Communication system, management device, and persistent computer-readable medium

Abstract

The invention relates to a communication system, a management device, and a persistent computer-readable medium. The present invention improves abnormality detection accuracy in a communication system. A communication system (1) is provided with slave ECUs (3, 4) and a master ECU (2). Power is received from the ECU (3) from the battery (5) via the electronic fuse (15). The slave ECU (4) and the slave ECU (3) are connected so as to be capable of data communication. The master ECU (2) and the slave ECUs (3, 4) are connected so as to be capable of data communication, and control the operation of the electronic fuse (15). The main ECU (2) executes at least one of a pre-notification process and a post-notification process. The pre-notification process transmits power-off pre-notification information to the slave ECU (4) before the electronic fuse (15) is turned off. The post-event notification process transmits power-off post-event notification information to the slave ECU (4) after the electronic fuse (15) is turned off.

Description

Technical Field

[0001] The present disclosure relates to a communication system, a management device and a persistent computer readable medium having an electronic fuse. Background Art

[0002] Patent document 1 describes an in-vehicle network system, in which a plurality of electronic control devices are provided with power relays for independently switching the power of the electronic control devices on / off, a control content for switching the power of the specific electronic control device on / off is determined for a specific electronic control device corresponding to a scenario determined based on the condition of the vehicle, and based on the determined control content, the power relay is used to switch the power supplied to the specific electronic control device on / off.

[0003] Patent Document 1: Japanese Patent Application Publication No. 2015-81021

[0004] As a result of detailed research by the inventors, it was found that in a communication system including a plurality of electronic control devices and using electronic fuses to switch the power supply of the electronic control devices on and off, an abnormality of communication interruption is erroneously detected, thereby reducing the accuracy of abnormality detection. Summary of the invention

[0005] The present disclosure aims to improve anomaly detection accuracy in a communication system.

[0006] One aspect of the present disclosure is a communication system (1, 100) including a first control device (3, 108), a second control device (4, 109), a switching control unit (2, 101, 104), and a power off notification unit (S30, S120, S330).

[0007] The first control device receives power supply from a power source (5, 117) via an electronic fuse (15, 195).

[0008] The second control device is connected to the first control device in a data communication manner.

[0009] The switching control unit is configured to perform switching control to switch the electronic fuse to an on state or an off state.

[0010] The power cut notification unit is configured to perform at least one of a pre-notification process and a post-notification process. The pre-notification process sends power cut pre-notification information notifying that the power supply from the power supply via the electronic fuse is cut off to the second control device before the electronic fuse is turned off to cut off the power supply from the power supply to the first control device. The post-notification process sends power cut post-notification information notifying that the power supply from the power supply via the electronic fuse is cut off to the second control device after the electronic fuse is turned off to cut off the power supply from the power supply to the first control device.

[0011] The second control device is configured to store the received power-off advance notification information and power-off post notification information.

[0012] In the communication system of the present disclosure constructed in this way, when the power supply to the first control device is cut off due to the electronic fuse being in the disconnected state, the power cut notification unit sends at least one of the power cut pre-notification information and the power cut post-notification information to the second control device. That is, the communication system of the present disclosure can determine whether the electronic fuse is in the disconnected state based on whether the second control device stores the power cut pre-notification information and the power cut post-notification information. Therefore, even if the second control device detects an abnormality caused by the electronic fuse being in the disconnected state and related to the first control device, the communication system of the present disclosure can be regarded as not having an abnormality in the first control device when the second control device stores the power cut pre-notification information and the power cut post-notification information. That is, the communication system of the present disclosure can suppress the occurrence of a situation in which an abnormality is judged to have occurred in the first control device even though no abnormality has occurred in the first control device. As a result, the communication system of the present disclosure can improve the accuracy of abnormality detection.

[0013] Another aspect of the present disclosure is a management device (2) including an electronic fuse control unit (S40), a communication unit (13), and a power cutoff notification unit (S30, S120, S330).

[0014] The electronic fuse control unit is configured to control the operation of the electronic fuse (15), which is configured to switch between an on state for conducting a power supply path for supplying power from a power source (5) to a first control device (3) and an off state for cutting off the power supply path.

[0015] The communication unit is configured to perform data communication with a second control device (4), and the second control device is connected to the first control device in a data-communicable manner.

[0016] The management device of the present disclosure is a device included in the communication system of the present disclosure, and can obtain the same effects as the communication system of the present disclosure.

[0017] Another aspect of the present disclosure is a management program for causing a computer to function as an electronic fuse control unit (S40), a communication unit (13), and a power cutoff notification unit (S30, S120, S330).

[0018] A computer controlled by the management program of the present disclosure can constitute a part of the management device of the present disclosure, and can obtain the same effect as the core of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a block diagram showing the configuration of the communication system according to the first embodiment.

[0020] Figure 2 This is a flowchart showing the advance notification process according to the first embodiment.

[0021] Figure 3 This is a flowchart showing the post-notification process.

[0022] Figure 4 This is a flowchart showing interrupt diagnosis invalidation processing.

[0023] Figure 5 A block diagram showing the configuration of a communication system according to a second embodiment

[0024] Figure 6 This is a flowchart showing the advance notification process according to the second embodiment.

[0025] Figure 7 This is a flowchart showing the monitoring management process.

[0026] Figure 8 This is a timing chart showing a specific example of the start and end of monitoring in the second embodiment.

[0027] Fig. 9 It is a timing chart showing a specific example of starting and ending monitoring in another embodiment.

[0028] Fig.10 It is a block diagram showing the configuration of a communication system according to the third embodiment.

[0029] Fig.11 It is a diagram showing the correspondence between control objects and clusters.

[0030] Fig.12 It is a block diagram showing the configuration of a communication system according to a fourth embodiment.

[0031] Fig.13 This is a block diagram showing the configuration of a central ECU and an upstream power distribution unit according to a fourth embodiment.

[0032] Fig.14This is a first block diagram showing the configuration of a zone ECU according to the fourth embodiment.

[0033] Fig.15 This is a second block diagram showing the configuration of the zone ECU according to the fourth embodiment.

[0034] Fig.16 It is a block diagram showing the structure of a slave ECU according to the fourth embodiment. DETAILED DESCRIPTION

[0035] [First embodiment]

[0036] The following and attached Figure 1 The first embodiment of the present disclosure will be described below.

[0037] The communication system 1 of this embodiment is installed in a vehicle, such as Figure 1 As shown, the master ECU 2, slave ECUs 3 and 4, and a battery 5 are provided. ECU is an abbreviation of Electronic Control Unit. Hereinafter, the master ECU 2 and the slave ECUs 3 and 4 are also collectively referred to as nodes.

[0038] The master ECU 2 and the slave ECU 3 are connected via a communication bus 6 so as to be able to perform data communication with each other.

[0039] The master ECU 2 and the slave ECU 4 are connected via a communication bus 7 so as to be able to perform data communication with each other.

[0040] The battery 5 supplies electric power to various parts of the vehicle at a DC battery voltage (eg, 12 V). The master ECU 2 and the slave ECUs 3 and 4 receive electric power from the battery 5 to operate.

[0041] The main ECU 2 includes a control unit 11, CAN communication units 12 and 13, a storage unit 14, and electronic fuses 15 and 16. CAN is an abbreviation for Controller Area Network.

[0042] The control unit 11 is an electronic control device centered around a microcomputer having a CPU 21, a ROM 22, and a RAM 23. The various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 22 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 21 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 11 may be one or more.

[0043] The CAN communication unit 12 communicates with the slave ECU 3 connected to the communication bus 6 by sending and receiving communication frames based on the CAN communication protocol.

[0044] The CAN communication unit 13 communicates with the slave ECU 4 connected to the communication bus 7 by sending and receiving communication frames based on the CAN communication protocol. Hereinafter, the CAN communication frame is referred to as a CAN frame.

[0045] The storage unit 14 is a storage device for storing various data. The storage unit 14 stores a startup table 25 described later.

[0046] The electronic fuse 15 is arranged on the power supply path between the battery 5 and the slave ECU 3. The electronic fuse 16 is arranged on the power supply path between the battery 5 and the slave ECU 4.

[0047] The electronic fuses 15 and 16 include a switch element (e.g., MOSFET) and a control circuit. The control circuit of the electronic fuses 15 and 16 is configured to cut off the power supply path by switching the switch element from the on state to the off state when the current value flowing through the power supply path exceeds a preset overcurrent judgment value.

[0048] The control circuits of the electronic fuses 15 and 16 are configured to open or shut off the power supply path by turning on or off the switching elements according to a command from the control unit 11 .

[0049] The slave ECUs 3 and 4 include a control unit 31 , a CAN communication unit 32 , and a storage unit 33 .

[0050] The control unit 31 is an electronic control device centered around a microcomputer having a CPU 41, a ROM 42, and a RAM 43. The various functions of the microcomputer are realized by the CPU 41 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 42 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 41 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 31 may be one or more.

[0051] The CAN communication unit 32 of the slave ECU 3 communicates with a communication device (ie, the master ECU 2 ) connected to the communication bus 6 based on the CAN communication protocol.

[0052] The CAN communication unit 32 of the slave ECU 4 communicates with a communication device (ie, the master ECU 2 ) connected to the communication bus 7 based on the CAN communication protocol.

[0053] The storage unit 33 is a storage device for storing various data.

[0054] The communication system 1 is configured such that the slave ECU 3 and the slave ECU 4 can transmit and receive CAN frames to each other via the master ECU 2 .

[0055] In addition, a power switch 8 is provided in the vehicle cabin. When starting the engine or the motor generator mounted on the vehicle, or when switching the power state of the vehicle, the driver operates the power switch 8. When the power switch 8 is pressed, the power switch 8 outputs a power switch signal indicating that the power switch 8 is pressed.

[0056] The driver starts the engine or the motor generator by pressing the power switch 8 while stepping on the brake pedal of the vehicle.

[0057] In addition, whenever the driver presses the power switch 8 without stepping on the vehicle's brake pedal, the vehicle's power state is switched in the order of power-off state → accessory-on state (hereinafter referred to as ACC-on state) → ignition switch-on state (hereinafter referred to as IG-on state) → power-off state → ...

[0058] The activation table 25 sets the correspondence between the power supply state, the electronic fuse in the on state (hereinafter referred to as the on fuse), and the electronic fuse in the off state (hereinafter referred to as the off fuse).

[0059] The activation table 25 is set, for example, so that when the power supply state is the power-off state, the electronic fuses 15 and 16 are cut-off fuses.

[0060] The activation table 25 is set, for example, so that when the power state is the ACC-on state, the on fuse is the electronic fuse 16 and the electronic fuse 15 is the off fuse.

[0061] The activation table 25 is set, for example, so that when the power supply state is the IG-on state, the electronic fuses 15 and 16 are turned on.

[0062] Next, the procedure of the advance notification process executed by the control unit 11 of the main ECU 2 will be described. The advance notification process is a process that is repeatedly executed when the main ECU 2 is activated.

[0063] If prior notification is performed, Figure 2 As shown, in S10, the CPU 21 of the control unit 11 determines whether to switch the power state of the vehicle based on the input of the power switch signal from the power switch 8. Here, when the power state of the vehicle is not to be switched, the CPU 21 ends the advance notification process.

[0064] On the other hand, when the power supply state of the vehicle is switched, in S20 , the CPU 21 determines the ON fuse and the OFF fuse in the power supply state after the switch based on the activation table 25 .

[0065] In S30, the CPU 21 transmits power supply cut-off notification information notifying that the power supply from the battery 5 via the electronic fuse is cut off and power supply status notification information notifying the power supply status after switching to the slave ECU connected to the conduction fuse. The power supply cut-off notification information includes fuse cut-off determination information that determines the fuse cut-off.

[0066] The slave ECUs 3 and 4 store the power shutoff advance notification information and the fuse cutout determination information received from the master ECU 2 in the storage unit 33 .

[0067] For example, when the cutoff fuse is electronic fuse 15 and the conduction fuse is electronic fuse 16, CPU 21 transmits power cutoff advance notification information and power state notification information to slave ECU 4. The cutoff fuse identification information included in the power cutoff advance notification information indicates that the cutoff fuse is electronic fuse 15.

[0068] In S40 , the CPU 21 turns on the conduction fuse identified in S20 based on the power supply state of the vehicle, turns off the disconnection fuse identified in S20 , and ends the advance notification process.

[0069] Next, a description will be given of a procedure of a post-notification process executed by the control unit 11 of the main ECU 2. The post-notification process is a process that is repeatedly executed when the main ECU 2 is activated.

[0070] If post-notification processing is performed, Figure 3 As shown, in S110, the CPU 21 of the control unit 11 determines whether the electronic fuse is switched to the disconnected state spontaneously. The electronic fuses 15 and 16 are configured to output a disconnection notification signal indicating that they are switched to the disconnected state spontaneously to the main ECU 2 when the current value flowing through the power supply path exceeds the overcurrent judgment value. Therefore, when the CPU 21 receives the disconnection notification signal from the electronic fuses 15 and 16, it determines that the electronic fuses 15 and 16 are switched to the disconnected state spontaneously.

[0071] Here, if there is no electronic fuse that has spontaneously switched to the open state, CPU 21 ends the subsequent notification process.

[0072] On the other hand, if there is an electronic fuse that has spontaneously switched to the disconnected state, in S120, the CPU 21 sends power cut-off post-notification information to the slave ECU connected to the conduction fuse, notifying that the power supply from the battery 5 via the electronic fuse has been cut off, and ends the post-notification processing. The power cut-off post-notification information includes cut-off fuse determination information that determines the cut-off fuse.

[0073] The slave ECUs 3 and 4 store the power-off post-notification information and the fuse-off determination information received from the master ECU 2 in the storage unit 33 .

[0074] Next, the procedure of the interrupt diagnosis invalidation process executed by the control unit 31 of the slave ECU 3 or 4 will be described. The interrupt diagnosis invalidation process is a process that is repeatedly executed during the activation of the slave ECU 3 or 4.

[0075] If the interrupt diagnosis invalid processing is executed, Figure 4 As shown, in S210, the CPU 41 of the control unit 31 determines whether the communication interruption diagnosis information of other nodes is stored in the storage unit 33. The communication interruption diagnosis information of other nodes is information indicating an abnormality that a communication interruption with other nodes has occurred.

[0076] Here, when the communication interruption diagnosis information of other nodes is not stored, the CPU 41 ends the interruption diagnosis invalidation process.

[0077] On the other hand, when communication interruption diagnostic information of other nodes is stored, in S220, CPU41 determines whether power supply cut-off pre-notification information or power supply cut-off post-notification information containing fuse cut-off determination information of electronic fuses connected to other nodes corresponding to the stored communication interruption diagnostic information is stored.

[0078] Here, when the power supply shutoff advance notification information or the power supply shutoff post notification information including the fuse cutoff determination information of the electronic fuse connected to the other node is not stored, the CPU 41 ends the interrupt diagnosis invalidation process.

[0079] On the other hand, when the power cut-off notice information or power cut-off notice information including the fuse cut-off determination information of the electronic fuse connected to other nodes is stored, in S230, the CPU 41 invalidates the communication interruption diagnosis information related to the slave ECU connected to the electronic fuse corresponding to the stored power cut-off notice information or power cut-off notice information, and ends the interruption diagnosis invalidation processing. For example, when the fuse cut-off determination information included in the power cut-off notice information or power cut-off notice information indicates the electronic fuse 15, the CPU 41 invalidates the communication interruption diagnosis information related to the slave ECU 3.

[0080] As the invalidation of the communication interruption diagnostic information, specifically, for example, invalidation information indicating invalidation is added to the communication interruption diagnostic information. Thus, when the fault diagnosis device obtains the communication interruption diagnostic information from the slave ECUs 3 and 4 of the communication system 1, the fault diagnosis device can determine whether the communication interruption diagnostic information should be invalidated based on whether the invalidation information is added to the communication interruption diagnostic information.

[0081] The communication system 1 configured as above includes the slave ECU 3 , the slave ECU 4 , and the master ECU 2 .

[0082] The ECU 3 receives power supply from the battery 5 via the electronic fuse 15 .

[0083] The slave ECU 4 and the slave ECU 3 are connected to each other so as to be able to perform data communication.

[0084] The master ECU 2 is connected to the slave ECU 3 and the slave ECU 4 so as to be data communicable therebetween, and controls the operation of the electronic fuse 15 .

[0085] The master ECU 2 is configured to execute at least one of a pre-notification process and a post-notification process. The pre-notification process is to send power supply cut-off pre-notification information to the slave ECU 4 to notify that the power supply from the battery 5 via the electronic fuse 15 is cut off before the electronic fuse 15 is turned off to cut off the power supply from the battery 5 to the slave ECU 3. The post-notification process is to send power supply cut-off post-notification information to the slave ECU 4 to notify that the power supply from the battery 5 via the electronic fuse 15 is cut off after the electronic fuse 15 is turned off to cut off the power supply from the battery 5 to the slave ECU 3.

[0086] In such a communication system 1, when the power supply to the slave ECU 3 is cut off due to the electronic fuse 15 being in the disconnected state, the master ECU 2 sends at least one of the power cut-off pre-notification information and the power cut-off post-notification information to the slave ECU 4. That is, the communication system 1 can determine whether the electronic fuse 15 is in the disconnected state based on whether the slave ECU 4 stores the power cut-off pre-notification information and the power cut-off post-notification information. Therefore, even if the slave ECU 4 detects an abnormality caused by the electronic fuse 15 being in the disconnected state and related to the slave ECU 3, when the slave ECU 4 stores the power cut-off pre-notification information and the power cut-off post-notification information, it can be regarded that no abnormality has occurred in the slave ECU 3. That is, the communication system 1 can suppress the occurrence of a situation in which an abnormality is determined to have occurred in the slave ECU 3 even though no abnormality has occurred in the slave ECU 3. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0087] The power shutoff pre-notification information and the power shutoff post-notification information include the cut-off fuse identification information for identifying the electronic fuse that has been cut off. Thus, the communication system 1 allows the slave ECU 4 to identify the slave ECU (ie, the slave ECU 3 ) to which the power supply is cut off.

[0088] The slave ECU 4 is configured to invalidate the communication interruption diagnostic information indicating the interruption of communication with the slave ECU 3 when receiving the power cut-off pre-notification information or the power cut-off post-notification information. Thus, even when the communication interruption of the slave ECU 3 is caused by the electronic fuse 15 being in the disconnected state, the communication system 1 can regard it as an abnormality that the communication interruption has not occurred in the slave ECU 3. That is, the communication system 1 can suppress the occurrence of an abnormal situation in which the communication interruption is judged to have occurred in the slave ECU 3 even though the abnormality has not occurred in the slave ECU 3. Thus, the communication system 1 can further improve the abnormality detection accuracy.

[0089] The master ECU 2 is also configured to send power state notification information indicating the changed power state. Thus, the communication system 1 enables the slave ECU 4 to identify the power state after the electronic fuse 15 is in the disconnected state. The slave ECU 4 that receives the power state notification information can perform processing corresponding to the power state indicated by the power state notification information. For example, the slave ECU 4 receives the power state notification information, and when the power state indicated by the received power state notification information is the power disconnected state, the slave ECU 4 performs processing to store the specified data in the storage unit 33.

[0090] In the embodiment described above, the slave ECU 3 is equivalent to the first control device, the battery 5 is equivalent to the power supply, the slave ECU 4 is equivalent to the second control device, the main ECU 2 is equivalent to the switching control unit and the management device, S30 and S120 are equivalent to the processing as the power cut-off notification unit, and S220 and S230 are equivalent to the processing as the invalidation unit.

[0091] [Second embodiment]

[0092] The following and attached Figure 1 A second embodiment of the present disclosure will be described. In the second embodiment, portions different from those of the first embodiment will be described. The same reference numerals are given to common structures.

[0093] The communication system 1 of the second embodiment differs from the first embodiment in that the structure of the communication system 1 is changed, the prior notification process is changed, the master ECU 2 does not execute the post notification process, the slave ECUs 3 and 4 do not execute the interrupt diagnosis invalidation process, and the monitoring management process is added.

[0094] like Figure 5As shown, the communication system 1 of the second embodiment is different from the first embodiment in that the configuration of the master ECU 2 is changed and the slave ECU 9 is added.

[0095] The main ECU 2 of the second embodiment is different from the first embodiment in that the CAN communication unit 12 is omitted and the electronic fuse 17 is added.

[0096] The slave ECU 9 includes a control unit 31 , a CAN communication unit 32 , and a storage unit 33 , similarly to the slave ECUs 3 and 4 .

[0097] The CAN communication unit 13 is connected to the CAN communication units 32 of the slave ECUs 3 , 4 , and 9 via the communication bus 7 .

[0098] The electronic fuse 17 is disposed on the power supply path between the battery 5 and the slave ECU 9. The control circuit of the electronic fuse 17 is configured to open or close the power supply path by turning on or off the switch element according to a command from the control unit 11.

[0099] Next, the procedure of the advance notification process according to the second embodiment will be described.

[0100] If the prior notification process of the second embodiment is executed, Figure 6 As shown, in S310, the CPU 21 of the control unit 11 determines whether to switch the power state of the vehicle based on the input of the power switch signal from the power switch 8. Here, when the power state of the vehicle is not switched, the CPU 21 ends the advance notification process.

[0101] On the other hand, when the power state of the vehicle is switched, in S320 , CPU 21 determines, based on activation table 25 , whether the fuse is turned on or off for each electronic fuse 15 , 16 , 17 in the switched power state.

[0102] In S330, CPU 21 transmits fuse state information to slave ECUs 3, 4, 9. The fuse state information indicates whether each electronic fuse 15, 16, 17 is turned on or off.

[0103] In S340 , CPU 21 turns on the conduction fuse identified in S320 . For example, when CPU 21 determines in S320 that electronic fuse 15 is a conduction fuse, CPU 21 turns on electronic fuse 15 .

[0104] In S350, after the fuse state information is sent in S330, the CPU 21 turns the cut-off fuse determined in S320 to an open state after the preset cut-off standby time has passed, and ends the advance notification process. In addition, the cut-off standby time for the electronic fuses 15 to 17 may be the same, or different values ​​may be set for each electronic fuse 15 to 17 according to the slave ECUs 3, 4, and 9 connected to the electronic fuses 15, 16, and 17. The cut-off standby time is set to be greater than the maximum value of the predicted time of the communication delay.

[0105] Next, the procedure of the monitoring management process executed by the control unit 31 of the slave ECU 3, 4, 9 will be described. The monitoring management process is a process that is repeatedly executed when the slave ECU 3, 4, 5 is activated.

[0106] If monitoring management processing is performed, Figure 7 As shown, in S410, CPU 41 of control unit 31 determines whether fuse state information has been received from main ECU 2. Here, if fuse state information has not been received, CPU 41 ends the monitoring management process.

[0107] On the other hand, when the fuse state information is received, in S420 the CPU 41 stops the communication interruption monitoring for monitoring whether the communication with the other nodes connected to the disconnected fuse indicated by the fuse state information is interrupted.

[0108] In the communication interruption monitoring, when the CAN frame sent from other nodes is not sent for more than the preset abnormality determination time, the CPU 41 stores the communication interruption diagnosis information indicating that the communication interruption abnormality has occurred in other nodes. The abnormality determination time is set to a time longer than the frame transmission cycle of the CAN frame sent by other nodes.

[0109] In S430, the CPU 41 starts the above-mentioned communication interruption monitoring for other nodes connected to the conduction fuse represented by the fuse status information after the monitoring standby time preset for the other nodes has passed, and ends the monitoring management processing. The monitoring standby time is set to be longer than the time required for the corresponding other nodes to start up and become able to communicate.

[0110] Next, a specific example of starting or stopping the communication interruption monitoring will be described.

[0111] like Figure 8 As shown, at time t0 , the electronic fuses 15 , 16 are in the open state, and the slave ECU 9 does not perform communication interruption monitoring of the slave ECUs 3 , 4 .

[0112] At time t1, main ECU 2 turns on electronic fuse 15. Main ECU 2 also transmits fuse state information indicating that electronic fuse 15 is turned on and electronic fuse 16 is turned off.

[0113] At time t2 when monitoring standby time MT1 has elapsed since receiving fuse state information, slave ECU 9 starts monitoring of communication interruption of slave ECU 3. Monitoring standby time MT1 is set to be longer than the time required for slave ECU 3 to start and become communicable.

[0114] At time t3, main ECU 2 turns on electronic fuse 16. In addition, main ECU 2 transmits fuse state information indicating that electronic fuses 15 and 16 are turned on.

[0115] At time t4 when monitoring standby time MT2 has elapsed since receiving fuse state information, slave ECU 9 starts monitoring of communication interruption of slave ECU 4. Monitoring standby time MT2 is set to be longer than the time required for slave ECU 4 to start and become communicable.

[0116] At time t5, main ECU 2 decides to open electronic fuse 15. Main ECU 2 then transmits fuse state information indicating that electronic fuse 15 is a cut fuse and electronic fuse 16 is a conduction fuse.

[0117] When the slave ECU 9 receives the fuse state information at time t6 , it stops the communication interruption monitoring of the slave ECU 3 .

[0118] At time t7 when the disconnection waiting time CT1 has elapsed from time t5 , the main ECU 2 sets the electronic fuse 15 to the open state.

[0119] At time t8, the main ECU 2 decides to open the electronic fuse 16. The main ECU 2 then transmits fuse state information indicating that the electronic fuses 15 and 16 are cut fuses.

[0120] When the slave ECU 9 receives the fuse state information at time t9, the slave ECU 9 stops the communication interruption monitoring by the slave ECU 4 .

[0121] At time t10 when the disconnection standby time CT2 has elapsed from time t8 , the main ECU 2 sets the electronic fuse 16 to the open state.

[0122] In the communication system 1 thus configured, the master ECU 2 transmits fuse state information notifying the slave ECU 4 to turn the electronic fuse 15 into the open state before the electronic fuse 15 turns into the open state to cut off the power supply from the battery 5 to the slave ECU 3. The master ECU 2 is further configured to turn the electronic fuse 15 into the open state after a preset disconnection standby time has passed after the fuse state information is sent.

[0123] In such a communication system 1, the master ECU 2 sets the electronic fuse 15 to the disconnected state after the disconnection standby time has passed after the fuse state information is sent to the slave ECU 4. Therefore, even if the communication delay occurs in the communication system 1 and the fuse state information is delayed in reaching the slave ECU 4, the electronic fuse 15 can be prevented from being disconnected before the fuse state information reaches the slave ECU 4. That is, the communication system 1 can prevent the occurrence of an abnormality in which the communication interruption is judged to have occurred in the slave ECU 3 even though the abnormality of the communication interruption has not occurred in the slave ECU 3. As a result, the communication system 1 can improve the accuracy of abnormality detection.

[0124] In addition, the slave ECU 4 is further configured to stop the communication interruption monitoring of the slave ECU 3 when receiving the fuse state information notifying that the electronic fuse 15 is in the disconnected state. In such a communication system 1, since the slave ECU 4 quickly stops the communication interruption monitoring of the slave ECU 3, it is possible to further suppress the occurrence of an abnormality in which the communication interruption is judged to have occurred in the slave ECU 3 even though the abnormality of the communication interruption has not occurred in the slave ECU 3.

[0125] In addition, the master ECU 2 is configured to send fuse state information notifying the slave ECU 4 that the electronic fuse 15 is turned on when the electronic fuse 15 is turned on. The slave ECU 4 is configured to start monitoring from the slave ECU 3 after a preset monitoring standby time has passed after receiving the fuse state information. In such a communication system 1, the slave ECU 4 can start monitoring from the slave ECU 3 after the electronic fuse 15 is turned on and the slave ECU 3 is started to be able to communicate. Therefore, the communication system 1 can further suppress the occurrence of an abnormal situation in which it is determined that the slave ECU 3 has an abnormal communication interruption although the abnormal communication interruption has not occurred in the slave ECU 3.

[0126] In the above-described embodiment, S330 corresponds to processing as a power shutoff notification unit, fuse status information corresponds to power shutoff advance notification information and power on notification information, S350 corresponds to processing as a shutoff unit, and S420 corresponds to processing as a monitoring suspension unit.

[0127] [Third Embodiment]

[0128] The following and attached Figure 1The third embodiment of the present disclosure will be described. In the third embodiment, the parts different from the first embodiment will be described. The same reference numerals are given to the common structures.

[0129] The communication system 1 of the third embodiment is as follows Fig.10 As shown, the present invention is different from the first embodiment in that a smart sensor 501 , a smart actuator 502 , a wireless device 503 , electronic fuses 504 and 505 , and a slave ECU 506 are added.

[0130] The smart sensor 501 is a sensor having a communication function and is connected to the communication bus 6 .

[0131] The smart actuator 502 is an actuator having a communication function and is connected to the communication bus 6 .

[0132] The wireless device 503 is a wireless communication device for wirelessly communicating with an external communication device installed outside the vehicle. The wireless device 503 is, for example, a DCM. DCM is an abbreviation of Data Communication Module.

[0133] The electronic fuse 504 is disposed on the power supply path between the battery 5 and the smart sensor 501 . The electronic fuse 505 is disposed on the power supply path between the battery 5 and the smart actuator 502 .

[0134] The electronic fuses 504 and 505 are each configured to switch to either an on state for conducting the power supply path or an off state for interrupting the power supply path in accordance with a command from the control unit 11 .

[0135] Hereinafter, the master ECU 2 , the slave ECUs 3 to 5 , the smart sensor 501 , the smart actuator 502 , and the slave ECU 506 are also collectively referred to as a node.

[0136] (Prerequisites)

[0137] The master ECU 2 and the slave ECU 506 are always powered from the battery 5 without an electronic fuse, and can switch to the awake state or the sleep state independently at the node. Hereinafter, the master ECU 2 and the slave ECU 506 are also referred to as NM-equipped nodes. NM-equipped nodes are nodes that have the function of generating NM frames.

[0138] The slave ECU 3, 4, smart sensor 501 and smart actuator 502 are powered via the electronic fuse, and the node cannot switch to the awake state or the sleep state alone. In other words, the awake state is reached when the electronic fuse is turned on, and the sleep state is reached when the electronic fuse is turned off. Hereinafter, the slave ECU 3, the slave ECU 4, the smart sensor 501 and the smart actuator 502 are also referred to as NM non-equipped nodes. NM non-equipped nodes refer to nodes that do not have the function of generating and interpreting NM frames.

[0139] The NM non-mounted node includes at least one of an actuator and a sensor in addition to the ECU having a control function.

[0140] The power supply paths of the NM non-mounted nodes are connected to the electronic fuses 15 , 16 , 504 , and 505 of the main ECU 2 , respectively.

[0141] The NM non-mounted nodes and the electronic fuse may be connected one-to-one, or multiple NM non-mounted nodes belonging to the same cluster (ie, a group started at the same time) may be connected under one electronic fuse.

[0142] The main ECU 2 and the NM-mounted node have a CAN communication unit and can transmit and receive NM frames.

[0143] The NM-equipped node determines whether to be in the awake state or the sleep state based on the NM frame transmitted and received via the communication bus.

[0144] The main ECU 2 turns on or off the electronic fuses 15 , 16 , 504 , and 505 connected to the NM non-mounted nodes based on the NM frames transmitted and received via the communication bus.

[0145] One or more bits of information indicating which cluster is activated are stored in the payload (ie, data area) of the NM frame transmitted and received between the main ECU 2 and the NM-equipped node.

[0146] One or more main ECUs (ie, ECUs having built-in electronic fuses) are mounted on a vehicle.

[0147] like Fig.11 As shown, the system developer predetermines one or more nodes belonging to each cluster. Although clusters can be assigned to each node, multiple nodes can be registered in one cluster. When the bit corresponding to each cluster is activated (i.e., bit = 1), the cluster is awakened. In the case of the main ECU, awakening means turning the electronic fuse on.

[0148] (First startup example)

[0149] The first activation case is an operation example of performing a fault diagnosis of the slave ECU 3 in response to a request from the cloud.

[0150] First, a connection request is sent from the base station (ie, cloud) side to the wireless device 503 of the vehicle.

[0151] Next, if the wireless device 503 determines that the connection is valid, it transmits the event received from the cloud to the main ECU 2 .

[0152] Next, the master ECU 2 determines a service called “failure diagnosis of the slave ECU 3 ” based on the event, and generates an NM frame that validates only the bit of the third cluster to which the slave ECU 3 belongs in order to activate the slave ECU 3 .

[0153] Next, the main ECU 2 sends the generated NM frame to the communication buses 6 , 7 .

[0154] Since there are no NM-equipped nodes belonging to the third cluster on the communication buses 6 and 7, there is no change in the devices on the communication buses.

[0155] Next, it is assumed that the main ECU 2 receives an NM frame in which the bit of the third cluster is enabled at the same time as described above, and the control unit 11 executes processing based on the NM frame.

[0156] Next, when the control unit 11 of the main ECU 2 determines to issue a wake-up instruction to the third cluster, the electronic fuse 15 is turned on because the third cluster includes the electronic fuse 15 .

[0157] When the electronic fuse 15 is turned on, power is supplied to the downstream slave ECU 3 to activate it.

[0158] The master ECU 2 waits for the slave ECU 3 to be started, requests the slave ECU 3 to send a diagnosis code, and transmits the response result from the slave ECU 3 to the base station via the wireless device 503 .

[0159] (Second startup example)

[0160] The second activation example is an operation example of performing a fault diagnosis of the slave ECU 506 in response to a request from the cloud.

[0161] First, a connection request is sent from the base station (ie, cloud) side to the wireless device 503 of the vehicle.

[0162] Next, if the wireless device 503 determines that the connection is valid, it transmits the event received from the cloud to the main ECU 2 .

[0163] Next, the master ECU 2 determines a service called “failure diagnosis of the slave ECU 506 ” based on the event, and generates an NM frame that validates only the bit of the fourth cluster to which the slave ECU 506 belongs in order to activate the slave ECU 506 .

[0164] Next, the main ECU 2 sends the generated NM frame to the communication buses 6 , 7 .

[0165] Since there is the slave ECU 506 as a node belonging to the fourth cluster on the communication bus 6 , the slave ECU 506 is awakened.

[0166] Next, it is assumed that the main ECU 2 receives an NM frame in which the bit of the fourth cluster is made valid at the same time as described above, and the control unit 11 executes processing based on the NM frame.

[0167] Next, even if the control unit 11 of the main ECU 2 determines to issue a wake-up instruction to the fourth cluster based on the NM frame, the instruction is ignored because the fourth cluster does not include a corresponding electronic fuse.

[0168] When the slave ECU 506 is activated, the master ECU 2 requests a diagnostic code from the slave ECU 506 via the communication bus, and transmits a response result from the slave ECU 506 to the base station via the wireless device 503 .

[0169] (Third startup example)

[0170] The third activation example is an action example in which a user remotely activates the air conditioner via a smartphone.

[0171] First, the user instructs the car's air conditioner to turn on from the smartphone.

[0172] The wireless device 503 receives the instruction signal from the smartphone. If the wireless device 503 determines that the instruction signal is valid, it transmits the event (ie, instruction signal) received from the cloud to the main ECU 2 .

[0173] The main ECU 2 determines the "air conditioning service" based on the event, and generates an NM frame for activating the second cluster as a cluster for air conditioning.

[0174] The main ECU 2 periodically sends the generated NM frame to the communication buses 6 and 7 until the air conditioner stop instruction is issued. If the activation state is to be continued, the NM frame needs to be sent periodically. At the same time, the control unit 11 of the main ECU 2 executes processing based on the NM frame.

[0175] When an NM frame for activating the second cluster is generated on the communication bus 6 , the slave ECU 506 (ie, the air-conditioning ECU) belonging to the second cluster receives the NM frame and wakes up according to the received NM frame.

[0176] When detecting that the second cluster is activated, the control unit 11 of the main ECU 2 turns on the electronic fuses 504 and 505 belonging to the second cluster.

[0177] When the electronic fuse 504 and the electronic fuse 505 are turned on, power is supplied to the smart sensor 501 (ie, temperature sensor) and the smart actuator 502 (ie, compressor).

[0178] As described above, the air conditioning ECU, the smart sensor 501 and the smart actuator 502 are powered on, and the vehicle air conditioning can be turned on.

[0179] When the user instructs to turn off the vehicle air conditioner from the smartphone, the main ECU 2 stops the periodic transmission of the NM frame.

[0180] If the NM frame is interrupted, the slave ECU 506 enters the sleep state, and the master ECU 2 disconnects the electronic fuse 504 and the electronic fuse 505. As a result, the vehicle air conditioner stops.

[0181] (Fourth startup example)

[0182] The fourth activation example is an operation example in which the vehicle air conditioner is activated from the ECU 506 .

[0183] Since slave ECU 506 always supplies power even when the vehicle is stopped, even when the vehicle is in sleep mode, it is possible to detect input of a signal indicating that a start switch connected to slave ECU 506 is turned on and wake up.

[0184] When the awakened slave ECU 506 confirms an input to activate the vehicle air conditioner, it generates an NM frame that activates a bit corresponding to the second cluster.

[0185] The slave ECU 506 transmits the generated NM frame via the CAN communication unit 32. When the master ECU 2 receives the NM frame, the master ECU 2 turns on the electronic fuses 504 and 505 belonging to the second cluster.

[0186] When the start switch of the vehicle air conditioner is turned off, the slave ECU 506 stops sending the NM frame and enters the sleep state after a while.

[0187] If the NM frame is interrupted, the main ECU 2 will soon open the electronic fuses 504 and 505 and terminate the control.

[0188] When the master ECU 2 determines that control needs to be continued even after the transmission of the NM frame stops, the master ECU 2 transmits an NM frame that activates the bit corresponding to the second cluster. Thus, the slave ECU 506, the smart sensor 501, and the smart actuator 502 can also remain activated until the transmission of the NM frame generated by the master ECU 2 stops.

[0189] [Fourth Embodiment]

[0190] The following and attached Figure 1A fourth embodiment of the present disclosure will now be described.

[0191] The communication system 100 of the fourth embodiment is installed in a vehicle. Fig.12 As shown, it includes a central ECU 101, upstream power distribution units 102, 103, regional ECUs 104, 105, 106, 107, slave ECUs 108, 109, 110, 111, 112, 113, 114, 115, 116, and a battery 117. Hereinafter, the central ECU 101, regional ECUs 104 to 107, and slave ECUs 108 to 116 are collectively referred to as nodes.

[0192] The battery 117 supplies power to various parts of the vehicle at a DC battery voltage (eg, 12 V). The central ECU 101 , the upstream power distribution units 102 , 103 , the area ECUs 104 to 107 , and the slave ECUs 108 to 116 receive power from the battery 117 to operate.

[0193] The upstream power distribution unit 102 receives power supply from the battery 117 via a power supply path 121 between the battery 117 and the upstream power distribution unit 102 .

[0194] The upstream power distribution unit 103 receives power supply from the battery 117 via a power supply path 122 between the battery 117 and the upstream power distribution unit 103 .

[0195] The regional ECUs 104 and 105 receive power supply from the battery 117 through power supply paths 123 and 124 between the upstream power distribution unit 102 and the regional ECUs 104 and 105 , respectively.

[0196] The regional ECUs 106 and 107 receive power supply from the battery 117 through power supply paths 125 and 126 between the upstream power distribution unit 103 and the regional ECUs 106 and 107 , respectively.

[0197] The slave ECUs 108 and 109 receive electric power from the battery 117 through power supply paths 127 and 128 between the zone ECU 104 and the slave ECUs 108 and 109 , respectively.

[0198] The slave ECUs 110 and 111 are supplied with electric power from the battery 117 through power supply paths 129 and 130 between the zone ECU 105 and the slave ECUs 110 and 111 , respectively.

[0199] The slave ECUs 112 , 113 , 114 receive electric power from a battery 117 through power supply paths 131 , 132 , 133 between the area ECU 106 and the slave ECUs 112 , 113 , 114 , respectively.

[0200] The slave ECUs 115 and 116 are supplied with electric power from a battery 117 through power supply paths 134 and 135 between the area ECU 107 and the slave ECUs 115 and 116 , respectively.

[0201] The central ECU 101 and the upstream power distribution unit 102 are connected via a communication line 141 so as to be able to perform data communication with each other.

[0202] The central ECU 101 and the upstream power distribution unit 103 are connected via a communication line 142 so as to be able to perform data communication with each other.

[0203] The central ECU 101 and the regional ECUs 104 , 105 , 106 , and 107 are connected via communication lines 143 , 144 , 145 , and 146 , respectively, so as to be able to perform data communication with each other.

[0204] The area ECU 104 and the slave ECUs 108 and 109 are connected via a communication bus 147 so as to be able to perform data communication with each other.

[0205] The area ECU 105 and the slave ECUs 110 and 111 are connected via a communication bus 148 so as to be able to perform data communication with each other.

[0206] The area ECU 106 and the slave ECUs 112 , 113 , and 114 are connected via a communication bus 149 so as to be able to perform data communication with each other.

[0207] The area ECU 107 and the slave ECUs 115 and 116 are connected via a communication bus 150 so as to be able to perform data communication with each other.

[0208] like Fig.13 As shown, the central ECU 101 includes a control unit 151 , communication units 152 , 153 , 154 , 155 , 156 , 157 , and a storage unit 158 ​​.

[0209] The control unit 151 is an electronic control device centered around a microcomputer having a CPU 161, a ROM 162, and a RAM 163. The various functions of the microcomputer are realized by the CPU 161 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 162 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 161 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 151 may be one or more.

[0210] The communication unit 152 communicates with the upstream power distribution unit 102 connected to the communication line 141 by sending and receiving communication frames based on, for example, the Ethernet communication protocol. Ethernet is a registered trademark.

[0211] The communication unit 153 communicates with the upstream power distribution unit 103 connected to the communication line 142 by sending and receiving communication frames based on the Ethernet communication protocol, for example.

[0212] The communication unit 154 communicates with the zone ECU 104 connected to the communication line 143 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0213] The communication unit 155 communicates with the zone ECU 105 connected to the communication line 144 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0214] The communication unit 156 communicates with the zone ECU 106 connected to the communication line 145 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0215] The communication unit 157 communicates with the zone ECU 107 connected to the communication line 145 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0216] The storage unit 158 ​​is a storage device for storing various data. The storage unit 158 ​​stores a startup table 165 described later.

[0217] The upstream power distribution unit 102 includes a control circuit 171 , a communication unit 172 , and electronic fuses 173 and 174 .

[0218] The control circuit 171 performs control to switch the electronic fuses 173 and 174 between the on state and the off state based on an instruction received from the central ECU 101 via the communication unit 172 .

[0219] The communication unit 172 communicates with the central ECU 101 connected to the communication line 141 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0220] The electronic fuse 173 is disposed between the power supply path 121 and the power supply path 123. The electronic fuse 174 is disposed between the power supply path 121 and the power supply path 124.

[0221] The upstream power distribution unit 103 includes a control circuit 181 , a communication unit 182 , and electronic fuses 183 and 184 .

[0222] The control circuit 181 performs control to switch the electronic fuses 183 and 184 between the on state and the off state based on an instruction received from the central ECU 101 via the communication unit 182 .

[0223] The communication unit 182 communicates with the central ECU 101 connected to the communication line 142 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0224] The electronic fuse 183 is disposed between the power supply path 122 and the power supply path 125. The electronic fuse 184 is disposed between the power supply path 122 and the power supply path 126.

[0225] like Fig.14 As shown, the zone ECU 104 includes a control unit 191 , a communication unit 192 , a CAN communication unit 193 , a storage unit 194 , and electronic fuses 195 and 196 .

[0226] The control unit 191 is an electronic control device centered around a microcomputer having a CPU 201, a ROM 202, and a RAM 203. The various functions of the microcomputer are realized by the CPU 201 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 202 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 201 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 191 may be one or more.

[0227] The communication unit 192 communicates with the central ECU 101 connected to the communication line 143 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0228] The CAN communication unit 193 communicates with the slave ECUs 108 and 109 connected to the communication bus 147 by sending and receiving communication frames based on the CAN communication protocol.

[0229] The storage unit 194 is a storage device for storing various data. The storage unit 194 stores a startup table 205 described later.

[0230] The electronic fuse 195 is disposed between the power supply path 123 and the power supply path 127. The electronic fuse 196 is disposed between the power supply path 123 and the power supply path 128.

[0231] The zone ECU 105 includes a control unit 211 , a communication unit 212 , a CAN communication unit 213 , a storage unit 214 , and electronic fuses 215 and 216 .

[0232] The control unit 211 is an electronic control device centered around a microcomputer having a CPU 221, a ROM 222, and a RAM 223. The various functions of the microcomputer are realized by the CPU 221 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 222 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 221 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 211 may be one or more.

[0233] The communication unit 212 communicates with the central ECU 101 connected to the communication line 144 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0234] The CAN communication unit 213 communicates with the slave ECUs 110 and 111 connected to the communication bus 148 by sending and receiving communication frames based on the CAN communication protocol.

[0235] The storage unit 214 is a storage device for storing various data. The storage unit 214 stores a startup table 225 described later.

[0236] The electronic fuse 215 is disposed between the power supply path 124 and the power supply path 129. The electronic fuse 216 is disposed between the power supply path 124 and the power supply path 130.

[0237] like Fig.15 As shown, the zone ECU 106 includes a control unit 231 , a communication unit 232 , a CAN communication unit 233 , a storage unit 234 , and electronic fuses 235 , 236 , and 237 .

[0238] The control unit 231 is an electronic control device centered around a microcomputer having a CPU 241, a ROM 242, and a RAM 243. The various functions of the microcomputer are realized by the CPU 241 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 242 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 241 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 231 may be one or more.

[0239] The communication unit 232 communicates with the central ECU 101 connected to the communication line 145 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0240] The CAN communication unit 233 communicates with the slave ECUs 112 , 113 , and 114 connected to the communication bus 149 by sending and receiving communication frames based on the CAN communication protocol.

[0241] The storage unit 234 is a storage device for storing various data. The storage unit 234 stores a startup table 245 described later.

[0242] The electronic fuse 235 is disposed between the power supply path 125 and the power supply path 131. The electronic fuse 236 is disposed between the power supply path 125 and the power supply path 132. The electronic fuse 237 is disposed between the power supply path 125 and the power supply path 133.

[0243] The zone ECU 107 includes a control unit 251 , a communication unit 252 , a CAN communication unit 253 , a storage unit 254 , and electronic fuses 255 and 256 .

[0244] The control unit 251 is an electronic control device centered around a microcomputer having a CPU 261, a ROM 262, and a RAM 263. The various functions of the microcomputer are realized by the CPU 261 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 262 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions performed by the CPU 261 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 251 may be one or more.

[0245] The communication unit 252 communicates with the central ECU 101 connected to the communication line 146 by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0246] The CAN communication unit 253 communicates with the slave ECUs 115 and 116 connected to the communication bus 150 by sending and receiving communication frames based on the CAN communication protocol.

[0247] The storage unit 254 is a storage device for storing various data. The storage unit 254 stores a startup table 265 described later.

[0248] The electronic fuse 255 is disposed between the power supply path 126 and the power supply path 134. The electronic fuse 256 is disposed between the power supply path 126 and the power supply path 135.

[0249] like Fig.16 As shown, the slave ECUs 108 and 109 include a control unit 271 , a CAN communication unit 272 , and a storage unit 273 .

[0250] The control unit 271 is an electronic control device centered around a microcomputer having a CPU 281, a ROM 282, and a RAM 283. The various functions of the microcomputer are realized by the CPU 281 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 282 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions performed by the CPU 281 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 271 may be one or more.

[0251] The CAN communication unit 272 communicates with the area ECU 104 connected to the communication bus 147 based on the CAN communication protocol.

[0252] The storage unit 273 is a storage device for storing various data. The storage unit 273 stores a startup table 285 described later.

[0253] The slave ECUs 110 and 111 include a control unit 291 , a CAN communication unit 292 , and a storage unit 293 .

[0254] The control unit 291 is an electronic control device centered around a microcomputer having a CPU 301, a ROM 302, and a RAM 303. The various functions of the microcomputer are realized by the CPU 301 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 302 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 301 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 291 may be one or more.

[0255] The CAN communication unit 292 communicates with the area ECU 105 connected to the communication bus 148 based on the CAN communication protocol.

[0256] The storage unit 293 is a storage device for storing various data. The storage unit 293 stores a startup table 305 described later.

[0257] The slave ECUs 112 , 113 , and 114 include a control unit 311 , a CAN communication unit 312 , and a storage unit 313 .

[0258] The control unit 311 is an electronic control device centered around a microcomputer having a CPU 321, a ROM 322, and a RAM 323. The various functions of the microcomputer are realized by the CPU 321 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 322 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 321 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 311 may be one or more.

[0259] The CAN communication unit 312 communicates with the area ECU 106 connected to the communication bus 149 based on the CAN communication protocol.

[0260] The storage unit 313 is a storage device for storing various data. The storage unit 313 stores a startup table 325 described later.

[0261] The slave ECUs 115 and 116 include a control unit 331 , a CAN communication unit 332 , and a storage unit 333 .

[0262] The control unit 331 is an electronic control device centered around a microcomputer having a CPU 341, a ROM 342, and a RAM 343. The various functions of the microcomputer are realized by the CPU 341 executing a program stored in a non-migrating physical recording medium. In this example, the ROM 342 is equivalent to a non-migrating physical recording medium storing the program. In addition, the method corresponding to the program is executed by executing the program. In addition, a part or all of the functions executed by the CPU 341 may be constituted in hardware by one or more ICs, etc. In addition, the number of microcomputers constituting the control unit 331 may be one or more.

[0263] The CAN communication unit 332 communicates with the area ECU 107 connected to the communication bus 150 based on the CAN communication protocol.

[0264] The storage unit 333 is a storage device for storing various data. The storage unit 333 stores a startup table 345 described later.

[0265] In the activation tables 165, 205, 225, 245, 265, 285, 305, 325, and 345, a communication group to be activated (ie, an activation group) is set for each event. Incidentally, an event also includes a power supply state of a vehicle.

[0266] The activation table 165 of the central ECU 101 also sets a correspondence between the activation group and the electronic fuses to be turned on among all the electronic fuses 173 , 174 , 183 , 184 , 195 , 196 , 215 , 216 , 235 , 236 , 237 , 255 , 256 included in the communication system 100 .

[0267] When the power supply state of the vehicle is switched ( S10 ), the central ECU 101 determines the ON fuse and the OFF fuse in the power supply state after the switch based on the activation table 165 ( S20 ).

[0268] Then, the central ECU 101 instructs the area ECUs 104 to 107 to turn on the identified conduction fuses and turn off the identified disconnection fuses.

[0269] The area ECUs 104 to 107 transmit power cut-off notification information and power state notification information to subordinate slave ECUs before disconnecting subordinate electronic fuses based on instructions from the central ECU 101 (S30). The power cut-off notification information includes fuse disconnection determination information.

[0270] The slave ECUs 108 to 116 store the received advance power shutoff notification information and power state notification information.

[0271] After transmitting the power-off advance notification information and the power-state notification information to the subordinate slave ECUs, the area ECUs 104 to 107 turn on or off the subordinate electronic fuses based on the instruction from the central ECU 101 ( S40 ).

[0272] When the subordinate electronic fuse is switched to the disconnected state spontaneously (S110), the area ECUs 104 to 107 transmit power-off post-notification information to the subordinate slave ECUs (S120). The power-off post-notification information includes fuse disconnection determination information.

[0273] The slave ECUs 108 to 116 store the received power shutoff post-notification information and fuse shutoff determination information.

[0274] The communication system 100 configured in this manner includes a slave ECU 108 , a slave ECU 109 , a central ECU 101 , and a regional ECU 104 .

[0275] The ECU 108 receives power from the battery 117 via the electronic fuse 195 .

[0276] The slave ECU 109 is connected to be able to perform data communication with the slave ECU 108 .

[0277] The central ECU 101 and the regional ECU 104 are configured to execute switching control for switching the electronic fuse 195 to an on state or an off state.

[0278] The area ECU 104 is configured to execute at least one of a pre-notification process and a post-notification process. The pre-notification process is to transmit power supply cut-off pre-notification information to the slave ECU 109 to notify that the power supply from the battery 117 via the electronic fuse 195 is cut off before the electronic fuse 195 is turned off to cut off the power supply from the battery 117 to the slave ECU 108. The post-notification process is to transmit power supply cut-off post-notification information to the slave ECU 109 to notify that the power supply from the battery 117 via the electronic fuse 195 is cut off after the electronic fuse 195 is turned off to cut off the power supply from the battery 117 to the slave ECU 108.

[0279] The slave ECU 109 is configured to store the received power-off pre-notification information and power-off post-notification information.

[0280] In such a communication system 100, when the power supply to the slave ECU 108 is cut off due to the electronic fuse 195 being in the open state, the central ECU 101 and the regional ECU 104 transmit at least one of the power cut-off notice information and the power cut-off post-notification information to the slave ECU 109. That is, the communication system 100 can determine whether the electronic fuse 195 is in the open state based on whether the slave ECU 109 stores the power cut-off notice information and the power cut-off post-notification information. Therefore, even if the slave ECU 109 detects an abnormality caused by the electronic fuse 195 being in the open state and related to the slave ECU 108, the communication system 100 can regard that no abnormality has occurred in the slave ECU 108 when the slave ECU 109 stores the power cut-off notice information and the power cut-off post-notification information. That is, the communication system 100 can suppress the occurrence of a situation in which the slave ECU 108 determines that an abnormality has occurred although no abnormality has occurred in the slave ECU 108. As a result, the communication system 100 can improve the accuracy of abnormality detection.

[0281] In the above-described embodiment, the slave ECU 108 corresponds to the first control device, the battery 117 corresponds to the power supply, the slave ECU 109 corresponds to the second control device, the central ECU 101 and the regional ECU 104 correspond to the switching control unit, and the regional ECU 104 corresponds to the power off notification unit.

[0282] [Fifth Embodiment]

[0283] The following and attached Figure 1A fifth embodiment of the present disclosure will be described. In the fifth embodiment, the parts different from the fourth embodiment will be described. The same reference numerals are given to the common structures.

[0284] When the power supply state of the vehicle is switched ( S10 ), the central ECU 101 determines the ON fuse and the OFF fuse in the power supply state after the switch based on the activation table 165 ( S20 ).

[0285] The central ECU 101 transmits the power-off advance notification information and the power-state notification information to the slave ECUs 108 to 116 using the area ECUs 104 to 107 as relays (S30). The power-off advance notification information includes the fuse-cut determination information.

[0286] The slave ECUs 108 to 116 store the received advance power shutoff notification information and power state notification information.

[0287] The central ECU 101 instructs the area ECUs 104 to 107 to turn on the identified conduction fuse and to turn off the identified disconnection fuse.

[0288] The area ECUs 104 to 107 turn the subordinate electronic fuses to the on state or the off state based on the instruction from the central ECU 101 ( S40 ).

[0289] When the subordinate electronic fuses are spontaneously switched to the open state (S110), the area ECUs 104 to 107 transmit power-off post-notification information to the central ECU 101. The power-off post-notification information includes fuse-off determination information.

[0290] When receiving the power-off post-notification information from the regional ECUs 104 to 107 , the central ECU 101 transmits the power-off post-notification information to the slave ECUs 108 to 116 using the regional ECUs 104 to 107 as relays ( S120 ).

[0291] The slave ECUs 108 to 116 store the received power shutoff post-notification information and fuse shutoff determination information.

[0292] When the slave ECUs 108 to 116 store the communication interruption diagnosis information of other nodes and store the power outage advance notification information or the power outage post notification information of other nodes, the slave ECUs 108 to 116 invalidate the communication interruption diagnosis information on the other nodes.

[0293] In the communication system 100 configured in this manner, the central ECU 101 is configured to execute at least one of the prior notification process and the subsequent notification process.

[0294] Such a communication system 100 can obtain the same effects as the communication system 100 of the third embodiment.

[0295] In the above-described embodiment, the central ECU 101 corresponds to the power cutoff notification unit.

[0296] As mentioned above, although one embodiment of the present disclosure has been described, the present disclosure is not limited to the above-mentioned embodiment, and can be implemented with various modifications.

[0297] [Modification 1]

[0298] In the above-mentioned embodiment, a mode in which both the prior notification process and the subsequent notification process are executed is shown, but either the prior notification process or the subsequent notification process may be executed.

[0299] [Modification 2]

[0300] In the above embodiment, the slave ECUs 3 and 4 are connected to the master ECU 2 via the communication buses 6 and 7 , but the slave ECUs 3 and 4 may be connected to the master ECU 2 via magnetic lines of force.

[0301] [Variation 3]

[0302] In the above embodiment, the driver starts the engine or the motor generator by pressing the power switch 8 while stepping on the brake pedal of the vehicle. However, the engine or the motor generator may be started when a person holding a key or a smartphone approaches the vehicle.

[0303] [Variation 4]

[0304] In the above embodiment, a method for determining whether to turn on the fuse and to turn off the fuse based on the power supply state of the vehicle is shown. However, the determination of whether to turn on the fuse and to turn off the fuse may also be based on whether the vehicle is in motion or in a passenger. For example, when a user holding a smart key unlocks the door of the vehicle, it may be determined that the vehicle is in a passenger. In addition, when the gear position of the vehicle is "D" (i.e., "driving") and the vehicle speed is greater than 0 km / h, it may be determined that the vehicle is in motion.

[0305] like Fig. 9 As shown, at time t0, the vehicle is neither traveling nor in use, so the electronic fuses 15 and 16 are in the open state, and the slave ECU 9 does not perform communication interruption monitoring of the slave ECUs 3 and 4 .

[0306] At time t1, the vehicle is in the passenger's seat, and the main ECU 2 turns on the electronic fuse 16. The main ECU 2 transmits fuse state information indicating that the electronic fuse 15 is in the off state and the electronic fuse 16 is in the on state.

[0307] At time t2 when monitoring standby time MT2 has elapsed after slave ECU 9 receives fuse state information, communication interruption monitoring of slave ECU 4 is started.

[0308] At time t3, the vehicle starts running, and the main ECU 2 turns on the electronic fuse 15. The main ECU 2 also transmits fuse state information indicating that the electronic fuses 15 and 16 are turned on.

[0309] At time t4 when the monitoring standby time MT1 has elapsed after the slave ECU 9 receives the fuse state information, the slave ECU 9 starts monitoring of the communication interruption of the slave ECU 3 .

[0310] At time t5, the vehicle is not running, and main ECU 2 decides to open electronic fuse 15. Main ECU 2 transmits fuse state information indicating that electronic fuse 15 is a cut fuse and electronic fuse 16 is a conduction fuse.

[0311] When the slave ECU 9 receives the fuse state information at time t6 , it stops the communication interruption monitoring of the slave ECU 3 .

[0312] At time t7 when the disconnection waiting time CT1 has elapsed from time t5 , the main ECU 2 sets the electronic fuse 15 to the open state.

[0313] At time t8, the vehicle is not occupied, and the main ECU 2 decides to open the electronic fuse 16. The main ECU 2 transmits fuse state information indicating that the electronic fuses 15 and 16 are cut fuses.

[0314] When the slave ECU 9 receives the fuse state information at time t9, the slave ECU 9 stops the communication interruption monitoring by the slave ECU 4 .

[0315] At time t10 when the disconnection standby time CT2 has elapsed from time t8 , the main ECU 2 sets the electronic fuse 16 to the open state.

[0316] [Variation 5]

[0317] In the first embodiment described above, when the communication interruption diagnostic information of other nodes is stored, and when the power cut-off advance notification information or power cut-off post notification information including the fuse cut-off determination information of the electronic fuse connected to the other nodes is stored, the communication interruption diagnostic information related to the slave ECU connected to the electronic fuse corresponding to the power cut-off advance notification information or power cut-off post notification information is invalidated. However, even when the communication interruption with other nodes is detected, the communication interruption diagnostic information of other nodes may not be stored when the power cut-off advance notification information corresponding to the other nodes is stored.

[0318] In the case where the communication interruption diagnostic information of other nodes is not stored, the invalidation can be terminated when a preset invalidation termination condition is satisfied. The invalidation termination condition is, for example, receiving an NM frame from another node or receiving a connection notification information indicating that an electronic fuse connected to another node has become connected.

[0319] [Variation 6]

[0320] In the first embodiment, the power cut notification information and the power cut notification information are sent to the slave ECU connected to the conduction fuse. However, the power cut notification information and the power cut notification information may be sent to all ECUs in the communication system 1.

[0321] [Variation 7]

[0322] In the first embodiment, the master ECU 2 sends the cut fuse determination information for determining the cut fuse to the slave ECU. However, the master ECU 2 may send information for determining the slave ECU connected to the cut fuse to the slave ECU instead of the cut fuse determination information. In this case, the master ECU 2 needs to have an association table for associating the cut fuse with the slave ECU connected to the cut fuse.

[0323] The control units 11, 31 and methods described in the present disclosure may also be implemented by a dedicated computer provided by a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the control units 11, 31 and methods described in the present disclosure may also be implemented by a dedicated computer provided by a processor composed of one or more dedicated hardware logic circuits. Alternatively, the control units 11, 31 and methods described in the present disclosure may also be implemented by one or more dedicated computers composed of a combination of a processor and a memory programmed to execute one or more functions and a processor composed of one or more hardware logic circuits. In addition, the computer program may also be stored as an instruction executed by a computer in a non-migratable tangible recording medium that can be read by a computer. The method for implementing the functions of each unit included in the control unit 11, 31 does not necessarily need to include software, and all of its functions may be implemented using one or more hardware.

[0324] It is also possible to realize multiple functions of one constituent element in the above-mentioned embodiment by multiple constituent elements, or realize one function of one constituent element by multiple constituent elements. In addition, it is also possible to realize multiple functions of multiple constituent elements by one constituent element, or realize one function realized by multiple constituent elements by one constituent element. In addition, it is also possible to omit a part of the structure of the above-mentioned embodiment. In addition, it is also possible to add or replace at least a part of the structure of the above-mentioned embodiment with the structure of other above-mentioned embodiment.

[0325] In addition to the above-mentioned ECU2~4, 101, 104~116, the present disclosure can also be implemented in various ways such as a system with the ECU2~4, 101, 104~116 as a constituent element, a program for making a computer function as the ECU2~4, 101, 104~116, a non-migrating physical recording medium such as a semiconductor memory recording the program, a communication method, etc.

Claims

1. A communication system comprising: A first control device receives power supply from a power source via an electronic fuse; A second control device is connected to the first control device in a manner capable of data communication; a switching control unit configured to perform switching control to switch the electronic fuse to an on state or an off state; and The power cut notification unit is configured to perform at least one of a pre-notification process and a post-notification process, wherein in the pre-notification process, before the electronic fuse becomes disconnected to cut off the power supply from the power supply to the first control device, the pre-notification information of power cut is sent to the second control device, wherein: The power supply cut-off pre-notification information notifies that the power supply from the power supply via the electronic fuse is cut off, and in the post-notification processing, after the electronic fuse becomes disconnected to cut off the power supply from the power supply to the first control device, the power supply cut-off post-notification information is sent to the second control device, wherein the power supply cut-off post-notification information notifies that the power supply from the power supply via the electronic fuse is cut off, The second control device is configured to store the received power shutoff advance notification information and the received power shutoff post notification information.

2. The communication system according to claim 1, wherein: The power-off pre-notification information and the power-off post-notification information include cut-off fuse identification information for identifying the electronic fuse that has been opened.

3. The communication system according to claim 1 or 2, wherein: The second control device comprises: The invalidation unit is configured to invalidate the communication interruption diagnosis information indicating that the communication with the first control device is interrupted, when receiving the power-off advance notification information or the power-off post notification information.

4. The communication system according to claim 1 or 2, wherein: The power shutoff notification unit is configured to transmit the power shutoff advance notification information before the electronic fuse is opened in response to a change in a power state of a vehicle equipped with the communication system.

5. The communication system according to claim 1 or 2, wherein: The power shutoff notification unit is configured to transmit the power shutoff post-notification information after the electronic fuse spontaneously becomes an open state.

6. The communication system according to claim 4, wherein: The power-off notification unit is configured to further transmit power state notification information indicating the changed power state.

7. The communication system according to claim 1, wherein: The power cut notification unit is configured to execute the prior notification process. The switching control unit further comprises: The disconnection unit is configured to open the electronic fuse after a preset disconnection standby time has elapsed after the power supply disconnection notification unit transmits the power supply disconnection advance notification information.

8. The communication system according to claim 7, wherein: The second control device further comprises: The monitoring stop unit is configured to stop monitoring of the first control device when receiving the power shutoff advance notification information.

9. The communication system according to claim 7 or 8, wherein: The switching control unit is configured to send power-on notification information when the electronic fuse is turned on. The second control device is configured to start monitoring the first control device after a preset monitoring standby time has elapsed after receiving the power-on notification information.

10. The communication system according to claim 3, wherein: The invalidation unit is configured to invalidate the communication interruption diagnostic information by not storing the communication interruption diagnostic information when the advance power outage notification information corresponding to the first control device is stored even when communication interruption with the first control device is detected.

11. The communication system according to claim 10, wherein: The invalidation unit is configured to terminate the invalidation when a preset invalidation termination condition is satisfied.

12. The communication system according to claim 3, wherein: The invalidation unit is configured to invalidate the communication interruption diagnostic information by adding invalidation information indicating invalidity to the stored communication interruption diagnostic information.

13. The communication system according to claim 1 or 2, wherein: The power shutoff notification unit is configured to transmit the power shutoff pre-notification information and the power shutoff post-notification information to all electronic control devices included in the communication system.

14. The communication system according to claim 1, wherein: The power shutoff advance notification information and the power shutoff post notification information include disconnection device identification information for identifying an electronic control device connected to the electronic fuse that has been opened.

15. The communication system according to claim 14, wherein: The power shutoff notification unit is configured to generate the shutoff device identification information by referring to a correlation table that correlates the electronic fuse in the disconnected state with the electronic control device connected to the electronic fuse.

16. The communication system according to claim 1 or 2, wherein: The communication system includes the first control device and the second control device as slave control devices, and includes a regional control device connected to the slave control devices in a manner capable of data communication, and a central control device connected to the regional control devices in a manner capable of data communication, The area control device includes the switching control unit and the power cutoff notification unit.

17. The communication system according to claim 1 or 2, wherein: The communication system includes the first control device and the second control device as slave control devices, and includes a regional control device connected to the slave control devices in a manner capable of data communication, and a central control device connected to the regional control devices in a manner capable of data communication, The central control device includes the power cut-off notification unit. The area control device includes the switching control unit.

18. A management device comprising: an electronic fuse control unit configured to control the operation of the electronic fuse, the electronic fuse configured to switch between an on state in which a power supply path for supplying power from a power source to the first control device is turned on and an off state in which the power supply path is turned off; a communication unit configured to perform data communication with a second control device connected to the first control device in a data-communicable manner; and The power cut notification unit is configured to perform at least one of a pre-notification process and a post-notification process, wherein in the pre-notification process, before the electronic fuse is turned off to cut off the power supply from the power supply to the first control device, the pre-notification information of power cut is sent to the second control device, wherein: The power-off pre-notification information notifies that the power supply from the above-mentioned power supply via the above-mentioned electronic fuse is cut off. In the above-mentioned post-notification processing, after the above-mentioned electronic fuse becomes in a disconnected state to cut off the power supply from the above-mentioned power supply to the above-mentioned first control device, the power-off post-notification information is sent to the above-mentioned second control device, wherein the power-off post-notification information notifies that the power supply from the above-mentioned power supply via the above-mentioned electronic fuse is cut off.

19. The management device according to claim 18, wherein: The power cut notification unit is configured to execute the prior notification process. The management device also includes: The disconnection unit is configured to open the electronic fuse after a preset disconnection standby time has elapsed after the power supply disconnection notification unit transmits the power supply disconnection advance notification information.

20. A persistent computer-readable medium having instructions for causing a computer to function as an electronic fuse control unit, a communication unit, and a power cutoff notification unit, The electronic fuse control unit is configured to control the operation of the electronic fuse, which is configured to switch between an on state in which a power supply path for supplying power from a power supply to the first control device is turned on and an off state in which the power supply path is turned off. The communication unit is configured to perform data communication with a second control device, and the second control device is connected to the first control device in a data-communicable manner. The power cut notification unit is configured to perform at least one of a pre-notification process and a post-notification process. In the pre-notification process, before the electronic fuse is turned off to cut off the power supply from the power supply to the first control device, the pre-notification information of power cut is sent to the second control device, wherein: The power-off pre-notification information notifies that the power supply from the above-mentioned power supply via the above-mentioned electronic fuse is cut off. In the above-mentioned post-notification processing, after the above-mentioned electronic fuse becomes in a disconnected state to cut off the power supply from the above-mentioned power supply to the above-mentioned first control device, the power-off post-notification information is sent to the above-mentioned second control device, and the power-off post-notification information notifies that the power supply from the above-mentioned power supply via the above-mentioned electronic fuse is cut off.

Images