Communication system

Abstract

The invention provides a communication system. A communication system (1) is provided with slave ECUs (3, 4), a master ECU (2), a control unit (11), and storage units (33) of the slave ECUs (3, 4). Power is received from the ECUs (3, 4) from the battery (5) via the electronic fuses (15, 16). The slave ECU (4) is connected to the slave ECU (3) so as to be capable of data communication. The control unit (11) performs switching control for switching the electronic fuses (15, 16) to an ON state or an OFF state. A storage unit (33) of the slave ECU (4) stores diagnostic information relating to communication of the slave ECU (3). A storage unit (33) of the ECU (3) stores power supply recovery date and time information that is information referenced for invalidation of the diagnostic information.

Description

Technical Field

[0001] The present disclosure relates to a communication system having an electronic fuse. Background Art

[0002] Patent document 1 discloses an in-vehicle network system comprising a power relay for independently switching the on / off state of the power supply of each of a plurality of electronic control devices, wherein for a specific electronic control device corresponding to a scenario determined based on the condition of the vehicle, a control content for switching the on / off state of the power supply of the specific electronic control device is determined, and based on the determined control content, the on / off state of the power supply to the specific electronic control device is switched using the power relay.

[0003] Patent Document 1: Japanese Patent Application Publication No. 2015-81021

[0004] As a result of detailed research by the inventors, it was found that in a communication system having a plurality of electronic control devices and using electronic fuses to switch the power supply of the electronic control devices on and off, the following problem was found: abnormality of communication interruption was erroneously detected, and the accuracy of abnormality detection was reduced. Summary of the invention

[0005] An object of the present disclosure is to improve the accuracy of abnormality detection in a communication system.

[0006] A technical solution of the present disclosure provides a communication system including a first control device, a second control device, a management device, a switching control unit, a diagnostic information storage unit, and a status information storage unit.

[0007] The first control device receives power supply from a power source via a first electronic fuse.

[0008] The second control device is connected to the first control device so as to be data communicable, and receives power supply from the power supply via the second electronic fuse.

[0009] The management device is connected to the first control device and the second control device so as to be able to perform data communication.

[0010] The switching control unit is configured to perform switching control to switch the first electronic fuse and the second electronic fuse to an on state or an off state.

[0011] The diagnostic information storage unit is configured to store diagnostic information related to communication with the first control device.

[0012] The state information storage unit is configured to store first fuse state information related to the state of the first electronic fuse, which is information referred to in order to invalidate the diagnostic information.

[0013] The communication system of the present disclosure thus constructed can determine whether to invalidate the diagnostic information related to the communication with the first control device by referring to the first fuse state information stored in the state information storage unit. Therefore, in the communication system of the present disclosure, it is possible to suppress the occurrence of a situation where an abnormality related to communication is determined to have occurred in the first control device even though an abnormality related to communication has not occurred in the first control device due to the first electronic fuse being switched to an open state. As a result, the communication system of the present disclosure can improve the accuracy of abnormality detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a block diagram showing the configuration of the communication system according to the first embodiment.

[0015] Figure 2 This is an explanatory diagram illustrating the belonging information and the activation information.

[0016] Figure 3 This is a flowchart showing the advance notification process according to the first embodiment.

[0017] Figure 4 This is a flowchart showing the notification confirmation process according to the first embodiment.

[0018] Figure 5 It is a block diagram showing the configuration of a communication system according to the second embodiment.

[0019] Figure 6 This is a flowchart showing the notification confirmation process according to the second embodiment.

[0020] Figure 7 : is a flowchart showing the diagnosis invalidation process according to the second embodiment.

[0021] Figure 8 It is a block diagram showing the configuration of the communication system according to the third, fourth and fifth embodiments.

[0022] Fig. 9 This is a flowchart showing the advance storage process according to the third embodiment.

[0023] Fig.10 : is a flowchart showing the diagnosis invalidation process according to the third embodiment.

[0024] Fig.11 This is a flowchart showing the advance notification process according to the fourth embodiment.

[0025] Fig.12 1 is a flowchart showing the interrupt diagnosis invalidation process according to the fourth embodiment.

[0026] Fig.13 This is a flowchart showing the interrupt diagnosis invalidation process according to the fifth embodiment.

[0027] Fig.14 This is a flowchart showing the response process according to the fifth embodiment.

[0028] Fig.15 It is a block diagram showing the structure of a communication system according to another embodiment.

[0029] Fig.16 It is a block diagram showing the structure of a communication system according to the sixth embodiment.

[0030] Fig.17 It is a diagram showing the correspondence between control objects and clusters.

[0031] Fig.18 It is a block diagram showing the structure of a communication system according to the seventh embodiment.

[0032] Fig.19 This is a block diagram showing the configuration of a central ECU and an upstream power distribution unit according to the seventh embodiment.

[0033] Fig. 20 This is a first block diagram showing the configuration of a zone ECU according to the seventh embodiment.

[0034] Fig.21 This is a second block diagram showing the configuration of the zone ECU according to the seventh embodiment.

[0035] Fig. 22 This is a block diagram showing the structure of a slave ECU according to the seventh embodiment. DETAILED DESCRIPTION

[0036] [First embodiment]

[0037] The following and attached Figure 1 The first embodiment of the present disclosure will be described.

[0038] The communication system 1 of this embodiment is installed in a vehicle, such as Figure 1 As shown, the main ECU 2, slave ECUs 3 and 4, and a battery 5 are provided. ECU is an abbreviation of Electronic Control Unit. Hereinafter, the main ECU 2 and the slave ECUs 3 and 4 are also collectively referred to as nodes.

[0039] The master ECU 2 and the slave ECU 3 are connected via a communication bus 6 so as to be able to perform data communication with each other.

[0040] The master ECU 2 and the slave ECU 4 are connected via a communication bus 7 so as to be able to perform data communication with each other.

[0041] The battery 5 supplies electric power to various parts of the vehicle at a DC battery voltage (eg, 12 V). The master ECU 2 and the slave ECUs 3 and 4 receive electric power from the battery 5 to operate.

[0042] The main ECU 2 includes a control unit 11, CAN communication units 12 and 13, a storage unit 14, and electronic fuses 15 and 16. CAN is an abbreviation of Controller Area Network. The communication protocol of the communication system 1 is not limited to CAN.

[0043] The control unit 11 is an electronic control device centered on a microcomputer having a CPU 21, a ROM 22, and a RAM 23. The various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 22 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 21 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 11 may be one or more.

[0044] The CAN communication unit 12 performs communication with the slave ECUs 3 connected to the communication bus 6 by transmitting and receiving communication frames based on the CAN communication protocol.

[0045] The CAN communication unit 13 performs communication by transmitting and receiving communication frames based on the CAN communication protocol with the slave ECU 4 connected to the communication bus 7. Hereinafter, the communication frame of the CAN is referred to as a CAN frame.

[0046] The storage unit 14 is a storage device for storing various data. The storage unit 14 stores a startup table 25 described later.

[0047] The electronic fuse 15 is arranged on the power supply path between the battery 5 and the slave ECU 3. The electronic fuse 16 is arranged on the power supply path between the battery 5 and the slave ECU 4.

[0048] The electronic fuses 15 and 16 include a switch element (e.g., MOSFET) and a control circuit. The control circuit of the electronic fuses 15 and 16 is configured to cut off the power supply path by switching the switch element from the on state to the off state when the current value flowing through the power supply path exceeds a preset overcurrent judgment value.

[0049] The control circuits of the electronic fuses 15 and 16 are configured to open or shut off the power supply path by turning on or off the switching elements according to a command from the control unit 11 .

[0050] The slave ECUs 3 and 4 include a control unit 31 , a CAN communication unit 32 , and a storage unit 33 .

[0051] The control unit 31 is an electronic control device centered around a microcomputer having a CPU 41, a ROM 42, and a RAM 43. The various functions of the microcomputer are realized by the CPU 41 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 42 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 41 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 31 may be one or more.

[0052] The CAN communication unit 32 of the slave ECU 3 communicates with a communication device (that is, the master ECU 2 ) connected to the communication bus 6 based on the CAN communication protocol.

[0053] The CAN communication unit 32 of the slave ECU 4 communicates with a communication device (that is, the master ECU 2 ) connected to the communication bus 7 based on the CAN communication protocol.

[0054] The storage unit 33 is a storage device for storing various data.

[0055] A vehicle fault diagnosis device 600 (so-called diagnosis tester) is connected to the main ECU 2. The fault diagnosis device 600 is installed in a vehicle dealership or a factory where the vehicle is installed.

[0056] Fault diagnosis device 600 is detachably connected to main ECU 2 via a connector (not shown) during fault diagnosis. Fault diagnosis device 600 can obtain various information from main ECU 2 and slave ECUs 3 and 4 via main ECU 2 or update data stored in main ECU 2 and slave ECUs 3 and 4.

[0057] The CAN frame is composed of a start frame, an arbitration field, a control field, a data field, a CRC field, an ACK field, and an end frame. In addition, the arbitration field is composed of an 11-bit or 29-bit identifier (ie, ID) and a 1-bit RTR bit.

[0058] An 11-bit identifier used in CAN communication is called a CANID. The CANID is set in advance based on the content of data included in the CAN frame, the transmission source of the CAN frame, the transmission destination of the CAN frame, and the like.

[0059] The data field is a payload consisting of first data, second data, third data, fourth data, fifth data, sixth data, seventh data and eighth data of 8 bits (ie, 1 byte), respectively.

[0060] The communication system 1 forms a power supply control method of communication control based on the CAN protocol standard specified by ISO11898-6, i.e., a partial network. Therefore, the communication system 1 realizes low power consumption by independently transferring one or more nodes belonging to a communication group to an awake state (i.e., a startup state) or a sleep state (i.e., a dormant state) according to a communication group described later. By waking up, the node becomes a normal operating state that can be used without limiting the functions assigned to the node, and by sleeping, it becomes a low-power operating state with limited available functions.

[0061] In the communication system 1, when waking up a node in a sleep state, a CAN frame, that is, an NM frame, which contains activation information specifying an activation group is used. NM is an abbreviation for Network Management.

[0062] Startup information such as Figure 2 DLC is the abbreviation of Data Length Code, which is an area that indicates the size of the data field in the CAN frame in bytes. That is, the startup information is stored in the data field of the CAN frame. Here, in order to simplify the explanation, the case where DLC is 1 byte (i.e., 8 bits) is shown. The startup group corresponds to each bit of the 8-bit data representing the startup information.

[0063] The activation information set in the NM frame sets the bit corresponding to the activation group to be activated to 1.

[0064] Each node stores the belonging information indicating the startup group to which the node belongs. The belonging information has the same data length as the startup information, and the allocation of each bit is also the same as the startup information. Moreover, the belonging information sets the bit corresponding to the startup group to which the node belongs to 1.

[0065] Each node determines whether the communication group to which the node belongs is a startup object by comparing the startup information extracted from the NM frame with the belonging information stored in the node.

[0066] For example, Figure 2 The shown belonging information indicates belonging to the first communication group, the third communication group, and the fifth communication group. Figure 2 The activation information shown indicates that the second communication group, the third communication group, the fourth communication group and the fifth communication group are activated. The third communication group and the fifth communication group are included in Figure 2 Since both the belonging information and the activation information are shown, this node determines that this node is the activation target of the third communication group and the fifth communication group.

[0067] In the activation table 25, a correspondence relationship between the activation groups and the electronic fuses that are turned on (hereinafter referred to as conduction fuses) is set.

[0068] For example, when the startup group is the first communication group, the startup table 25 is set so that the conduction fuse is the electronic fuse 15. For example, when the startup group is the second communication group, the startup table 25 is set so that the conduction fuse is the electronic fuse 16. For example, when the startup group is the third communication group, the startup table 25 is set so that the conduction fuse is the electronic fuses 15 and 16. For example, when the startup group is the fourth communication group, the startup table 25 is set so that the conduction fuse is none.

[0069] Therefore, if the main ECU 2 obtains the NM frame that specifies the first communication group as the startup group, for example, the electronic fuse 15 is turned on and the electronic fuse 16 is turned off. In this way, the situation where the electronic fuses 15 and 16 are turned off along with the startup group being specified is called "intentional disconnection of the electronic fuses 15 and 16". Therefore, the situation where the electronic fuses 15 and 16 are turned off when an excessive current flows through the power supply path is equivalent to "accidental disconnection of the electronic fuses 15 and 16".

[0070] In addition, when there are multiple startup groups, the main ECU 2 turns the electronic fuses corresponding to the multiple startup groups into an on state by OR (i.e., logical AND), and turns the electronic fuses other than the electronic fuses corresponding to the multiple startup groups into an off state by AND (i.e., logical product). Assuming that multiple events occur, and NM frames that set the first, third, and fifth communication groups as the startup group and NM frames that set the first, fourth, and sixth communication groups as the startup group are generated, the main ECU 2 also refers to the two NM frames and turns the electronic fuses other than the electronic fuses corresponding to the multiple startup groups into an off state by AND (i.e., logical product).

[0071] Next, the procedure of the advance notification process executed by the control unit 11 of the main ECU 2 will be described. The advance notification process is a process that is repeatedly executed when the main ECU 2 is activated.

[0072] If the prior notification process is implemented, Figure 3As shown, the CPU 21 of the control unit 11 determines in S10 whether there is an electronic fuse that is intentionally cut off. Here, if there is no electronic fuse that is intentionally cut off, the CPU 21 ends the advance notification process. On the other hand, if there is an electronic fuse that is intentionally cut off, the CPU 21 sends a power supply cut-off notification message to the slave ECU connected to the electronic fuse that is intentionally cut off in S20 to notify the cut-off of the power supply from the battery 5, and ends the advance notification process. It should be noted that the process of S20 is executed before the electronic fuse is intentionally cut off.

[0073] When the electronic fuse 15 is intentionally cut off, the power supply cut-off notification information is sent to the slave ECU 3. When the electronic fuse 16 is intentionally cut off, the power supply cut-off notification information is sent to the slave ECU 4. When the slave ECUs 3 and 4 receive the power supply cut-off notification information, they store the received power supply cut-off notification information in the storage unit 33 together with the reception date and time information indicating the date and time when the power supply cut-off notification information is received.

[0074] Next, a description will be given of the procedure of the notification confirmation process executed by the control unit 31 of the slave ECU 3 or 4. Immediately after the slave ECU 3 or 4 starts up by starting the power supply from the battery 5, the notification confirmation process is executed.

[0075] If the notification confirmation process is executed, Figure 4 As shown, the CPU 41 of the control unit 31 checks in S110 whether the power supply cutoff notification information is stored in the storage unit 33 .

[0076] In S120, the CPU 41 determines whether the power off notification information is stored in the storage unit 33 based on the confirmation result in S110. Here, if the power off notification information is not stored in the storage unit 33, the CPU 41 ends the notification confirmation process.

[0077] On the other hand, when the power cut notification information is stored in the storage unit 33, the CPU 41 in S130 stores information indicating the date and time when the ECU 3, 4 was most recently started by starting the power supply from the battery 5 as power recovery date and time information in the storage unit 33, and ends the notification confirmation processing.

[0078] An operator who performs vehicle inspection connects the fault diagnosis device 600 to the master ECU 2 , and acquires the diagnosis information and power supply recovery date and time information stored in the master ECU 2 and the slave ECUs 3 and 4 .

[0079] The operator confirms the acquired diagnostic information and power recovery date and time information. Furthermore, the operator invalidates the diagnostic information associated with the slave ECU from the date and time of receiving the power cut notification indicated by the date and time of receiving the power cut notification information to the date and time of power recovery indicated by the date and time of power recovery. For example, when the power recovery date and time information is stored in the slave ECU 3, the operator invalidates the diagnostic information generated from the date and time of receiving the power cut notification information to the date and time of power recovery and associated with the slave ECU 3 in the master ECU 2 and the slave ECU 4. As the diagnostic information associated with the slave ECU 3, for example, an abnormality of communication interruption from the slave ECU 3 is listed.

[0080] Specifically, for example, the invalidation of the diagnostic information includes adding invalidation information indicating invalidation to the diagnostic information.

[0081] Furthermore, the master ECU 2 and the slave ECUs 3 and 4 may invalidate the diagnostic information associated with other nodes from the shutdown notification reception date and time to the power restoration date and time by acquiring the reception date and time information and the power restoration date and time information from other nodes.

[0082] Furthermore, fault diagnosis device 600 may invalidate the diagnosis information associated with slave ECUs 3 and 4 from the shutdown notification reception date and time to the power restoration date and time by acquiring reception date and time information and power restoration date and time information from slave ECUs 3 and 4 .

[0083] In addition, a center installed outside the vehicle can also obtain reception date and time information and power recovery date and time information from ECU3 and 4 through remote diagnosis, and invalidate the diagnostic information associated with ECU3 and 4 from the cutoff notification reception date and time to the power recovery date and time.

[0084] The communication system 1 configured in this manner includes the slave ECU 3 , the slave ECU 4 , the master ECU 2 , the control unit 11 , the storage unit 33 of the slave ECU 4 , and the storage unit 33 of the slave ECU 3 .

[0085] The ECU 3 receives power supply from the battery 5 via the electronic fuse 15 .

[0086] The slave ECU 4 is connected to the slave ECU 3 so as to be data communicable, and receives power supply from the battery 5 via the electronic fuse 16 .

[0087] The master ECU 2 is connected to the slave ECU 3 and the slave ECU 4 so as to be able to perform data communication. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 to an on state or an off state.

[0088] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to the communication of the slave ECU 3 .

[0089] The storage unit 33 of the slave ECU 3 is configured to store power restoration date and time information which is information referred to in order to invalidate the diagnostic information.

[0090] Such a communication system 1 can determine whether to invalidate the diagnostic information related to the communication of the slave ECU 3 by referring to the power recovery date and time information stored in the storage unit 33 of the slave ECU 3. Therefore, in the communication system 1, it is possible to suppress the occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though an abnormality related to communication has not occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the open state. As a result, the communication system 1 can improve the abnormality detection accuracy.

[0091] Furthermore, the master ECU 2 is configured to transmit power cutoff notification information notifying the cutoff of power supply from the battery 5 via the electronic fuse 15 to the slave ECU 3 before the electronic fuse 15 is opened to cut off power supply from the battery 5 to the slave ECU 3 .

[0092] The slave ECU 3 is configured to determine whether the power cut notification information is stored when it is started by the power supply from the battery 5 , and to store power recovery date and time information indicating the date and time when the slave ECU 3 was last started if the power cut notification information is stored.

[0093] In such a communication system 1, when the power supply from the battery 5 is cut off due to the main ECU 2 turning the electronic fuse 15 into an open state, and then the communication system 1 is started by the power supply from the battery 5, the power supply recovery date and time information is stored in the slave ECU 3. That is, the communication system 1 can judge whether the main ECU 2 intentionally turns the electronic fuse 15 into an open state based on whether the slave ECU 3 stores the power supply recovery date and time information. Therefore, even in the case where the communication from the slave ECU 3 is interrupted due to the main ECU 2 intentionally turning the electronic fuse 15 into an open state, the communication system 1 can regard the abnormality of no communication interruption in the slave ECU 3 when the power supply recovery date and time information is stored in the slave ECU 3. That is, the communication system 1 can suppress the occurrence of an abnormality in which it is judged that the communication interruption occurs in the slave ECU 3 even though the abnormality does not occur in the slave ECU 3. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0094] In the above-described embodiment, the slave ECU 3 corresponds to the first control device, the slave ECU 4 corresponds to the second control device, the master ECU 2 corresponds to the management device, and the battery 5 corresponds to the power source.

[0095] The control unit 11 corresponds to the switching control unit, the storage unit 33 of the slave ECU 4 corresponds to the diagnostic information storage unit, the storage unit 33 of the slave ECU 3 corresponds to the state information storage unit, and the power recovery date and time information corresponds to the first fuse state information.

[0096] In addition, S20 corresponds to the processing as the shutdown notification sending unit, S110 to S130 correspond to the processing as the state information storage unit, and the power shutdown notification information corresponds to the first power shutdown related information.

[0097] [Second embodiment]

[0098] The following and attached Figure 1 The second embodiment of the present disclosure will be described together. In the second embodiment, the parts different from the first embodiment will be described. The same reference numerals are given to the common structures.

[0099] like Figure 5 As shown, the communication system 1 of the second embodiment is different from the first embodiment in that the slave ECUs 3 and 4 include a power storage unit 35 .

[0100] The power storage unit 35 is charged by the battery voltage from the battery 5. The power storage unit 35 secures enough power for the ECUs 3 and 4 to operate for a predetermined backup time (for example, several tens of milliseconds) when the power supply from the battery 5 is cut off.

[0101] Next, the procedure of the notification confirmation process executed by the control unit 31 of the slave ECU 3 or 4 will be described. The notification confirmation process of the second embodiment is a process that is repeatedly executed during the activation of the slave ECU 3 or 4 .

[0102] If the notification confirmation process of the second embodiment is executed, Figure 6 As shown, the CPU 41 of the control unit 31 determines in S210 whether the power supply from the battery 5 is cut off. Here, if the power supply from the battery 5 is not cut off, the CPU 41 ends the notification confirmation process.

[0103] On the other hand, when the power supply from the battery 5 is cut off, the CPU 41 checks in S220 whether the power cutoff notification information is stored in the storage unit 33 .

[0104] In S230, the CPU 41 determines whether the power off notification information is stored in the storage unit 33 based on the confirmation result in S220. Here, if the power off notification information is not stored in the storage unit 33, the CPU 41 ends the notification confirmation process.

[0105] On the other hand, when the power cut-off notification information is stored in the storage unit 33, the CPU 41 stores the cut-off information indicating that the power supply from the battery 5 to the ECU 3 and 4 is cut off and the cut-off time information indicating the time when the cut-off information is stored in the storage unit 33 in S240, thereby ending the notification confirmation processing.

[0106] Next, the procedure of the diagnosis invalidation process executed by the operator who performs the vehicle inspection will be described.

[0107] If the diagnosis is invalid, Figure 7 As shown, the operator connects fault diagnosis device 600 to master ECU 2 in S310 , and reads slave cutoff time information indicating the time when slave cutoff information is stored from master ECU 2 or slave ECUs 3 and 4 .

[0108] In S320, the operator invalidates the diagnostic information associated with the slave ECU near the time indicated by the slave cut-off time information (hereinafter referred to as the slave cut-off time), and ends the diagnostic invalidation process. For example, when the slave cut-off time information is read from the slave ECU 3, the operator invalidates the diagnostic information generated at the time near the slave cut-off time and associated with the slave ECU 3 in the master ECU 2 and the slave ECU 4.

[0109] The period from the vicinity of the cutoff time may refer to the period from time T1 before the cutoff time to time T2 after the cutoff time. Also, the period from the vicinity of the cutoff time may refer to the period from the cutoff time T3 to time T4 after a preset invalidation time from time T3.

[0110] Furthermore, the master ECU 2 and the slave ECUs 3 and 4 may acquire the slave cutoff time information from the other nodes to invalidate the diagnosis information related to the other nodes generated at a time near the slave cutoff time.

[0111] Furthermore, the fault diagnosis device 600 may invalidate the diagnosis information related to the slave ECUs 3 and 4 generated at a time near the slave cut-off time by acquiring the slave cut-off time information from the slave ECUs 3 and 4 .

[0112] Alternatively, a center installed outside the vehicle may acquire slave cutoff timing information from the slave ECUs 3 and 4 through remote diagnosis, thereby invalidating diagnostic information related to the slave ECUs 3 and 4 generated at a time near the slave cutoff timing.

[0113] The communication system 1 configured in this manner includes the slave ECU 3 , the slave ECU 4 , the master ECU 2 , the control unit 11 , the storage unit 33 of the slave ECU 4 , and the storage unit 33 of the slave ECU 3 .

[0114] The slave ECU 3 includes a power storage unit 35 , and receives power supply from the battery 5 via the electronic fuse 15 .

[0115] The master ECU 2 is connected to the slave ECU 3 and the slave ECU 4 so as to be able to perform data communication. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 to an on state or an off state.

[0116] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to the communication of the slave ECU 3 .

[0117] The storage unit 33 of the slave ECU 3 is configured to store slave cutoff information which is information to be referred to in order to invalidate the diagnostic information.

[0118] Such a communication system 1 can determine whether to invalidate the diagnostic information related to the communication with the slave ECU 3 by referring to the slave disconnection information stored in the storage unit 33 of the slave ECU 3. Therefore, in the communication system 1, it is possible to suppress the occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though an abnormality related to communication has not occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the disconnected state. As a result, the communication system 1 can improve the abnormality detection accuracy.

[0119] Furthermore, the master ECU 2 is configured to transmit power cutoff notification information notifying the cutoff of power supply from the battery 5 via the electronic fuse 15 to the slave ECU 3 before the electronic fuse 15 is opened to cut off power supply from the battery 5 to the slave ECU 3 .

[0120] The slave ECU 3 is configured to determine whether power cutoff notification information is obtained from the master ECU 2 when the power supply from the battery 5 is cut off, and if the power cutoff notification information is obtained, store slave cutoff information indicating that the battery 5 is cut off in the slave ECU 3.

[0121] In such a communication system 1, when the power supply from the battery 5 is cut off due to the main ECU 2 turning the electronic fuse 15 into an open state, the slave ECU 3 can receive the power supply from the power storage unit 35 and store the slave cut-off information in the slave ECU 3. That is, the communication system 1 can determine whether the main ECU 2 intentionally turns the electronic fuse 15 into an open state based on whether the slave ECU 3 stores the slave cut-off information. Therefore, even if the communication from the slave ECU 3 is interrupted due to the main ECU 2 intentionally turning the electronic fuse 15 into an open state, the communication system 1 can regard it as an abnormality that the communication interruption has not occurred in the slave ECU 3 when the slave ECU 3 stores the slave cut-off information. That is, the communication system 1 can suppress the occurrence of an abnormality that is judged as an abnormality that the communication interruption has occurred in the slave ECU 3 even though the abnormality has not occurred in the slave ECU 3. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0122] In the above-described embodiment, power storage unit 35 corresponds to a backup power source, S20 corresponds to a process as a shutdown notification transmitter, S240 corresponds to a process as a state information storage unit, and the shutdown information corresponds to power shutdown information.

[0123] [Third Embodiment]

[0124] The following and attached Figure 1 The third embodiment of the present disclosure will be described together. In the third embodiment, the parts different from the first embodiment will be described. The same reference numerals are given to the common structures.

[0125] like Figure 8 As shown, the communication system 1 of the third embodiment is different from the first embodiment in that the CAN communication unit 13 is omitted in the master ECU 2 and the CAN communication unit 32 of the slave ECU 4 is connected to the communication bus 6 instead of the communication bus 7 .

[0126] Next, the procedure of the advance storage process executed by the control unit 11 of the main ECU 2 will be described. The advance storage process is a process that is repeatedly executed when the main ECU 2 is activated.

[0127] If the pre-storage process is performed, Fig. 9As shown, the CPU 21 of the control unit 11 determines whether there is an intentionally cut electronic fuse in S410. Here, if there is no intentionally cut electronic fuse, the CPU 21 ends the pre-storage process. On the other hand, if there is an intentionally cut electronic fuse, the CPU 21 stores the cut fuse notification information notifying the cut electronic fuse and the fuse cut time information indicating the time when the electronic fuse is cut in the storage unit 14 in S420, and ends the pre-storage process. It should be noted that the process of S420 is executed before the electronic fuse is intentionally cut.

[0128] Next, the procedure of the diagnosis invalidation process executed by the operator who performs the vehicle inspection will be described.

[0129] If the diagnosis is invalid, Fig.10 As shown, the operator connects fault diagnosis device 600 to main ECU 2 in S510 , and reads fuse cut notification information and fuse cut timing information from main ECU 2 .

[0130] In S520, the operator invalidates the diagnostic information associated with the slave ECU connected to the electronic fuse indicated by the fuse cut notification information near the time indicated by the fuse cut time information (hereinafter referred to as the fuse cut time), and ends the diagnostic invalidation process. For example, when the fuse cut notification information indicates the electronic fuse 15, the operator invalidates the diagnostic information associated with the slave ECU 3 generated at the time near the fuse cut time in the master ECU 2 and the slave ECU 4.

[0131] Furthermore, the master ECU 2 may invalidate the diagnosis information associated with the slave ECUs around the fuse cutting time based on the stored fuse cutting notification information and fuse cutting time information.

[0132] Furthermore, fault diagnosis device 600 may obtain fuse-cut notification information and fuse-cut time information from master ECU 2 to invalidate diagnosis information associated with slave ECUs around the fuse-cut time.

[0133] Alternatively, a center installed outside the vehicle may acquire the fuse cut notification information and fuse cut time information from the master ECU 2 through remote diagnosis, thereby invalidating the diagnosis information associated with the slave ECU around the fuse cut time.

[0134] The communication system 1 configured in this manner includes the slave ECU 3 , the slave ECU 4 , the master ECU 2 , the storage unit 33 of the slave ECU 4 , and the storage unit 14 of the master ECU 2 .

[0135] The ECU 3 receives power supply from the battery 5 via the electronic fuse 15 .

[0136] The slave ECU 4 is connected to the slave ECU 3 so as to be data communicable, and receives power supply from the battery 5 via the electronic fuse 16 .

[0137] The master ECU 2 is connected to the slave ECU 3 and the slave ECU 4 so as to be able to perform data communication. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 to an on state or an off state.

[0138] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to the communication of the slave ECU 3 .

[0139] The storage unit 14 of the main ECU 2 is configured to store the cut fuse notification information and the fuse cut time information which are information referred to in order to invalidate the diagnostic information.

[0140] Such a communication system 1 can determine whether to invalidate the diagnostic information related to the communication with the slave ECU 3 by referring to the cut fuse notification information and the fuse cut time information stored in the storage unit 14 of the master ECU 2. Therefore, in the communication system 1, it is possible to suppress the occurrence of a situation where an abnormality related to communication is determined to have occurred in the slave ECU 3 even though an abnormality related to communication has not occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the open state. As a result, the communication system 1 can improve the abnormality detection accuracy.

[0141] In addition, the main ECU 2 is configured to store fuse cut-off notification information (hereinafter referred to as the first fuse cut-off notification information) notifying the cut-off of the electronic fuse 15 and fuse cut-off time information (hereinafter referred to as the first fuse cut-off time information) indicating the moment when the electronic fuse 15 is cut off before the electronic fuse 15 is turned off in order to cut off the power supply from the battery 5 to the slave ECU 3.

[0142] The main ECU 2 is configured to store fuse cut-off notification information (hereinafter referred to as the second fuse cut-off notification information) notifying that the electronic fuse 16 is cut off and fuse cut-off time information (hereinafter referred to as the second fuse cut-off time information) indicating the moment when the electronic fuse 16 is cut off before the electronic fuse 16 is turned off in order to cut off the power supply from the battery 5 to the slave ECU 4.

[0143] In such a communication system 1, when the main ECU 2 turns the electronic fuses 15 and 16 into an open state and thus cuts off the power supply to the slave ECUs 3 and 4, the main ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information. That is, the communication system 1 can determine whether the main ECU 2 intentionally turns the electronic fuses 15 and 16 into an open state based on whether the main ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information. Therefore, even if the communication from the slave ECUs 3 and 4 is interrupted due to the main ECU 2 intentionally turning the electronic fuses 15 and 16 into an open state, when the main ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information, the communication system 1 can regard that an abnormality of communication interruption does not occur in the slave ECUs 3 and 4 near the time indicated by the first and second fuse cut time information. That is, the communication system 1 can suppress the occurrence of a situation where it is determined that an abnormality of communication interruption has occurred in the slave ECUs 3 and 4 even though no abnormality has occurred in the slave ECUs 3 and 4. Thus, the communication system 1 can improve the abnormality detection accuracy.

[0144] In the embodiment described above, the storage unit 14 of the main ECU 2 is equivalent to the status information storage unit, the electronic fuse 15 is equivalent to the first electronic fuse, the slave ECU 3 is equivalent to the first control device, the electronic fuse 16 is equivalent to the second electronic fuse, the slave ECU 4 is equivalent to the second control device, the storage unit 14 of the main ECU 2 is equivalent to the status information storage unit, and S410~S420 are equivalent to the processing as a fuse cutting information storage unit.

[0145] [Fourth Embodiment]

[0146] The following and attached Figure 1 The fourth embodiment of the present disclosure will be described together. In the fourth embodiment, the parts different from the third embodiment will be described. The same reference numerals are given to the common structures.

[0147] The communication system 1 of the fourth embodiment is different from the third embodiment in that the prior notification process is executed instead of the prior storage process.

[0148] Next, the procedure of the advance notification process executed by the control unit 11 of the main ECU 2 will be described. The advance notification process is a process that is repeatedly executed when the main ECU 2 is activated.

[0149] If the prior notification process of the fourth embodiment is executed, Fig.11As shown, the CPU 21 of the control unit 11 determines in S610 whether the electronic fuse is intentionally cut off. Here, in the case where the electronic fuse is not intentionally cut off, the CPU 21 ends the advance notification process. On the other hand, in the case where the electronic fuse is intentionally cut off, the CPU 21 sends a fuse cut-off notification message notifying the cut-off electronic fuse and a fuse cut-off time information indicating the time when the electronic fuse is cut off to all slave ECUs possessed by the communication system 1 in S620, and ends the advance notification process. In addition, the process of S620 is executed before the electronic fuse is intentionally cut off. In addition, the main ECU 2 may also send a cut-off ECU notification message notifying the cut-off electronic fuse instead of sending the fuse cut-off notification message notifying the cut-off electronic fuse, to notify the slave ECUs connected to the cut-off electronic fuse.

[0150] When receiving the cut-fuse notification information and the fuse-cutting time information from the ECUs 3 and 4 , the cut-fuse notification information and the fuse-cutting time information are stored in the storage unit 33 .

[0151] Next, the procedure of the interrupt diagnosis invalidation process executed by the control unit 31 of the slave ECU 3 or 4 will be described. The interrupt diagnosis invalidation process is a process that is repeatedly executed during the activation of the slave ECU 3 or 4.

[0152] If the interrupt diagnosis invalid processing is executed, Fig.12 As shown, the CPU 41 of the control unit 31 determines in S710 whether the communication interruption diagnosis information of other nodes is stored in the storage unit 33. Here, when the communication interruption diagnosis information of other nodes is not stored, the CPU 41 ends the interruption diagnosis invalidation process.

[0153] On the other hand, when the communication interruption diagnostic information of other nodes is stored, the CPU 41 determines in S720 whether the fuse cut-off notification information is received, and the fuse cut-off notification information indicates the electronic fuse connected to the other node corresponding to the stored communication interruption diagnostic information. In addition, the slave ECUs 3 and 4 store a table setting the correspondence between the electronic fuse and the ECU connected to the electronic fuse.

[0154] Here, when the blown fuse notification information indicating that the electronic fuse connected to the other node has not been received, the CPU 41 ends the interrupt diagnosis invalidation process.

[0155] On the other hand, when receiving the fuse-cut notification information indicating the electronic fuse connected to other nodes, the CPU 41 invalidates the interruption diagnosis information associated with the slave ECU connected to the electronic fuse indicated by the fuse-cut notification information at a time near the time indicated by the fuse-cut time information received together with the fuse-cut notification information (hereinafter referred to as the fuse-cut time) in S730, and ends the interruption diagnosis invalidation processing. For example, when the fuse-cut notification information indicates the electronic fuse 15, the CPU 41 invalidates the interruption diagnosis information associated with the slave ECU 3 generated at a time near the fuse-cut time.

[0156] The vicinity of the fuse cutting time may also refer to the period from time T11 before the fuse cutting time to time T12 after the fuse cutting time. Also, the vicinity of the fuse cutting time may refer to the period from time T13 after the fuse cutting time to time T14 after a preset invalidation time from time T13.

[0157] The communication system 1 configured in this manner includes the slave ECU 3 , the slave ECU 4 , the master ECU 2 , the control unit 11 , and the storage unit 33 of the slave ECU 4 .

[0158] The storage unit 33 of the slave ECU 4 is configured to store communication interruption diagnostic information related to communication of the slave ECU 3 .

[0159] The storage unit 33 of the slave ECU 4 is configured to store the blown fuse notification information which is information referred to in order to invalidate the communication interruption diagnostic information.

[0160] Such a communication system 1 can determine whether to invalidate the communication interruption diagnostic information related to the communication of the slave ECU 3 by referring to the cut fuse notification information stored in the storage unit 33 of the slave ECU 4. Therefore, in the communication system 1, it is possible to suppress the occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though an abnormality related to communication has not occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the disconnected state. As a result, the communication system 1 can improve the abnormality detection accuracy.

[0161] In addition, the main ECU 2 is configured to send fuse cut-off notification information (hereinafter referred to as the first fuse cut-off notification information) notifying the cut-off of the electronic fuse 15 and fuse cut-off time information (hereinafter referred to as the first fuse cut-off time information) indicating the time when the electronic fuse 15 is cut off to the slave ECU 4 after the electronic fuse 15 is turned off in order to cut off the power supply from the slave battery 5 to the slave ECU 3.

[0162] The main ECU 2 is configured to send fuse cut-off notification information (hereinafter referred to as the second fuse cut-off notification information) notifying the cut-off of the electronic fuse 16 and fuse cut-off time information (hereinafter referred to as the second fuse cut-off time information) indicating the time when the electronic fuse 16 is cut off to the slave ECU 3 after the electronic fuse 16 is turned off in order to cut off the power supply from the slave battery 5 to the slave ECU 4.

[0163] In such a communication system 1, when the master ECU 2 turns the electronic fuses 15 and 16 into the disconnected state and thus cuts off the power supply to the slave ECUs 3 and 4, the master ECU 2 transmits the first and second disconnected fuse notification information and the first and second fuse disconnection time information to the slave ECUs 4 and 3. That is, the communication system 1 can determine whether the master ECU 2 intentionally turns the electronic fuses 16 and 15 into the disconnected state based on whether the slave ECUs 3 and 4 store the second and first disconnected fuse notification information and the second and first fuse disconnection time information, respectively. Therefore, even when the communication from the slave ECUs 3 and 4 is interrupted due to the master ECU 2 intentionally turning the electronic fuses 15 and 16 into the disconnected state, if the slave ECUs 4 and 3 store the first and second disconnected fuse notification information and the first and second fuse disconnection time information, the communication system 1 can regard that an abnormality of communication interruption does not occur in the slave ECUs 3 and 4 near the time indicated by the first and second fuse disconnection time information. That is, the communication system 1 can suppress the occurrence of a situation where it is determined that an abnormality of communication interruption has occurred in the slave ECUs 3 and 4 even though no abnormality has occurred in the slave ECUs 3 and 4. Thus, the communication system 1 can improve the abnormality detection accuracy.

[0164] In the above-described embodiment, S610 to S620 correspond to the processing as the shutdown notification transmission unit, and the storage unit 33 of the slave ECU 4 corresponds to the state information storage unit.

[0165] [Fifth Embodiment]

[0166] The following and attached Figure 1 The fifth embodiment of the present disclosure will be described together. In the fifth embodiment, the parts different from the third embodiment will be described. The same reference numerals are given to the common structures.

[0167] The communication system 1 of the fifth embodiment is different from the third embodiment in that the interrupt diagnosis invalidation process is executed instead of the diagnosis invalidation process, and the response process is executed instead of the pre-storage process.

[0168] Next, the procedure of the interrupt diagnosis invalidation process executed by the control unit 31 of the slave ECU 3 or 4 will be described. The interrupt diagnosis invalidation process is a process that is repeatedly executed during the activation of the slave ECU 3 or 4.

[0169] If the interrupt diagnosis invalid processing is executed, Fig.13 As shown, the CPU 41 of the control unit 31 determines in S810 whether the communication interruption diagnostic information of other nodes is stored in the storage unit 33. Here, when the communication interruption diagnostic information of other nodes is not stored, the CPU 41 ends the interruption diagnosis invalidation process.

[0170] On the other hand, when the communication interruption diagnostic information of other nodes is stored, the CPU 41 inquires the master ECU 2 about the state of the electronic fuse in S820. Specifically, the CPU 41 sends a status confirmation request to the master ECU 2, which inquires about the state of the electronic fuse connected to the slave ECU corresponding to the communication interruption diagnostic information determined in S810. For example, when the slave ECU 3 stores the communication interruption diagnostic information of the slave ECU 4, the status confirmation request inquiring about the state of the electronic fuse 16 is sent to the master ECU 2.

[0171] In S830, the CPU 41 acquires the electronic fuse state information from the main ECU 2. The electronic fuse state information indicates whether each of the electronic fuses 15 and 16 is in the on state or the off state, and whether the electronic fuses 15 and 16 are intentionally disconnected in the off state.

[0172] In S840, the CPU 41 determines whether the electronic fuse connected to the other node corresponding to the stored communication interruption diagnosis information is intentionally disconnected based on the acquired electronic fuse state information. If disconnection is not intentional, the CPU 41 ends the interruption diagnosis invalidation process.

[0173] On the other hand, if the disconnection is intentional, the CPU 41 invalidates the communication interruption diagnosis information determined in S810 in S850 , and ends the interruption diagnosis invalidation process.

[0174] Next, the procedure of the response process executed by the control unit 11 of the main ECU 2 will be described. The response process is a process that is repeatedly executed when the main ECU 2 is activated.

[0175] If response processing is performed, Fig.14 As shown, the CPU 21 of the control unit 11 determines in S910 whether there is an inquiry from the slave ECU 3 or 4. Here, when there is no inquiry from the slave ECU 3 or 4, the CPU 21 ends the response processing.

[0176] On the other hand, when there is an inquiry from slave ECU 3 or slave ECU 4, CPU 21 checks the status of electronic fuses 15 and 16 in S920. That is, CPU 21 checks whether electronic fuses 15 and 16 are in the on state or the off state, and whether they are intentionally cut if they are in the off state.

[0177] In S930 , the CPU 21 generates electronic fuse state information based on the confirmation result in S920 , transmits the generated electronic fuse state information to the slave ECUs 3 and 4 that have made inquiries, and ends the response process.

[0178] The communication system 1 configured in this manner includes the slave ECU 3 , the slave ECU 4 , and the master ECU 2 .

[0179] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to the communication of the slave ECU 3 .

[0180] The storage unit 33 of the slave ECU 4 is configured to store electronic fuse state information which is information referred to in order to invalidate the diagnostic information and indicates the confirmation result.

[0181] Such a communication system 1 can determine whether to invalidate the diagnostic information related to the communication with the slave ECU 3 by referring to the electronic fuse state information stored in the storage unit 33 of the slave ECU 4. Therefore, in the communication system 1, it is possible to suppress the occurrence of a situation where an abnormality related to communication is determined to have occurred in the slave ECU 3 even though an abnormality related to communication has not occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the disconnected state. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0182] Furthermore, when slave ECU 3 stores communication interruption diagnostic information (hereinafter, second communication interruption diagnostic information) indicating interruption of communication with slave ECU 4 , it is configured to send a status confirmation request (hereinafter, second status confirmation request) to master ECU 2 to inquire about the status of electronic fuse 16 .

[0183] Slave ECU 4 is configured to transmit a status confirmation request (hereinafter, first status confirmation request) to inquire about the status of electronic fuse 15 to master ECU 2 when communication interruption diagnosis information (hereinafter, first communication interruption diagnosis information) indicating interruption of communication with slave ECU 3 is stored.

[0184] When receiving the second status confirmation request from the slave ECU 3 , the master ECU 2 is configured to confirm the status of the electronic fuse 16 and transmit electronic fuse status information (hereinafter, second electronic fuse status information) indicating the confirmation result to the slave ECU 3 .

[0185] When receiving the first status confirmation request from the slave ECU 4 , the master ECU 2 is configured to confirm the status of the electronic fuse 15 and transmit electronic fuse status information (hereinafter referred to as first electronic fuse status information) indicating the confirmation result to the slave ECU 4 .

[0186] In such a communication system 1, the master ECU 2 sends the second and first electronic fuse state information to the slave ECUs 3 and 4 when the slave ECUs 3 and 4 store the second and first communication interruption diagnostic information, respectively. Therefore, in the communication system 1, the slave ECUs 3 and 4 can judge whether the power supply to the slave ECUs 4 and 3 is cut off due to the master ECU 2 turning the electronic fuses 16 and 15 into the disconnected state based on the second and first electronic fuse state information. Moreover, when the slave ECUs 3 and 4 judge that the power supply to the slave ECUs 4 and 3 is cut off due to the master ECU 2 turning the electronic fuses 16 and 15 into the disconnected state, it can be regarded that the abnormality of communication interruption does not occur in the slave ECUs 4 and 3 when the second and first communication interruption diagnostic information are stored. That is, the communication system 1 can suppress the occurrence of the abnormality of judging that the communication interruption occurs in the slave ECUs 3 and 4 even though the abnormality does not occur in the slave ECUs 3 and 4. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0187] In the above-described embodiment, the storage unit 33 of the slave ECU 4 corresponds to the diagnostic information storage unit, the storage unit 33 of the slave ECU 4 corresponds to the state information storage unit, S820 corresponds to the processing as the first request unit and the second request unit, and S910 to S930 correspond to the processing as the responding unit.

[0188] [Sixth Embodiment]

[0189] The following and attached Figure 1 The sixth embodiment of the present disclosure will be described together. It should be noted that in the sixth embodiment, the parts different from the first embodiment will be described. The same reference numerals are given to the common structures.

[0190] like Fig.16 As shown, the communication system 1 of the sixth embodiment is different from the first embodiment in that a smart sensor 501 , a smart actuator 502 , a wireless device 503 , electronic fuses 504 and 505 , and a slave ECU 506 are added.

[0191] The smart sensor 501 is a sensor having a communication function and is connected to the communication bus 6 .

[0192] The smart actuator 502 is an actuator having a communication function and is connected to the communication bus 6 .

[0193] The wireless device 503 is a wireless communication device for wirelessly communicating with an external communication device installed outside the vehicle. The wireless device 503 is, for example, a DCM. DCM is an abbreviation of Data Communication Module.

[0194] The electronic fuse 504 is arranged on the power supply path between the battery 5 and the smart sensor 501 . The electronic fuse 505 is arranged on the power supply path between the battery 5 and the smart actuator 502 .

[0195] Each of the electronic fuses 504 and 505 is configured to switch to either an on state for conducting the power supply path or an off state for interrupting the power supply path in response to a command from the control unit 11 .

[0196] Hereinafter, the master ECU 2 , the slave ECUs 3 and 4 , the smart sensor 501 , the smart actuator 502 , and the slave ECU 506 are also collectively referred to as nodes.

[0197] (Prerequisites)

[0198] The master ECU 2 and the slave ECU 506 are always powered by the battery 5 without an electronic fuse, and can be switched to the awake state or the sleep state by the node alone. Hereinafter, the master ECU 2 and the slave ECU 506 are also referred to as NM-equipped nodes. The NM-equipped node refers to a node that has the function of generating an NM frame.

[0199] The slave ECUs 3 and 4, the smart sensor 501, and the smart actuator 502 are powered via the electronic fuse, and cannot be switched to the awake state or the sleep state by the node alone. That is, the awake state is achieved with the electronic fuse being turned on, and the sleep state is achieved with the electronic fuse being turned off. Hereinafter, the slave ECU 3, the slave ECU 4, the smart sensor 501, and the smart actuator 502 are also referred to as NM non-equipped nodes. NM non-equipped nodes refer to nodes that do not have the function of generating and interpreting NM frames.

[0200] The NM non-mounted node includes at least one of an actuator and a sensor in addition to an ECU having a control function.

[0201] The power supply path of the NM non-mounted node is connected to the electronic fuses 15 , 16 , 504 , and 505 of the main ECU 2 , respectively.

[0202] The NM non-mounted nodes and the electronic fuses may be connected one-to-one, or a plurality of NM non-mounted nodes belonging to the same cluster (ie, a group activated simultaneously) may be connected under one electronic fuse.

[0203] The main ECU 2 and the NM-mounted node have a CAN communication unit and can transmit and receive NM frames.

[0204] The NM-equipped node determines whether to be in the awake state or the sleep state based on the NM frame transmitted and received via the communication bus.

[0205] The main ECU 2 turns on or off the electronic fuses 15 , 16 , 504 , and 505 to which the NM non-mounted nodes are connected, based on the NM frames transmitted and received via the communication bus.

[0206] In the payload (ie, data area) of the NM frame transmitted and received between the main ECU 2 and the NM-equipped node, one or more bits of information indicating which cluster is activated are stored.

[0207] One or more main ECUs (ie, ECUs having built-in electronic fuses) are mounted on a vehicle.

[0208] like Fig.17 As shown, one or more nodes belonging to each cluster are determined in advance by the system developer. Although clusters can be assigned to each node, multiple nodes can be registered in one cluster. When the bit corresponding to each cluster is activated (i.e., bit = 1), the cluster wakes up. In the case of the main ECU, waking up means turning the electronic fuse on.

[0209] (First startup example)

[0210] The first activation case is an operation example in which a failure diagnosis of the slave ECU 3 is performed in response to a request from the cloud.

[0211] First, a connection request is issued from the base station (ie, cloud) side to the wireless device 503 of the vehicle.

[0212] Next, when the wireless device 503 determines that the connection is valid, it transmits the event received from the cloud to the main ECU 2 .

[0213] Next, the master ECU 2 determines a service called “failure diagnosis of the slave ECU 3 ” based on the event, and generates an NM frame in which only the bit of the third cluster to which the slave ECU 3 belongs is enabled in order to activate the slave ECU 3 .

[0214] Then, the main ECU 2 sends the generated NM frame to the communication buses 6 , 7 .

[0215] Since there are no NM-equipped nodes belonging to the third cluster on the communication buses 6 and 7, there is no change in the devices on the communication buses.

[0216] Next, the main ECU 2 regards that the NM frame in which the bit of the third cluster is made valid is received simultaneously with the above, and the control unit 11 executes a process based on the NM frame.

[0217] Next, when the control unit 11 of the main ECU 2 determines to issue a wake-up instruction to the third cluster, since the electronic fuse 15 is included in the third cluster, the control unit 11 of the main ECU 2 turns the electronic fuse 15 to the on state.

[0218] When the electronic fuse 15 is turned on, power is supplied to the downstream slave ECU 3 to activate it.

[0219] The master ECU 2 waits for the slave ECU 3 to be activated, requests the slave ECU 3 to send a diagnostic code, and transmits a response result from the slave ECU 3 to the base station via the wireless device 503 .

[0220] (Second startup example)

[0221] The second activation case is an operation example in which a fault diagnosis of the slave ECU 506 is performed in response to a request from the cloud.

[0222] First, a connection request is issued from the base station (ie, cloud) side to the wireless device 503 of the vehicle.

[0223] Next, when the wireless device 503 determines that the connection is valid, it transmits the event received from the cloud to the main ECU 2 .

[0224] Next, the master ECU 2 determines a service called “failure diagnosis of the slave ECU 506 ” based on the event, and generates an NM frame in which only the bit of the fourth cluster to which the slave ECU 506 belongs is enabled in order to activate the slave ECU 506 .

[0225] Then, the main ECU 2 sends the generated NM frame to the communication buses 6 , 7 .

[0226] As a node belonging to the fourth cluster, the slave ECU 506 exists on the communication bus 6 , and thus the slave ECU 506 wakes up.

[0227] Next, the main ECU 2 regards that the NM frame in which the bit of the fourth cluster is made valid is received simultaneously with the above, and the control unit 11 executes a process based on the NM frame.

[0228] Next, even if the control unit 11 of the main ECU 2 determines to issue a wake-up instruction to the fourth cluster based on the NM frame, the fourth cluster does not include the corresponding electronic fuse and thus ignores the instruction.

[0229] When the slave ECU 506 is activated, the master ECU 2 requests a diagnostic code from the slave ECU 506 via the communication bus, and transmits a response result from the slave ECU 506 to the base station via the wireless device 503 .

[0230] (Third startup example)

[0231] The third activation example is an action example in which a user activates the air conditioner remotely using a smartphone.

[0232] First, the user instructs to turn on the vehicle air conditioner from the smartphone.

[0233] When the wireless device 503 receives the instruction signal from the smartphone, the wireless device 503 determines that the instruction signal is valid and transmits the event (ie, instruction signal) received from the cloud to the main ECU 2 .

[0234] The main ECU 2 determines the "air conditioning service" based on the event, and generates an NM frame for activating the second cluster as a cluster for air conditioning.

[0235] The main ECU 2 periodically sends the generated NM frame to the communication buses 6 and 7 until the air conditioner stop instruction is issued. If the activation state is to be continued, the NM frame needs to be sent periodically. At the same time, the control unit 11 of the main ECU 2 executes processing based on the NM frame.

[0236] When an NM frame for activating the second cluster is generated on the communication bus 6 , the slave ECU 506 (ie, the air-conditioning ECU) belonging to the second cluster receives the NM frame and wakes up according to the received NM frame.

[0237] When the control unit 11 of the main ECU 2 detects that the second cluster is active, the control unit 11 turns on the electronic fuses 504 and 505 belonging to the second cluster.

[0238] When the electronic fuse 504 and the electronic fuse 505 are turned on, power is supplied to the smart sensor 501 (ie, the temperature sensor) and the smart actuator 502 (ie, the compressor).

[0239] Based on the above, power supply to the air-conditioning ECU, the smart sensor 501, and the smart actuator 502 starts, and the vehicle air-conditioning can be turned on.

[0240] When the user instructs the vehicle air conditioner to be turned off from the smartphone, the main ECU 2 stops the periodic transmission of the NM frame.

[0241] When the NM frame is interrupted, the slave ECU 506 shifts to the sleep state, and the master ECU 2 opens the electronic fuse 504 and the electronic fuse 505. As a result, the vehicle air conditioner stops.

[0242] (Fourth startup example)

[0243] The fourth activation example is an operation example in which the vehicle air conditioner is activated from the ECU 506 .

[0244] Since the slave ECU 506 is always supplied with power even when the vehicle is stopped, even when the slave ECU 506 is in sleep mode, it is possible to detect input of a signal indicating that a start switch connected to the slave ECU 506 is turned on and wake up.

[0245] When the awakened slave ECU 506 confirms an input to activate the vehicle air conditioner, it generates an NM frame in which the bit corresponding to the second cluster is turned on.

[0246] The slave ECU 506 transmits the generated NM frame via the CAN communication unit 32. When the master ECU 2 receives the NM frame, the master ECU 2 turns on the electronic fuses 504 and 505 belonging to the second cluster.

[0247] When the start switch of the vehicle air conditioner is turned off, the slave ECU 506 stops sending the NM frame and shifts to the sleep state after a certain period of time.

[0248] If the NM frame is interrupted, the main ECU 2 turns the electronic fuses 504 and 505 to the open state after a certain period of time to terminate the control.

[0249] When the master ECU 2 determines that control needs to be continued even after the transmission of the NM frame stops, the master ECU 2 transmits an NM frame with the bit corresponding to the second cluster turned on. Thus, the slave ECU 506, the smart sensor 501, and the smart actuator 502 can also maintain activation until the transmission of the NM frame generated by the master ECU 2 stops.

[0250] [Seventh Embodiment]

[0251] The following and attached Figure 1 The seventh embodiment of the present disclosure will be described.

[0252] The communication system 100 of the seventh embodiment is installed in a vehicle, such as Fig.18 As shown, it includes a central ECU 101, upstream power distribution units 102, 103, regional ECUs 104, 105, 106, 107, slave ECUs 108, 109, 110, 111, 112, 113, 114, 115, 116, and a battery 117. Hereinafter, the central ECU 101, regional ECUs 104 to 107, and slave ECUs 108 to 116 are also collectively referred to as nodes.

[0253] The battery 117 supplies power to various parts of the vehicle at a DC battery voltage (eg, 12 V). The central ECU 101 , the upstream power distribution units 102 , 103 , the area ECUs 104 to 107 , and the slave ECUs 108 to 116 receive power from the battery 117 and operate.

[0254] The upstream power distribution unit 102 receives power supply from the battery 117 through a power supply path 121 between the battery 117 and the upstream power distribution unit 102 .

[0255] The upstream power distribution unit 103 receives power supply from the battery 117 through a power supply path 122 between the battery 117 and the upstream power distribution unit 103 .

[0256] The regional ECUs 104 and 105 receive power supply from the battery 117 through power supply paths 123 and 124 between the upstream power distribution unit 102 and the regional ECUs 104 and 105 , respectively.

[0257] The regional ECUs 106 and 107 receive power supply from the battery 117 through power supply paths 125 and 126 between the upstream power distribution unit 103 and the regional ECUs 106 and 107 , respectively.

[0258] The slave ECUs 108 and 109 receive electric power from the battery 117 through power supply paths 127 and 128 between the zone ECU 104 and the slave ECUs 108 and 109 , respectively.

[0259] The slave ECUs 110 and 111 are supplied with electric power from the battery 117 through power supply paths 129 and 130 between the zone ECU 105 and the slave ECUs 110 and 111 , respectively.

[0260] The slave ECUs 112 , 113 , 114 receive electric power from the battery 117 through power supply paths 131 , 132 , 133 between the zone ECU 106 and the slave ECUs 112 , 113 , 114 , respectively.

[0261] The slave ECUs 115 and 116 receive electric power from the battery 117 through power supply paths 134 and 135 between the zone ECU 107 and the slave ECUs 115 and 116 , respectively.

[0262] The central ECU 101 and the upstream power distribution unit 102 are connected via a communication line 141 so as to be able to perform data communication with each other.

[0263] The central ECU 101 and the upstream power distribution unit 103 are connected via a communication line 142 so as to be able to perform data communication with each other.

[0264] The central ECU 101 and the regional ECUs 104 , 105 , 106 , and 107 are connected via communication lines 143 , 144 , 145 , and 146 , respectively, so as to be able to perform data communication with each other.

[0265] The area ECU 104 and the slave ECUs 108 and 109 are connected via a communication bus 147 so as to be able to communicate data with each other.

[0266] The area ECU 105 and the slave ECUs 110 and 111 are connected via a communication bus 148 so as to be able to perform data communication with each other.

[0267] The area ECU 106 and the slave ECUs 112 , 113 , and 114 are connected via a communication bus 149 so as to be able to communicate data with each other.

[0268] The area ECU 107 and the slave ECUs 115 and 116 are connected via a communication bus 150 so as to be able to communicate data with each other.

[0269] like Fig.19 As shown, the central ECU 101 includes a control unit 151 , communication units 152 , 153 , 154 , 155 , 156 , 157 , and a storage unit 158 ​​.

[0270] The control unit 151 is an electronic control device centered around a microcomputer having a CPU 161, a ROM 162, and a RAM 163. The various functions of the microcomputer are realized by the CPU 161 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 162 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 161 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 151 may be one or more.

[0271] The communication unit 152 communicates with the upstream power distribution unit 102 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. Ethernet is a registered trademark.

[0272] The communication unit 153 communicates with the upstream power distribution unit 103 connected to the communication line 142 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0273] The communication unit 154 performs communication with the zone ECU 104 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0274] The communication unit 155 performs communication with the zone ECU 105 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0275] The communication unit 156 performs communication with the zone ECU 106 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0276] The communication unit 157 performs communication with the zone ECU 107 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0277] The storage unit 158 ​​is a storage device for storing various data. The storage unit 158 ​​stores a startup table 165 described later.

[0278] The upstream power distribution unit 102 includes a control circuit 171 , a communication unit 172 , and electronic fuses 173 and 174 .

[0279] The control circuit 171 performs control to switch the electronic fuses 173 and 174 between the on state and the off state based on the instruction acquired from the central ECU 101 via the communication unit 172 .

[0280] The communication unit 172 performs communication with the central ECU 101 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0281] The electronic fuse 173 is disposed between the power supply path 121 and the power supply path 123. The electronic fuse 174 is disposed between the power supply path 121 and the power supply path 124.

[0282] The upstream power distribution unit 103 includes a control circuit 181 , a communication unit 182 , and electronic fuses 183 and 184 .

[0283] The control circuit 181 performs control to switch the electronic fuses 183 and 184 between the on state and the off state based on the instruction acquired from the central ECU 101 via the communication unit 182 .

[0284] The communication unit 182 performs communication with the central ECU 101 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0285] The electronic fuse 183 is disposed between the power supply path 122 and the power supply path 125. The electronic fuse 184 is disposed between the power supply path 122 and the power supply path 126.

[0286] like Fig. 20 As shown, the zone ECU 104 includes a control unit 191 , a communication unit 192 , a CAN communication unit 193 , a storage unit 194 , and electronic fuses 195 and 196 .

[0287] The control unit 191 is an electronic control device centered around a microcomputer having a CPU 201, a ROM 202, and a RAM 203. The various functions of the microcomputer are realized by the CPU 201 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 202 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 201 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 191 may be one or more.

[0288] The communication unit 192 performs communication with the central ECU 101 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0289] The CAN communication unit 193 performs communication by transmitting and receiving communication frames based on the CAN communication protocol between the slave ECUs 108 and 109 connected to the communication bus 147 .

[0290] The storage unit 194 is a storage device for storing various data. The storage unit 194 stores a startup table 205 described later.

[0291] The electronic fuse 195 is disposed between the power supply path 123 and the power supply path 127. The electronic fuse 196 is disposed between the power supply path 123 and the power supply path 128.

[0292] The zone ECU 105 includes a control unit 211 , a communication unit 212 , a CAN communication unit 213 , a storage unit 214 , and electronic fuses 215 and 216 .

[0293] The control unit 211 is an electronic control device centered around a microcomputer having a CPU 221, a ROM 222, and a RAM 223. The various functions of the microcomputer are realized by the CPU 221 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 222 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 221 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 211 may be one or more.

[0294] The communication unit 212 performs communication with the central ECU 101 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0295] The CAN communication unit 213 performs communication by transmitting and receiving communication frames based on the CAN communication protocol between the slave ECUs 110 and 111 connected to the communication bus 148 .

[0296] The storage unit 214 is a storage device for storing various data. The storage unit 214 stores a startup table 225 described later.

[0297] The electronic fuse 215 is disposed between the power supply path 124 and the power supply path 129. The electronic fuse 216 is disposed between the power supply path 124 and the power supply path 130.

[0298] like Fig.21 As shown, the zone ECU 106 includes a control unit 231 , a communication unit 232 , a CAN communication unit 233 , a storage unit 234 , and electronic fuses 235 , 236 , and 237 .

[0299] The control unit 231 is an electronic control device centered around a microcomputer having a CPU 241, a ROM 242, and a RAM 243. The various functions of the microcomputer are realized by the CPU 241 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 242 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 241 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 231 may be one or more.

[0300] The communication unit 232 performs communication with the central ECU 101 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0301] The CAN communication unit 233 performs communication by transmitting and receiving communication frames based on the CAN communication protocol between the slave ECUs 112 , 113 , and 114 connected to the communication bus 149 .

[0302] The storage unit 234 is a storage device for storing various data. The storage unit 234 stores a startup table 245 described later.

[0303] The electronic fuse 235 is disposed between the power supply path 125 and the power supply path 131. The electronic fuse 236 is disposed between the power supply path 125 and the power supply path 132. The electronic fuse 237 is disposed between the power supply path 125 and the power supply path 133.

[0304] The zone ECU 107 includes a control unit 251 , a communication unit 252 , a CAN communication unit 253 , a storage unit 254 , and electronic fuses 255 and 256 .

[0305] The control unit 251 is an electronic control device centered around a microcomputer having a CPU 261, a ROM 262, and a RAM 263. The various functions of the microcomputer are realized by the CPU 261 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 262 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 261 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 251 may be one or more.

[0306] The communication unit 252 performs communication with the central ECU 101 connected to the communication line 146 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0307] The CAN communication unit 253 performs communication by transmitting and receiving communication frames based on the CAN communication protocol between the slave ECUs 115 and 116 connected to the communication bus 150 .

[0308] The storage unit 254 is a storage device for storing various data. The storage unit 254 stores a startup table 265 described later.

[0309] The electronic fuse 255 is disposed between the power supply path 126 and the power supply path 134. The electronic fuse 256 is disposed between the power supply path 126 and the power supply path 135.

[0310] like Fig. 22 As shown, the slave ECUs 108 and 109 include a control unit 271 , a CAN communication unit 272 , and a storage unit 273 .

[0311] The control unit 271 is an electronic control device centered on a microcomputer having a CPU 281, a ROM 282, and a RAM 283. The various functions of the microcomputer are realized by the CPU 281 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 282 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 281 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 271 may be one or more.

[0312] CAN communication unit 272 communicates with area ECU 104 connected to communication bus 147 based on the CAN communication protocol.

[0313] The storage unit 273 is a storage device for storing various data. The storage unit 273 stores a startup table 285 described later.

[0314] The slave ECUs 110 and 111 include a control unit 291 , a CAN communication unit 292 , and a storage unit 293 .

[0315] The control unit 291 is an electronic control device centered on a microcomputer having a CPU 301, a ROM 302, and a RAM 303. The various functions of the microcomputer are realized by the CPU 301 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 302 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 301 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 291 may be one or more.

[0316] CAN communication unit 292 communicates with area ECU 105 connected to communication bus 148 based on the CAN communication protocol.

[0317] The storage unit 293 is a storage device for storing various data. The storage unit 293 stores a startup table 305 described later.

[0318] The slave ECUs 112 , 113 , and 114 include a control unit 311 , a CAN communication unit 312 , and a storage unit 313 .

[0319] The control unit 311 is an electronic control device centered around a microcomputer having a CPU 321, a ROM 322, and a RAM 323. The various functions of the microcomputer are realized by the CPU 321 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 322 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 321 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 311 may be one or more.

[0320] CAN communication unit 312 communicates with area ECU 106 connected to communication bus 149 based on the CAN communication protocol.

[0321] The storage unit 313 is a storage device for storing various data. The storage unit 313 stores a startup table 325 described later.

[0322] The slave ECUs 115 and 116 include a control unit 331 , a CAN communication unit 332 , and a storage unit 333 .

[0323] The control unit 331 is an electronic control device centered around a microcomputer having a CPU 341, a ROM 342, and a RAM 343. The various functions of the microcomputer are realized by the CPU 341 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 342 is equivalent to a non-migrating physical recording medium storing the program. In addition, by executing the program, a method corresponding to the program is executed. In addition, a part or all of the functions executed by the CPU 341 may be constituted in hardware by one or more ICs. In addition, the number of microcomputers constituting the control unit 331 may be one or more.

[0324] The CAN communication unit 332 communicates with the area ECU 107 connected to the communication bus 150 based on the CAN communication protocol.

[0325] The storage unit 333 is a storage device for storing various data. The storage unit 333 stores a startup table 345 described later.

[0326] The activation tables 165 , 205 , 225 , 245 , 265 , 285 , 305 , 325 , and 345 set a communication group to be activated (ie, activation group) for each event.

[0327] In the activation table 205 of the regional ECU 104 , a correspondence relationship between the activation group and the electronic fuses 195 and 196 built in the regional ECU 104 to be turned on is further set.

[0328] In the activation table 225 of the regional ECU 105 , a correspondence relationship between the activation group and the electronic fuses 215 and 216 built into the regional ECU 105 to be turned on is further set.

[0329] In the activation table 245 of the regional ECU 106 , a correspondence relationship between the activation group and the electronic fuses 235 , 236 , and 237 built into the regional ECU 106 to be turned on is further set.

[0330] In the activation table 265 of the regional ECU 107 , a correspondence relationship between the activation group and the electronic fuses 255 and 256 built in the regional ECU 107 to be turned on is further set.

[0331] When receiving the NM frame, the area ECUs 104 , 105 , 106 , and 107 are configured to refer to the activation tables 205 , 225 , 246 , and 267 based on the activation group indicated by the NM frame, thereby turning on or off the subordinate electronic fuses.

[0332] The slave ECUs 108 to 116 execute processing corresponding to the interrupt diagnosis invalidation processing of the fifth embodiment.

[0333] That is, when the communication interruption diagnostic information of other nodes is stored, slave ECUs 108 to 116 inquire about the status of the electronic fuses to all the area ECUs 104 to 107 .

[0334] When receiving an inquiry from the slave ECUs 108 to 116, the area ECUs 104 to 107 check the status of the subordinate electronic fuses. The area ECUs 104 to 107 generate electronic fuse status information based on the check result and transmit the generated electronic fuse status information to the inquiring slave ECUs 108 to 116.

[0335] The slave ECUs 108 to 116 determine whether the electronic fuses connected to other nodes corresponding to the stored communication interruption diagnostic information are intentionally disconnected based on the electronic fuse state information acquired from the area ECUs 104 to 107. If disconnected intentionally, the slave ECUs 108 to 116 invalidate the communication interruption diagnostic information.

[0336] In the above-described embodiment, electronic fuse 195 corresponds to the first electronic fuse, battery 117 corresponds to the power supply, slave ECU 108 corresponds to the first control device, electronic fuse 196 corresponds to the second electronic fuse, and slave ECU 109 corresponds to the second control device.

[0337] The central ECU 101 corresponds to the management device, the control unit 151 corresponds to the switching control unit, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 273 of the slave ECU 109 corresponds to the state information storage unit.

[0338] [Eighth Embodiment]

[0339] The following and attached Figure 1 The eighth embodiment of the present disclosure will be described together. In the eighth embodiment, the parts different from the seventh embodiment will be described. The same reference numerals are given to the common structures.

[0340] In the communication system 100 of the eighth embodiment, the central ECU 101 executes a process corresponding to the advance notification process of the first embodiment.

[0341] That is, when there is an intentionally cut electronic fuse ( S10 ), the central ECU 101 uses the area ECUs 104 to 107 as relays to transmit power cut notification information to the slave ECUs 108 to 116 connected to the intentionally cut electronic fuse ( S20 ).

[0342] Upon receiving the power-off notification information, slave ECUs 108 to 116 store the received power-off notification information together with reception date and time information indicating the date and time when the power-off notification information was received.

[0343] When the power-off notification information is stored immediately after the startup ( S120 ), the slave ECUs 108 to 116 store the power-on recovery date and time information ( S130 ).

[0344] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 273 of the slave ECU 108 corresponds to the state information storage unit.

[0345] [Ninth Embodiment]

[0346] The following and attached Figure 1 The ninth embodiment of the present disclosure will be described together. In the ninth embodiment, the parts different from the seventh embodiment will be described. The same reference numerals are given to the common structures.

[0347] In the communication system 100 of the ninth embodiment, the slave ECUs 108 to 116 execute a process corresponding to the notification confirmation process of the second embodiment. In addition, the slave ECUs 108 to 116 include a power storage unit (not shown).

[0348] That is, when the power supply from the battery 117 is cut off (S210), the slave ECU 108 to 116 checks whether there is power cut notification information (S220), and when the power cut notification information is stored (S230), the slave cut information is stored together with the slave cut time information (S240).

[0349] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 273 of the slave ECU 108 corresponds to the state information storage unit.

[0350] [Tenth embodiment]

[0351] The following and attached Figure 1 The tenth embodiment of the present disclosure will be described together. In the tenth embodiment, the parts different from the seventh embodiment will be described. The same reference numerals are given to the common structures.

[0352] In the communication system 100 of the tenth embodiment, the central ECU 101 executes a process corresponding to the pre-stored process of the third embodiment.

[0353] That is, when there is an electronic fuse intended to be cut ( S410 ), the central ECU 101 stores the cut fuse notification information notifying the cut electronic fuse and the fuse cut time information indicating the time when the electronic fuse was cut in the storage unit 158 ​​( S420 ).

[0354] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 158 ​​of the central ECU 101 corresponds to the state information storage unit.

[0355] [Eleventh Embodiment]

[0356] The following and attached Figure 1 The eleventh embodiment of the present disclosure will be described together. In the eleventh embodiment, the parts different from the seventh embodiment will be described. The same reference numerals are given to the common structures.

[0357] In the communication system 100 of the eleventh embodiment, the central ECU 101 executes a process corresponding to the advance notification process of the fourth embodiment.

[0358] Specifically, when the central ECU 101 intentionally cuts the electronic fuse ( S610 ), it transmits cut fuse notification information notifying the cut electronic fuse and fuse cut time information indicating the time when the electronic fuse was cut to all slave ECUs 108 to 116 included in the communication system 100 ( S620 ).

[0359] In addition, the slave ECUs 108 to 116 execute processing corresponding to the interrupt diagnosis invalidation processing of the fourth embodiment.

[0360] That is, when slave ECUs 108 to 116 store communication interruption diagnostic information of other nodes (S710) and receive fuse-cut notification information indicating an electronic fuse connected to other nodes (S720), near the moment of fuse cutting, the interruption diagnostic information associated with the slave ECU connected to the electronic fuse indicated by the fuse-cut notification information is invalidated (S730).

[0361] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 273 of the slave ECU 109 corresponds to the state information storage unit.

[0362] As mentioned above, although one embodiment of the present disclosure has been described, the present disclosure is not limited to the above embodiment, and can be implemented in various modified forms.

[0363] [Modification 1]

[0364] In the third, fourth and fifth embodiments described above, the slave ECU 3 and the slave ECU 4 are connected to the communication bus 6. Fig.15 As shown, more than three ECUs may be connected to the communication bus 6. Fig.15 In the embodiment, in addition to the slave ECU 3 and the slave ECU 4 , the slave ECU 8 and the slave ECU 9 are also connected to the communication bus 6 .

[0365] In this case, the master ECU 2 of the fourth embodiment may also send the fuse cut notification information and the fuse cut time information to all slave ECUs (i.e., slave ECUs 3, 4, 8, 9) connected to the communication bus 6. Thus, in the communication system 1, not only the slave ECUs 3, 4 but also the slave ECUs 8, 9 can obtain the fuse cut notification information and the fuse cut time information. Therefore, not only the slave ECUs 3, 4 but also the slave ECUs 8, 9 can determine whether the master ECU 2 intentionally makes the electronic fuses 15, 16 disconnected. Thus, in the communication system 1, it is possible to suppress the occurrence of a situation where the slave ECUs 8, 9 determine that the communication interruption has occurred in the slave ECUs 3, 4 even though no abnormality has occurred in the slave ECUs 3, 4. Thus, the communication system 1 can further improve the abnormality detection accuracy.

[0366] In addition, there is a communication bus (for example, Figure 5 In this case, the master ECU 2 of the fourth embodiment may also send fuse cut notification information and fuse cut time information to all slave ECUs connected to the communication bus that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2.

[0367] In addition, the master ECU 2 of the fifth embodiment may also send the electronic fuse status information to all slave ECUs (i.e., slave ECUs 3, 4, 8, 9) connected to the communication bus 6. Thus, the communication system 1 can reduce the frequency of status confirmation requests sent by the slave ECUs 8 and 9 to the master ECU 2, and can reduce the usage rate of the communication bus 6 (i.e., bus load).

[0368] In addition, there is a communication bus (for example, Figure 5 In this case, the master ECU 2 of the fifth embodiment may also send the electronic fuse status information to all slave ECUs connected to the communication bus that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2.

[0369] [Modification 2]

[0370] In the above embodiment, the operator who performs vehicle inspection connects fault diagnosis device 600 to main ECU 2 to obtain diagnostic information, etc. However, after fault diagnosis device 600 is connected to main ECU 2 by remote communication to obtain diagnostic information, the diagnostic information may be invalidated.

[0371] [Variation 3]

[0372] In the fourth embodiment, the fuse disconnection notification information and the fuse disconnection time information are sent after the electronic fuses 15 and 16 are disconnected. However, the fuse disconnection notification information and the fuse disconnection time information may be sent before the electronic fuses 15 and 16 are disconnected.

[0373] [Variation 4]

[0374] In the first embodiment described above, a method of storing power restoration date and time information when power cut notification information is stored is shown. However, the slave ECU 3, 4 may store power restoration date and time information when it is started by the power supply from the battery 5, regardless of whether the power cut notification information is stored. Thus, in the case where both the power cut notification information and the power restoration date and time information are stored before and after the power restoration of the slave ECU 3, 4, the diagnostic information associated with the slave ECU 3, 4 from the power cut notification reception date and time to the power restoration date and time can be invalidated.

[0375] [Variation 5]

[0376] In the second embodiment, the method of storing the slave cutoff information and the slave cutoff time information when the power cutoff notification information is stored is shown. However, the slave ECUs 3 and 4 may store the slave cutoff information and the slave cutoff time information when the power supply from the battery 5 is cut off, regardless of whether the power cutoff notification information is stored. Thus, when both the power cutoff notification information and the slave cutoff information are stored, the diagnostic information associated with the slave ECUs 3 and 4 generated at a time near the slave cutoff time can be invalidated.

[0377] [Variation 6]

[0378] In the above-mentioned embodiment, the first embodiment and the second embodiment are described respectively. However, both the power recovery date and time information of the first embodiment and the cut-off time information of the second embodiment can be stored. Thus, the diagnostic information from the time indicated by the cut-off time information to the date and time indicated by the power recovery date and time information can be invalidated.

[0379] [Variation 7]

[0380] In the fifth embodiment, the slave ECU 3, 4 sends a status confirmation request to the master ECU 2 to inquire about the status of the electronic fuse connected to the slave ECU corresponding to the communication interruption diagnostic information. However, the slave ECU 3, 4 may also inquire about the ECU status indicating whether to cut off the power supply to the slave ECU corresponding to the communication interruption diagnostic information.

[0381] [Variation 8]

[0382] In the sixth embodiment, the slave ECUs 108 to 116 inquire about the status of the electronic fuses to all the regional ECUs 104 to 107. However, when the regional ECUs 104 to 107 notify the central ECU 101 of the status of the subordinate electronic fuses, the slave ECUs 108 to 116 may inquire about the status of the electronic fuses to the central ECU 101. The central ECU 101 centrally manages the status of the electronic fuses of the regional ECUs 104 to 107 based on the notification from the regional ECUs 104 to 107. Therefore, the status of the electronic fuses can be answered in response to the inquiries from the slave ECUs 108 to 116.

[0383] [Variation 9]

[0384] In the first and second embodiments, the master ECU 2 sends power cut notification information to the slave ECUs 3 and 4. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the regional ECUs 104 to 107, and the slave ECUs 108 to 116, the regional ECUs 104 to 107 send power cut notification information to the subordinate slave ECUs 108 to 116.

[0385] [Variation 10]

[0386] In the third embodiment, the master ECU 2 stores fuse-cut notification information notifying the electronic fuse that is intentionally cut and fuse-cut time information indicating the time when the electronic fuse is cut, when there is an electronic fuse that is intentionally cut. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the regional ECUs 104 to 107, and the slave ECUs 108 to 116, the regional ECUs 104 to 107 store fuse-cut notification information and fuse-cut time information related to the subordinate electronic fuses. In addition, when the regional ECUs 104 to 107 notify the central ECU 101 of the state of the subordinate electronic fuses, the central ECU 101 stores fuse-cut notification information and fuse-cut time information related to all the electronic fuses of the communication system 100.

[0387] [Variation 11]

[0388] In the fourth embodiment, the master ECU 2 transmits the fuse cut notification information and the fuse cut time information to the slave ECUs 3 and 4. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the regional ECUs 104 to 107, and the slave ECUs 108 to 116, the regional ECUs 104 to 107 transmit the fuse cut notification information and the fuse cut time information to all the slave ECUs 108 to 116.

[0389] [Variation 12]

[0390] In the fourth embodiment, a method of invalidating the interruption diagnostic information near the time indicated by the fuse cut-off time information is shown. However, the interruption diagnostic information may be invalidated during the period from the time indicated by the fuse cut-off time information until a preset invalidation end condition is satisfied. The invalidation end condition refers to, for example, obtaining the conduction fuse notification information indicating that the corresponding electronic fuse has become in the on state, or receiving a communication frame from the ECU that is the object of the interruption diagnostic information.

[0391] The control units 11, 31 and methods thereof described in the present disclosure may also be implemented by a special-purpose computer, which is provided by constituting a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the control units 11, 31 and methods thereof described in the present disclosure may also be implemented by a special-purpose computer, which is provided by constituting a processor composed of one or more special-purpose hardware logic circuits. Alternatively, the control units 11, 31 and methods thereof described in the present disclosure may also be implemented by one or more special-purpose computers, which are constituted by a combination of a processor and a memory programmed to execute one or more functions and a processor composed of one or more hardware logic circuits. In addition, a computer program may also be stored as an instruction executed by a computer in a non-migratable tangible recording medium that can be read by a computer. In the method for realizing the functions of each unit included in the control unit 11, 31, it is not necessary to include software, and all of its functions may be realized using one or more hardware.

[0392] It is also possible to realize multiple functions of one constituent element of the above-mentioned embodiment by multiple constituent elements, or realize one function of one constituent element by multiple constituent elements. In addition, it is also possible to realize multiple functions of multiple constituent elements by one constituent element, or realize one function realized by multiple constituent elements by one constituent element. In addition, it is also possible to omit a part of the structure of the above-mentioned embodiment. In addition, it is also possible to add or replace at least a part of the structure of the above-mentioned embodiment relative to the structure of other above-mentioned embodiments.

[0393] In addition to the above-mentioned ECU2~4, 101, 104~116, the present disclosure can also be implemented in various ways such as a system with the ECU2~4, 101, 104~116 as a constituent element, a program for enabling a computer to function as the ECU2~4, 101, 104~116, a non-migrating physical recording medium such as a semiconductor memory recording the program, a communication method, etc.

Claims

1. A communication system comprising: a first control device receiving power supply from a power source via a first electronic fuse; a second control device connected to the first control device so as to be capable of data communication and receiving power supply from the power supply via a second electronic fuse; as well as a management device connected to the first control device and the second control device so as to be able to perform data communication, in, The communication system comprises: a switching control unit configured to perform switching control to switch the first electronic fuse and the second electronic fuse to an on state or an off state; a diagnostic information storage unit configured to store diagnostic information related to communication with the first control device; as well as The state information storage unit is configured to store first fuse state information related to a state of the first electronic fuse, which is information referred to in order to invalidate the diagnostic information.

2. The communication system according to claim 1, wherein: A cut-off notification sending unit is provided, the cut-off notification sending unit being configured to send first power supply cut-off related information related to the situation of cutting off the power supply from the power supply via the first electronic fuse before or after the first electronic fuse is set to the open state in order to cut off the power supply from the power supply to the first control device, The state information storage unit is configured to store the first fuse state information in response to receiving the first power shutoff related information.

3. The communication system according to claim 2, wherein: The cut-off notification sending unit is configured to send power cut-off notification information notifying that the power supply from the power supply via the first electronic fuse is cut off as the first power cut-off related information to the first control device before the first electronic fuse is turned into the disconnected state in order to cut off the power supply from the power supply to the first control device. The status information storage unit is configured to determine whether the power cut-off notification information is stored in the first control device when it is started by the power supply from the power supply, and if the power cut-off notification information is stored, store the power recovery date and time information indicating the date and time when the first control device was most recently started as the first fuse status information.

4. The communication system according to claim 2, wherein: The cut-off notification sending unit is configured to send, as the first power supply cut-off related information, first fuse cut-off notification information notifying the cut-off of the first electronic fuse and first fuse cut-off time information indicating the time when the first electronic fuse is cut off to the second control device before or after the first electronic fuse is turned off in order to cut off the power supply from the power supply to the first control device, The state information storage unit is configured to store the first blown fuse notification information and the first fuse blown time information received by the second control device as the first fuse state information.

5. The communication system according to claim 2, wherein: The first control device includes a backup power supply. The cut-off notification sending unit is configured to send power cut-off notification information notifying that the power supply from the power supply via the first electronic fuse is cut off as the first power cut-off related information to the first control device before the first electronic fuse is turned into the disconnected state in order to cut off the power supply from the power supply to the first control device. The status information storage unit is configured to determine whether the power cutoff notification information is obtained when the power supply from the power supply is cut off, and if the power cutoff notification information is obtained, store the power cutoff information indicating the content of cutting off the power as the first fuse status information.

6. The communication system according to claim 1, wherein: The status information storage unit is configured to store, in the management device, first fuse cut-off notification information notifying that the first electronic fuse is cut off and first fuse cut-off time information indicating the moment when the first electronic fuse is cut off as the first fuse status information before the first electronic fuse is turned off in order to cut off the power supply from the power supply to the first control device, and to store, in the management device, second fuse cut-off notification information notifying that the second electronic fuse is cut off and second fuse cut-off time information indicating the moment when the second electronic fuse is cut off, before the second electronic fuse is turned off in order to cut off the power supply from the power supply to the second control device.

7. The communication system according to claim 1, wherein: The first control device includes a first request unit configured to send a second status confirmation request for inquiring about the status of the second electronic fuse to the management device if second communication interruption diagnostic information indicating a communication interruption with the second control device is stored. The second control device includes a second request unit configured to send a first status confirmation request to the management device to inquire about the status of the first electronic fuse if first communication interruption diagnostic information indicating a communication interruption with the first control device is stored. The management device includes a response unit, which is configured to, if the second status confirmation request is obtained from the first control device, confirm the status of the second electronic fuse and send the second electronic fuse status information indicating the confirmation result to the first control device; if the first status confirmation request is obtained from the second control device, confirm the status of the first electronic fuse and send the first electronic fuse status information indicating the confirmation result to the second control device, The state information storage unit is configured to store the acquired first electronic fuse state information in the second control device as the first fuse state information.

8. The communication system according to claim 4, wherein: The cut-off notification sending unit is configured to send the first cut-off fuse notification information and the first fuse cut-off time information to all electronic control devices connected to the same communication bus as the first control device and a communication bus that can communicate with the first control device via the management device.

9. The communication system according to claim 7, wherein: The response unit of the management device is configured to transmit the first electronic fuse state information to all electronic control devices connected to the same communication bus as the first control device and to a communication bus capable of communicating with the first control device via the management device.

10. The communication system according to claim 2, wherein: The cut-off notification sending unit is configured to send power cut-off notification information notifying that the power supply from the power supply via the first electronic fuse is cut off as the first power cut-off related information to the first control device before the first electronic fuse is turned into the disconnected state in order to cut off the power supply from the power supply to the first control device. The state information storage unit is configured to store, as the first fuse state information, power recovery date and time information indicating the date and time when the first control device was last activated when activated by the power supply from the power supply.

11. The communication system according to claim 2, wherein: The first control device includes a backup power supply. The cut-off notification sending unit is configured to send power cut-off notification information notifying that the power supply from the power supply via the first electronic fuse is cut off as the first power cut-off related information to the first control device before the first electronic fuse is turned into the disconnected state in order to cut off the power supply from the power supply to the first control device. The state information storage unit is configured to store, when power supply from the power source is cut off, power supply cutoff information indicating that the power source has been cut off as the first fuse state information.

12. The communication system according to any one of claims 1 to 7, wherein: At least one of the one or more electronic control devices included in the communication system is configured to invalidate the diagnostic information based on the first fuse state information.

13. The communication system according to any one of claims 1 to 7, wherein: A service tool connected to the communication system is configured to invalidate the diagnostic information based on the first fuse state information.

14. The communication system according to claim 3, wherein: The second control device is configured to invalidate the diagnostic information based on the first fuse state information, tracing back to the timing when the power supply shutoff notification information is acquired.

15. The communication system according to claim 14, wherein: The second control device is configured to terminate the invalidation of the diagnostic information when a preset invalidation termination condition is satisfied.

16. The communication system according to any one of claims 3 to 5, wherein: The shutdown notification transmission unit is configured to transmit the first power shutdown related information to all electronic control devices included in the communication system.

17. The communication system according to claim 7, wherein: The communication system includes the first control device and the second control device as slave control devices, and includes a regional control device and a central control device as the management device. The regional control device is configured to be connected to the slave control device so as to be able to perform data communication and control the operation of the first electronic fuse and the second electronic fuse. The central control device is connected to the regional control device so as to be able to perform data communication. The first request unit is configured to send the second status confirmation request to all the area control devices included in the communication system. The second request unit is configured to send the first status confirmation request to all the area control devices included in the communication system.

18. The communication system according to claim 7, wherein: The communication system includes the first control device and the second control device as slave control devices, and includes a regional control device and a central control device as the management device. The regional control device is configured to be connected to the slave control device so as to be able to perform data communication and control the operation of the first electronic fuse and the second electronic fuse. The central control device is connected to the regional control device so as to be able to perform data communication. The first request unit is configured to send the second status confirmation request to the central control device, The second request unit is configured to send the first status confirmation request to the central control device.

Images