function restriction has been implemented. In this case, the gateway ECU 10 may transmit a restriction instruction to the next application after receiving the fact that the function restriction has been performed.

Subsequently, as shown in S4 of FIG. 10, the same processing as in S3 is performed for the application having the second restriction order. However, in S4, in addition to the processing of S3, the communication port used by the application for transmitting and receiving data is invalidated as necessary.

In this way, the communication system 1 performs the processing corresponding to S3 and S4 as many as the number of applications for limiting.
[1-3. effect]
According to the embodiment described in detail above, the following effects are obtained.

(1a) The communication system 1 includes a gateway ECU 10 mounted on a vehicle and configured to communicate with an external communication device 20, a first ECU 30, a second ECU 40, and a server device 63 as a plurality of other communication devices, and the gateway ECU 10 is provided. , The master control unit 15 is provided. In S210 and S220, the master control unit 15 includes an influence indicating the degree of influence on other applications when the application is functionally restricted each time the application is added to the ECUs 30 and 40 including a plurality of applications. It is configured to acquire degree information. Impact information is obtained from at least one communication device comprising a plurality of applications.

In S270 and S310, the master control unit 15 sets a restriction order indicating an order in which at least one of a plurality of applications is functionally restricted according to the degree of influence when a preset function restriction condition is satisfied. It is configured to do. The master control unit 15 is configured in S370 to instruct at least one application whose function is restricted to sequentially restrict the function according to the restriction order.

According to such a configuration, when the function of the application is restricted, the restriction order which is the order of restricting the function of the application is set according to the degree of influence, and the function of the application is sequentially restricted according to this restriction order. At this time, the degree of influence is acquired each time an application is added, and the restriction order is set in consideration of the added application. Therefore, even if an application is added, the restriction order is set each time. can. Therefore, it is possible to suppress the start of functional restriction of a large number of applications at the same time. Then, even when an application is added, the user can satisfactorily take over the functions of a plurality of applications when an abnormality occurs.

(1b) In S210 and S220, the master control unit 15 classifies the degree of danger of the vehicle when the function of the application is restricted into a plurality of categories as at least a part of the degree of influence, and determines which of the plurality of categories the application belongs to. It is configured to obtain the indicated safety rank. The master control unit 15 sets the restriction order in S270 and S310 according to the safety rank.

According to such a configuration, since the limiting order is set according to the safety rank, it is possible to reduce the influence on the safety of the vehicle. In the configuration of the present embodiment, the functions are restricted in order from the one with the lowest safety rank, and the time for restricting the functions of the ones with the higher safety ranks is separated. Therefore, when the functions of a plurality of applications are restricted, the user Since the function can be taken over satisfactorily, the safety of the vehicle can be ensured.

(1c) In S210 and S220, the master control unit 15 acquires the operation content and the degree of influence when the function of the application is restricted for each of a plurality of applications.
According to such a configuration, it is possible to individually set the operation content when the function of the application is restricted for each application.

(1d) In S210 and S220, the master control unit 15 determines the operation content and the degree of influence for each input ID for specifying the type of data input to a plurality of applications, that is, for each affected communication ID. Is configured to get. According to this configuration, it is possible to set the operation content when the function of the application is restricted according to the communication ID of the data received by the application.
As an example, the master control unit 15 is configured in S210 and S220 to acquire, as an operation content, a measure for restricting reception to a receiving port representing a communication port used by an application for receiving data. Further, the master control unit 15 instructs the receiving port to take measures to restrict reception when the function of at least one application is restricted in S370. According to such a configuration, since the reception is restricted to the reception port used by the application for reception, it is possible to suppress the reception of data that may adversely affect the application.

(1e) The master control unit 15 acquires the operation content and the degree of influence for each operation mode of a plurality of applications in S210 and S220.
According to such a configuration, since the operation content can be set for each operation mode of the application, it is possible to set detailed function restrictions according to the usage mode of the application.

(1f) In S210 and S220, the master control unit 15 acquires at least an output ID for specifying the type of data output by the application and an input ID for specifying the type of data input by the application. It is configured as follows. Further, in S270 and S310, the master control unit 15 searches for another application whose input ID is the output ID of at least one application whose function is restricted, and sets the searched other application as an application whose function is restricted. It is configured to repeat the procedure to set the restriction order for the application whose function is restricted.
According to such a configuration, it is possible to satisfactorily search for an application to which the influence of the application whose function is restricted propagates by using the output ID and the input ID, and to restrict the function.

(1g) The master control unit 15 is configured in S350 to seek the consent of the user for the application for which the function is to be restricted according to the restriction order. When the consent of the user is obtained, the master control unit 15 instructs S370 to limit the functions of the application for which the consent has been obtained.
According to such a configuration, the function of the application can be restricted when the consent of the user is obtained, so that the function can be surely handed over to the user.

(1f) In S210 and S220, the master control unit 15 has, as the degree of influence, a receiving port representing a communication port used by the application for receiving data, and a communication ID for specifying the type of data output by the application. Is configured to get. Further, the master control unit 15 sets S270 and S310 to an application that restricts the function of an application that uses the data specified by the communication ID corresponding to the receiving port when a failure occurs in the receiving port. It is composed.
According to such a configuration, another application affected by the application whose function is restricted can be specified by using the communication ID, so that the other application can be set as the application whose function is restricted.

[2. Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and can be variously modified and implemented.

(2a) In the above embodiment, the failure determination unit 26 determines and notifies the failure of the communication port, and the gateway ECU 10 receiving the notification is configured to limit the functions of the application, but the present invention is not limited to this. do not have. For example, the function may be restricted when a preset function restriction condition other than the failure of the communication port is satisfied. When the function restriction condition is satisfied, for example, when an arbitrary condition that can affect any one of multiple applications is satisfied, when an abnormality in data quality / accuracy occurs, another vehicle moves. This applies when there is a risk of communication failure such as crack information indicating that damage such as intrusion has occurred.

(2b) In the above embodiment, the process of limiting the functions of the apps of the slave ECUs 30 and 40 has been described, but the functions of the apps of the gateway ECU 10 may be restricted. In this case, it is preferable to mount the functions corresponding to the slave control units 35 and 45 on the gateway ECU 10 and perform each process of the above embodiment on the gateway ECU 10.

(2c) In the above embodiment, the configuration that the application 19 is provided in the gateway ECU 10 has been described, but it is not necessary that the gateway ECU 10 is provided with the application 19.
(2d) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. .. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. Further, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment.

(2e) In addition to the communication system 1 described above, a communication device that is a component of the communication system 1, a program for operating a computer as a device constituting the communication system 1, a semiconductor memory that records this program, and the like. The present disclosure can also be realized in various forms such as a transitional actual recording medium and a function limiting method.

[3. Correspondence between the configuration of the embodiment and the configuration of the present disclosure]
The gateway ECU 10 in the above embodiment corresponds to the communication device in the present disclosure. Further, among the processes executed by the gateway ECU 10, the functional unit of S210 and S220 corresponds to the acquisition unit in the present disclosure, and the functional unit of S310 and S270 corresponds to the order setting unit in the present disclosure. Further, the functional unit of S370 corresponds to the restriction instruction unit in the present disclosure, and the functional unit of S350 corresponds to the consent request unit in the present disclosure.

1 ... Communication system, 10 ... Gateway ECU, 11,21,31,41 ... CPU, 12,22,32,42 ... Memory, 13,23,33,43 ... Communication unit, 15 ... Master control unit, 16 ... Order Setting unit, 17 ... Impact recording unit, 18 ... Restriction instruction unit, 19, 38, 39, 48, 49 ... App, 20 ... External communication unit, 24A, 24B ... Communication port, 26 ... Failure judgment unit, 27 ... Communication Port control unit, 30 ... 1st ECU, 35,45 ... Slave control unit, 36,46 ... Impact transmission unit, 37,47 ... Restriction execution unit, 63 ... Server device.

Claims (7)

A communication device (10) mounted on a vehicle and configured to be able to communicate with at least one other communication device.
Each time an application is added to at least one communication device having a plurality of applications of the communication device and the other communication device, an effect indicating the degree of influence on the other application when the function of the application is restricted. The acquisition unit (S210, S220) configured to acquire the degree, and
An order setting unit configured to set a restriction order indicating an order for functionally restricting at least one of the plurality of applications according to the degree of influence when a preset function restriction condition is satisfied. (S310, S270) and
A restriction instruction unit (S370) configured to sequentially instruct at least one application whose function is restricted according to the restriction order to restrict the function.
A communication device equipped with. The communication device according to claim 1.
As at least a part of the influence level, the acquisition unit divides the risk level of the vehicle when the application functions are restricted into a plurality of categories, and acquires a safety rank indicating which of the plurality of categories the application belongs to. Consists of
The order setting unit is a communication device configured to set the restricted order according to the safety rank. The communication device according to claim 1 or 2.
The acquisition unit is a communication device configured to acquire the operation content when the function of the application is restricted and the degree of influence for each of the plurality of applications. The communication device according to claim 3.
The acquisition unit is a communication device configured to acquire the operation content and the degree of influence for each input ID for specifying the type of data input to the plurality of applications. The communication device according to claim 3 or 4.
The acquisition unit is a communication device configured to acquire the operation content and the influence degree for each operation mode of the plurality of applications. The communication device according to any one of claims 1 to 5.
The acquisition unit is configured to acquire at least an output ID for specifying the type of data output by the application and an input ID for specifying the type of data input by the application.
The order setting unit repeats the procedure of searching for another application whose input ID is the output ID for at least one application whose function is restricted, and setting the searched other application to the application whose function is restricted, and the procedure is repeated. A communication device configured to set a restriction order for applications that are functionally restricted. The communication device according to any one of claims 1 to 6.
Further, a consent request unit (S350) configured to seek the consent of the user for the application for which the function is to be restricted is provided according to the restriction order.
The restriction instruction unit is a communication device configured to instruct to restrict the function of the application for which the consent has been obtained when the consent of the user is obtained.

Images