IN-VEHICLE SYSTEM AND METHOD FOR CONTROLLING AN IN-VEHICLE SYSTEM

Abstract

An in-vehicle system (100) includes control devices (10, 20, 30, 40, 50, 60) mounted on a vehicle. The control devices comprise at least one subordinate control device (40, 50, 60) and at least one superior control device (20, 30) located at a higher level than the at least one subordinate control device. The at least one superior control device includes a relay control unit (24, 34) that switches on or off a relay circuit (26, 28, 36) provided in a power supply line (6) of the at least one subordinate control device. The in-vehicle system further includes a current sensing unit (27, 29, 37) that detects the amount of current flowing through the power supply line of the at least one subordinate control device.The relay control unit is configured to switch off the relay circuit when the current detected by the current sensing unit reaches a predetermined current level that indicates a standby state of at least one subordinate control device.

Description

TECHNICAL AREA The present disclosure relates to an in-vehicle system comprising several control devices attached to a vehicle and to a method for controlling the in-vehicle system. STATE OF THE ART For example, one conceivable technique teaches an in-vehicle network system that includes a superior ECU (higher-level ECU), an intermediate ECU (middle-level ECU), and a subordinate ECU (lower-level ECU). In the in-vehicle network system of this conceivable technique, the intermediate ECU is powered by a power source and has a relay that can switch between supplying and interrupting power from the power source to the subordinate ECU. The intermediate ECU closes the relay to supply power to the subordinate ECU from the power source in response to a message received from the superior ECU. In other words, the intermediate ECU keeps the subordinate ECU in a power-off state until the intermediate ECU receives a message from the superior ECU.The subordinate ECU transitions from the power-off state to a standby state, in which the subordinate ECU waits for an instruction when the subordinate ECU is supplied with power. BRIEF SUMMARY OF THE INVENTION For example, an in-vehicle system may comprise: several control devices mounted on the vehicle. The several control devices include at least one subordinate control device and at least one superior control device, which is located at a higher level than, or above, the subordinate control device. The superior control device has a relay control unit that switches a relay circuit provided in a power supply line of the subordinate control device on or off. The in-vehicle system may further comprise: a current sensing unit that detects the amount of current flowing through the power supply line of the subordinate control device.The relay control unit is configured to switch off the relay circuit when the current detected by the current sensing unit reaches a predetermined current level that indicates a standby state of at least one subordinate control device. BRIEF DESCRIPTION OF THE DRAWINGS The tasks, features, and advantages of the present disclosure are more clearly evident from the following detailed description with reference to the accompanying drawings. In the drawings: Fig. 1 shows an illustration of an example of the configuration of an in-vehicle system according to a first embodiment; Fig. 2 shows an illustration of an example of an NM message and a method for implementing subnetwork operation using the NM message; Fig. 3 shows a flowchart illustrating an example of a process executed by the first and second intermediate ECUs to control the on and off states of the first to third relay circuits; Fig. 4 shows a flowchart illustrating an example of a first relay off determination process in step S160 of the flowchart of Fig. 3; Fig.5 a flowchart illustrating an example of a second relay off determination process in step S170 of the flowchart of Fig. 3; Fig. 6 a figure illustrating the first to fourth thresholds for determining the amount of current flowing through the power supply lines of the first to third subordinate ECUs; Fig. 7 a flowchart illustrating an example of a process performed by the first and second intermediate ECUs to control the on and off states of the first to third relay circuit in the second embodiment; Fig. 8 a figure illustrating a method for determining the occurrence of an anomaly, such as an open fault, in the third embodiment; and Fig. 9 a figure illustrating an example of the configuration of an in-vehicle system according to a modification example. DETAILED DESCRIPTION In the system of the conceivable technology, when the superior ECU determines that it is no longer necessary to operate the subordinate ECU, it sends a message to instruct the subordinate ECU to enter a standby state and to instruct the intermediate ECU to open the relay. However, if the intermediate ECU opens the relay without considering the situation in the subordinate ECU, a malfunction in the subordinate ECU's processing may occur. For example, after completing the processing for a specific function, the subordinate ECU might execute a predetermined termination process, such as a data backup process for processing progress and learning results, or a transition process to an actuator's initial position. In such a case, if the relay circuit opens while the subordinate ECU is executing a predetermined termination process, necessary processes like the data backup process and the transition process to an actuator's initial position may not be completed. The present embodiments were developed taking into account the above points and provide an in-vehicle system and a method for controlling the in-vehicle system which is capable of interrupting the power supply to a subordinate control device, which receives the power via a relay circuit, at a suitable timing. To solve the aforementioned problem, an in-vehicle system according to the present embodiments is an in-vehicle system with multiple control devices mounted on a vehicle. The multiple control devices comprise at least one subordinate control device and at least one superior control device located at a higher level than the subordinate control device. The superior control device has a relay control unit that switches a relay circuit provided in a power supply line of the subordinate control device on or off. The in-vehicle system further comprises a current sensing unit that detects the amount of current flowing through the power supply line of the subordinate control device.The relay control unit is configured to turn off the relay circuit when the current detected by the current sensing unit reaches a predetermined current level, indicating a sleep state of the subordinate control device. Furthermore, a method for controlling an in-vehicle system according to the present embodiments is a control method for an in-vehicle system with multiple control devices mounted on a vehicle. The multiple control devices comprise at least one subordinate control device and at least one superior control device located at a higher level than the subordinate control device. The superior control device has a relay control unit that switches a relay circuit provided in a power supply line of the subordinate control device on or off. The in-vehicle system also includes a current sensing unit that detects the amount of current flowing through the power supply line of the subordinate control device.The procedure for controlling the vehicle's internal system includes: detecting the amount of current flowing through the power supply line using the current detection unit; and switching off the relay circuit using the relay control unit when the amount of current detected by the current detection unit reaches a predetermined amount of current indicating a sleep state of the subordinate control device. In the vehicle-internal system and the method for controlling the vehicle-internal system according to the present embodiments, the relay control unit of the superior control device switches off the relay circuit based on the fact that the amount of current detected by the current sensing unit reaches the predetermined amount of current that indicates the sleep state of the subordinate control device, as described above. Therefore, according to the vehicle's internal system and the method for controlling the vehicle's internal system in the present embodiments, it is possible to avoid interrupting the power supply to the subordinate control device while the subordinate control device is performing a specific processing operation. In other words, it becomes possible to interrupt the power supply to the subordinate control device at a suitable time when the subordinate control device enters a sleep state. The reference symbols and / or numbers in parentheses are merely intended to provide examples of correspondences to specific structures in the embodiments described below, in order to facilitate understanding of the present disclosure, and are not intended to limit the scope of the present disclosure in any way. The technical features described in the following sections, which are not among the features mentioned above, can be seen from the description of the embodiments and the accompanying drawings. An embodiment of an in-vehicle system and a method for controlling an in-vehicle system according to the present embodiments are described below with reference to the drawings. The present disclosure is not limited to the following embodiments, and various modified examples described below are likewise included within the technical scope of this disclosure. Various modifications may be made in addition to the embodiment described below without departing from the spirit and scope of this disclosure. The embodiments and various modified examples may be combined to an extent that does not cause technical inconsistency. In the following description, identical or similar components in the drawings may be designated with the same reference numerals and may not be described repeatedly.Furthermore, if in an embodiment or modification example only references a part of the configuration, the description in the preceding embodiment can be applied to the remaining configuration. (First embodiment) Fig. 1 shows an illustration of an example configuration of an in-vehicle system 100 according to a first embodiment. The in-vehicle system 100 shown in Fig. 1 includes a master ECU 10 as a higher-level control unit, a first and a second intermediate ECU 20, 30 as higher-level control units, and a first to third intermediate ECU 40, 50, 60 as subordinate control units. ECU stands for Electronic Control Unit. In this embodiment, the master ECU 10, the first and second intermediate ECU 20, 30, and the first to third subordinate ECU 40, 50, 60 are each mounted on a vehicle. The vehicle includes a passenger car, a motorcycle, a transport vehicle, a construction vehicle, an agricultural vehicle, and the like. The vehicle's internal system 100 operates by being powered by a vehicle-mounted battery 2. More precisely, the energy from battery 2 is supplied via a power supply circuit 4 to the master ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50, and 60 of the vehicle's internal system 100. The power supply circuit 4 can, if necessary, convert the power supply voltage from the vehicle-mounted battery 2 into the operating voltages for the master ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50, and 60. The power supply lines 6 for the first to third subordinate ECU 40, 50 and 60 are equipped with a first to third relay circuit 26, 28 and 36, whose on and off states are switched by the first and the second intermediate ECU 20 and 30. The configuration of the vehicle's internal system 100 is not limited to the example shown in Fig. 1. For example, the number of higher-level ECUs 10 can be two or more instead of just one. In this case, an intermediate ECU and a subordinate ECU are arranged below each higher-level ECU. Two or more higher-level ECUs 10 can be interconnected so that they can communicate with each other. Furthermore, one of the intermediate ECUs 20, 30 can also perform the functions of the higher-level ECU 10, thus eliminating the need for the higher-level ECU 10. The number of intermediate ECUs 20, 30 arranged below the higher-level ECU need not be two, but can also be one, three, or more. With respect to the subordinate ECUs 40, 50, and 60, several subordinate ECUs can be connected to a single relay circuit 26, 28, or 36.Furthermore, one or some of the subordinate ECUs 40, 50 and 60 can be powered directly from the power supply circuit 4 without passing through the relay circuits 26, 28 or 36. The master ECU 10, the first and second intermediate ECUs 20 and 30, and the first through third subordinate ECUs 40, 50, and 60 can each consist of a computer equipped with components such as a processor, main memory, and storage. The processor could be, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), or a DFP (Data Flow Processor), each capable of executing a predetermined process according to a program. Main memory is a volatile storage medium, such as RAM (Random Access Memory), which temporarily stores the results of arithmetic operations performed by the processor. Memory is a non-volatile storage medium, such as flash memory or ROM (read-only memory). It stores various data and programs that are executed by the processor. Furthermore, the memory can store backup data such as processing progress and learning results, for example, through a predetermined termination process that the first to third subordinate ECUs 40, 50, 60 execute when the control process ends. The predetermined processing of the present embodiments comprises a predetermined control processing and a predetermined termination processing. The control processing and the termination processing are described in more detail below.It should be noted that some or all of the functions provided by the parent ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50 and 60 cannot be implemented by software such as a program, but rather by hardware, for example using an ASIC (Application-Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The superior ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50 and 60 are also equipped with communication interfaces (i.e., communication IFs) 12, 22, 32, 42, 52 and 62 for communication with other ECUs via communication buses 38, 44, 54 and 64. The communication interface 12 of the higher-level ECU 10 is connected via communication bus 38 to the communication interfaces 22 and 32 of the first and second intermediate ECUs 20 and 30. The first and second intermediate ECUs 20 and 30 can also communicate with each other via communication bus 38. The communication bus connecting the higher-level ECU 10 to the first and second intermediate ECUs 20 and 30, and the communication bus connecting the first and second intermediate ECUs 20 and 30 themselves, can be separate. Furthermore, the communication interface 22 of the first intermediate ECU 20 is connected via communication bus 44 to the communication interface 42 of the first subordinate ECU 40. Additionally, the communication interface 22 of the first intermediate ECU 20 is connected via communication bus 54 to the communication interface 52 of the second subordinate ECU 50.The communication IF 42 of the first subordinate ECU 40 and the communication IF 52 of the second subordinate ECU 50 can be connected to the communication IF 22 of the first intermediate ECU 20 via a common communication bus. The communication IF 32 of the second intermediate ECU 30 is connected to the communication IF 62 of the third subordinate ECU 60 via communication bus 64. The communication IFs 22 and 32 of the first and second intermediate ECUs 20 and 30 are configured to act as gateways when the parent ECU 10 and the first through third subordinate ECUs 40, 50, and 60, which are connected to different communication buses 38, 44, 54, and 64, communicate with each other. The vehicle's internal system 100 can use CAN® (registered trademark, the same applies hereafter) as a communication protocol to enable the respective communication interfaces 12, 22, 32, 42, 52, and 62 of the higher-level ECU 10, the first and second intermediate ECUs 20 and 30, and the first through third subordinate ECUs 40, 50, and 60 to communicate with each other. CAN stands for Controller Area Network. It should be noted that the communication protocol is not limited to CAN. The vehicle's internal system 100 can use various communication protocols such as Ethernet®, LIN (Local Interconnect Network), FlexRay®, and CAN-FD (CAN with flexible data rate). For example, different communication protocols can be used for the various communication buses 38, 44, 54, and 64. The higher-level ECU 10 can function as a domain controller, overseeing the control of the first and second intermediate ECUs 20 and 30, as well as the first to third subordinate ECUs 40, 50, and 60. A domain refers to a functional unit when vehicle functions are broadly divided into a powertrain domain, a chassis domain, an advanced driver assistance system domain, a body domain, a cockpit domain, and so on. For example, if the powertrain domain controller is the parent ECU 10, the first through third child ECUs contain 40, 50, and 60 different ECUs for controlling the vehicle's powertrain, such as an internal combustion engine ECU, a motor (or inverter) ECU, a battery monitoring ECU, and a transmission ECU. Similarly, if the chassis domain controller is the parent ECU 10, the first through third child ECUs contain 40, 50, and 60 different ECUs for controlling the vehicle's chassis, such as a steering ECU, a brake ECU, and a suspension ECU. The above is an example of the functional domain division, and the domains divided according to function may differ from the example described above. Alternatively, the master ECU 10 can act as an area controller, overseeing the control of the first and second intermediate ECUs 20, 30, and the first to third subordinate ECUs 40, 50, 60, located in each area of ​​the vehicle (e.g., front, rear, right and left sides, and the like). The master ECU 10 has a vehicle state management unit 14 that transmits vehicle state information to the first and second intermediate ECUs 20 and 30, and the first through third subordinate ECUs 40, 50, and 60, based on the vehicle state (e.g., vehicle state such as driving, stopped, parked, and the like, and / or the state of user operation of various vehicle functions). This information is gathered from sensors and other ECUs. It should be noted that the vehicle state management unit 14 may also be located not in the master ECU 10, but in a different ECU, such as the first or second intermediate ECU 20 or 30. Furthermore, functions of the vehicle state management unit 14 may be distributed across multiple ECUs.In this case, the ECU receiving the vehicle state information can acquire the required vehicle state information by integrating or selecting from multiple pieces of vehicle state information acquired by multiple ECUs. Based on the vehicle state information from the vehicle state management unit 14, the first and second intermediate ECUs 20 and 30 can determine whether or not the activation and operation of the first to third subordinate ECUs 40, 50, and 60 is necessary. That is, the first and second intermediate ECUs 20 and 30 store in advance, as a table and list, the vehicle state information required for the activation and operation of the first to third subordinate ECUs 40, 50, and 60, linked to these subordinate ECUs. By referring to this stored table and list, the first and second intermediate ECUs 20 and 30 can determine, based on the vehicle state information, whether or not the activation and operation of the first to third subordinate ECUs 40, 50, and 60 is necessary.If the first and second intermediate ECUs 20, 30 determine that at least one of the first to third subordinate ECUs 40, 50, 60 must be activated and operated, the first and second intermediate ECUs 20, 30 switch on one of the first to third relay circuits 26, 28, 36, which corresponds to at least one of the first to third subordinate ECUs 40, 50, 60 that has been determined to be activated and operated.If, on the other hand, the first and second intermediate ECUs 20, 30 determine that the activation and operation of the first to third subordinate ECUs 40, 50, 60 is not required, the first and second intermediate ECUs 20, 30 switch off one of the first to third relay circuits 26, 28, 36, which corresponds to one of the first to third subordinate ECUs 40, 50, 60 that has been determined not to be activated and operated, taking into account the amount of current detected by the first to third current sensors 27, 29, 37, which are described below. In addition to or instead of transmitting the vehicle state information, the vehicle state management unit 14 can send a communication message (i.e., a relay control message) to the first and second intermediate ECUs 20, 30 to instruct the first to third relay circuits 26, 28, 36 to turn on or off. In this case, the vehicle state management unit 14 can pre-store, as a table or list, the vehicle state information required to activate and operate each of the first to third subordinate ECUs 40, 50, 60, linked to the first to third subordinate ECUs 40, 50, 60. The vehicle state management unit 14 can then refer to the stored table and list to determine, based on the vehicle state, whether or not activation and operation of the first to third subordinate ECUs 40, 50, 60 is required.When the vehicle state management unit 14 determines that activation and operation of at least one of the first to third subordinate ECUs 40, 50, 60 is required, the vehicle state management unit 14 sends a communication message to the intermediate ECUs 20, 30 to instruct them to activate the relay circuits 26, 28, 36 corresponding to the relevant subordinate ECUs 40, 50, 60. In this case, the first and second intermediate ECUs 20, 30 activate the first to third relay circuits 26, 28, 36 in response to the received communication message.If, however, the vehicle state management unit 14 determines that the first to third subordinate ECUs 40, 50, 60 do not need to be activated and operated, the vehicle state management unit 14 can send a communication message to the intermediate ECUs 20, 30 to instruct them to switch off the first to third relay circuit 26, 28, 36. In this case, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36 in response to the received communication message, taking into account the amount of current detected by the first to third current sensors 27, 29, 37, which are described below. Furthermore, the higher-level ECU 10 may, in addition to or instead of the vehicle state management unit 14, include a network management unit 15, which sends a network management message (hereinafter referred to as NM message) as a wake-up signal to the first and second intermediate ECUs 20, 30, based on the vehicle state and / or in response to the input of a predetermined activation trigger. A predetermined activation trigger may be considered, for example, when the vehicle door lock is unlocked by pressing a mobile key carried by the user or by pressing the door handle, when the vehicle's master switch is turned on, or when a notification of the occurrence of an activation trigger is received from a higher-level ECU other than a domain controller. The NM message is explained below. In this embodiment, partial network operation is implemented via the NM message, such that each of the first to third subordinate ECUs 40, 50, 60 is assigned a cluster, to which each of the first to third subordinate ECUs 40, 50, 60 belongs from several subdivided clusters. Here, partial network operation means that only ECUs belonging to specific clusters are activated (i.e., in an operating state), while ECUs belonging to the remaining clusters are in a power-off state or a sleep state. In this way, it is possible to reduce the energy consumption of each ECU installed in the vehicle by only activating the ECUs that need to be powered on.The information of the assigned cluster is stored as cluster setting information (also known as PNC setting information) in the first and second intermediate ECUs 20 and 30, which are located at a higher level than the respective subordinate ECUs 40, 50 and 60. If the received NM message contains activation cluster information (also referred to as PN request information) that designates the cluster to which the first to third subordinate ECUs 40, 50, and 60 belong as the activation cluster, the first and second intermediate ECUs 20 and 30 activate the relay circuits 26, 28, and 36 corresponding to the respective first to third subordinate ECUs 40, 50, and 60. The network management unit 15 can modify the PN request information contained in the NM message depending on the vehicle's state and / or the reason for the activation trigger input. Therefore, the network management unit 15 can send an NM message that selectively activates and operates the first to third subordinate ECUs 40, 50, and 60. Figure 2 shows an example of an NM message. In the example in Figure 2, the NM message contains data in bytes 0 to 7. Byte 0 contains the node ID (NID). The node ID is a unique identifier assigned to each of the parent ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50, and 60. The node ID allows identification of the NM message's sending source. Byte 1 contains a control bit vector (CBV). The control bit vector contains data indicating whether subnetting is being used. If the control bit vector indicates the use of subnetting, the user data area of ​​bytes 2 to 7 contains the PN request information, i.e., activation cluster information, which specifies the cluster to be activated. In the example shown in Fig. 2, the control bit vector demonstrates the use of subnetwork operation, and the PN request information is stored in bytes 6 and 7 of the user data area. The user data area of ​​bytes 2 to 5 can be used to transmit any information, such as ECU activation factors or information about normal or abnormal states. It should be noted that Fig. 2 shows only an example of the NM message format, and the NM message can have a different format as long as it contains the PN request information. For example, NID and CBV can be omitted. The PN request information specifies which clusters should be activated and which should not, for each of the multiple subdivided clusters. More precisely, in the example in Fig. 2, the clusters are pre-classified into 16 clusters. The PN request information comprises 16-bit data, one for each of the 16 clusters. That is, the 16-bit data of the PN request information is pre-assigned to the 16 clusters. If a bit in the 16-bit data of the PN request information is "0", the data indicates that activation of the corresponding cluster is not required. If a bit in the 16-bit data of the PN request information is "1", the data indicates that activation of the corresponding cluster is required. Note that the PN request information can also specify only the clusters that need to be activated. Alternatively, the PN request information can also specify only the clusters that do not need to be activated. Figure 2 also shows an example of the PNC setting information set for the first to third subordinate ECUs 40, 50, and 60. In the PNC setting information of Figure 2, where the linked clusters in the drawing are classified from left to right as A to P, the PNC setting information in Figure 2 indicates that the subordinate ECUs for which this PNC setting information is set belong to clusters D, H, and J. Since the first to third subordinate ECUs 40, 50, and 60 are capable of performing various functions by executing a program and the like, they can belong to one or more clusters. The first and second intermediate ECUs 20, 30 can receive the NM message, including the PN request information, via their respective communication interfaces 22, 32. Upon receiving the NM message, the first and second intermediate ECUs 20, 30 compare the PN request information of the NM message bit-by-bit with the PNC setting information of the first to third subordinate ECUs 40, 50, 60, as shown in Fig. 2, and calculate, for example, a logical operation. Then, the first and second intermediate ECUs 20 and 30 determine whether the cluster whose activation is requested by the PN request information in the NM message matches the cluster in the PNC setting information set for the first through third subordinate ECUs 40, 50, and 60. For example, in the example shown in Fig. 2, the clusters whose activation is requested by the PN request information include clusters D, G, I, M, N, and O. The clusters to which the lower ECUs belong, as specified by the PNC setting information, are clusters D, H, and J. In this case, for cluster D, the cluster whose activation is requested by the PN request information in the NM message matches the cluster set in the PNC setting information. Therefore, the result of the logical operation in cluster D is "1," as shown in Fig. 2. If any bit is "1" as a result of the logical operation, the first and second intermediate ECUs 20 and 30 determine that activation of the subordinate ECU, for which the PNC setting information shown in Fig. 2 is set, is requested. In response to this determination, the first and second intermediate ECUs 20 and 30 switch on the relay circuits corresponding to the lower ECUs for which the PNC setting information shown in Fig. 2 is set. If the relay circuit is already switched on, the first and second intermediate ECUs 20 and 30 keep the relay circuit switched on. Conversely, if the result of the logical operation is that none of the bits are "1" and all bits are "0", the first and second intermediate ECUs 20 and 30 determine that there is no request to activate the subordinate ECU for which the PNC setting information shown in Fig. 2 is set.In this case, the first and second intermediate ECUs 20 and 30 switch off the relay circuits corresponding to the subordinate ECUs for which the PNC setting information shown in Fig. 2 is set, taking into account the amount of current detected by the first to third current sensors 27, 29 and 37, which are described below. Here it is also possible to configure the PNC setting information for the parent ECU 10 and / or the first and second intermediate ECUs 20, 30 so that the activation state (i.e., the operating state) and the sleep state can be switched by an NM message. Alternatively, the parent ECU 10 and / or the first and second intermediate ECUs 20, 30 can be configured to enter a sleep state if a predetermined period of time has elapsed without an NM message being received from another ECU. The first and second intermediate ECUs 20 and 30 each have, as one of their functions, a first relay control unit 24 and a second relay control unit 34. Based on vehicle status information and / or the communication message (i.e., the relay control message and the NM messages), the first and second relay control units 24 and 34 can determine which relay circuits 26, 28, and 36 should be switched on and which relay circuits 26, 28, and 36 should remain switched off. In other words, by referring to the table and list mentioned above, the first and second relay control units 24 and 34 can determine, based on the acquired vehicle status information, which relay circuits 26, 28, and 36 should be switched on and which relay circuits 26, 28, and 36 should be switched off.Furthermore, the first and second relay control units 24, 34 can determine, based on the communication message, which relay circuits 26, 28, 36 should be switched on and which relay circuits 26, 28, 36 should be switched off. The first intermediate ECU 20 has the first and second relay circuits 26 and 28, and the second intermediate ECU 30 has the third relay circuit 36. The first relay control unit 24 of the first intermediate ECU 20 switches the first and second relay circuits 26 and 28 on or off according to the determination result based on the vehicle status information and the received communication message. The second relay control unit 34 of the second intermediate ECU 30 switches the third relay circuit 36 ​​on or off according to the determination result based on the vehicle status information and the received communication message. The first relay circuit 26 is connected to the power supply line 6 to supply power to the first subordinate ECU 40. In other words, the power line of the first subordinate ECU 40 is connected to a first power terminal 26a, which is connected to the first relay circuit 26. The second relay circuit 28 is connected to the power supply line 6 to supply power to the second subordinate ECU 50. In other words, the power line of the second subordinate ECU 50 is connected to a second power terminal 28a, which is connected to the second relay circuit 28. The third relay circuit 36 ​​is connected to the power supply line 6 to supply power to the third subordinate ECU 60. In other words, the power line of the third subordinate ECU 40 is connected to a third power terminal 36a, which is connected to the third relay circuit 36. The first to third relay circuits 26, 28, and 36 can be constructed from semiconductor switches such as MOSFETs or IGBTs. However, the first to third relay circuits 26, 28, and 36 can also consist of ordinary mechanical relays, which differ from the semiconductor switches. Furthermore, the first to third relay circuits 26, 28, and 36 can be arranged within the first and second intermediate ECUs 20 and 30, as shown in Fig. 1, or outside of the first and second intermediate ECUs 20 and 30. The first to third subordinate ECUs 40, 50, 60 can, for example, be a control ECU that executes a control process to control a specific control target in a vehicle, a sensor ECU that calculates a specific physical quantity based on a sensor's detection signal, or a drive ECU that outputs a drive signal to an actuator to power it. When the first and second intermediate ECUs 20 and 30 switch on the corresponding relay circuits 26, 28, and 36, the first to third subordinate ECUs 40, 50, and 60 are activated and made operational by the power supply. Once operational, the first to third subordinate ECUs 40, 50, and 60 execute predetermined control processes, such as...A control process for controlling the control target, a control process for calculating a predetermined physical quantity based on the sensor's detection signal, and a control process for outputting the drive signal to actuate the actuator. On the other hand, the first to third subordinate ECUs 40, 50, 60 do not need to control the control target, calculate the predetermined physical quantity, or actuate the actuator. Therefore, the first to third subordinate ECUs 40, 50, 60 are in a switched-off state when the corresponding relay circuits 26, 28, 36 are switched off. The first to third lower ECUs 40, 50, 60 may be able to terminate the predetermined control process based on the completion of the execution of the predetermined control process described above. Alternatively, the first to third lower ECUs 40, 50, 60 may determine, based on vehicle state information received from the higher-level ECU 10 or similar, whether the vehicle state has changed to such an extent that the respective predetermined control processes are no longer required. In this case, if the first to third lower ECUs 40, 50, 60 determine that the vehicle state has changed to such an extent that the respective specific control processes are no longer required, they may terminate the specific control processes, for example, at the same time as the specific control processes currently being executed have finished. After completing their respective control processing, the first through third subordinate ECUs (40, 50, and 60) perform a predetermined termination process. This predetermined termination process may include backup data storage procedures, such as backing up data generated during each stage of the control processing and backing up learning data in cases where the control processing includes a learning process. Additionally, the predetermined termination process may include a process to return the actuator to its initial state in preparation for the next operation. The predetermined termination process places a lower processing load on the first through third subordinate ECUs (40, 50, and 60) than the predetermined control process itself.Therefore, the amount of current flowing when the first to third subordinate ECUs 40, 50, 60 execute a predetermined termination process is less than the amount of current flowing when the first to third subordinate ECUs 40, 50, 60 execute a predetermined control process. When the first to third subordinate ECUs 40, 50, 60 complete the predetermined termination process, they enter a sleep state (e.g., a standby state). While the first to third subordinate ECUs 40, 50, 60 are supplied with power in this sleep state, they do not execute any power-intensive processes, such as control processes. Therefore, the amount of current flowing when the first to third subordinate ECUs 40, 50, 60 are in the sleep state is less than the amount of current flowing when the first to third subordinate ECUs 40, 50, 60 are executing a predetermined control process or a predetermined termination process. In short, the current flowing through the first to third subordinate ECUs 40, 50, 60 is greatest when these ECUs are executing a predetermined control process. The current flowing through these ECUs is the second greatest when they are executing a predetermined termination process. The current flowing through these ECUs is lowest when they are in a sleep state. The first to third current sensors 27, 29, 37 detect the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60, respectively. More precisely, the first current sensor 27 detects the amount of current flowing through the power supply line of the first subordinate ECU 40. The second current sensor 29 detects the amount of current flowing through the power supply line of the second subordinate ECU 50. The third current sensor 37 detects the amount of current flowing through the power supply line of the third subordinate ECU 60. The current values ​​detected by the first to third current sensors 27, 29, 37 are input to the first and second intermediate ECUs 20, 30. Consequently, based on the current values ​​input from the first to third current sensors 27, 29, 37, the first and second intermediate ECUs 20, 30 can determine whether the corresponding first to third subordinate ECUs 40, 50, 60 are executing a predetermined control process, executing a predetermined termination process, or are in a standby state. In the example shown in Fig. 1, the first to third current sensors 27, 29, 37 are located outside the first and second intermediate ECUs 20, 30, but they can also be located inside them. If the first and second intermediate ECUs 20, 30 switch off the first to third relay circuits 26, 28, 36 based on vehicle status information or a communication message instructing the relay circuits to switch off, without taking into account the situation in the first to third subordinate ECUs 40, 50, 60, there is a possibility of difficulty in that the error described below as an example occurs. For example, suppose the first intermediate ECU 20 switches off the first and second relay circuits 26, 28 based on vehicle status information or a communication message, even though the first and second subordinate ECUs 40, 50 are executing the predetermined termination process. In this case, the predetermined termination process is interrupted in the first and second subordinate ECUs 40, 50. As a result, the first and second subordinate ECUs 40, 50 may, for example, be unable to save required backup data or return the actuator to its initial position. Therefore, in the vehicle-internal system 100 according to this embodiment, the first and the second intermediate ECU 20, 30 determine whether the first to third relay circuit 26, 28, 36 should be switched on or off, not only on the basis of the detected vehicle status information and / or the received communication message, but also on the basis of the amount of current detected by the first to third current sensor 27, 29, 37. More precisely, based on the amount of current detected by the first to third current sensor 27, 29, 37, the first and second intermediate ECU (corresponding to the first and second relay control unit 24, 34) can detect whether the first to third subordinate ECU 40, 50, 60 are in an operating state for executing the predetermined control process or a predetermined termination process, or whether they are in a sleep state. Even if the detected vehicle status information and / or the received communication message indicates that the first to third relay circuit 26, 28, 36 should be switched off, the first and second intermediate ECUs 20, 30 may therefore leave the first to third relay circuit 26, 28, 36 switched on if the amount of current detected by the current sensors 27, 29, 36 on the power supply line indicates that the subordinate ECUs 40, 50, 60 are in operation.This prevents the first to third relay circuit 26, 28, 36 from being switched off while the subordinate ECUs 40, 50, 60 are in the operating state, thus avoiding, for example, the interruption of a predetermined termination process. Then, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuits 26, 28, 36 when the detected vehicle status information and / or the received communication message indicate that the first to third relay circuits 26, 28, 36 should be switched off, and when the current detected by the current sensors 27, 29, 36 on the power supply line is an amount indicating that the subordinate ECUs 40, 50, 60 are in a sleep state. This allows the first to third relay circuits 26, 28, 36 to be switched off at a suitable time when the subordinate ECUs 40, 50, 60 are in a sleep state. An example of the processing performed in the first and second intermediate ECUs 20, 30 to control the on and off states of the first to third relay circuits 26, 28, 36 is described below with reference to the flowcharts shown in Figures 3, 4 to 5. The first and second intermediate ECUs 20, 30 repeatedly execute the processes shown in the flowcharts of Figures 3, 4 to 5 for each of the first to third relay circuits 26, 28, 36. The execution of the processes in the flowcharts described below by the first and second intermediate ECUs 20, 30 corresponds to the execution of the control method for the vehicle system 100 in the present embodiments. In step S100 of the flowchart in Fig. 3, the first and second intermediate ECUs 20 and 30 acquire the vehicle state information transmitted by the higher-level ECU 10 and the like. And / or the first and second intermediate ECUs 20 and 30 receive the communication message (i.e., the relay control message and the NM message) transmitted by a higher-level ECU or the like. Then, in step S110, the first and second intermediate ECUs 20 and 30 determine, based on the acquired vehicle state information, whether or not it is necessary to activate the first to third relay circuit 26, 28, 36, and / or whether or not a communication message has instructed them to activate the first to third relay circuit 26, 28, 36. When it is determined that the first to third relay circuit 26, 28, 36 should be switched on, the first and the second intermediate ECU 20, 30 proceed to step S120.If, however, it is determined that the first to third relay circuit 26, 28, 36 should not be switched on, the first and the second intermediate ECU 20, 30 return to processing step S100. In step S120, the first and second intermediate ECUs 20, 30 activate the first to third relay circuits 26, 28, 36. This enables the first to third subordinate ECUs 40, 50, 60, which are powered via the activated relay circuits 26, 28, 36, to execute predetermined control processes. The first to third subordinate ECUs 40, 50, 60 execute the predetermined control processes independently or in cooperation with other ECUs. In step S130, the first and second intermediate ECUs 20, 30 acquire the vehicle status information and / or receive the communication message to check for a change in the vehicle status and / or to receive a new communication message. In step S140, the first and second intermediate ECUs 20, 30 receive the current measured by the first to third current sensors 27, 29, 37 and measure the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60. In step S150, the first and second intermediate ECUs 20 and 30 determine, based on the acquired vehicle state information, whether it is necessary to switch off the first to third relay circuit 26, 28, 36, and / or whether a communication message has instructed them to do so. If it is determined that the first to third relay circuit 26, 28, 36 should be switched off, the first and second intermediate ECUs 20 and 30 proceed to a first relay-off determination process in step S160. Conversely, if it is determined that the first to third relay circuit 26, 28, 36 should not be switched off, the first and second intermediate ECUs 20 and 30 proceed to the second relay-off determination process of step S170. An example of the first relay-off determination process is shown in the flowchart of Fig. 4.An example of the second relay off determination process is shown in the flowchart of Fig. 5. In step S180, the first and second intermediate ECUs 20, 30 determine whether the first to third relay circuits 26, 28, 36 were switched off in the first relay determination process or in the second relay determination process. If it is determined that the first to third relay circuits 26, 28, 36 are switched off, the first and second intermediate ECUs 20, 30 temporarily terminate the processing shown in the flowchart of Fig. 3. If, however, it is determined that the first to third relay circuits 26, 28, 36 are not switched off, the first and second intermediate ECUs 20, 30 return to processing step S130. The first relay off determination process in step S160 of the flowchart in Fig. 3 is described in detail below with reference to the flowchart shown in Fig. 4. In step S200, the first and second intermediate ECUs 20, 30 determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is within the range that is not less than the first threshold and not greater than the third threshold (threshold is also denoted as SW in the drawings). As shown in Fig. 6, the first threshold is a predetermined threshold for distinguishing whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 indicates the idle state of the first to third subordinate ECUs 40, 50, 60 or an operating state in which the first to third subordinate ECUs 40, 50, 60 are in operation. As shown in Fig.As shown in Figure 6, the third threshold is a threshold predetermined based on the maximum current flowing through the first to third subordinate ECUs 40, 50, 60 when the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 indicates an operating state in which the first to third subordinate ECUs 40, 50, 60 are in operation. The first and third thresholds are determined individually for each of the first to third subordinate ECUs 40, 50, 60. If the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is within the range of greater than or equal to the first threshold and less than or equal to the third threshold, the first to third subordinate ECUs 40, 50, 60 can be considered operational. Although the first and second intermediate ECUs 20, 30 should be switching off the first to third relay circuit 26, 28, 36 based on the acquired vehicle state information and / or the received communication message, the first and second intermediate ECUs 20, 30 do not switch off the first to third relay circuit 26, 28, 36. Instead, they terminate the first relay off determination process of Fig. 4 and return to the processing in the flowchart of Fig. 3. On the other hand, if the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is not within the range of greater than or equal to the first threshold and less than or equal to the third threshold, the first and second intermediate ECUs 20, 30 advance to step S210. In step S210, the first and second intermediate ECUs 20, 30 determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than a first threshold. If it is determined that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than the first threshold, the first and second intermediate ECUs 20, 30 advance to step S220.On the other hand, if it is determined that the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is not less than the first threshold, the first and second intermediate ECUs 20, 30 proceed to step S250. If, in step S210, it is determined that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than the first threshold, it is sufficient or satisfactory that the acquired vehicle state information and / or the received communication message indicate that the first to third relay circuit 26, 28, 36 should be switched off, and that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is a current indicating that the first to third subordinate ECUs 40, 50, 60 are in a sleep state. Therefore, in step S220, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36. The first and second intermediate ECUs 20, 30 then proceed to step S230 and determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than a second threshold set to a value lower than the first threshold. As shown in Fig. 6, the second threshold is lower than the first threshold and lower than the current when the first to third subordinate ECUs 40, 50, 60 are in a sleep state.Consequently, if the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 becomes less than the second threshold, the first and second intermediate ECUs 20, 30 can determine that an open circuit fault (hereinafter referred to as an open circuit fault) has occurred in at least one of the power supply lines of the first to third subordinate ECUs 40, 50, 60, the first to third relay circuit 26, 28, 36 connected to the first to third subordinate ECUs 40, 50, 60, and the first to third subordinate ECUs 40, 50, 60. If, in step S230, the first and second intermediate ECUs 20 and 30 determine that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 is less than the second threshold, the process proceeds to step S240. In step S240, the first and second intermediate ECUs 20 and 30 store the occurrence of the open circuit fault in non-volatile memory, such as their own memory. This makes it easy to determine the location of the fault during fault diagnosis. Furthermore, the first and second intermediate ECUs 20 and 30 send a communication message to inform other ECUs that an open circuit fault has occurred in the subordinate ECU.This allows the other ECUs to gather information about the subordinate ECU where the interruption fault occurred and to recognize that they are unable to communicate normally with that subordinate ECU. Furthermore, if step S230 determines that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is equal to or greater than the second threshold, then the first and second intermediate ECUs 20, 30 terminate the first relay off determination process of Fig. 4 and return to processing the flowchart of Fig. 3. If step S210 determines that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 is not less than the first threshold, then, considering the result of step S200, the current flow will be greater than the third threshold. As described above, the third threshold is determined based on the maximum current flowing through the first to third subordinate ECUs 40, 50, and 60 when they are in an operating state. Consequently, if the current flow is greater than the third threshold, an excessive current is flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60. Therefore, in step S250, the first and second intermediate ECUs 20 and 30 switch off the first to third relay circuit 26, 28, and 36. This prevents an excessively high current from constantly flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60. Subsequently, the first and second intermediate ECUs 20 and 30 proceed to step S260 to determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 exceeds a fourth threshold, which is set to a value greater than the third threshold. As shown in Fig. 6, the fourth threshold is a threshold that is greater than the third threshold and greater than the overcurrent current that may temporarily flow in the power supply lines of the first to third subordinate ECU 40, 50, 60 due to the influence of electromagnetic noise and the like. Consequently, if the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 becomes greater than the fourth threshold, the first and second intermediate ECUs 20, 30 can determine that a short-circuit fault has occurred in at least one of the power supply lines of the first to third subordinate ECUs 40, 50, 60, the first to third relay circuit 26, 28, 36 connected to the first to third subordinate ECUs 40, 50, 60, and the first to third subordinate ECUs 40, 50, 60. If, in step S260, the first and second intermediate ECUs 20 and 30 determine that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 is greater than the fourth threshold, the process proceeds to step S270. In step S270, the first and second intermediate ECUs 20 and 30 store the occurrence of the short-circuit fault in non-volatile memory, such as their own memory. This makes it easy to determine the location of the fault during fault diagnosis. Furthermore, the first and second intermediate ECUs 20 and 30 send a communication message to inform other ECUs that a short-circuit fault has occurred in the subordinate ECU.This allows the other ECUs to gather information about the subordinate ECU where the short circuit occurred and to recognize that the other ECU cannot communicate normally with this subordinate ECU. Furthermore, if in step S260 it is determined that the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is equal to or less than the fourth threshold, then the first and second intermediate ECUs 20, 30 terminate the first relay off determination process of Fig. 4 and return to processing the flowchart of Fig. 3. The second relay off determination process in step S170 of the flowchart in Fig. 3 is described in detail below with reference to the flowchart shown in Fig. 5. In the second relay off determination process, since the acquired vehicle status information and / or the received communication message do not indicate that the first to third relay circuits 26, 28, 36 should be switched off, the first and second intermediate ECUs 20, 30 perform an anomaly detection, which corresponds to the overcurrent detection (in steps S200, S210), the open circuit fault detection (in step S230), and the short circuit fault detection (in step S270) in the first relay off determination process described above. If any anomaly is detected, the first and second intermediate ECUs 20, 30 take the necessary actions, such as switching off the relay circuit, storing the fault, and reporting the fault. In step S300, the first and second intermediate ECUs 20 and 30 determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 is within the range that is not less than the second threshold and not greater than the third threshold. In other words, in step S300, the first and second intermediate ECUs 20 and 30 determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 indicates that the first to third subordinate ECUs 40, 50, and 60 are in an operating state, either in operation or in a sleep state. If the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is within the range equal to or greater than the second threshold and equal to or less than the third threshold, the first to third subordinate ECUs 40, 50, 60 can be considered to be in an operating or idle state. In other words, the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 does not indicate the occurrence of an anomaly. Consequently, if in step S300 it is determined that the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is in the range equal to or greater than the second threshold and equal to or less than the third threshold, the first and second intermediate ECUs 20, 30 terminate the second relay off determination process of Fig.5 and return to processing the flowchart of Fig. 3. If, however, the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is not within the range equal to or greater than the second threshold and equal to or less than the third threshold, the first and second intermediate ECUs 20, 30 proceed to step S310. In step S310, the first and second intermediate ECUs 20, 30 determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than a second threshold. If it is determined that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is less than the second threshold, the first and second intermediate ECUs 20, 30 proceed to step S320.If, on the other hand, it is determined that the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is not less than the second threshold, the first and second intermediate ECUs 20, 30 proceed to step S340. Consequently, in step S310, if the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 falls below the second threshold, the first and second intermediate ECUs 20, 30 can determine that an open circuit fault has occurred in at least one of the power supply lines of the first to third subordinate ECUs 40, 50, 60, the first to third relay circuit 26, 28, 36 connected to the first to third subordinate ECUs 40, 50, 60, and the first to third subordinate ECUs 40, 50, 60 themselves. Therefore, in step S320, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36. Subsequently, as the process progresses to step S330, the first and second intermediate ECUs 20 and 30 store the occurrence of the open circuit fault in non-volatile memory, such as their own. This makes it easy to determine the location of the fault during troubleshooting. Furthermore, the first and second intermediate ECUs 20 and 30 send a communication message to inform other ECUs that an open circuit fault has occurred in the lower-level ECU. This allows the other ECUs to gather information about the lower-level ECU where the open circuit fault occurred and to recognize that they are unable to communicate normally with that lower-level ECU. If, in step S310, it is determined that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is not less than the second threshold, then, considering the result of the determination in step S300, the current is greater than the third threshold. Therefore, in step S340, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36. This prevents an excessively high current from constantly flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60. Subsequently, the first and second intermediate ECUs 20, 30 proceed to step S350 to determine whether the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is greater than a fourth threshold. If, in step S350, the first and second intermediate ECUs 20 and 30 determine that the current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, and 60 exceeds the fourth threshold, the process proceeds to step S360. In step S360, the first and second intermediate ECUs 20 and 30 store the occurrence of the short-circuit fault in non-volatile memory, such as their own memory. This makes it easy to determine the location of the fault during fault diagnosis. Furthermore, the first and second intermediate ECUs 20 and 30 send a communication message to inform other ECUs that a short-circuit fault has occurred in the subordinate ECU.This allows the other ECUs to gather information about the subordinate ECU where the short circuit occurred and to recognize that the other ECU cannot communicate normally with this subordinate ECU. Furthermore, if in step S350 it is determined that the amount of current flowing through the power supply lines of the first to third subordinate ECUs 40, 50, 60 is equal to or less than the fourth threshold, then the first and second intermediate ECUs 20, 30 terminate the second relay off determination process of Fig. 5 and return to processing the flowchart of Fig. 3. As described above, in the vehicle-internal system 100 according to the first embodiment, the first and second intermediate ECUs 20, 30 (and the corresponding first and second relay control units 24, 34) switch off the first to third relay circuit 26, 28, 36 based on the feature that the current detected by the first to third current sensors 27, 29, 37 has reached the current level indicating that the first to third subordinate ECUs 40, 50, 60 are in a sleep state. Consequently, if the first to third subordinate ECUs 40, 50, 60 are in an operating state, it is possible to avoid interrupting the power supply to the first to third subordinate ECUs 40, 50, 60. In other words, the power supply to the first to third subordinate ECUs 40, 50, 60 can be switched off at a suitable timing when the first to third subordinate ECUs 40, 50, 60 are in a sleep state. (Second embodiment) A second embodiment of the vehicle-integrated system 100 and the control method for the vehicle-integrated system 100 according to the present embodiments is described below. The vehicle-integrated system 100 according to this embodiment is configured similarly to the vehicle-integrated system 100 according to the first embodiment. Therefore, a description of the configuration of the vehicle-integrated system 100 according to the second embodiment is omitted. According to the first embodiment, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36 when the detected vehicle status information and / or the received communication message indicate that the first to third relay circuit 26, 28, 36 should be switched off, and when the current detected by the current sensors 27, 29, 36 on the power supply line is a current that indicates that the subordinate ECUs 40, 50, 60 are in a sleep state. In contrast, in this embodiment, the first and second intermediate ECUs 20, 30 are configured to switch off the first to third relay circuit 26, 28, 36 when the current quantities detected by the first to third current sensors 27, 29, 36 indicate that the first to third subordinate ECUs 40, 50, 60 are in a sleep state. This is because the first to third subordinate ECUs 40, 50, 60 may contain subordinate ECUs which, when activated and entering an operating state, execute a specific control process a predetermined number of times (for example, once) and then enter a sleep state. The flowchart shown in Fig. 7 illustrates the processing carried out by the first and second intermediate ECUs 20, 30 when the first to third relay circuits 26, 28, 36 are switched off in response to the fact that the current quantities detected by the first to third current sensors 27, 29, 36 are the current quantities indicating the idle states of the first to third subordinate ECUs 40, 50, 60. In the flowchart of Fig. 7, the vehicle state information and / or the communication message are not considered when the first to third relay circuits 26, 28, 36 are switched off, and therefore steps S130, S150, and S170 in the flowchart of Fig. 3 are omitted. The other processes in the flowchart of Fig. 7 are the same as in the flowchart of Fig. 3 and are therefore not described again. The processing shown in the flowchart of Fig. 7 and the processing shown in the flowchart of Fig. 3 can be used separately for each of the first to third subordinate ECUs 40, 50, 60, depending on how the control process is executed by the subordinate ECUs 40, 50, 60 (i.e., whether the control process is executed a predetermined number of times or whether the control process is executed repeatedly as long as a specific vehicle state persists). Furthermore, as described above, if the first and second intermediate ECUs 20, 30 switch off the first to third relay circuit 26, 28, 36 in accordance with the current detected by the first to third current sensor 27, 29, 36, which is the current indicating the idle state of the first to third subordinate ECUs 40, 50, 60, the first to third subordinate ECUs 40, 50, 60 do not necessarily have to be configured to communicate with other ECUs via the communication buses 44, 54, 64. (Third embodiment) A third embodiment of the vehicle-integrated system 100 and the control method for the vehicle-integrated system 100 according to the present embodiments is described below. The vehicle-integrated system 100 according to this embodiment is configured similarly to the vehicle-integrated system 100 according to the first embodiment. Therefore, a description of the configuration of the vehicle-integrated system 100 according to the third embodiment is omitted. In the first embodiment, an open circuit fault is determined to have occurred when the current detected by the first to third current sensors 27, 29, and 36 becomes equal to or less than the second threshold value. In contrast, in this embodiment, the occurrence of an anomaly, such as an open circuit fault, is determined by considering the history of changes in the current detected by the current sensors 27, 29, and 36 on the power supply lines. Therefore, in this embodiment, the first and second intermediate ECUs 20 and 30 store the current values ​​detected by the first to third current sensors 27, 29, and 36 for a specific period of time in the past. When the first to third subordinate ECUs 40, 50, and 60 are powered on and operating normally, they initially execute a predetermined control process. Once this process is complete, they execute a predetermined termination process. After this termination process is finished, the first to third subordinate ECUs 40, 50, and 60 enter a sleep state. Consequently, when the first to third subordinate ECUs 40, 50, 60 enter a sleep state, the current detected by the current sensors 27, 29, 36 on the power supply line should change from the current range in which the control process is carried out, through the current range in which the termination process is carried out, to the current range in which the sleep state is reached, as shown in Fig. 8. Therefore, if the current detected by the current sensors 27, 29, 36 on the power supply line becomes a current that indicates a quiescent state below the first threshold, and the course of changes in the current indicates that the first to third subordinate ECUs 40, 50, 60 are executing a predetermined control process, then that the first to third subordinate ECUs 40, 50, 60 are executing a predetermined termination process, and finally that the first to third subordinate ECUs 40, 50, 60 are in a quiescent state, it can be determined that the first to third subordinate ECUs 40, 50, 60 have normally entered a quiescent state. In this case, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuits 26, 28, 36 when the first to third subordinate ECUs 40, 50, 60 go into sleep mode. Conversely, if the current change profile does not indicate that the first to third subordinate ECUs 40, 50, 60 have transitioned from a state in which a predetermined control process is executed, through a state in which a predetermined termination process is executed, to a state in which the first to third subordinate ECUs 40, 50, 60 are in a sleep state, and the current detected by the first to third current sensor 27, 29, 36 becomes a current indicating a state in which the first to third subordinate ECUs 40, 50, 60 are in a sleep state, and the current is less than the first threshold value, then it can be assumed that an anomaly, such as... B. an interruption fault, in at least either the power supply lines or the first to third relay circuit 26, 28, 36 or the subordinate ECUs 40, 50, 60.Therefore, in such a case, the first and second intermediate ECUs 20, 30 switch off the first to third relay circuits 26, 28, 36 and execute the process, such as storing the information about the occurrence of an anomaly and notifying other ECUs about the occurrence of an anomaly. (Modifications) An exemplary embodiment of the present disclosure has been explained above. The present disclosure is not limited to the embodiment described above and can be implemented by various modifications without departing from the spirit of the present disclosure. (Modification 1) For example, in the first to third embodiments described above, an example is described in which a subordinate ECU 40, 50, 60 is connected to each of the relay circuits 26, 28, 36. However, as shown in Fig. 9, for example, two or more subordinate ECUs 40a, 40b can be connected to a relay circuit 26. In this case, the communication interfaces 42a and 42b of the respective subordinate ECUs 40a and 40b can both be connected to the communication bus 44. In this way, when two or more subordinate ECUs 40a, 40b are connected to a relay circuit 26, the first threshold shown in Fig. 6 is set to differentiate between a case in which the two or more subordinate ECUs 40a, 40b are all in a sleep state and a case in which at least one of the two or more subordinate ECUs 40a, 40b is in an operating state. The third threshold shown in Fig. 6 is set based on the maximum amount of current flowing through each of the two or more subordinate ECUs 40aa, 40b in an operating state in which all of the two or more subordinate ECUs 40a, 40b are in operation. As a result, if the amount of current detected by the current sensor 27 falls below the first threshold, the first intermediate ECU 20 can determine that all of the two or more subordinate ECUs 40a, 40b have entered a sleep state and switch off the first relay circuit 26. (Modification 2) The system and associated method of this disclosure can be implemented by a specialized computer containing a processor programmed to provide one or more functions that are executed by computer programs. The systems and methods of this disclosure can be implemented using a dedicated hardware logic circuit. The system and the associated method of the present disclosure can be implemented by one or more dedicated computers configured by a combination of a processor executing a computer program and one or more hardware logic circuits. For example, some or all of the functions provided by the master ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50, and 60 can be implemented in hardware. A configuration in which a particular function is implemented by a hardware logic circuit includes a configuration in which the function is implemented using one or more integrated circuits or the like.Some or all of the functions provided by the parent ECU 10, the first and second intermediate ECUs 20 and 30, and the first to third subordinate ECUs 40, 50 and 60 can be implemented using a system-on-chip (SoC), an integrated circuit (IC) or an FPGA (field-programmable gate array). The IC concept also includes ASICs (Application-Specific Integrated Circuits). The computer program described above can be stored as instructions to be executed by a computer on a computer-readable, non-volatile, physical storage medium. A hard disk drive (HDD), a solid-state drive (SSD), flash memory, or the like can be used as the storage medium for the computer program. Furthermore, the present embodiments also include a program that causes a computer to act as the master ECU 10, the first and second intermediate ECUs 20 and 30, and the first through third subordinate ECUs 40, 50, and 60, as well as non-volatile physical storage media such as semiconductor memory or the like on which such a program is stored. (Forms of implementation of technical features) This document discloses several technical features, which are described in several points listed below. Some points may be described in multiply dependent form to refer to more than one preceding point. Furthermore, some points may be written in multiply dependent form and refer to several points, which in turn contain other points in multiply dependent form. These points described in multiply dependent form define several technical features. Moreover, the technical features described in the following paragraphs also apply to a control method for an in-vehicle network system. (Technical feature 1) An in-vehicle system (100) comprises several control devices (10, 20, 30, 40, 50, 60) mounted on a vehicle. The several control devices include at least one subordinate control device (40, 50, 60) and at least one superior control device (20, 30) located at a higher level than the at least one subordinate control device. The at least one superior control device has a relay control unit (24, 34) that switches on or off a relay circuit (26, 28, 36) provided in a power supply line (6) of the at least one subordinate control device. The in-vehicle system further comprises a current sensing unit (27, 29, 37) that detects the amount of current flowing through the power supply line of the at least one subordinate control device.The relay control unit is configured to switch off the relay circuit when the current detected by the current sensing unit reaches a predetermined current level that indicates a standby state of at least one subordinate control device. (Technical feature 2) In the vehicle-internal system according to technical feature 1, the at least one lower control device is able to execute a predetermined process when energy is supplied via the relay circuit and enters a rest state after completion of the predetermined process. (Technical feature 3) In the vehicle-internal system according to technical feature 1 or 2, the relay control unit switches on the relay circuit in response to vehicle status information about a state of the vehicle and / or in response to receiving a communication message from another control device indicating that the relay circuit needs to be switched on. (Technical feature 4) In the vehicle-internal system according to one of technical features 1 to 3, the relay control unit keeps the relay circuit in an on state when the current detected by the current sensing unit is an amount of current indicating that at least one subordinate control device is in operation, although vehicle state information relating to a state of the vehicle and / or a communication message received from another control device indicates that the relay circuit must be switched off. (Technical feature 5) In the vehicle-internal system according to one of technical features 1 to 4, the relay control unit switches off the relay circuit when vehicle status information relating to a state of the vehicle and / or a communication message received from another control device indicates that the relay circuit must be switched off, and the current quantity detected by the current sensing unit is a current quantity indicating the idle state of at least one subordinate control device. (Technical feature 6) The vehicle-internal system according to one of technical features 1 to 5 further comprises a further higher-level control device (10) which is arranged at a higher level than the at least one higher-level control device. The further higher-level control device provides the higher-level control device with at least some of the vehicle status information and / or, as a separate control device, sends a communication message indicating that the relay circuit should be switched on or off. (Technical feature 7) In the vehicle-internal system according to one of technical features 1 to 6, the at least one subordinate control device comprises at least two subordinate control devices (40a, 40b) connected to the power supply line equipped with the relay circuit. The relay control unit switches off the relay circuit based on a feature that the current detected by the current sensing unit reaches a current level indicating that the at least two subordinate control devices have all entered the standby state. (Technical feature 8) In the vehicle-internal system according to one of the technical features 1 to 7, the relay control unit determines that the current detected by the current sensing unit reaches a current quantity indicating the standby state of the at least one subordinate control device when the current detected by the current sensing unit is less than a first threshold value predetermined to distinguish between the standby state of the at least one subordinate control device and an operating state in which the at least one subordinate control device is in operation. (Technical feature 9) In the vehicle-internal system according to technical feature 8, the relay control unit determines that an interruption fault has occurred in at least either the power supply line or the relay circuit or the at least one subordinate control device when the amount of current detected by the current sensing unit becomes less than a second threshold set to a lower threshold than the first threshold. (Technical feature 10) In the vehicle-internal system according to one of technical features 1 to 9, the relay control unit switches off the relay circuit when the current detected by the current sensing unit exceeds a third threshold value, which is preset on the basis of a maximum current flowing through the at least one subordinate control device when the at least one subordinate control device is in an operating state in which the at least one subordinate control device is in operation. (Technical feature 11) In the vehicle-internal system according to technical feature 10, the relay control unit determines that a short-circuit fault has occurred in at least either the power supply line or the relay circuit or the at least one subordinate control device when the current detected by the current sensing unit becomes greater than a fourth threshold that is greater than the third threshold. (Technical feature 12) In the vehicle-internal system according to one of technical features 1 to 11, the at least one lower control device can execute a predetermined process by being energized via the relay circuit. The predetermined process comprises a predetermined control process and a predetermined termination process. When the execution of the predetermined control process is complete, the at least one lower control device enters a rest state after executing the predetermined termination process. The amount of current flowing through the at least one lower control device differs depending on whether the at least one lower control device is executing the predetermined control process, executing the predetermined termination process, or is in a rest state.The relay control unit switches off the relay circuit when the current detected by the current sensing unit is a current that indicates the idle state of the at least one lower control device, and a history or progression of changes in the current indicates that the at least one lower control device has transitioned from an execution state of the predetermined control process, through an execution state of the predetermined termination process, to the idle state. (Technical feature 13) In the vehicle-internal system according to technical feature 12, the relay control unit determines that an interruption fault has occurred in at least either the power supply line or the relay circuit or the at least one lower control device if the course of changes in the amount of current detected by the current sensing unit does not indicate that the at least one lower control device has transitioned from an execution state of the predetermined control process, through the execution state of the predetermined termination process, to the idle state, and the amount of current detected by the current sensing unit reaches an amount of current that indicates the idle state of the at least one lower control device. (Technical feature 14) In the vehicle-internal system according to one of the technical features 9, 11 and 13, the relay control unit stores an occurrence of a corresponding fault if it determines that the open circuit fault or the short circuit fault has occurred in at least either the power supply line or the relay circuit or the at least one subordinate control device. (Technical feature 15) In the vehicle-internal system according to technical feature 14, the relay control unit further sends a communication message to the other control device to inform the other control device of the occurrence of the corresponding fault when it is determined that the open circuit fault or the short circuit fault has occurred in at least either the power supply line or the relay circuit or the at least one subordinate control device. Reference numeral 2 denotes a battery, reference numeral 4 denotes a power supply circuit, reference numeral 6 denotes a power supply line, reference numeral 10 denotes a higher-level ECU, reference numeral 12 denotes a communication IF, reference numeral 14 denotes a vehicle state management unit, reference numeral 15 denotes a network management unit, reference numeral 20 denotes a first intermediate ECU, reference numeral 22 denotes a communication IF, reference numeral 24 denotes a first relay control unit, reference numeral 26 denotes a first relay circuit, reference numeral 27 denotes a first current sensor, reference numeral 28 denotes a second relay circuit, reference numeral 29 denotes a second current sensor, reference numeral 30 denotes a second intermediate ECU, reference numeral 32 denotes a communication IF, reference numeral 34 denotes a second Relay control unitReference numeral 36 designates a third relay circuit, reference numeral 37 designates a third current sensor, reference numeral 38 designates a communication bus, reference numeral 40 designates a first subordinate ECU, reference numeral 42 designates a communication IF, reference numeral 44 designates a communication bus, reference numeral 50 designates a second subordinate ECU, reference numeral 52 designates a communication IF, reference numeral 54 designates a communication bus, reference numeral 60 designates a third subordinate ECU, reference numeral 62 designates a communication IF, reference numeral 64 designates a communication bus, and reference numeral 100 designates an in-vehicle system. It should be noted that a flowchart or the execution of the flowchart in the present application comprises sections (also referred to as steps), each of which is represented, for example, as S100. Furthermore, each section can be divided into several subsections, while several sections can be combined into a single section. Moreover, each of the sections thus configured can also be referred to as a device, a module, or a means. Although the present disclosure is described above with reference to its embodiments, it should be noted that it is not limited to these embodiments and constructions. The present disclosure is intended to cover various modifications and equivalent arrangements. Furthermore, the various combinations and configurations, as well as other combinations and configurations, including more, fewer, or only a single element, are to be understood as included within the meaning and scope of the present disclosure.

Claims

Vehicle-internal system (100) comprising: - several control devices (10, 20, 30, 40, 50, 60) attached to a vehicle, wherein - the several control devices comprise at least one subordinate control device (40, 50, 60) and at least one superior control device (20, 30) arranged at a higher level than the at least one subordinate control device;and- the at least one superior control device comprises a relay control unit (24, 34) which switches on or off a relay circuit (26, 28, 36) provided in a power supply line (6) of the at least one subordinate control device, wherein- the vehicle-internal system further comprises:- a current sensing unit (27, 29, 37) which detects a quantity of current flowing through the power supply line of the at least one subordinate control device, wherein- the relay control unit is configured to switch off the relay circuit when the quantity of current detected by the current sensing unit reaches a predetermined quantity of current indicating a standby state of the at least one subordinate control device.; Vehicle-internal system according to claim 1, wherein the at least one subordinate control device is able to execute a predetermined process when it is supplied with energy via the relay circuit, and enters a rest state after completion of an execution of the predetermined process. In-vehicle system according to claim 1 or 2, wherein the relay control unit switches on the relay circuit in response to vehicle status information relating to a state of the vehicle and / or in response to receiving a communication message from another control device indicating that the relay circuit needs to be switched on. In-vehicle system according to one of claims 1 to 3, wherein the relay control unit keeps the relay circuit in an on state when the current detected by the current sensing unit is a current that indicates that the at least one subordinate control device is in operation, although vehicle state information relating to a state of the vehicle and / or a communication message received from another control device indicates that the relay circuit must be switched off. In-vehicle system according to one of claims 1 to 4, wherein the relay control unit switches off the relay circuit when vehicle state information relating to a state of the vehicle and / or a communication message received from another control device indicates that the relay circuit must be switched off, and the current quantity detected by the current sensing unit is a current quantity indicating a standby state of the at least one subordinate control device. Vehicle-internal system according to claim 3, further comprising: - a further superior control device (10) which is arranged at a higher level than the at least one superior control device, wherein - the further superior control device provides at least part of the vehicle status information to the superior control device and / or sends a communication message as another control device indicating that the relay circuit should be switched on or off. Vehicle-internal system according to one of claims 1 to 6, wherein the at least one subordinate control device comprises at least two subordinate control devices (40a, 40b) which are connected to the power supply line provided with the relay circuit; and the relay control unit switches off the relay circuit on the basis of a feature that the amount of current detected by the current sensing unit reaches an amount of current which indicates that the at least two subordinate control devices have all entered a rest state. In-vehicle system according to one of claims 1 to 7, wherein the relay control unit determines that the current detected by the current sensing unit reaches a current quantity indicating a standstill state of the at least one subordinate control device when the current detected by the current sensing unit is less than a first threshold value determined in advance to distinguish between the standstill state of the at least one subordinate control device and an operating state in which the at least one subordinate control device is in operation. In-vehicle system according to claim 8, wherein the relay control unit determines that an interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device when the amount of current detected by the current sensing unit falls below a second threshold value which is set to be smaller than the first threshold value. Vehicle-internal system according to claim 9, wherein the relay control unit stores an occurrence of the interruption fault when it determines that the interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. In-vehicle system according to claim 10, wherein the relay control unit further sends a communication message to another control device to inform the other control device of the occurrence of the interruption fault when it is determined that the interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. In-vehicle system according to one of claims 1 to 11, wherein the relay control unit switches off the relay circuit when the current detected by the current sensing unit exceeds a third threshold value, which has been preset on the basis of a maximum current flowing through the at least one subordinate control device when the at least one subordinate control device is in an operating state in which the at least one subordinate control device is in operation. In-vehicle system according to claim 12, wherein the relay control unit determines that a short-circuit fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device when the amount of current detected by the current sensing unit exceeds a fourth threshold value, which is set to be greater than the third threshold value. Vehicle-internal system according to claim 13, wherein the relay control unit stores an occurrence of the short-circuit fault when it determines that the short-circuit fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. In-vehicle system according to claim 14, wherein the relay control unit further sends a communication message to another control device to inform the other control device of the occurrence of the short circuit fault when it is determined that the short circuit fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. In-vehicle system according to any one of claims 1 to 15, wherein: - the at least one subordinate control device can execute a predetermined process by being supplied with energy via the relay circuit; - the predetermined process comprises a predetermined control process and a predetermined termination process; - when an execution of the predetermined control process is completed, the at least one subordinate control device enters a rest state after having executed the predetermined termination process; - the amount of current flowing through the at least one subordinate control device differs when the at least one subordinate control device is executing the predetermined control process, when the at least one subordinate control device is executing the predetermined termination process, and when the at least one subordinate control device is in a rest state;and- the relay control unit switches off the relay circuit when the current detected by the current sensing unit is a current indicating the idle state of the at least one subordinate control device, and a history of changes in the current indicates that the at least one subordinate control device has transitioned from an execution state of the predetermined control process, via an execution state of the predetermined termination process, to the idle state. Vehicle-internal system according to claim 16, wherein the relay control unit determines that an interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device if the history of changes in the amount of current detected by the current sensing unit does not indicate that the at least one subordinate control device has transitioned from the execution state of the predetermined control process via the execution state of the predetermined termination process to the idle state, and the amount of current detected by the current sensing unit reaches an amount of current that indicates the idle state of the at least one subordinate control device. In-vehicle system according to claim 17, wherein the relay control unit stores an occurrence of the interruption fault when it determines that the interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. In-vehicle system according to claim 18, wherein the relay control unit further sends a communication message to another control device to inform the other control device of the occurrence of the interruption fault when it is determined that the interruption fault has occurred in the power supply line and / or the relay circuit and / or the at least one subordinate control device. Method for controlling an in-vehicle system (100) comprising several control devices (10, 20, 30, 40, 50, 60) attached to a vehicle, wherein: - the several control devices comprise at least one subordinate control device (40, 50, 60) and at least one superior control device (20, 30) arranged at a higher level than the at least one subordinate control device; - the at least one superior control device comprises a relay control unit (24, 34) which switches on or off a relay circuit (26, 28, 36) provided in a power supply line (6) of the at least one subordinate control device;and- the vehicle-internal system further comprises a current sensing unit (27, 29, 37) which detects a quantity of current flowing through the power supply line of the at least one subordinate control device, wherein- the method for controlling the vehicle-internal system comprises:- detecting the quantity of current flowing through the power supply line by the current sensing unit; and- switching off the relay circuit by the relay control unit when the quantity of current detected by the current sensing unit reaches a predetermined quantity of current indicating a standby state of the at least one subordinate control device.;

Images