Communication systems, management devices, communication methods, and computer programs

Abstract

This system provides a communication method that enables more reliable power control of electronic control devices via message communication. [Solution] The communication system 1 installed in the vehicle includes a Mobicon 2 and ECUs 4-9 arranged to communicate with the Mobicon 2. ECUs 4-9 are started by power supplied from the battery 17 via IPDs 23, 24, 27, 28, 31 and 32, and stopped by power cut off from the battery 17 via IPDs 23-32. ECUs 4-9 start by switching to a wake-up state and stop by switching to a sleep state based on a communication frame received from the Mobicon 2 while power is supplied. When the Mobicon 2 decides to stop ECUs 4-9, it sends stop requests to ECUs 4-9 multiple times in a row.

Description

[Technical Field]

[0001] The present invention relates to a communication system mounted on a vehicle, the management device, a communication method, and a computer program, the communication system including a management device and an electronic control device communicably arranged with the management device. [Background Art]

[0002] Regarding safety requirements for vehicles, standards such as risk ranks are set according to the impact degree of system abnormalities. For system abnormalities with a high risk rank, that is, a large impact degree, it is necessary to take countermeasures such as redundant design to ensure safety. On the other hand, for system abnormalities with limited impact degree, it is difficult to adopt a redundant configuration from the viewpoint of cost, so a non-redundant configuration is often adopted.

[0003] In vehicles, there is known a technology for reducing power consumption of the entire system by transitioning some unnecessary ECUs from a wake-up state to a sleep state. As a means for starting and stopping an ECU, for example, Patent Document 1 discloses a configuration that performs mechanical relay control for each system. [Prior Art Documents] [Patent Documents]

[0004] [Patent Document 1] Japanese Patent No. 5958445 [Summary of the Invention] [Problem to be Solved by the Invention]

[0005] In Patent Document 1, the mechanical relay is replaced with, for example, a semiconductor switch, and the control device sends a message to the ECU to switch the semiconductor switch on and off, thereby switching between the wake-up state and the sleep state. In the non-redundant configuration described above, if power control is performed by message communication, if a communication error occurs, such as a message corruption causing a transmission timeout, the request to stop the power will not be sent, the power will remain on, and there is a risk that the battery power will be depleted.

[0006] The present invention has been made in view of the above circumstances, and its purpose is to provide a communication system, a management device, a communication method, and a computer program that can more reliably control the power supply of an electronic control device by message communication. [Means for solving the problem]

[0007] The communication system described in claim 1 comprises a management device (2) and electronic control devices (4-9) arranged to communicate with the management device, and is mounted on a vehicle. The electronic control devices are started by power supply from an external source (17) via semiconductor switches (23, 24, 27, 28, 31 and 32), and stopped by power cut-off from an external source via semiconductor switches. While power is supplied, they are started by switching to a wake-up state and stopped by switching to a sleep state based on a communication frame received from an external source. When the management device decides to stop the electronic control device, it sends several consecutive stop requests to the electronic control device, which are the first such requests after the decision. With this configuration, even if some of the stop requests are not properly transmitted to the electronic control device due to message corruption or other reasons, the electronic control device can be stopped more reliably.

[0008] According to the communication system described in claim 2, when the management device decides to start the electronic control unit, it sends multiple consecutive start requests to the electronic control unit. This makes it possible to start the electronic control unit more reliably, just as it does when stopping it. [Brief explanation of the drawing]

[0009] [Figure 1] Functional block diagram showing the overall configuration in the first embodiment [Figure 2] Mobicon Functional Block Diagram [Figure 3] Functional block diagram of the power distribution management ECU [Figure 4] Block diagram of Zone ECU functions [Figure 5] First End ECU Functional Block Diagram [Figure 6] Flowchart showing the processing steps of Mobicon [Figure 7] A flowchart showing the ECU's processing steps upon receiving the first message. [Figure 8] Sequence diagram for transmitting the IPD off signal [Figure 9] Sequence diagram for transmitting the IPD ON signal [Figure 10] This flowchart illustrates the process of transitioning to sleep mode if a certain period of time has elapsed since the reception of a wake-up request communication frame was interrupted. [Figure 11] A diagram showing the data format of the third message in the second embodiment. [Figure 12] Diagram showing the transmission method of the third message. [Modes for carrying out the invention]

[0010] One embodiment will be described with reference to the drawings. The communication system 1 is based on a well-known zone architecture and is configured to include a plurality of ECUs arranged according to zones that indicate the location of the vehicle body, such as the front, rear, left, and right sides.

[0011] As shown in Figure 1, the communication system 1 installed in the vehicle includes a mobility computer (hereinafter referred to as "Mobicon") 2 which corresponds to a management device, a power distribution management ECU 3 which corresponds to a power distribution management device and is connected to the Mobicon 2 in a communicative manner, a first zone ECU 4 and a second zone ECU 5 which correspond to a first electronic control device, a first end ECU 6 and a second end ECU 7 which correspond to a second electronic control device and are connected to the first zone ECU 4 in a communicative manner, and a third end ECU 8 and a fourth end ECU 9 which correspond to a second electronic control device and are connected to the second zone ECU 5 in a communicative manner.

[0012] In Figure 1, two zone ECUs 4 and 5 are shown as examples of zone ECUs that can communicate with Mobicon 2, but there may be one or more zone ECUs that can communicate with Mobicon 2. Similarly, two end ECUs 6 and 7 are shown as examples of end ECUs that can communicate with the first zone ECU 4, but there may be one or more end ECUs that can communicate with the first zone ECU 4. Likewise, two end ECUs 8 and 9 are shown as examples of end ECUs that can communicate with the second zone ECU 5, but there may be one or more end ECUs that can communicate with the second zone ECU 5.

[0013] Mobicon 2 is a control device capable of controlling the operation of the power distribution management ECU 3, zone ECUs 4 and 5, and end ECUs 6 through 9. Mobicon 2 and the power distribution management ECU 3 are connected via communication line 10. Mobicon 2 and the first zone ECU 4 are connected via communication line 11. Mobicon 2 and the second zone ECU 5 are connected via communication line 12.

[0014] The first zone ECU 4 and the first end ECU 6 are communicably connected via a communication line 13. The first zone ECU 4 and the second end ECU 7 are communicably connected via a communication line 14. The second zone ECU 5 and the third end ECU 8 are communicably connected via a communication line 15. The second zone ECU 5 and the fourth end ECU 9 are communicably connected via a communication line 16. Each of the communication lines 10 to 16 is a communication line capable of performing communication based on a communication frame conforming to a communication protocol such as CAN (Controller Area Network, registered trademark) or CAN FD (CAN With Flexible Data Rate, registered trademark), for example.

[0015] The power distribution management ECU 3 is supplied with electric power from a battery 17 via a power line 18, distributes the electric power supplied from the battery 17 to the mobility controller 2 and the zone ECUs 4 and 5, distributes electric power to the end ECUs 6 and 7 via the first zone ECU 4, and distributes electric power to the end ECUs 8 and 9 via the second zone ECU 5.

[0016] The power distribution management ECU 3 and the mobility controller 2 are connected so as to enable power distribution via a power line 19. The power distribution management ECU 3 includes an IPD (Intelligent Power Device) 22, which is a high-performance semiconductor power switch interposed between the power line 18 and the power line 19. The IPD is a high-performance semiconductor power switch that incorporates a protection circuit and can absorb energy from an inductive load or the like. The IPD may also be referred to as a semiconductor fuse, an IPS (Intelligent Power switch), a smart switch, a high-side / low-side switch, or the like. Compared with a mechanical relay having mechanical contacts, the IPD does not have mechanical contacts, so it has advantages of excellent mechanical durability, quietness, and compact size. In addition, since it is provided with a protection function that does not exist in a mechanical relay, high reliability can also be ensured.

[0017] IPD22 is basically always on, and power from the battery 17 is constantly supplied to the mobile control unit 2. In the present embodiment, IPD22 is basically always on, but a configuration that allows IPD22 to be turned off may also be employed. For example, when the vehicle is not used for a long period of time such as during transportation by ship, temporarily turning off IPD22 makes it possible to suppress dark current flowing to the mobile control unit 2, thereby making it possible to suppress power consumption of the battery 17.

[0018] Furthermore, when IPD22 is temporarily turned off, the power supply from the battery 17 to the mobile control unit 2 is stopped, but a configuration may be adopted in which switching IPD22 from off to on is enabled by operating the mobile control unit 2 in a low power consumption state via battery drive, for example, during the period in which the power supply is stopped. In addition, a configuration may be adopted in which power from the battery 17 is constantly supplied to the mobile control unit 2 by directly connecting the mobile control unit 2 and the battery 17. In that case, the power line 19 and IPD22 are omitted.

[0019] The power distribution management ECU 3 and the first zone ECU 4 are connected via a power line 20 so that power can be distributed. The power distribution management ECU 3 and the second zone ECU 5 are connected via a power line 21 so that power can be distributed. The power distribution management ECU 3 includes IPD23 interposed between the power line 18 and the power line 20, and IPD24 interposed between the power line 18 and the power line 21.

[0020] The power distribution management ECU 3 turns IPD23 on and off based on an on / off instruction for IPD23 from the mobile control unit 2, and switches between a power supply state and a power cut-off state to the first zone ECU 4. That is, turning on IPD23 starts power supply from the power distribution management ECU 3 to the first zone ECU 4, and turning off IPD23 terminates power supply from the power distribution management ECU 3 to the first zone ECU 4. The power distribution management ECU 3 turns IPD24 on and off based on an on / off instruction for IPD24 from the mobile control unit 2, and switches between a power supply state and a power cut-off state to the second zone ECU 5. That is, turning on IPD24 starts power supply from the power distribution management ECU 3 to the second zone ECU 5, and turning off IPD24 terminates power supply from the power distribution management ECU 3 to the second zone ECU 5.

[0021] The first zone ECU4 and the first end ECU6 are connected via power line 25 for power distribution. The first zone ECU4 and the second end ECU7 are connected via power line 26 for power distribution. The first zone ECU4 includes an IPD27 interposed between power line 20 and power line 25, and an IPD28 interposed between power line 20 and power line 26.

[0022] The first zone ECU4 switches the IPD27 on and off based on the on / off instruction from Mobicon 2, switching between a power supply state and a power cut-off state to the first end ECU6. That is, when the IPD27 is turned on, power supply from the first zone ECU4 to the first end ECU6 begins, and when the IPD27 is turned off, power supply from the first zone ECU4 to the first end ECU6 ends. The first zone ECU4 switches the IPD28 on and off based on the on / off instruction from Mobicon 2, switching between a power supply state and a power cut-off state to the second end ECU7. That is, when the IPD28 is turned on, power supply from the first zone ECU4 to the second end ECU7 begins, and when the IPD28 is turned off, power supply from the first zone ECU4 to the second end ECU7 ends.

[0023] The second zone ECU 5 and the third end ECU 8 are connected via power line 29 for power distribution, and the second zone ECU 5 and the fourth end ECU 9 are connected via power line 30 for power distribution. The second zone ECU 5 includes an IPD 31 interposed between power line 21 and power line 29, and an IPD 32 interposed between power line 21 and power line 30.

[0024] The second zone ECU 5 switches the IPD31 on and off based on the on / off instruction for IPD31 from Mobicon 2, switching between a power supply state and a power cut-off state to the third end ECU 8. That is, when IPD31 is turned on, power supply from the second zone ECU 5 to the third end ECU 8 begins, and when IPD31 is turned off, power supply from the second zone ECU 5 to the third end ECU 8 ends. The second zone ECU 5 switches the IPD32 on and off based on the on / off instruction for IPD32 from Mobicon 2, switching between a power supply state and a power cut-off state to the fourth end ECU 9. That is, when IPD32 is turned on, power supply from the second zone ECU 5 to the fourth end ECU 9 begins, and when IPD32 is turned off, power supply from the second zone ECU 5 to the fourth end ECU 9 ends. In the above configuration, some of the zone ECUs 4 and 5 and end ECUs 6 to 9 may be directly connected to the battery 17, thereby ensuring that power is constantly supplied from the battery 17.

[0025] As shown in Figure 2, the Mobicon 2 comprises a Mobicon control unit 33 (corresponding to the control unit), a Mobicon storage unit 34, and a Mobicon communication unit 35. The Mobicon control unit 33 is a device that performs various calculations and processing related to the operation of the Mobicon 2, and is mainly composed of a microcomputer (hereinafter referred to as "microcontroller") having, for example, a well-known CPU 33a, RAM 33b, ROM 33c, etc. The various functions of the Mobicon control unit 33 are realized by the CPU 33a executing a program stored in a non-transitional physical recording medium. The non-transitional physical recording medium is, for example, ROM 33c. When the program is executed by the CPU 33a, the method corresponding to the program is executed.

[0026] In this embodiment, the CPU 33a executes a startup / shutdown control program for the electronic control unit, thereby executing a startup / shutdown control method corresponding to the startup / shutdown control program for the electronic control unit. The number of microcontrollers constituting the Mobicon control unit 33 may be one or more. Furthermore, the method for realizing the various functions of the Mobicon control unit 33 is not limited to software; some or all of its elements may be realized using one or more hardware components. For example, if the above-mentioned functions are realized by an electronic circuit which is hardware, that electronic circuit may be a digital circuit containing many logic circuits, an analog circuit, or a combination thereof.

[0027] The Mobicon memory unit 34 is, for example, a well-known non-volatile memory, such as a flash memory or EEPROM that can rewrite various data. The Mobicon memory unit 34 stores the vehicle power supply status, which will be described later. The Mobicon communication unit 35 controls data communication with the power distribution management ECU 3 via the communication line 10, data communication with the first zone ECU 4 via the communication line 11, and data communication with the second zone ECU 5 via the communication line 12.

[0028] As shown in Figure 3, the power distribution management ECU 3 comprises a power distribution management control unit 36, a power distribution management storage unit 37, and a power distribution management communication unit 38. The power distribution management control unit 36 ​​is a device that performs various calculations and processing related to the operation of the power distribution management ECU 3, and is mainly composed of a microcontroller having, for example, a well-known CPU 36a, RAM 36b, ROM 36c, etc. The various functions of the power distribution management control unit 36 ​​are realized by the CPU 36a executing a program stored in a non-transitional physical recording medium. The non-transitional physical recording medium is, for example, ROM 36c. When the program is executed by the CPU 36a, the method corresponding to the program is executed.

[0029] In this embodiment, the CPU 36a executes a vehicle power supply state management program, thereby executing a management method corresponding to the vehicle power supply state management program. The number of microcontrollers constituting the power distribution management control unit 36 ​​may be one or more. Furthermore, the method for realizing the various functions of the power distribution management control unit 36 ​​is not limited to software; some or all of its elements may be realized using one or more hardware components. For example, if the above-mentioned functions are realized by an electronic circuit, which is hardware, that electronic circuit may be a digital circuit containing a large number of logic circuits, an analog circuit, or a combination thereof.

[0030] The power distribution management memory unit 37 is, for example, a well-known non-volatile memory, such as a flash memory or EEPROM that can rewrite various data. The vehicle power supply status is stored in the power distribution management memory unit 37. In addition, a volatile memory may be provided separately from the power distribution management memory unit 37, and the vehicle power supply status may be stored in the volatile memory. The power distribution management communication unit 38 controls data communication with the Mobicon 2 via the communication line 10.

[0031] As shown in Figure 4, the first zone ECU 4 comprises a first zone control unit 39, a first zone storage unit 40, and a first zone communication unit 41. The second zone ECU 5 has the same configuration as the first zone ECU 4. The first zone control unit 39 is a device that performs various calculations and processing related to the operation of the first zone ECU 4, and is mainly composed of a microcontroller having, for example, a well-known CPU 39a, RAM 39b, ROM 39c, etc. The various functions of the first zone control unit 39 are realized by the CPU 39a executing a program stored in a non-transitional tangible recording medium. The non-transitional tangible recording medium is, for example, ROM 39c. When the program is executed by the CPU 39a, the method corresponding to the program is executed.

[0032] In this embodiment, the CPU 39a executes a vehicle power state management program, thereby executing a management method corresponding to the vehicle power state management program. The number of microcontrollers constituting the first zone control unit 39 may be one or more. Furthermore, the method for realizing the various functions of the first zone control unit 39 is not limited to software; some or all of its elements may be realized using one or more hardware components. For example, if the above-mentioned functions are realized by an electronic circuit, which is hardware, that electronic circuit may be a digital circuit containing many logic circuits, an analog circuit, or a combination thereof.

[0033] The first zone storage unit 40 is, for example, a well-known non-volatile memory, such as a flash memory or EEPROM that can rewrite various data. The vehicle power supply state is stored in the first zone storage unit 40. In addition, a volatile memory may be provided separately from the first zone storage unit 40, and the vehicle power supply state may be stored in the volatile memory. The first zone communication unit 41 controls data communication with the Mobicon 2 via the communication line 11, data communication with the first end ECU 6 via the communication line 13, and data communication with the second end ECU 7 via the communication line 14.

[0034] As shown in Figure 5, the first end ECU 6 comprises a first end control unit 42, a first end storage unit 43, and a first end communication unit 44. The second end ECU 7, third end ECU 8, and fourth end ECU 9 have the same configuration as the first end ECU 6. The first end control unit 42 is a device that performs various calculations and processing related to the operation of the first end ECU 6, and is mainly composed of a microcontroller having, for example, a well-known CPU 42a, RAM 42b, ROM 42c, etc. The various functions of the first end control unit 42 are realized by the CPU 42a executing a program stored in a non-transitional tangible recording medium. The non-transitional tangible recording medium is, for example, ROM 42c. When the program is executed by the CPU 42a, the method corresponding to the program is executed.

[0035] In this embodiment, the CPU 42a executes a vehicle power state management program, thereby executing a management method corresponding to the vehicle power state management program. The number of microcontrollers constituting the first end control unit 42 may be one or more. Furthermore, the method for realizing the various functions of the first end control unit 42 is not limited to software; some or all of its elements may be realized using one or more hardware components. For example, if the above-mentioned functions are realized by an electronic circuit which is hardware, that electronic circuit may be a digital circuit containing many logic circuits, an analog circuit, or a combination thereof.

[0036] The first end memory unit 43 is, for example, a well-known non-volatile memory, such as a flash memory or EEPROM that can be rewritten with various data. The vehicle power supply state is stored in the first end memory unit 43. In addition, a volatile memory may be provided separately from the first end memory unit 43, and the vehicle power supply state may be stored in the volatile memory. The first end communication unit 44 controls data communication with the first zone ECU 4 via the communication line 13.

[0037] Communication system 1 combines two types of startup / shutdown control: one that uses a relay based on the on / off state of the IPD, which corresponds to the first startup / shutdown control, and another that uses a communication frame (also called an NM (Network Management) frame or NM message) to switch to a wake-up state or a sleep state, which corresponds to the second startup / shutdown control. The latter may be referred to as startup / shutdown control based on the communication frame.

[0038] Relay-based start / stop control includes relay-based start control based on IPD being ON and relay-based stop control based on IPD being OFF. Communication frame-based start / stop control includes start control by switching from sleep state to wake-up state based on a wake-up request communication frame and stop control by switching from wake-up state to sleep state based on a sleep request communication frame.

[0039] The start / stop control via relays uses an IPD-on signal to instruct the IPD to be turned on and an IPD-off signal to instruct the IPD to be turned off. That is, an ECU that receives an IPD-on signal from Mobicon 2 turns on the IPD identified by the received IPD-on signal and starts supplying power to the ECUs under its power supply that are connected to the turned-on IPD. An ECU that receives an IPD-off signal from Mobicon 2 turns off the IPD identified by the received IPD-off signal and stops supplying power to the ECUs under its power supply that are connected to the turned-off IPD. The IPD-on signal and IPD-off signal correspond to the first message.

[0040] Start-up / shutdown control based on communication frames uses the value of a predetermined bit in the data field of the communication frame. For example, a communication frame with "1" stored in the predetermined bit of the data field is used as a wake-up request communication frame, and a communication frame with "0" stored in the predetermined bit of the data field is used as a sleep request communication frame. That is, the ECU that receives a communication frame from Mobicon 2 determines the value stored in the predetermined bit of the received communication frame. If it is "1", it transitions from the sleep state to the wake-up state or continues in the wake-up state; if it is "0", it transitions from the wake-up state to the sleep state or continues in the sleep state. The communication frame used for start-up / shutdown control corresponds to the second message.

[0041] Furthermore, the ECU may remain in the wake-up state while it periodically receives wake-up request communication frames from Mobicon 2, for example, at predetermined intervals, and may transition from the wake-up state to the sleep state if a certain period of time has elapsed since the reception of wake-up request communication frames ceased. The wake-up state is the normal operating state in which the functions assigned to the ECU can be used without restriction. The sleep state is a low-power operating state in which the available functions are limited. Here, the communication frames are not limited to being transmitted from Mobicon 2, but may also be transmitted from other ECUs.

[0042] Mobicon 2 performs start-stop control via relays by sending an IPD ON signal to an ECU located above the ECU to be controlled, thereby starting the ECU to be controlled by turning on the IPD, and by sending an IPD OFF signal to turn off the IPD, thereby stopping the ECU to be controlled. Specifically, if the ECU to be controlled is the first zone ECU4, Mobicon 2 sends an IPD ON signal to the power distribution management ECU3 located above the first zone ECU4, thereby starting the first zone ECU4 by turning on IPD23, and then sends an IPD OFF signal to stop the first zone ECU4 by turning off IPD23. Similarly, if the ECU to be controlled is the first end ECU6, Mobicon 2 sends an IPD ON signal to the first zone ECU4 located above the first end ECU6, thereby starting the first end ECU6 by turning on IPD27, and then sends an IPD OFF signal to stop the first end ECU6 by turning off IPD27.

[0043] MobiCon 2 performs start-up and stop-down control based on communication frames by sending a wake-up request communication frame addressed to the controlled ECU to transition the controlled ECU to the wake-up state, and by sending a sleep request communication frame to transition the controlled ECU to the sleep state. That is, for example, if the controlled ECU is Zone 1 ECU4, MobiCon 2 will send a wake-up request communication frame addressed to Zone 1 ECU4 to transition Zone 1 ECU4 to the wake-up state, and will send a sleep request communication frame to transition Zone 1 ECU4 to the sleep state.

[0044] Furthermore, if the ECU to be controlled is, for example, the first end ECU6, Mobicon 2 will transition the first end ECU6 to the wake-up state by sending a wake-up request communication frame addressed to the first end ECU6, and will transition the first end ECU6 to the sleep state by sending a sleep request communication frame. Note that an ECU whose power supply has been started by an IPD turned on, which is located higher up, will automatically enter the wake-up state, so it is unnecessary for Mobicon 2 to send a wake-up request communication frame to the ECU whose power supply has been started.

[0045] Next, the operation of this embodiment will be described. In the following, the control targets are the first zone ECU 4 and the second end ECU 7 connected downstream thereto. Figures 8 and 9 show the power management unit 2a and the power communication coordination control unit 2b as functional blocks inside the Mobicon 2. These are functions realized by the Mobicon control unit 33 through software execution. The power management unit 2a manages the power supply status from the battery 17 supplied via +B, accessory switch, ignition switch, etc. The operations described below are performed exclusively by the power communication coordination control unit 2b.

[0046] As shown in Figures 6, 8, and 9, in this embodiment, the power communication coordination control unit 2b of the Mobicon 2 transmits a power control request, which is a start / stop control via a relay, to the first zone ECU 4 in succession, for example, three times. Figure 8 shows the case where an IPD off signal is transmitted. The Mobicon 2 first transmits a stop preparation request to the second end ECU 7 to the first zone ECU 4. The first zone ECU 4 forwards the received stop preparation request to the second end ECU 7.

[0047] When the second end ECU 7 receives a shutdown preparation request, it performs shutdown preparation processing, such as storing data currently held in the second end storage unit 43 in preparation for power cutoff. Once the shutdown preparation processing is complete, it sends a shutdown preparation completion notification to the first zone ECU 4. The first zone ECU 4 forwards the received shutdown preparation completion notification to the Mobicon 2. Figures 6 and 7 correspond to the processing from this point onward.

[0048] When Mobicon 2 sends the first power control request (1) (Yes in S1), it starts a forced time count (S2). In step S3, it determines whether or not it has received a power control completion notification. If it has not received one (NO), it determines whether or not it has sent up to power control request (3) (S6). If it has not sent up to power control request (3) (NO), it returns to step S1.

[0049] As shown in Figure 7, when the first zone ECU4 receives a power control request (S11), it determines whether there is a change in the on / off state of the IPD28 (S12). In Figure 8, when the power control request (1) is received, the IPD28 is in the on state and will change to the off state, so it determines "YES". Then, the IPD28 is turned off (S13). As a result, the power supply to the second end ECU7 is cut off and the second end ECU7 stops.

[0050] Mobicon 2 sends power control requests (2) and (3) following the transmission of power control request (1). However, if the IPD28 is off when the first zone ECU4 receives power control requests (2) and (3), there is no change in the control state, and therefore "NO" is determined in step S12. After executing step S13, the first zone ECU4 sends a power control completion notification from the second end ECU7 to Mobicon 2 (S14).

[0051] When MobiCon 2 receives a power control completion notification (Yes in S4), it resets the forced time count to zero (S5, S7) and performs a power control completion check (S8). Then it proceeds to the next control. If a power control request (3) is sent before receiving the power control completion notification (No in S4) (Yes in S6), it proceeds to step S7. The time for the forced time count is set to be longer than the time for sending power control requests (1) to (3).

[0052] Figure 9 shows the case where an IPD ON signal is sent to change IPD28 from OFF to ON. Basically, it is the same as the case where IPD28 is changed from ON to OFF as described above. The difference is that the power control completion determination is performed by the first zone ECU4 instead of Mobicon 2. This is a variation of the control method, and the power control completion determination may also be performed on the Mobicon 2 side, as in the case shown in Figure 8.

[0053] Figure 10 is a flowchart illustrating the process described above, which transitions from the wake-up state to the sleep state when a certain period of time has elapsed since the reception of the wake-up request communication frame was interrupted. For example, the first zone ECU4 determines whether or not it has received a message from Mobicon 2 until a certain period of time has elapsed (No in S24) (S21). If it receives a message (Yes), it determines whether or not it is a start message or a stop message (S22). For example, if it is a start message targeting the first end ECU6, it performs the start process (S23) and transitions the first end ECU6 to the wake-up state.

[0054] On the other hand, if a stop message is received, the stop process is performed (S25), and the first end ECU 6 is put into sleep mode. Also, if a certain amount of time has elapsed in step S24 (Yes), the process proceeds to step S25. If the first end ECU is in the wake-up state when the message is received, step S23 is skipped. Similarly, if the first end ECU is in sleep mode, step S25 is skipped.

[0055] As described above, according to this embodiment, the communication system 1 mounted on the vehicle includes a Mobicon 2 and ECUs 4 to 9 arranged to communicate with the Mobicon 2. ECUs 4 to 9 are started by power supplied from the battery 17 via IPDs 23, 24, 27, 28, 31 and 32, and stopped by power cut off from the battery 17 via IPDs 23 to 32. Furthermore, while power is supplied, ECUs 4 to 9 are started by switching to a wake-up state based on a communication frame received from the Mobicon 2 and stopped by switching to a sleep state. When the Mobicon 2 decides to stop ECUs 4 to 9, it sends stop requests to ECUs 4 to 9 multiple times in succession.

[0056] With this configuration, even if some of the stop requests are not properly transmitted to ECU4-9 due to message corruption or other reasons, the shutdown of ECU4-9 can be performed more reliably. In addition, when Mobicon 2 decides to start ECU4-9, it sends start requests to ECU4-9 multiple times in succession. This ensures that the startup of ECU4-9 can be performed more reliably, just as it is when stopping them.

[0057] (Second Embodiment) In the following description, parts identical to those in the first embodiment are denoted by the same reference numerals and their descriptions are omitted, while parts that differ are described. In the second embodiment, an NM frame, which is a CAN frame containing a first message and a second message, is used to switch IPD27,28 to an ON state or an OFF state, or to switch the first end ECU6 and second end ECU7 to a wake-up state or a sleep state. In the following description, the first message may be referred to as switching information and the second message as startup information.

[0058] The first message indicates whether or not to turn on IPD27 and IPD28. The second message indicates whether or not to wake up the first end ECU6 and the second end ECU7. The first and second messages are set, for example, as shown in Figure 11. DLC stands for Data Length Code and is an area that represents the size of the data field in the CAN frame in bytes. In other words, the first and second messages are stored in the data field of the CAN frame. For simplicity of explanation, here we will show the case where the DLC is 1 byte, or 8 bits.

[0059] Each bit of the 8-bit data is assigned to switch information for IPD27 and 28, startup information for the first end ECU6, and startup information for the second end ECU7. In the NM frame shown in Figure 6, the first upper bit of the first data is assigned to switch information for IPD27, the second upper bit of the first data is assigned to startup information for the first end ECU6, the third upper bit of the first data is assigned to switch information for IPD28, and the fourth upper bit of the first data is assigned to startup information for the second end ECU7.

[0060] In the NM frame shown in Figure 11, the first to fourth bits of the first data are set to "1100". In other words, this NM frame instructs the IPD27 to be turned on, the first end ECU6 to be woken up, the IPD28 to be turned off, and the second end ECU7 to be put into sleep mode. The first message takes precedence over the second message. Also, an NM frame that contains both the first and second messages corresponds to a third message.

[0061] When the ECU receives a communication frame from Mobicon 2, it determines the value stored in a predetermined bit of the received NM frame. If the value is "1", it transitions from sleep state to wake-up state or continues in the wake-up state. If the value is "0", it transitions from wake-up state to sleep state or continues in the sleep state.

[0062] In the first embodiment, an IPD ON signal and an IPD OFF signal corresponding to the first message were transmitted three times in succession. In the second embodiment, a third message was transmitted three times in succession instead of the first message. The third message was transmitted at the timing when the IPD to be controlled was switched on or off. Furthermore, the third message was transmitted multiple times in succession at a fixed interval T1 and at an interval T2 shorter than that fixed interval. Figure 12 shows the transmission form of the third message described above. In the figure, "stop" in "decide to stop" means transitioning to a sleep state or turning off the IPD. In this case as well, the same effect as in the first embodiment is obtained.

[0063] (Other embodiments) The number of times the first or third message is sent consecutively is not limited to "3" and may be changed as appropriate. Messages to switch to wake-up or sleep mode can also be sent multiple times in a row.

[0064] This disclosure includes, in addition to the claims, the following disclosures: [1] A communication system mounted on a vehicle, comprising a management device (2) and electronic control devices (4-9) arranged to communicate with the management device, The electronic control unit is started by power supply from an external source (17) via semiconductor switches (23, 24, 27, 28, 31 and 32), and stopped by power cut-off from an external source via the semiconductor switches. Furthermore, while power is supplied, it starts up by switching to a wake-up state and stops by switching to a sleep state based on a communication frame received from an external source. The management device is a communication system that, upon deciding to stop the electronic control device, transmits a stop request to the electronic control device multiple times in succession, which will be the first such request after the decision. [2] The communication system described in [1], wherein the management device also sends multiple consecutive activation requests to the electronic control device when it decides to activate the electronic control device. [3] The communication system described in [2], wherein the management device, upon deciding to start up by supplying power from an external source via the semiconductor switch, or to stop up by cutting off power from an external source via the semiconductor switch, transmits the start request or the stop request multiple times in succession. [4] The communication system described in [2], wherein the management device transmits a first message requesting the power supply or the power cutoff, and a second message requesting the switch to the wake-up state or the sleep state, and transmits the first message multiple times in succession. [5] The electronic control unit enters sleep mode on its own if it does not receive a second message requesting a switch to the wake-up state for a predetermined period of time. [4] The communication system described above. [6] The communication system described in [2], wherein the management device transmits multiple messages in succession that can instruct individual electronic control devices to request power supply or power cutoff and to switch to the wake-up state or the sleep state, respectively. [7] The communication system described in [6], wherein the management device transmits the message multiple times in succession at the timing of requesting the power supply or the power interruption. [8] The communication system according to [6] or [7], wherein the management device periodically transmits the message at regular intervals, and when transmitting multiple times consecutively, does so at intervals shorter than the regular interval. [9] The management device starts the timer count when it first sends the request to the electronic control device, and sends the multiple requests until the timer count reaches a certain value. A communication system according to any one of [1] to [8], wherein when the timer count reaches a certain value, a determination is made as to whether power control is complete.

[10] The management device starts the timer count when it first sends the request to the electronic control device, and sends the multiple requests until the timer count reaches a certain value. The communication system according to any one of [1] to [8], wherein the electronic control unit performs processing in response to the request, determines that power control is complete, and transmits the determination result to the management device.

[11] The aforementioned electronic control device includes a first electronic control device (4,5) equipped with the semiconductor switch, A communication system according to any one of [1] to

[10] , comprising a second electronic control unit (6-9) to which power is supplied via the semiconductor switch.

[0065] This disclosure is described in accordance with the embodiments, but it is understood that this disclosure is not limited to such embodiments or structures. This disclosure also includes various modifications and variations within the equivalence. In addition, various combinations and forms, as well as other combinations and forms that include only one, more, or fewer of those elements, fall within the scope and concept of this disclosure.

[0066] The control unit and its method described herein may be implemented by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. Alternatively, the control unit and its method described herein may be implemented by a dedicated computer provided by configuring a processor by one or more dedicated hardware logic circuits. Alternatively, the control unit and its method described herein may be implemented by one or more dedicated computers configured by a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitional tangible recording medium. [Explanation of Symbols]

[0067] In the drawing, 1 is the communication system, 2 is the Mobicon (management device), 3 is the power distribution management ECU (power distribution management device), 4 and 5 are zone ECUs (electronic control devices, first electronic control device), and 6 to 9 are end ECUs (electronic control devices, second electronic control device).

Claims

1. A communication system mounted on a vehicle, comprising a management device (2) and electronic control devices (4-9) arranged to communicate with the management device, The electronic control unit is started by power supply from an external source (17) via semiconductor switches (23, 24, 27, 28, 31 and 32), and stopped by power cut-off from an external source via the semiconductor switches. Furthermore, while power is supplied, it is started by switching to a wake-up state and stopped by switching to a sleep state based on a communication frame received from an external source. The management device is a communication system that, upon deciding to stop the electronic control device, transmits a stop request to the electronic control device multiple times in succession, which will be the first such request after the decision.

2. The communication system according to claim 1, wherein the management device, when it decides to start the electronic control device, also transmits a start request to the electronic control device multiple times in a row.

3. The communication system according to claim 2, wherein the management device, upon deciding to start up by supplying power from an external source via the semiconductor switch, or to stop up by cutting off power from an external source via the semiconductor switch, transmits the start request or the stop request multiple times in succession.

4. The communication system according to claim 2, wherein the management device transmits a first message requesting the power supply or the power cutoff, and a second message requesting the switch to the wake-up state or the sleep state, and transmits the first message multiple times in a row.

5. The communication system according to claim 4, wherein the electronic control unit enters a sleep state on its own if it does not receive a second message requesting a switch to the wake-up state for a predetermined period of time.

6. The communication system according to claim 2, wherein the management device transmits messages to individual electronic control devices multiple times in succession, each message instructing them to request power supply or power cutoff and to switch to the wake-up state or the sleep state.

7. The communication system according to claim 6, wherein the management device transmits the message multiple times in succession at the timing of requesting the power supply or the power interruption.

8. The communication system according to claim 6 or 7, wherein the management device periodically transmits the message at regular intervals, and when transmitting multiple times consecutively, transmits them consecutively at intervals shorter than the regular interval.

9. The management device starts the timer count when it first sends the request to the electronic control device, and sends the multiple requests until the timer count reaches a certain value. A communication system according to any one of claims 1 to 7, wherein when the timer count reaches a certain value, a determination is made as to the completion of power control.

10. The management device starts the timer count when it first sends the request to the electronic control device, and sends the multiple requests until the timer count reaches a certain value. The communication system according to any one of claims 1 to 7, wherein the electronic control device performs processing in response to the request, determines that power control is complete, and transmits the determination result to the management device.

11. The aforementioned electronic control device includes a first electronic control device (4, 5) equipped with the semiconductor switch, A communication system according to any one of claims 1 to 7, comprising a second electronic control device (6 to 9) to which power is supplied via the semiconductor switch.

12. A management device that is configured to communicate with an electronic control device which is started by an external power supply via a semiconductor switch, stopped by an external power interruption via the semiconductor switch, and which starts up by switching to a wake-up state and stops by switching to a sleep state based on a communication frame received from the outside while power is supplied, Determine whether to start or stop the aforementioned electronic control device. Generate start and stop requests for the aforementioned electronic control device. A management device that, upon deciding to stop the electronic control device, transmits the first stop request to the electronic control device multiple times in a row.

13. A method performed by a control device that is communicatively positioned with an electronic control device that is started by an external power supply via a semiconductor switch, stopped by an external power interruption via the semiconductor switch, and that starts by switching to a wake-up state and stops by switching to a sleep state based on a communication frame received from the outside while power is supplied, Determine whether to start or stop the aforementioned electronic control device. Generate start and stop requests for the aforementioned electronic control device. A communication method that, upon deciding to stop the electronic control device, transmits a stop request to the electronic control device multiple times in succession, the first such transmission after the decision.

14. A program executed by a computer constituting a management device that is configured to communicate with an electronic control device that is started by external power supply via a semiconductor switch, stopped by external power cut-off via the semiconductor switch, and that starts by switching to a wake-up state and stops by switching to a sleep state based on a communication frame received from the outside while power is supplied, The electronic control unit is made to decide whether to start or stop. To generate start and stop requests for the aforementioned electronic control device, A computer program that, once it has decided to stop the electronic control device, causes it to send multiple consecutive stop requests to the electronic control device, each time being the first such request after the decision.

Images