Communication system

Abstract

To improve the accuracy of abnormality detection in a communication system.SOLUTION: A communication system 1 includes slave ECUs 3 and 4, a master ECU 2, a control unit 11, and a storage unit 33 of each of the slave ECUs 3 and 4. The slave ECUs 3 and 4 receive power from a battery 5 via electronic fuses 15 and 16, respectively. The slave ECU 4 is connected so as to be able to perform data communication with the slave ECU 3. The control unit 11 executes switching control for switching the electronic fuses 15 and 16 between an on state and an off state. The storage unit 33 of the slave ECU 4 stores diagnostic information related to communication with the slave ECU 3. The storage unit 33 of the slave ECU 3 stores power recovery date and time information, which is information referenced for invalidating the diagnostic information.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a communication system including an electronic fuse. [Background technology]

[0002] Patent document 1 describes an in-vehicle network system that includes a power supply relay that individually switches the power supply of each of a plurality of electronic control devices on / off, determines the control content for switching the power supply of a specific electronic control device on / off for a specific electronic control device that corresponds to a scene identified based on the vehicle situation, and uses the power supply relay to switch the power supplied to the specific electronic control device on / off based on the determined control content. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-81021 A Summary of the Invention [Problem to be solved by the invention]

[0004] As a result of detailed investigation by the inventors, it was found that in a communication system having multiple electronic control devices and configured to use electronic fuses to switch the power supply to the electronic control devices on and off, there is a problem in that a communication interruption is erroneously detected, resulting in reduced accuracy in detecting the abnormality.

[0005] The present disclosure aims to improve the accuracy of anomaly detection in a communication system. [Means for solving the problem]

[0006] One aspect of the present disclosure is a communication system (1, 100) including a first control device (3, 108), a second control device (4, 109), a management device (2, 101), a switching control unit (11, 151), a diagnostic information storage unit (33, 273), and a status information storage unit (14, 33, 158, 273).

[0007] The first control device receives power from a power source (5, 117) through a first electronic fuse (15, 195). The second control device is connected to the first control device so as to be able to communicate data with the first control device, and receives power from a power source via a second electronic fuse (16, 196).

[0008] The management device is connected to the first control device and the second control device so as to be able to communicate data with each other. The switching control unit is configured to execute switching control for switching the first electronic fuse and the second electronic fuse between an on state and an off state.

[0009] The diagnostic information storage unit is configured to store diagnostic information relating to communication with the first control device. The state information storage unit is configured to store first fuse state information, which is information to be referenced for invalidating the diagnostic information and relates to a state of the first electronic fuse.

[0010] The communication system of the present disclosure thus configured can determine whether or not to invalidate diagnostic information related to communication with the first control device by referring to the first fuse state information stored in the state information storage unit. Therefore, the communication system of the present disclosure can prevent the occurrence of a situation in which it is determined that a communication abnormality has occurred in the first control device even though no communication abnormality has occurred in the first control device due to the first electronic fuse being switched to the off state. This allows the communication system of the present disclosure to improve the accuracy of abnormality detection. [Brief description of the drawings]

[0011] [Figure 1] 1 is a block diagram showing a configuration of a communication system according to a first embodiment. [Diagram 2] 11 is an explanatory diagram illustrating an example of affiliation information and startup information; [Diagram 3] 5 is a flowchart showing a prior notification process according to the first embodiment. [Figure 4] 5 is a flowchart showing a notification confirmation process according to the first embodiment. [Diagram 5] FIG. 11 is a block diagram showing a configuration of a communication system according to a second embodiment. [Figure 6] 13 is a flowchart showing a notification confirmation process according to the second embodiment. [Figure 7] 10 is a flowchart showing a diagnosis invalidation process according to the second embodiment. [Figure 8] FIG. 11 is a block diagram showing a configuration of a communication system according to the third, fourth and fifth embodiments. [Figure 9] 13 is a flowchart showing a pre-storage process according to a third embodiment. [Figure 10] 13 is a flowchart showing a diagnosis invalidation process according to the third embodiment. [Figure 11] 13 is a flowchart showing a prior notification process according to the fourth embodiment. [Figure 12] 13 is a flowchart showing a process of disabling interruption diagnosis according to the fourth embodiment. [Figure 13] 13 is a flowchart showing a process of disabling interruption diagnosis according to the fifth embodiment. [Figure 14] 13 is a flowchart showing a response process according to the fifth embodiment. [Figure 15] FIG. 11 is a block diagram showing a configuration of a communication system according to another embodiment. [Figure 16] FIG. 13 is a block diagram showing a configuration of a communication system according to a sixth embodiment. [Figure 17] FIG. 2 is a diagram showing a correspondence relationship between control objects and clusters. [Figure 18] FIG. 13 is a block diagram showing a configuration of a communication system according to a seventh embodiment. [Figure 19]FIG. 23 is a block diagram showing the configuration of a central ECU and an upstream power distribution unit according to a seventh embodiment. [Figure 20] FIG. 23 is a first block diagram showing a configuration of a zone ECU according to a seventh embodiment. [Figure 21] FIG. 23 is a second block diagram showing the configuration of the zone ECU according to the seventh embodiment. [Figure 22] FIG. 13 is a block diagram showing a configuration of a slave ECU according to a seventh embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] [First embodiment] A first embodiment of the present disclosure will be described below with reference to the drawings. A communication system 1 according to the present embodiment is mounted on a vehicle, and includes a master ECU 2, slave ECUs 3 and 4, and a battery 5, as shown in Fig. 1. ECU is an abbreviation for Electronic Control Unit. In the following description, the master ECU 2 and the slave ECUs 3 and 4 are also collectively referred to as nodes.

[0013] The master ECU 2 and the slave ECU 3 are connected to each other via a communication bus 6 so as to be able to communicate data with each other. The master ECU 2 and the slave ECU 4 are connected to each other via a communication bus 7 so as to be able to communicate data with each other.

[0014] The battery 5 supplies electric power to each part of the vehicle at a DC battery voltage (for example, 12 V). The master ECU 2 and the slave ECUs 3 and 4 operate by receiving electric power from the battery 5.

[0015] The master ECU 2 includes a control unit 11, CAN communication units 12 and 13, a storage unit 14, and electronic fuses 15 and 16. CAN is an abbreviation for Controller Area Network. Note that the communication protocol of the communication system 1 is not limited to CAN.

[0016] The control unit 11 is an electronic control device mainly composed of a microcomputer including a CPU 21, a ROM 22, a RAM 23, etc. Various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-transient real recording medium. In this example, the ROM 22 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 21 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 11 may be one or more.

[0017] The CAN communication unit 12 communicates with the slave ECU 3 connected to the communication bus 6 by transmitting and receiving communication frames based on the CAN communication protocol. The CAN communication unit 13 communicates with the slave ECU 4 connected to the communication bus 7 by transmitting and receiving communication frames based on the CAN communication protocol. Hereinafter, a CAN communication frame is referred to as a CAN frame.

[0018] The storage unit 14 is a storage device for storing various data. The storage unit 14 stores a startup table 25, which will be described later. The electronic fuse 15 is disposed on the power supply path between the battery 5 and the slave ECU 3. The electronic fuse 16 is disposed on the power supply path between the battery 5 and the slave ECU 4.

[0019] The electronic fuses 15 and 16 each include a switching element (e.g., a MOSFET) and a control circuit. The control circuit of the electronic fuses 15 and 16 is configured to switch the switching element from an on state to an off state to cut off the power supply path when the current value flowing through the power supply path exceeds a preset overcurrent determination value.

[0020] The control circuits of the electronic fuses 15 and 16 are configured to turn on or off the switching elements in accordance with commands from the control unit 11, thereby making or breaking the power supply path.

[0021] The slave ECUs 3 and 4 each include a control unit 31 , a CAN communication unit 32 , and a storage unit 33 . The control unit 31 is an electronic control device mainly composed of a microcomputer including a CPU 41, a ROM 42, a RAM 43, etc. Various functions of the microcomputer are realized by the CPU 41 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 42 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 41 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 31 may be one or more.

[0022] The CAN communication unit 32 of the slave ECU 3 communicates with a communication device (that is, the master ECU 2) connected to the communication bus 6 based on the CAN communication protocol. The CAN communication unit 32 of the slave ECU 4 communicates with a communication device (that is, the master ECU 2) connected to the communication bus 7 based on the CAN communication protocol.

[0023] The storage unit 33 is a storage device for storing various data. A vehicle fault diagnosis device 600 (so-called diagnostic tester) is connected to the master ECU 2. The fault diagnosis device 600 is installed in a vehicle dealer, a vehicle repair shop, or the like.

[0024] Fault diagnosis device 600 is configured to be detachable via a connector (not shown), and is connected to master ECU 2 during fault diagnosis, etc. Fault diagnosis device 600 can obtain various information from master ECU 2 and slave ECUs 3 and 4 via master ECU 2, and can update data stored in master ECU 2 and slave ECUs 3 and 4.

[0025] A CAN frame consists of a start of frame, an arbitration field, a control field, a data field, a CRC field, an ACK field, and an end of frame. The arbitration field consists of an 11-bit or 29-bit identifier (i.e., ID) and a 1-bit RTR bit.

[0026] The 11-bit identifier used in CAN communication is called CANID. The CANID is preset based on the contents of the data included in the CAN frame, the sender of the CAN frame, the destination of the CAN frame, etc.

[0027] The data field is a payload made up of first data, second data, third data, fourth data, fifth data, sixth data, seventh data, and eighth data, each of which is 8 bits (i.e., 1 byte).

[0028] The communication system 1 forms a partial network, which is a power supply control method based on the communication control of the CAN protocol standard specified in ISO11898-6. For this reason, the communication system 1 achieves low power consumption by collectively transitioning one or more nodes belonging to each communication group (described later) to a wake-up state (i.e., an active state) or a sleep state (i.e., a dormant state) individually for each communication group. By waking up, a node enters a normal operating state in which the functions assigned to the node can be used without restrictions, and by sleeping, it enters a low-power operating state in which the available functions are restricted.

[0029] In the communication system 1, when waking up a node in a sleep state, an NM frame, which is a CAN frame including startup information that specifies an activation group, is used. NM is an abbreviation for Network Management.

[0030] The activation information is set, for example, as shown in Fig. 2. DLC is an abbreviation for Data Length Code, and is an area that indicates the size of the data field in the CAN frame in bytes. In other words, the activation information is stored in the data field of the CAN frame. For ease of explanation, a case where DLC is 1 byte (i.e., 8 bits) is shown here. Each bit of the 8-bit data that indicates the activation information is associated with an activation group.

[0031] In the activation information set in the NM frame, a bit corresponding to the activation group to be activated is set to 1. Each node stores affiliation information that indicates the activation group to which the node belongs. The affiliation information has the same data length as the activation information, and the allocation of each bit is also the same as the activation information. In the affiliation information, the bit corresponding to the activation group to which the node belongs is set to 1.

[0032] Each node compares the activation information extracted from the NM frame with the membership information stored in the node itself to determine whether or not the communication group to which the node itself belongs is an activation target.

[0033] For example, the affiliation information shown in Fig. 2 indicates that the node belongs to the first communication group, the third communication group, and the fifth communication group. The startup information shown in Fig. 2 indicates that the second communication group, the third communication group, the fourth communication group, and the fifth communication group are to be started. Since the third communication group and the fifth communication group are included in both the affiliation information and the startup information shown in Fig. 2, the local node determines that the local node is to be started as the third communication group and the fifth communication group.

[0034] In the activation table 25, a correspondence relationship between the activation groups and the electronic fuses to be turned on (hereinafter, called conduction fuses) is set. For example, the activation table 25 is set so that when the activation group is the first communication group, the continuity fuse is electronic fuse 15. For example, the activation table 25 is set so that when the activation group is the second communication group, the continuity fuse is electronic fuse 16. For example, the activation table 25 is set so that when the activation group is the third communication group, the continuity fuse is electronic fuse 15, 16. For example, the activation table 25 is set so that when the activation group is the fourth communication group, there is no continuity fuse.

[0035] Therefore, for example, when the master ECU 2 acquires an NM frame that specifies the first communication group as the activation group, it turns the electronic fuse 15 on and turns the electronic fuse 16 off. Turning the electronic fuses 15 and 16 off in this way in response to the specification of an activation group is referred to as "intentionally blowing the electronic fuses 15 and 16." For this reason, turning the electronic fuses 15 and 16 off when an excessive current flows through the power supply path corresponds to "unintentionally blowing the electronic fuses 15 and 16."

[0036] If there are multiple activation groups, the master ECU 2 turns on the electronic fuses corresponding to the multiple activation groups using OR (i.e., logical sum), and turns off the electronic fuses other than those corresponding to the multiple activation groups using AND (i.e., logical product). Even if multiple events occur and an NM frame is generated in which the 1st, 3rd, and 5th communication groups are activation groups and an NM frame is generated in which the 1st, 4th, and 6th communication groups are activation groups, the master ECU 2 refers to both NM frames and turns off the electronic fuses other than those corresponding to the multiple activation groups using AND (i.e., logical product).

[0037] Next, a description will be given of a procedure of the advance notification process executed by the control unit 11 of the master ECU 2. The advance notification process is a process that is repeatedly executed while the master ECU 2 is running. When the advance notification process is executed, the CPU 21 of the control unit 11 determines in S10 whether or not there is an electronic fuse to be intentionally cut off, as shown in Fig. 3. If there is no electronic fuse to be intentionally cut off, the CPU 21 ends the advance notification process. On the other hand, if there is an electronic fuse to be intentionally cut off, the CPU 21 transmits power cutoff notification information to notify the slave ECU connected to the electronic fuse to be intentionally cut off in S20 that the power supply from the battery 5 will be cut off, and ends the advance notification process. Note that the process of S20 is executed before the electronic fuse is intentionally cut off.

[0038] When the electronic fuse 15 is intentionally blown, power cut-off notification information is transmitted to the slave ECU 3. When the electronic fuse 16 is intentionally blown, power cut-off notification information is transmitted to the slave ECU 4. Upon receiving the power cut-off notification information, the slave ECUs 3 and 4 store the received power cut-off notification information in the storage unit 33 together with reception date and time information indicating the date and time when the power cut-off notification information was received.

[0039] Next, a description will be given of the procedure of the notification confirmation process executed by the control unit 31 of the slave ECU 3, 4. The notification confirmation process is executed immediately after the slave ECU 3, 4 is started up as a result of the start of power supply from the battery 5.

[0040] When the notification confirmation process is executed, the CPU 41 of the control unit 31 confirms whether or not the power cutoff notification information is stored in the storage unit 33 in S110, as shown in FIG. At S120, the CPU 41 determines, based on the confirmation result at S110, whether or not the power cutoff notification information is stored in the storage unit 33. If the power cutoff notification information is not stored in the storage unit 33, the CPU 41 ends the notification confirmation process.

[0041] On the other hand, if the power cutoff notification information is stored in the memory unit 33, the CPU 41 stores, at S130, information indicating the date and time when the slave ECUs 3, 4 were most recently started up due to the start of power supply from the battery 5 in the memory unit 33 as power recovery date and time information, and terminates the notification confirmation process.

[0042] An operator who performs a vehicle inspection connects the fault diagnosis device 600 to the master ECU 2 and obtains the diagnostic information and power restoration date and time information stored in the master ECU 2 and the slave ECUs 3 and 4.

[0043] The worker checks the acquired diagnostic information and power restoration date and time information. The worker then invalidates diagnostic information related to the slave ECU from the shutdown notification reception date and time indicated by the reception date and time information when the power shutdown notification information was received to the power restoration date and time indicated by the power restoration date and time information. For example, if the power restoration date and time information is stored in the slave ECU 3, the worker invalidates diagnostic information related to the slave ECU 3 that occurs between the reception date and time of the power shutdown notification information and the power restoration date and time in the master ECU 2 and the slave ECU 4. An example of diagnostic information related to the slave ECU 3 is an abnormality in which communication from the slave ECU 3 is interrupted.

[0044] Specifically, for example, the diagnostic information may be invalidated by adding invalidation information indicating that the diagnostic information is invalid. In addition, the master ECU 2 and the slave ECUs 3 and 4 may acquire reception date and time information and power restoration date and time information from the other nodes, and invalidate diagnostic information related to the other nodes from the time when the shutdown notification was received until the time when the power was restored.

[0045] Furthermore, the fault diagnosis device 600 may acquire reception date and time information and power restoration date and time information from the slave ECUs 3 and 4, and invalidate diagnostic information related to the slave ECUs 3 and 4 from the time the cutoff notification was received until the time the power was restored.

[0046] In addition, a center installed outside the vehicle may obtain reception date and time information and power restoration date and time information from the slave ECUs 3 and 4 via remote diagnosis, thereby invalidating diagnostic information related to the slave ECUs 3 and 4 from the date and time of reception of the shutoff notification to the date and time of power restoration.

[0047] The communication system 1 configured in this manner includes the slave ECU 3, the slave ECU 4, the master ECU 2, a control unit 11, a storage unit 33 of the slave ECU 4, and a storage unit 33 of the slave ECU 3.

[0048] The slave ECU 3 receives power from the battery 5 via an electronic fuse 15 . The slave ECU 4 is connected to the slave ECU 3 so as to be able to perform data communication with the slave ECU 3, and receives power from the battery 5 via an electronic fuse 16.

[0049] The master ECU 2 is connected to be able to communicate data with the slave ECU 3 and the slave ECU 4. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 between an on state and an off state.

[0050] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to communication with the slave ECU 3 . The storage unit 33 of the slave ECU 3 is configured to store power recovery date and time information, which is information to be referenced for invalidating the diagnosing information.

[0051] Such a communication system 1 can determine whether or not to invalidate diagnostic information related to communication with the slave ECU 3 by referring to the power recovery date and time information stored in the storage unit 33 of the slave ECU 3. Therefore, the communication system 1 can prevent the occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though no abnormality related to communication has occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the off state. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0052] In addition, the master ECU 2 is configured to transmit power cut-off notification information to the slave ECU 3 to notify that the power supply from the battery 5 via the electronic fuse 15 will be cut off before turning off the electronic fuse 15 to cut off the power supply from the battery 5 to the slave ECU 3.

[0053] When the slave ECU 3 is started up by power supply from the battery 5, the slave ECU 3 is configured to determine whether or not power cut-off notification information has been stored, and if the power cut-off notification information has been stored, to store power restoration date and time information indicating the date and time when the slave ECU 3 was most recently started up.

[0054] In such a communication system 1, the slave ECU 3 stores the power recovery date and time information when the slave ECU 3 is started by the power supply from the battery 5 after the power supply from the battery 5 is cut off due to the master ECU 2 turning the electronic fuse 15 to the off state. That is, the communication system 1 can determine whether the master ECU 2 intentionally turned the electronic fuse 15 to the off state based on whether the slave ECU 3 stores the power recovery date and time information. Therefore, even if the communication from the slave ECU 3 is interrupted due to the master ECU 2 intentionally turning the electronic fuse 15 to the off state, the communication system 1 can determine that no abnormality in communication interruption has occurred in the slave ECU 3 if the power recovery date and time information is stored in the slave ECU 3. That is, the communication system 1 can suppress the occurrence of a situation in which it is determined that an abnormality in communication interruption has occurred in the slave ECU 3 even when no abnormality has occurred in the slave ECU 3. This allows the communication system 1 to improve the abnormality detection accuracy.

[0055] In the embodiment described above, the slave ECU 3 corresponds to the first control device, the slave ECU 4 corresponds to the second control device, the master ECU 2 corresponds to the management device, and the battery 5 corresponds to the power source.

[0056] Moreover, the control unit 11 corresponds to a switching control unit, the memory unit 33 of the slave ECU 4 corresponds to a diag information memory unit, the memory unit 33 of the slave ECU 3 corresponds to a status information memory unit, and the power restoration date and time information corresponds to first fuse status information.

[0057] Moreover, S20 corresponds to a process performed by a shutdown notification transmitting unit, S110 to S130 correspond to a process performed by a state information storing unit, and the power shutdown notification information corresponds to first power shutdown related information. [Second embodiment] A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0058] As shown in FIG. 5, the communication system 1 of the second embodiment differs from the first embodiment in that the slave ECUs 3 and 4 each include a power storage unit 35. The power storage unit 35 is charged by the battery voltage from the battery 5. When the power supply from the battery 5 is cut off, the power storage unit 35 secures enough power to enable the slave ECUs 3 and 4 to operate for a predetermined backup time (e.g., several tens of milliseconds).

[0059] Next, there will be described the procedure of the notification confirmation process executed by the control unit 31 of the slave ECUs 3 and 4. The notification confirmation process of the second embodiment is a process that is repeatedly executed while the slave ECUs 3 and 4 are running.

[0060] When the notification confirmation process of the second embodiment is executed, the CPU 41 of the control unit 31 determines whether or not the power supply from the battery 5 has been cut off in S210, as shown in Fig. 6. If the power supply from the battery 5 has not been cut off, the CPU 41 ends the notification confirmation process.

[0061] On the other hand, if the power supply from the battery 5 is cut off, the CPU 41 checks whether or not power cutoff notification information is stored in the storage unit 33 in S220. At S230, the CPU 41 determines, based on the confirmation result at S220, whether or not the power cutoff notification information is stored in the storage unit 33. If the power cutoff notification information is not stored in the storage unit 33, the CPU 41 ends the notification confirmation process.

[0062] On the other hand, if power cut-off notification information is stored in the memory unit 33, the CPU 41 stores, in S240, slave cut-off information indicating that the power supply from the battery 5 to the slave ECUs 3, 4 has been cut off in the memory unit 33 together with slave cut-off time information indicating the time at which the slave cut-off information is stored, and terminates the notification confirmation process.

[0063] Next, the procedure for the diagnostic invalidation process executed by the worker who inspects the vehicle will be described. When the diagnosis disable process is executed, as shown in FIG. 7, in S310, the operator connects the fault diagnosis device 600 to the master ECU 2 and reads out slave shutoff time information indicating the time when the slave shutoff information was stored from the master ECU 2 or the slave ECUs 3 and 4.

[0064] In S320, the operator invalidates diagnostic information related to the slave ECU in the vicinity of the time indicated by the slave cutoff time information (hereinafter, slave cutoff time), and ends the diagnostic invalidation process. For example, when the slave cutoff time information is read from the slave ECU 3, the operator invalidates diagnostic information related to the slave ECU 3 that occurs at a time near the slave cutoff time in the master ECU 2 and the slave ECU 4.

[0065] The vicinity of the slave cutoff time may be from time T1 before the slave cutoff time to time T2 after the slave cutoff time, or from time T3 to time T4 after the preset invalidation time.

[0066] Furthermore, the master ECU 2 and the slave ECUs 3 and 4 may acquire slave cutoff time information from the other nodes, and invalidate diagnostic information related to the other nodes that occurs at a time close to the slave cutoff time.

[0067] Furthermore, the fault diagnosis device 600 may acquire slave cutoff time information from the slave ECUs 3 and 4, and invalidate diagnostic information related to the slave ECUs 3 and 4 that occurred at a time close to the slave cutoff time.

[0068] In addition, a center installed outside the vehicle may obtain slave shutoff time information from the slave ECUs 3 and 4 via remote diagnosis, and invalidate diagnostic information related to the slave ECUs 3 and 4 that occurred around the slave shutoff time.

[0069] The communication system 1 configured in this manner includes the slave ECU 3, the slave ECU 4, the master ECU 2, a control unit 11, a storage unit 33 of the slave ECU 4, and a storage unit 33 of the slave ECU 3.

[0070] The slave ECU 3 includes a power storage unit 35 and receives power from the battery 5 via the electronic fuse 15 . The master ECU 2 is connected to be able to communicate data with the slave ECU 3 and the slave ECU 4. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 between an on state and an off state.

[0071] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to communication with the slave ECU 3 . The storage unit 33 of the slave ECU 3 is configured to store slave cutoff information, which is information to be referenced for invalidating the diagnostic information.

[0072] Such a communication system 1 can determine whether or not to invalidate diagnostic information related to communication with the slave ECU 3 by referring to the slave cutoff information stored in the storage unit 33 of the slave ECU 3. Therefore, the communication system 1 can prevent occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though no abnormality related to communication has occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the off state. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0073] In addition, the master ECU 2 is configured to transmit power cut-off notification information to the slave ECU 3 to notify that the power supply from the battery 5 via the electronic fuse 15 will be cut off before turning off the electronic fuse 15 to cut off the power supply from the battery 5 to the slave ECU 3.

[0074] The slave ECU 3 is configured to determine whether or not power cut-off notification information has been acquired from the master ECU 2 when the power supply from the battery 5 is cut off, and if power cut-off notification information has been acquired, to store in the slave ECU 3 slave cut-off information indicating that the battery 5 has been cut off.

[0075] In such a communication system 1, when the power supply from the battery 5 is interrupted due to the master ECU 2 turning the electronic fuse 15 to the OFF state, the slave ECU 3 can receive power supply from the power storage unit 35 and store slave cutoff information in the slave ECU 3. That is, the communication system 1 can determine whether the master ECU 2 intentionally turned the electronic fuse 15 to the OFF state based on whether the slave ECU 3 stores the slave cutoff information. Therefore, even if the communication from the slave ECU 3 is interrupted due to the master ECU 2 intentionally turning the electronic fuse 15 to the OFF state, the communication system 1 can determine that no abnormality such as communication interruption has occurred in the slave ECU 3 if the slave cutoff information is stored in the slave ECU 3. That is, the communication system 1 can suppress the occurrence of a situation in which it is determined that an abnormality such as communication interruption has occurred in the slave ECU 3 even when no abnormality has occurred in the slave ECU 3. This allows the communication system 1 to improve the abnormality detection accuracy.

[0076] In the embodiment described above, the power storage unit 35 corresponds to a standby power supply, S20 corresponds to the process of a shutdown notification transmitting unit, S240 corresponds to the process of a status information storing unit, and the slave shutdown information corresponds to power shutdown information.

[0077] [Third embodiment] A third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0078] As shown in FIG. 8, the communication system 1 of the third embodiment differs from the first embodiment in that the CAN communication unit 13 is omitted in the master ECU 2 and that the CAN communication unit 32 of the slave ECU 4 is connected to the communication bus 6 instead of the communication bus 7.

[0079] Next, a description will be given of the procedure of the pre-storage process executed by the control unit 11 of the master ECU 2. The pre-storage process is a process that is repeatedly executed while the master ECU 2 is running. When the advance storage process is executed, the CPU 21 of the control unit 11 determines in S410 whether or not there is an electronic fuse to be intentionally blown, as shown in Fig. 9. If there is no electronic fuse to be intentionally blown, the CPU 21 ends the advance storage process. On the other hand, if there is an electronic fuse to be intentionally blown, the CPU 21 stores in the memory unit 14 in S420 blow fuse notification information notifying the electronic fuse to be blown and fuse blow time information indicating the time when the electronic fuse will be blown, and ends the advance storage process. Note that the process of S420 is executed before the electronic fuse is intentionally blown.

[0080] Next, the procedure for the diagnostic invalidation process executed by the worker who inspects the vehicle will be described. When the diagnosis invalidation process is executed, the operator connects the fault diagnosis device 600 to the master ECU 2 in S510 as shown in FIG. 10, and reads out the blown fuse notification information and the fuse blown time information from the master ECU 2.

[0081] In S520, the worker invalidates diagnostic information related to the slave ECU connected to the electronic fuse indicated by the fuse blowing notification information around the time indicated by the fuse blowing time information (hereinafter, fuse blowing time), and ends the diagnostic invalidation process. For example, if the fuse blowing notification information indicates electronic fuse 15, the worker invalidates diagnostic information related to slave ECU 3 that occurs around the fuse blowing time in master ECU 2 and slave ECU 4.

[0082] Furthermore, the master ECU 2 may invalidate diagnostic information related to the slave ECU near the fuse blowing time based on the stored blowing fuse notification information and fuse blowing time information.

[0083] Furthermore, the fault diagnosis device 600 may acquire blown fuse notification information and fuse blown time information from the master ECU 2, thereby invalidating diagnostic information related to the slave ECU around the fuse blown time.

[0084] In addition, a center installed outside the vehicle may obtain fuse blow notification information and fuse blow time information from the master ECU 2 via remote diagnosis, and invalidate diagnostic information related to the slave ECU around the fuse blow time.

[0085] The communication system 1 configured in this manner includes the slave ECU 3, the slave ECU 4, the master ECU 2, a storage unit 33 of the slave ECU 4, and a storage unit 14 of the master ECU 2.

[0086] The slave ECU 3 receives power from the battery 5 via an electronic fuse 15 . The slave ECU 4 is connected to the slave ECU 3 so as to be able to perform data communication with the slave ECU 3, and receives power from the battery 5 via an electronic fuse 16.

[0087] The master ECU 2 is connected to be able to communicate data with the slave ECU 3 and the slave ECU 4. The control unit 11 is configured to execute switching control for switching the electronic fuses 15 and 16 between an on state and an off state.

[0088] The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to communication with the slave ECU 3 . The storage unit 14 of the master ECU 2 is configured to store blown fuse notification information and fuse blown time information, which are information to be referenced for invalidating the diagnostic information.

[0089] Such a communication system 1 can determine whether or not to invalidate diagnostic information related to communication with the slave ECU 3 by referring to the blown fuse notification information and the fuse blown time information stored in the memory unit 14 of the master ECU 2. Therefore, the communication system 1 can prevent the occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though no abnormality related to communication has occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the off state. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0090] In addition, before turning off the electronic fuse 15 to cut off the power supply from the battery 5 to the slave ECU 3, the master ECU 2 is configured to store cut-off fuse notification information (hereinafter, first cut-off fuse notification information) that notifies the electronic fuse 15 to be cut off, and fuse cut-off time information (hereinafter, first fuse cut-off time information) that indicates the time to cut off the electronic fuse 15.

[0091] Before turning off the electronic fuse 16 to cut off the power supply from the battery 5 to the slave ECU 4, the master ECU 2 is configured to store blown fuse notification information (hereinafter, second blown fuse notification information) that notifies the electronic fuse 16 to be blown, and fuse blown time information (hereinafter, second fuse blown time information) that indicates the time to blow the electronic fuse 16.

[0092] In such a communication system 1, when the master ECU 2 cuts off the power supply to the slave ECUs 3 and 4 due to the master ECU 2 turning off the electronic fuses 15 and 16, the master ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information. That is, the communication system 1 can determine whether the master ECU 2 intentionally turned off the electronic fuses 15 and 16 based on whether the master ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information. Therefore, even if communication from the slave ECUs 3 and 4 is interrupted due to the master ECU 2 intentionally turning off the electronic fuses 15 and 16, the communication system 1 can consider that no abnormality in communication interruption has occurred in the slave ECUs 3 and 4 around the time indicated by the first and second fuse cut time information, if the master ECU 2 stores the first and second fuse cut notification information and the first and second fuse cut time information. That is, the communication system 1 can suppress occurrence of a situation in which it is determined that an abnormality such as communication interruption has occurred in the slave ECUs 3 and 4 even though no abnormality has occurred in the slave ECUs 3 and 4. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0093] In the embodiment described above, the memory unit 14 of the master ECU 2 corresponds to a status information memory unit, the electronic fuse 15 corresponds to a first electronic fuse, the slave ECU 3 corresponds to a first control device, the electronic fuse 16 corresponds to a second electronic fuse, the slave ECU 4 corresponds to a second control device, the memory unit 14 of the master ECU 2 corresponds to a status information memory unit, and S410 to S420 correspond to processing as a fuse tripping information memory unit.

[0094] [Fourth embodiment] A fourth embodiment of the present disclosure will be described below with reference to the drawings. In the fourth embodiment, only the parts different from the third embodiment will be described. The same reference numerals will be used to designate the same components.

[0095] The communication system 1 of the fourth embodiment differs from the third embodiment in that the system does not execute a pre-storage process but executes a pre-notification process. Next, a description will be given of a procedure of the advance notification process executed by the control unit 11 of the master ECU 2. The advance notification process is a process that is repeatedly executed while the master ECU 2 is running.

[0096] When the advance notification process of the fourth embodiment is executed, the CPU 21 of the control unit 11 judges whether or not to intentionally blow off the electronic fuse in S610, as shown in FIG. 11. If the electronic fuse is not to be blown intentionally, the CPU 21 ends the advance notification process. On the other hand, if the electronic fuse is to be blown intentionally, the CPU 21 transmits, in S620, blow-off fuse notification information notifying the electronic fuse to be blown and fuse blow-off time information indicating the time to blow off the electronic fuse to all slave ECUs included in the communication system 1, and ends the advance notification process. The process of S620 is executed before intentionally blowing off the electronic fuse. Moreover, the master ECU 2 may transmit blow-off ECU notification information notifying the slave ECU connected to the electronic fuse to be blown, instead of the blow-off fuse notification information notifying the electronic fuse to be blown.

[0097] Upon receiving the blown fuse notification information and the fuse blown time information, the slave ECUs 3 and 4 store the blown fuse notification information and the fuse blown time information in the storage unit 33 . Next, there will be described the procedure of the interruption diagnosis disabling process executed by the control unit 31 of the slave ECU 3, 4. The interruption diagnosis disabling process is a process that is repeatedly executed while the slave ECU 3, 4 is in operation.

[0098] 12, the CPU 41 of the control unit 31 determines whether or not communication disruption diag information of other nodes is stored in the storage unit 33 in S710. If communication disruption diag information of other nodes is not stored, the CPU 41 ends the disruption diag invalidation process.

[0099] On the other hand, if communication interruption diagnostic information of another node is stored, the CPU 41 determines in S720 whether or not it has received blown fuse notification information indicating an electronic fuse connected to the other node corresponding to the stored communication interruption diagnostic information. The slave ECUs 3 and 4 store a table that sets the correspondence between electronic fuses and ECUs connected to the electronic fuses.

[0100] If blown fuse notification information indicating an electronic fuse connected to another node has not been received, the CPU 41 ends the interruption diagnosis invalidation process. On the other hand, when the CPU 41 receives blown fuse notification information indicating an electronic fuse connected to another node, the CPU 41 invalidates the disruption diagnosing information related to the slave ECU connected to the electronic fuse indicated by the blown fuse notification information in the vicinity of the time indicated by the fuse blown time information received together with the blown fuse notification information (hereinafter, the fuse blown time) at S730, and ends the disruption diagnosing invalidation process. For example, when the blown fuse notification information indicates the electronic fuse 15, the CPU 41 invalidates the disruption diagnosing information related to the slave ECU 3 that occurs in the vicinity of the fuse blown time.

[0101] The vicinity of the fuse blowing time may be from time T11 before the fuse blowing time to time T12 after the fuse blowing time, or from time T13 to time T14 after a preset invalidation time.

[0102] The communication system 1 configured in this manner includes the slave ECU 3, the slave ECU 4, the master ECU 2, a control unit 11, and a storage unit 33 of the slave ECU 4. The storage unit 33 of the slave ECU 4 is configured to store communication interruption diagnostic information regarding communication with the slave ECU 3 .

[0103] The storage unit 33 of the slave ECU 4 is configured to store blown fuse notification information, which is information to be referenced for invalidating the communication interruption diagnosing information. Such a communication system 1 can determine whether to invalidate communication interruption diagnostic information regarding communication with the slave ECU 3 by referring to the blown fuse notification information stored in the storage unit 33 of the slave ECU 4. Therefore, the communication system 1 can prevent occurrence of a situation in which it is determined that an abnormality regarding communication has occurred in the slave ECU 3 even though no abnormality regarding communication has occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the off state. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0104] In addition, after turning off the electronic fuse 15 to cut off the power supply from the battery 5 to the slave ECU 3, the master ECU 2 is configured to transmit to the slave ECU 4 blown fuse notification information (hereinafter, first blown fuse notification information) notifying the electronic fuse 15 to be blown, and fuse blown time information (hereinafter, first fuse blown time information) indicating the time to blow the electronic fuse 15.

[0105] The master ECU 2 is configured to transmit to the slave ECU 3, after turning off the electronic fuse 16 to cut off the power supply from the battery 5 to the slave ECU 4, cut-off fuse notification information (hereinafter, second cut-off fuse notification information) notifying the electronic fuse 16 to be cut off, and fuse cut-off time information (hereinafter, second fuse cut-off time information) indicating the time to cut off the electronic fuse 16.

[0106] In such a communication system 1, when the master ECU 2 cuts off the power supply to the slave ECUs 3 and 4 due to the master ECU 2 turning off the electronic fuses 15 and 16, the master ECU 2 transmits the first and second fuse cutoff notification information and the first and second fuse cutoff time information to the slave ECUs 4 and 3. That is, the communication system 1 can determine whether the master ECU 2 intentionally turned off the electronic fuses 16 and 15 based on whether the slave ECUs 3 and 4 store the second and first fuse cutoff notification information and the second and first fuse cutoff time information, respectively. Therefore, even if communication from the slave ECUs 3 and 4 is interrupted due to the master ECU 2 intentionally turning off the electronic fuses 15 and 16, the communication system 1 can determine that no abnormality in the form of communication interruption has occurred in the slave ECUs 3 and 4 around the time indicated by the first and second fuse cutoff time information, if the slave ECUs 4 and 3 store the first and second fuse cutoff notification information and the first and second fuse cutoff time information. That is, the communication system 1 can suppress occurrence of a situation in which it is determined that an abnormality such as communication interruption has occurred in the slave ECUs 3 and 4 even though no abnormality has occurred in the slave ECUs 3 and 4. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0107] In the embodiment described above, steps S610 to S620 correspond to the processing performed by the cutoff notification transmitting unit, and the storage unit 33 of the slave ECU 4 corresponds to a state information storage unit. [Fifth embodiment] A fifth embodiment of the present disclosure will be described below with reference to the drawings. In the fifth embodiment, only the parts different from the third embodiment will be described. The same reference numerals will be used to designate the same components.

[0108] The communication system 1 of the fifth embodiment differs from the third embodiment in that the communication system 1 executes the interruption-diagnosis invalidation process without executing the diagnosing invalidation process, and in that the communication system 1 executes the response process without executing the advance storage process.

[0109] Next, there will be described the procedure of the interruption diagnosis disabling process executed by the control unit 31 of the slave ECU 3, 4. The interruption diagnosis disabling process is a process that is repeatedly executed while the slave ECU 3, 4 is in operation.

[0110] 13, the CPU 41 of the control unit 31 determines whether or not communication disruption diag information of other nodes is stored in the storage unit 33 in S810. If communication disruption diag information of other nodes is not stored, the CPU 41 ends the disruption diag invalidation process.

[0111] On the other hand, if communication interruption diag information of another node is stored, the CPU 41 inquires of the master ECU 2 about the state of the electronic fuse in S820. Specifically, the CPU 41 transmits a status confirmation request to the master ECU 2 to inquire about the state of the electronic fuse connected to the slave ECU corresponding to the communication interruption diag information determined in S810. For example, if the slave ECU 3 stores communication interruption diag information of the slave ECU 4, the CPU 41 transmits a status confirmation request to the master ECU 2 to inquire about the state of the electronic fuse 16.

[0112] In S830, the CPU 41 acquires electronic fuse state information from the master ECU 2. The electronic fuse state information indicates, for each of the electronic fuses 15 and 16, whether it is in an on state or an off state, and, if it is in an off state, whether it is an intended cutoff or not.

[0113] In S840, the CPU 41 determines whether or not the electronic fuse connected to the other node corresponding to the stored communication interruption diag information has been intentionally cut off based on the acquired electronic fuse state information. If the cutoff is not intentional, the CPU 41 ends the communication interruption diagnosing invalidation process.

[0114] On the other hand, if the cutoff is intentional, the CPU 41 invalidates the communication interruption diagnosing information determined in S810 in S850, and ends the communication interruption diagnosing invalidation process. Next, a description will be given of the procedure of the response process executed by the control unit 11 of the master ECU 2. The response process is a process that is repeatedly executed while the master ECU 2 is running.

[0115] When the response process is executed, as shown in Fig. 14, the CPU 21 of the control unit 11 determines in S910 whether or not there has been an inquiry from the slave ECUs 3 and 4. If there has been no inquiry from the slave ECUs 3 and 4, the CPU 21 ends the response process.

[0116] On the other hand, when an inquiry is received from the slave ECU 3 or the slave ECU 4, the CPU 21 checks at S920 the states of the electronic fuses 15, 16. That is, the CPU 21 checks whether each of the electronic fuses 15, 16 is in an on or off state, and if in an off state, whether or not the blowing is intended.

[0117] In S930, the CPU 21 generates electronic fuse state information based on the confirmation result in S920, transmits the generated electronic fuse state information to the inquired slave ECUs 3 and 4, and ends the response process.

[0118] The communication system 1 thus configured includes a slave ECU 3, a slave ECU 4, and a master ECU 2. The storage unit 33 of the slave ECU 4 is configured to store diagnostic information related to communication with the slave ECU 3 .

[0119] The storage unit 33 of the slave ECU 4 is configured to store electronic fuse state information, which is information to be referred to for invalidating the diagnostic information and indicates the confirmation result. Such a communication system 1 can determine whether or not to invalidate diagnostic information related to communication with the slave ECU 3 by referring to the electronic fuse state information stored in the storage unit 33 of the slave ECU 4. Therefore, the communication system 1 can prevent occurrence of a situation in which it is determined that an abnormality related to communication has occurred in the slave ECU 3 even though no abnormality related to communication has occurred in the slave ECU 3 due to the electronic fuse 15 being switched to the off state. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0120] In addition, when the slave ECU 3 stores communication interruption diagnosing information (hereinafter, second communication interruption diagnosing information) indicating that communication with the slave ECU 4 has been interrupted, the slave ECU 3 is configured to transmit a status confirmation request (hereinafter, second status confirmation request) to the master ECU 2 to inquire about the status of the electronic fuse 16.

[0121] The slave ECU 4 is configured to transmit a status confirmation request (hereinafter, the first status confirmation request) to the master ECU 2 inquiring about the status of the electronic fuse 15 when it stores communication interruption diagnosing information (hereinafter, the first communication interruption diagnosing information) indicating that communication with the slave ECU 3 has been interrupted.

[0122] When the master ECU 2 receives a second status confirmation request from the slave ECU 3, the master ECU 2 is configured to confirm the status of the electronic fuse 16 and transmit electronic fuse status information indicating the confirmation result (hereinafter, second electronic fuse status information) to the slave ECU 3.

[0123] When the master ECU 2 receives a first status confirmation request from the slave ECU 4, the master ECU 2 confirms the status of the electronic fuse 15 and transmits electronic fuse status information indicating the confirmation result (hereinafter, first electronic fuse status information) to the slave ECU 4.

[0124] In such a communication system 1, the master ECU 2 transmits the second, first electronic fuse state information to the slave ECUs 3, 4 when the slave ECUs 3, 4 store the second, first communication interruption diagnosing information. Therefore, in the communication system 1, the slave ECUs 3, 4 can determine whether the power supply to the slave ECUs 4, 3 has been cut off due to the master ECU 2 turning the electronic fuses 16, 15 to the off state based on the second, first electronic fuse state information. Then, when the slave ECUs 3, 4 determine that the power supply to the slave ECUs 4, 3 has been cut off due to the master ECU 2 turning the electronic fuses 16, 15 to the off state, they can assume that no communication interruption abnormality has occurred in the slave ECUs 4, 3 even if the second, first communication interruption diagnosing information is stored. That is, the communication system 1 can suppress the occurrence of a situation in which it is determined that a communication interruption abnormality has occurred in the slave ECUs 3, 4 when no abnormality has occurred in the slave ECUs 3, 4. This allows the communication system 1 to improve the abnormality detection accuracy.

[0125] In the embodiment described above, the memory unit 33 of the slave ECU 4 corresponds to a diag information memory unit, the memory unit 33 of the slave ECU 4 corresponds to a status information memory unit, S820 corresponds to processing as a first request unit and a second request unit, and S910 to S930 correspond to processing as a response unit.

[0126] [Sixth embodiment] A sixth embodiment of the present disclosure will be described below with reference to the drawings. In the sixth embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same components.

[0127] As shown in FIG. 16, the communication system 1 of the sixth embodiment differs from the first embodiment in that a smart sensor 501, a smart actuator 502, a wireless device 503, electronic fuses 504 and 505, and a slave ECU 506 are added.

[0128] The smart sensor 501 is a sensor having a communication function. The smart sensor 501 is connected to the communication bus 6. The smart actuator 502 is an actuator having a communication function. The smart actuator 502 is connected to the communication bus 6.

[0129] The wireless device 503 is a wireless communication device for performing wireless communication with an external communication device installed outside the vehicle. The wireless device 503 is, for example, a DCM. DCM is an abbreviation for Data Communication Module.

[0130] The electronic fuse 504 is disposed on the power supply path between the battery 5 and the smart sensor 501. The electronic fuse 505 is disposed on the power supply path between the battery 5 and the smart actuator 502.

[0131] Each of the electronic fuses 504 and 505 is configured to switch, in response to a command from the control unit 11, between a conductive state in which the power supply path is conductive and a cut-off state in which the power supply path is cut off.

[0132] Hereinafter, the master ECU 2, the slave ECUs 3 and 4, the smart sensor 501, the smart actuator 502, and the slave ECU 506 are collectively referred to as nodes. (Prerequisite) The master ECU 2 and the slave ECU 506 are always powered by the battery 5 without using an electronic fuse, and can switch to a wake-up state or a sleep state independently. Hereinafter, the master ECU 2 and the slave ECU 506 are also referred to as NM-equipped nodes. An NM-equipped node is a node that has a function of generating an NM frame.

[0133] The slave ECUs 3 and 4, the smart sensor 501, and the smart actuator 502 are powered via electronic fuses, and cannot be switched to a wake-up state or a sleep state by themselves. That is, they enter a wake-up state when the electronic fuse is turned on, and enter a sleep state when the electronic fuse is turned off. Hereinafter, the slave ECU 3, the slave ECU 4, the smart sensor 501, and the smart actuator 502 are also referred to as non-NM nodes. A non-NM node is a node that does not have the function of generating and interpreting an NM frame.

[0134] The non-NM node includes at least one of an actuator and a sensor in addition to an ECU having a control function. The power supply paths of the non-NM nodes are connected to electronic fuses 15, 16, 504, and 505 of the master ECU 2, respectively.

[0135] A non-NM node and an electronic fuse may be connected on a one-to-one basis, or multiple non-NM nodes belonging to the same cluster (i.e., a group that starts up simultaneously) may be connected under one electronic fuse.

[0136] The master ECU 2 and the NM-equipped node have a CAN communication unit and are capable of transmitting and receiving NM frames. An NM-equipped node determines whether to be in a wake-up or sleep state based on the NM frames it sends and receives via the communication bus.

[0137] The master ECU 2 turns on or off the electronic fuses 15, 16, 504, and 505 to which the non-NM nodes are connected, based on the NM frame transmitted and received via the communication bus.

[0138] The payload (i.e., data area) of the NM frame transmitted and received by the master ECU 2 and the NM-equipped node stores one or more bits of information indicating which cluster to start.

[0139] One or more master ECUs (ie, ECUs with built-in electronic fuses) are installed in a vehicle. As shown in Fig. 17, one or more nodes belonging to each cluster are determined in advance by the system developer. Although it is possible to assign a cluster to each node, multiple nodes can be registered in one cluster. When the bit corresponding to each cluster is active (i.e., bit=1), the cluster wakes up. In the case of the master ECU, waking up means turning on the electronic fuse.

[0140] (First startup example) The first startup example is an operation example in which a fault diagnosis of the slave ECU 3 is performed in response to a request from the cloud.

[0141] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud.

[0142] Next, the master ECU 2 determines a service called "fault diagnosis of the slave ECU 3" based on the event, and generates an NM frame in which the bit of the third cluster to which only the slave ECU 3 belongs is enabled in order to start the slave ECU 3.

[0143] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 6 and 7. Since there are no NM-equipped nodes belonging to the third cluster on communication buses 6 and 7, there are no changes in the devices on the communication buses.

[0144] Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the third cluster is enabled at the same time as the above. Next, when the control unit 11 of the master ECU 2 determines to issue a wake-up instruction to the third cluster, the control unit 11 turns on the electronic fuse 15 since the third cluster includes the electronic fuse 15.

[0145] When the electronic fuse 15 is turned on, power is supplied to the downstream slave ECU 3 and the slave ECU 3 starts up. The master ECU 2 waits for the slave ECU 3 to start up, requests a diagnostic code from the slave ECU 3, and transmits a response from the slave ECU 3 to the base station via the wireless device 503.

[0146] (Second startup example) The second activation example is an operation example in which a fault diagnosis of the slave ECU 506 is performed in response to a request from the cloud.

[0147] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud.

[0148] Next, the master ECU 2 determines a service called "fault diagnosis of the slave ECU 506" based on the event, and generates an NM frame in which the bit of the fourth cluster to which only the slave ECU 506 belongs is enabled in order to start the slave ECU 506.

[0149] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 6 and 7. Since the slave ECU 506 is present on the communication bus 6 as a node belonging to the fourth cluster, the slave ECU 506 wakes up.

[0150] Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the fourth cluster is enabled at the same time as the above. Next, even if the control unit 11 of the master ECU 2 determines to issue a wake-up instruction to the fourth cluster based on the NM frame, the fourth cluster does not include the corresponding electronic fuse, so the control unit 11 ignores the instruction.

[0151] When the slave ECU 506 is started, the master ECU 2 requests a diagnostic code from the slave ECU 506 via the communication bus, and transmits a response from the slave ECU 506 to the base station via the wireless device 503.

[0152] (Third startup example) The third activation example is an operation example in which a user activates a remote air conditioning device using a smartphone. First, the user issues a command to turn on the vehicle air conditioner via the smartphone.

[0153] When the wireless device 503 receives the instruction signal from the smartphone and determines that the instruction signal is valid, it transmits the event received from the cloud (i.e., the instruction signal) to the master ECU 2.

[0154] The master ECU2 determines the "air conditioning service" based on the event, and generates an NM frame in which the second cluster is activated as the air conditioning cluster. The master ECU 2 periodically transmits the generated NM frame to the communication buses 6 and 7 until an instruction to stop the air conditioner is received. If it is desired to continue the active state, it is necessary to continue transmitting the NM frame periodically. At the same time, the control unit 11 of the master ECU 2 executes processing based on the NM frame.

[0155] When an NM frame that activates the second cluster occurs on the communication bus 6, the slave ECU 506 (ie, the air conditioner ECU) that belongs to the second cluster receives the NM frame and wakes up in accordance with the received NM frame.

[0156] When the control unit 11 of the master ECU 2 detects that the second cluster is active, it turns on the electronic fuses 504 and 505 that belong to the second cluster. When electronic fuse 504 and electronic fuse 505 are in the ON state, power is provided to smart sensor 501 (ie, temperature sensor) and smart actuator 502 (ie, compressor).

[0157] As a result of the above, power supply to the air conditioner ECU, smart sensor 501, and smart actuator 502 begins, making it possible to turn on the in-vehicle air conditioner. When the user issues an instruction to turn off the in-vehicle air conditioner via the smartphone, the master ECU 2 stops the periodic transmission of the NM frame.

[0158] When the NM frame is interrupted, the slave ECU 506 transitions to a sleep state, and the master ECU 2 turns off the electronic fuse 504 and the electronic fuse 505. This stops the in-vehicle air conditioner.

[0159] (4th startup example) The fourth activation example is an operation example in which the slave ECU 506 activates the vehicle air conditioner. Since the slave ECU 506 is always supplied with power even when the vehicle is stopped, it is possible for the slave ECU 506 to wake up when it detects an input of a signal indicating that a start switch connected to the slave ECU 506 has been turned on, even when the slave ECU 506 is in a sleep state.

[0160] When the woken up slave ECU 506 confirms an input to start the in-vehicle air conditioner, it generates an NM frame with the bit corresponding to the second cluster turned on. The slave ECU 506 transmits the generated NM frame via the CAN communication unit 32. When the master ECU 2 receives this NM frame, the master ECU 2 turns on the electronic fuses 504 and 505 that belong to the second cluster.

[0161] When the start switch of the in-vehicle air conditioner is turned off, the slave ECU 506 stops transmitting NM frames and enters a sleep state after a while. When the NM frame is discontinued, the master ECU 2 turns off the electronic fuses 504 and 505 after a while and ends the control.

[0162] If the master ECU 2 determines that control needs to continue even after the transmission of the NM frame has stopped, the master ECU 2 transmits an NM frame with the bit corresponding to the second cluster turned on. This allows the slave ECU 506, the smart sensor 501, and the smart actuator 502 to remain active until the transmission of the NM frame generated by the master ECU 2 stops.

[0163] [Seventh embodiment] The seventh embodiment of the present disclosure will be described below with reference to the drawings. 18, the communication system 100 of the seventh embodiment is mounted on a vehicle and includes a central ECU 101, upstream power distribution units 102, 103, zone ECUs 104, 105, 106, 107, slave ECUs 108, 109, 110, 111, 112, 113, 114, 115, 116, and a battery 117. In the following, the central ECU 101, zone ECUs 104 to 107, and slave ECUs 108 to 116 are also collectively referred to as nodes.

[0164] The battery 117 supplies power to each part of the vehicle at a DC battery voltage (for example, 12 V). The central ECU 101, the upstream power distribution units 102 and 103, the zone ECUs 104 to 107, and the slave ECUs 108 to 116 operate by receiving power supplied from the battery 117.

[0165] The upstream power supply distribution unit 102 receives power supply from the battery 117 via a power supply path 121 between the battery 117 and the upstream power supply distribution unit 102 . The upstream power supply distribution unit 103 receives power supply from the battery 117 via a power supply path 122 between the battery 117 and the upstream power supply distribution unit 103 .

[0166] The zone ECUs 104 and 105 receive power from a battery 117 via power supply paths 123 and 124 between the upstream power distribution unit 102 and the zone ECUs 104 and 105, respectively.

[0167] The zone ECUs 106 and 107 receive power from a battery 117 via power supply paths 125 and 126 between the upstream power distribution unit 103 and the zone ECUs 106 and 107, respectively.

[0168] The slave ECUs 108 and 109 receive power from the battery 117 via power supply paths 127 and 128 between the zone ECU 104 and the slave ECUs 108 and 109, respectively.

[0169] The slave ECUs 110 and 111 are supplied with power from a battery 117 via power supply paths 129 and 130 between the zone ECU 105 and the slave ECUs 110 and 111, respectively.

[0170] The slave ECUs 112, 113, and 114 receive power from a battery 117 via power supply paths 131, 132, and 133 between the zone ECU 106 and the slave ECUs 112, 113, and 114, respectively.

[0171] The slave ECUs 115 and 116 receive power from a battery 117 via power supply paths 134 and 135 between the zone ECU 107 and the slave ECUs 115 and 116, respectively.

[0172] The central ECU 101 and the upstream power distribution unit 102 are connected to each other via a communication line 141 so as to be able to communicate data with each other. The central ECU 101 and the upstream power distribution unit 103 are connected to each other via a communication line 142 so as to be able to communicate data with each other.

[0173] The central ECU 101 and the zone ECUs 104, 105, 106, and 107 are connected to each other via communication lines 143, 144, 145, and 146, respectively, so as to be able to communicate data with each other.

[0174] The zone ECU 104 and the slave ECUs 108 and 109 are connected to each other via a communication bus 147 so as to be able to communicate data with each other. The zone ECU 105 and the slave ECUs 110 and 111 are connected to each other via a communication bus 148 so as to be able to communicate data with each other.

[0175] The zone ECU 106 and the slave ECUs 112, 113, and 114 are connected to each other via a communication bus 149 so as to be able to communicate data with each other. The zone ECU 107 and the slave ECUs 115 and 116 are connected to each other via a communication bus 150 so as to be able to communicate data with each other.

[0176] As shown in FIG. 19, the central ECU 101 includes a control unit 151, communication units 152, 153, 154, 155, 156, and 157, and a storage unit 158. The control unit 151 is an electronic control device mainly composed of a microcomputer including a CPU 161, a ROM 162, a RAM 163, etc. Various functions of the microcomputer are realized by the CPU 161 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 162 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 161 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 151 may be one or more.

[0177] The communication unit 152 communicates with the upstream power distribution unit 102 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. Ethernet is a registered trademark.

[0178] The communication unit 153 communicates with the upstream power distribution unit 103 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 154 communicates with the zone ECU 104 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0179] The communication unit 155 communicates with the zone ECU 105 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 156 communicates with the zone ECU 106 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0180] The communication unit 157 communicates with the zone ECU 107 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The storage unit 158 ​​is a storage device for storing various data. The storage unit 158 ​​stores a startup table 165, which will be described later.

[0181] The upstream power distribution unit 102 includes a control circuit 171 , a communication unit 172 , and electronic fuses 173 and 174 . The control circuit 171 performs control to switch the electronic fuses 173 and 174 between an on state and an off state based on an instruction obtained from the central ECU 101 via a communication unit 172 .

[0182] The communication unit 172 communicates with the central ECU 101 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0183] The electronic fuse 173 is disposed between the power supply path 121 and the power supply path 123. The electronic fuse 174 is disposed between the power supply path 121 and the power supply path . The upstream power distribution unit 103 includes a control circuit 181 , a communication unit 182 , and electronic fuses 183 and 184 .

[0184] The control circuit 181 performs control to switch the electronic fuses 183 and 184 between the on state and the off state based on an instruction obtained from the central ECU 101 via the communication unit 182 .

[0185] The communication unit 182 communicates with the central ECU 101 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0186] The electronic fuse 183 is disposed between the power supply path 122 and the power supply path 125. The electronic fuse 184 is disposed between the power supply path 122 and the power supply path 126. As shown in FIG. 20, the zone ECU 104 includes a control unit 191, a communication unit 192, a CAN communication unit 193, a storage unit 194, and electronic fuses 195 and 196.

[0187] The control unit 191 is an electronic control device mainly composed of a microcomputer including a CPU 201, a ROM 202, a RAM 203, etc. Various functions of the microcomputer are realized by the CPU 201 executing a program stored in a non-transient real recording medium. In this example, the ROM 202 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 201 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 191 may be one or more.

[0188] The communication unit 192 communicates with the central ECU 101 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0189] The CAN communication unit 193 communicates with the slave ECUs 108 and 109 connected to the communication bus 147 by transmitting and receiving communication frames based on the CAN communication protocol.

[0190] The storage unit 194 is a storage device for storing various data. The storage unit 194 stores a startup table 205, which will be described later. The electronic fuse 195 is disposed between the power supply path 123 and the power supply path 127. The electronic fuse 196 is disposed between the power supply path 123 and the power supply path 128.

[0191] The zone ECU 105 includes a control unit 211, a communication unit 212, a CAN communication unit 213, a storage unit 214, and electronic fuses 215 and 216. The control unit 211 is an electronic control device mainly composed of a microcomputer including a CPU 221, a ROM 222, a RAM 223, etc. Various functions of the microcomputer are realized by the CPU 221 executing a program stored in a non-transient real recording medium. In this example, the ROM 222 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 221 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 211 may be one or more.

[0192] The communication unit 212 communicates with the central ECU 101 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0193] The CAN communication unit 213 communicates with the slave ECUs 110 and 111 connected to the communication bus 148 by transmitting and receiving communication frames based on the CAN communication protocol.

[0194] The storage unit 214 is a storage device for storing various data. The storage unit 214 stores a startup table 225, which will be described later. The electronic fuse 215 is disposed between the power supply path 124 and the power supply path 129. The electronic fuse 216 is disposed between the power supply path 124 and the power supply path 130.

[0195] As shown in FIG. 21, the zone ECU 106 includes a control unit 231, a communication unit 232, a CAN communication unit 233, a storage unit 234, and electronic fuses 235, 236, and 237. The control unit 231 is an electronic control device mainly composed of a microcomputer including a CPU 241, a ROM 242, a RAM 243, etc. Various functions of the microcomputer are realized by the CPU 241 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 242 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 241 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 231 may be one or more.

[0196] The communication unit 232 communicates with the central ECU 101 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0197] The CAN communication unit 233 communicates with the slave ECUs 112, 113, and 114 connected to the communication bus 149 by transmitting and receiving communication frames based on the CAN communication protocol.

[0198] The storage unit 234 is a storage device for storing various data. The storage unit 234 stores a startup table 245, which will be described later. The electronic fuse 235 is disposed between the power supply path 125 and the power supply path 131. The electronic fuse 236 is disposed between the power supply path 125 and the power supply path 132. The electronic fuse 237 is disposed between the power supply path 125 and the power supply path 133.

[0199] The zone ECU 107 includes a control unit 251, a communication unit 252, a CAN communication unit 253, a storage unit 254, and electronic fuses 255 and 256. The control unit 251 is an electronic control device mainly composed of a microcomputer including a CPU 261, a ROM 262, a RAM 263, etc. Various functions of the microcomputer are realized by the CPU 261 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 262 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 261 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 251 may be one or more.

[0200] The communication unit 252 communicates with the central ECU 101 connected to the communication line 146 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0201] The CAN communication unit 253 communicates with the slave ECUs 115 and 116 connected to the communication bus 150 by transmitting and receiving communication frames based on the CAN communication protocol.

[0202] The storage unit 254 is a storage device for storing various data. The storage unit 254 stores a startup table 265, which will be described later. The electronic fuse 255 is disposed between the power supply path 126 and the power supply path 134. The electronic fuse 256 is disposed between the power supply path 126 and the power supply path 135.

[0203] As shown in FIG. 22, the slave ECUs 108 and 109 each include a control unit 271, a CAN communication unit 272, and a storage unit 273. The control unit 271 is an electronic control device mainly composed of a microcomputer including a CPU 281, a ROM 282, a RAM 283, etc. Various functions of the microcomputer are realized by the CPU 281 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 282 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 281 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 271 may be one or more.

[0204] The CAN communication unit 272 communicates with the zone ECUs 104 connected to the communication bus 147 based on the CAN communication protocol. The storage unit 273 is a storage device for storing various data. The storage unit 273 stores a startup table 285, which will be described later.

[0205] The slave ECUs 110 and 111 each include a control unit 291 , a CAN communication unit 292 , and a storage unit 293 . The control unit 291 is an electronic control device mainly composed of a microcomputer including a CPU 301, a ROM 302, a RAM 303, etc. Various functions of the microcomputer are realized by the CPU 301 executing a program stored in a non-transient real recording medium. In this example, the ROM 302 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 301 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 291 may be one or more.

[0206] The CAN communication unit 292 communicates with the zone ECU 105 connected to the communication bus 148 based on the CAN communication protocol. The storage unit 293 is a storage device for storing various data. The storage unit 293 stores a startup table 305, which will be described later.

[0207] The slave ECUs 112 , 113 , and 114 each include a control unit 311 , a CAN communication unit 312 , and a storage unit 313 . The control unit 311 is an electronic control device mainly composed of a microcomputer including a CPU 321, a ROM 322, a RAM 323, etc. Various functions of the microcomputer are realized by the CPU 321 executing a program stored in a non-transient real recording medium. In this example, the ROM 322 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 321 may be configured as hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 311 may be one or more.

[0208] The CAN communication unit 312 communicates with the zone ECU 106 connected to the communication bus 149 based on the CAN communication protocol. The storage unit 313 is a storage device for storing various data. The storage unit 313 stores a startup table 325, which will be described later.

[0209] The slave ECUs 115 and 116 each include a control unit 331 , a CAN communication unit 332 , and a storage unit 333 . The control unit 331 is an electronic control device mainly composed of a microcomputer including a CPU 341, a ROM 342, a RAM 343, etc. Various functions of the microcomputer are realized by the CPU 341 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 342 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 341 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 331 may be one or more.

[0210] The CAN communication unit 332 communicates with the zone ECU 107 connected to the communication bus 150 based on the CAN communication protocol. The storage unit 333 is a storage device for storing various data. The storage unit 333 stores a startup table 345, which will be described later.

[0211] In the initiation tables 165, 205, 225, 245, 265, 285, 305, 325, and 345, a communication group to be initiated (that is, an initiation group) is set for each event.

[0212] The activation table 205 of the zone ECU 104 further stores a correspondence between the activation group and one of the electronic fuses 195 and 196 built in the zone ECU 104 that is to be turned on.

[0213] The activation table 225 of the zone ECU 105 further stores a correspondence between the activation group and one of the electronic fuses 215, 216 built in the zone ECU 105 that is to be turned on.

[0214] The activation table 245 of the zone ECU 106 further stores a correspondence between the activation group and the electronic fuses 235, 236, and 237 built in the zone ECU 106 that are to be turned on.

[0215] The activation table 265 of the zone ECU 107 further stores a correspondence between the activation group and one of the electronic fuses 255 and 256 built in the zone ECU 107 that is to be turned on.

[0216] Upon receiving an NM frame, the zone ECUs 104, 105, 106, and 107 are configured to set the electronic fuses under their control to the on or off state by referring to the activation tables 205, 225, 246, and 267 based on the activation group indicated by the NM frame.

[0217] The slave ECUs 108 to 116 execute a process corresponding to the interruption diagnosis invalidation process of the fifth embodiment. That is, when communication interruption diagnosing information of other nodes is stored, the slave ECUs 108 to 116 inquire of all the zone ECUs 104 to 107 about the states of the electronic fuses.

[0218] When the zone ECUs 104 to 107 receive an inquiry from the slave ECUs 108 to 116, they check the status of the electronic fuses under their control. The zone ECUs 104 to 107 generate electronic fuse status information based on the check results, and transmit the generated electronic fuse status information to the slave ECUs 108 to 116 that have received the inquiry.

[0219] The slave ECUs 108-116 determine whether or not the electronic fuse connected to the other node corresponding to the stored communication interruption diagnosing information has been intentionally cut off based on the electronic fuse state information acquired from the zone ECUs 104-107. If the cutoff is intentional, the slave ECUs 108-116 invalidate the communication interruption diagnosing information.

[0220] In the embodiments described above, the electronic fuse 195 corresponds to the first electronic fuse, the battery 117 corresponds to the power supply, the slave ECU 108 corresponds to the first control device, the electronic fuse 196 corresponds to the second electronic fuse, and the slave ECU 109 corresponds to the second control device.

[0221] Moreover, the central ECU 101 corresponds to a management device, the control unit 151 corresponds to a switching control unit, the storage unit 273 of the slave ECU 109 corresponds to a diag information storage unit, and the storage unit 273 of the slave ECU 109 corresponds to a state information storage unit.

[0222] [Eighth embodiment] An eighth embodiment of the present disclosure will be described below with reference to the drawings. In the eighth embodiment, differences from the seventh embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0223] In the communication system 100 of the eighth embodiment, the central ECU 101 executes a process corresponding to the advance notification process of the first embodiment. That is, when there is an electronic fuse to be intentionally cut off (S10), the central ECU 101 transmits power cut-off notification information to the slave ECUs 108-116 connected to the electronic fuse to be intentionally cut off, using the zone ECUs 104-107 as repeaters (S20).

[0224] When the slave ECUs 108 to 116 receive the power cutoff notification information, they store the received power cutoff notification information together with reception date and time information indicating the date and time when the power cutoff notification information was received. Immediately after startup, if power-off notification information is stored (S120), the slave ECUs 108 to 116 store power-restoration date and time information (S130).

[0225] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to a diagnostic information storage unit, and the storage unit 273 of the slave ECU corresponds to a state information storage unit. [Ninth embodiment] A ninth embodiment of the present disclosure will be described below with reference to the drawings. In the ninth embodiment, differences from the seventh embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0226] In the communication system 100 of the ninth embodiment, the slave ECUs 108 to 116 execute processing corresponding to the notification confirmation processing of the second embodiment. Note that the slave ECUs 108 to 116 each include a power storage unit (not shown).

[0227] That is, when the power supply from the battery 117 is cut off (S210), the slave ECUs 108 to 116 check whether or not there is power cut-off notification information (S220), and when the power cut-off notification information is stored (S230), they store the slave cut-off information together with slave cut-off time information (S240).

[0228] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to a diagnostic information storage unit, and the storage unit 273 of the slave ECU corresponds to a state information storage unit. [Tenth embodiment] A tenth embodiment of the present disclosure will be described below with reference to the drawings. In the tenth embodiment, only the parts different from the seventh embodiment will be described. The same reference numerals will be used to designate the same components.

[0229] In the communication system 100 of the tenth embodiment, the central ECU 101 executes a process corresponding to the advance storage process of the third embodiment. That is, when there is an electronic fuse to be intentionally blown (S410), the central ECU 101 stores in the memory unit 158 ​​blown fuse notification information notifying the electronic fuse to be blown and fuse blown time information indicating the time when the electronic fuse will be blown (S420).

[0230] In the above-described embodiment, the storage unit 273 of the slave ECU 109 corresponds to the diagnostic information storage unit, and the storage unit 158 ​​of the central ECU 101 corresponds to the state information storage unit. [Eleventh embodiment] An eleventh embodiment of the present disclosure will be described below with reference to the drawings. In the eleventh embodiment, only the parts different from the seventh embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0231] In the communication system 100 of the eleventh embodiment, the central ECU 101 executes a process corresponding to the advance notification process of the fourth embodiment. That is, when the central ECU 101 intentionally blows an electronic fuse (S610), it transmits blown fuse notification information notifying the electronic fuse to be blown and fuse blown time information indicating the time to blow the electronic fuse to all slave ECUs 108 to 116 in the communication system 100 (S620).

[0232] Moreover, the slave ECUs 108 to 116 execute a process corresponding to the interruption diagnosis invalidation process of the fourth embodiment. That is, when the slave ECUs 108-116 store communication interruption diagnostic information of other nodes (S710) and receive fuse cut notification information indicating an electronic fuse connected to the other node (S720), they invalidate the interruption diagnostic information related to the slave ECU connected to the electronic fuse indicated in the fuse cut notification information around the time of fuse cut (S730).

[0233] In the embodiment described above, the storage unit 273 of the slave ECU 109 corresponds to a diag information storage unit, and the storage unit 273 of the slave ECU 109 corresponds to a state information storage unit. Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modified forms.

[0234] [Variation 1] In the third, fourth and fifth embodiments, the slave ECU 3 and the slave ECU 4 are connected to the communication bus 6. However, as shown in Fig. 15, three or more ECUs may be connected to the communication bus 6. In Fig. 15, in addition to the slave ECU 3 and the slave ECU 4, a slave ECU 8 and a slave ECU 9 are connected to the communication bus 6.

[0235] In this case, the master ECU 2 of the fourth embodiment may transmit the fuse cutoff notification information and the fuse cutoff time information to all slave ECUs (i.e., the slave ECUs 3, 4, 8, and 9) connected to the communication bus 6. As a result, in the communication system 1, not only the slave ECUs 3 and 4 but also the slave ECUs 8 and 9 can obtain the fuse cutoff notification information and the fuse cutoff time information. Therefore, not only the slave ECUs 3 and 4 but also the slave ECUs 8 and 9 can determine whether the master ECU 2 intentionally put the electronic fuses 15 and 16 in the OFF state. As a result, in the communication system 1, it is possible to prevent the slave ECUs 8 and 9 from determining that the slave ECUs 3 and 4 have an abnormality of communication interruption even though no abnormality has occurred in the slave ECUs 3 and 4. As a result, the communication system 1 can further improve the abnormality detection accuracy.

[0236] There may also be a slave ECU connected to a communication bus (e.g., the communication bus 7 in FIG. 5) that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2. In this case, the master ECU 2 in the fourth embodiment may transmit the blown fuse notification information and the fuse blown time information to all slave ECUs connected to the communication bus that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2.

[0237] Furthermore, the master ECU 2 in the fifth embodiment may transmit the electronic fuse state information to all slave ECUs (i.e., the slave ECUs 3, 4, 8, and 9) connected to the communication bus 6. This enables the communication system 1 to reduce the frequency at which the slave ECUs 8 and 9 transmit status confirmation requests to the master ECU 2, thereby reducing the usage rate of the communication bus 6 (i.e., the bus load).

[0238] There may also be a slave ECU connected to a communication bus (e.g., the communication bus 7 in FIG. 5) that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2. In this case, the master ECU 2 in the fifth embodiment may transmit electronic fuse state information to all slave ECUs connected to the communication bus that can communicate with the slave ECU 3 connected to the electronic fuse 15 via the master ECU 2.

[0239] [Variation 2] In the above embodiment, the operator who performs the vehicle inspection connects the fault diagnosis device 600 to the master ECU 2 to acquire the diagnostic information, etc. However, the fault diagnosis device 600 may be connected to the master ECU 2 by remote communication to acquire the diagnostic information, etc., and then invalidate the diagnostic information.

[0240] [Variation 3] In the above fourth embodiment, a form has been shown in which the blown fuse notification information and the fuse blown time information are transmitted after the electronic fuses 15, 16 are blown, but the blown fuse notification information and the fuse blown time information may also be transmitted before the electronic fuses 15, 16 are blown.

[0241] [Variation 4] In the first embodiment, the power recovery date and time information is stored when the power cutoff notification information is stored. However, the slave ECUs 3 and 4 may store the power recovery date and time information when started by power supply from the battery 5, regardless of whether the power cutoff notification information is stored. This makes it possible to invalidate the diagnosing information related to the slave ECUs 3 and 4 from the cutoff notification reception date and time to the power recovery date and time when both the power cutoff notification information and the power recovery date and time information are stored before and after the power recovery of the slave ECUs 3 and 4.

[0242] [Variation 5] In the second embodiment, the slave ECUs 3 and 4 store slave cutoff information and slave cutoff time information when power cutoff notification information is stored. However, the slave ECUs 3 and 4 may store slave cutoff information and slave cutoff time information when power supply from the battery 5 is cut off, regardless of whether power cutoff notification information is stored. This makes it possible to invalidate diagnostic information related to the slave ECUs 3 and 4 that occurs around the slave cutoff time when both power cutoff notification information and slave cutoff information are stored.

[0243] [Variation 6] In the above embodiment, the first embodiment and the second embodiment are described separately. However, both the power recovery date and time information of the first embodiment and the slave cutoff time information of the second embodiment may be stored. This makes it possible to invalidate the diagnostic information from the time indicated by the slave cutoff time information to the time indicated by the power recovery date and time information.

[0244] [Variation 7] In the above fifth embodiment, the slave ECUs 3 and 4 transmit a status confirmation request inquiring about the status of the electronic fuse connected to the slave ECU corresponding to the communication interruption diagnosing information to the master ECU 2. However, the slave ECUs 3 and 4 may inquire about an ECU status indicating whether or not the power supply to the slave ECU corresponding to the communication interruption diagnosing information is interrupted.

[0245] [Variation 8] In the sixth embodiment, the slave ECUs 108-116 inquire about the states of the electronic fuses of all the zone ECUs 104-107. However, if the zone ECUs 104-107 notify the central ECU 101 of the states of the electronic fuses under their control, the slave ECUs 108-116 may inquire about the states of the electronic fuses of the central ECU 101. The core ECU 101 centrally manages the states of the electronic fuses provided in the zone ECUs 104-107 based on the notifications from the zone ECUs 104-107. Therefore, the core ECU 101 can respond to inquiries from the slave ECUs 108-116 with the states of the electronic fuses.

[0246] [Variation 9] In the above first and second embodiments, the master ECU 2 transmits the power cutoff notification information to the slave ECUs 3 and 4. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the zone ECUs 104 to 107, and the slave ECUs 108 to 116, the zone ECUs 104 to 107 may transmit the power cutoff notification information to the slave ECUs 108 to 116 under their control.

[0247] [Variation 10] In the above third embodiment, when there is an electronic fuse to be intentionally cut off, the master ECU 2 stores cut fuse notification information notifying the electronic fuse to be cut off and fuse cut time information indicating the time to cut off the electronic fuse. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the zone ECUs 104 to 107, and the slave ECUs 108 to 116, the zone ECUs 104 to 107 may store the cut fuse notification information and fuse cut time information related to the electronic fuses under their control. Also, when the zone ECUs 104 to 107 notify the central ECU 101 of the states of the electronic fuses under their control, the central ECU 101 may store the cut fuse notification information and fuse cut time information related to all the electronic fuses in the communication system 100.

[0248] [Variation 11] In the above fourth embodiment, the master ECU 2 transmits the blown fuse notification information and the fuse blown time information to the slave ECUs 3 and 4. However, as shown in the sixth embodiment, when the communication system 100 includes the central ECU 101, the zone ECUs 104 to 107, and the slave ECUs 108 to 116, the zone ECUs 104 to 107 may transmit the blown fuse notification information and the fuse blown time information to all the slave ECUs 108 to 116.

[0249] [Variation 12] In the above fourth embodiment, the disruption diagnosing information is invalidated near the time indicated by the fuse cutoff time information. However, the disruption diagnosing information may be invalidated between the time indicated by the fuse cutoff time information and a preset invalidation end condition is satisfied. The invalidation end condition may be, for example, obtaining conductive fuse notification information indicating that the corresponding electronic fuse has been turned on, or receiving a communication frame from the ECU that is the subject of the disruption diagnosing information.

[0250] The control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in the control unit 11, 31 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0251] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0252] In addition to the above-mentioned ECUs 2-4, 101, 104-116, the present disclosure can also be realized in various forms, such as a system having the ECUs 2-4, 101, 104-116 as components, a program for causing a computer to function as the ECUs 2-4, 101, 104-116, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a communication method. [Technical idea disclosed in this specification] [Item 1] a first control device (3, 108) that receives power from a power source (5, 117) via a first electronic fuse (15, 195); a second control device (4, 109) connected to the first control device so as to be capable of data communication with the first control device and receiving power from the power source via a second electronic fuse (16, 196); A communication system (1, 100) including a management device (2, 101) connected to the first control device and the second control device so as to be capable of data communication therebetween, a switching control unit (11, 151) configured to execute switching control for switching the first electronic fuse and the second electronic fuse to an on state or an off state; a diagnostic information storage unit (33, 273) configured to store diagnostic information related to communication with the first control device; a status information storage unit (14, 33, 158, 273) configured to store first fuse status information related to a status of the first electronic fuse, the first fuse status information being information to be referenced for invalidating the diagnostic information; A communication system comprising:

[0253] [Item 2] Item 1 is a communication system according to the present invention, a cutoff notification transmission unit (S20, S610 to S620) configured to transmit first power cutoff related information regarding cutting off the power supply from the power source via the first electronic fuse before or after the first electronic fuse is turned off in order to cut off the power supply from the power source to the first control device; The communication system, wherein the state information storage unit (S110 to S130, S240) is configured to store the first fuse state information upon receiving the first power supply cutoff related information.

[0254] [Item 3] Item 2. A communication system according to the present invention, the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that, when started up by power supply from the power source, the status information storage unit (S110-S130) determines whether the power cut-off notification information is stored in the first control device, and if the power cut-off notification information is stored, stores power recovery date and time information indicating the date and time when the first control device was most recently started up as the first fuse status information.

[0255] [Item 4] Item 2. A communication system according to the present invention, the shutoff notification transmission unit (S610 to S620) is configured to transmit, as the first power supply shutoff related information, to the second control device, first shutoff fuse notification information notifying the first electronic fuse to be shut off and first fuse shutoff time information indicating the time to shut off the first electronic fuse, before or after turning off the first electronic fuse to shut off the power supply from the power source to the first control device; The communication system is configured such that the state information storage unit stores the first blown fuse notification information and the first fuse blown time information received by the second control device as the first fuse state information.

[0256] [Item 5] Item 2. A communication system according to the present invention, The first control device includes a standby power supply (35), the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that the status information storage unit (S240) determines whether or not the power cut-off notification information has been acquired when the power supply from the power source is cut off, and if the power cut-off notification information has been acquired, stores power cut-off information indicating that the power source has been cut off as the first fuse status information.

[0257] [Item 6] Item 1 is a communication system according to the present invention, The status information storage unit (S410 to S420) is configured to store in the management device, as the first fuse status information, first blown fuse notification information notifying the first electronic fuse to be blown and first fuse blown time information indicating the time to blow the first electronic fuse before turning off the first electronic fuse to cut off the power supply from the power source to the first control device, and to store in the management device, second blown fuse notification information notifying the second electronic fuse to be blown and second fuse blown time information indicating the time to blow the second electronic fuse before turning off the second electronic fuse to cut off the power supply from the power source to the second control device.

[0258] [Item 7] Item 1 is a communication system according to the present invention, The first control device is a first request unit (S820) configured to transmit a second status confirmation request to the management device inquiring about a status of the second electronic fuse when second communication interruption diagnosing information indicating that communication with the second control device has been interrupted is stored; The second control device is a second request unit (S820) configured to transmit a first status confirmation request to the management device inquiring about a status of the first electronic fuse when first communication interruption diagnosing information indicating that communication with the first control device has been interrupted is stored; The management device includes: a response unit (S910 to S930) configured to, when receiving the second status confirmation request from the first control device, confirm a status of the second electronic fuse and transmit second electronic fuse status information indicating a confirmation result to the first control device, and to, when receiving the first status confirmation request from the second control device, confirm a status of the first electronic fuse and transmit first electronic fuse status information indicating a confirmation result to the second control device; The communication system is configured such that the state information storage unit stores the acquired first electronic fuse state information as the first fuse state information in the second control device.

[0259] [Item 8] Item 5. A communication system according to item 4, The communication system is configured such that the shutdown notification sending unit transmits the first shutdown fuse notification information and the first fuse shutdown time information to all electronic control devices (4, 8, 9) connected to the same communication bus (6) as the first control device and to a communication bus (7) that can communicate with the first control device via the management device.

[0260] [Item 9] Item 7. A communication system according to item 7, A communication system in which the response unit of the management device is configured to transmit the first electronic fuse status information to all electronic control devices (4, 8, 9) connected to the same communication bus (6) as the first control device and to a communication bus (7) that can communicate with the first control device via the management device.

[0261] [Item 10] Item 2. A communication system according to the present invention, the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that, when started up by power supply from the power source, the status information storage unit stores power recovery date and time information indicating the date and time when the first control device was most recently started up as the first fuse status information.

[0262] [Item 11] Item 2. A communication system according to the present invention, The first control device includes a standby power supply (35), the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that, when power supply from the power source is cut off, the status information storage unit (S240) stores, as the first fuse status information, power cut-off information indicating that the power source has been cut off.

[0263] [Item 12] A communication system according to any one of items 1 to 11, At least one of the one or more electronic control devices included in the communication system is configured to invalidate the diagnostic information based on the first fuse status information.

[0264] [Item 13] A communication system according to any one of items 1 to 12, A communication system, comprising: a service tool (600) connected to the communication system, configured to invalidate the diagnostic information based on the first fuse status information.

[0265] [Item 14] Item 3. A communication system according to item 3, The second control device is configured to invalidate the diagnostic information based on the first fuse state information, going back to a timing when the power cutoff notification information was acquired.

[0266] [Item 15] Item 15. A communication system according to item 14, The second control device is configured to end the invalidation of the diagnostic information when a preset invalidation end condition is satisfied.

[0267] [Item 16] A communication system according to any one of items 3 to 5, The communication system is configured such that the shutdown notification transmission unit transmits the first power supply shutdown related information to all electronic control devices included in the communication system.

[0268] [Item 17] Item 7. A communication system according to item 7, The communication system includes: the first control device and the second control device are included as slave control devices (108, 109), a zone control device (104) is connected to the slave control devices so as to be able to communicate data therebetween and configured to control the operation of the first electronic fuse (195) and the second electronic fuse (196), and a central control device (101) is connected to the zone control devices so as to be able to communicate data therebetween, The first request unit is configured to transmit the second status confirmation request to all of the zone control devices included in the communication system; A communication system, wherein the second request unit is configured to transmit the first status confirmation request to all of the zone control devices included in the communication system.

[0269] [Item 18] Item 7. A communication system according to item 7, The communication system includes: the first control device and the second control device are included as slave control devices (108, 109), a zone control device (104) connected to the slave control devices so as to be able to communicate data therebetween and configured to control operations of the first electronic fuse and the second electronic fuse, and a central control device (101) connected to the zone control devices so as to be able to communicate data therebetween are included as the management devices; the first request unit is configured to transmit the second status confirmation request to the central control device; The second request unit is configured to transmit the first status confirmation request to the central control device. [Explanation of symbols]

[0270] 1... communication system, 2... master ECU, 3, 4... slave ECU, 5... battery, 11... control unit, 14... memory unit, 15, 16... electronic fuse, 31... control unit, 33... memory unit, 35... power storage unit, 100... communication system, 101... central ECU, 104... zone ECU, 108, 109... slave ECU, 117... battery, 151... control unit, 158... memory unit, 195, 196... electronic fuse, 273... memory unit

Claims

1. a first control device (3, 108) receiving power from a power source (5, 117) via a first electronic fuse (15, 195); a second control device (4, 109) connected to the first control device so as to be capable of data communication with the first control device and receiving power from the power source via a second electronic fuse (16, 196); A communication system (1, 100) including a management device (2, 101) connected to the first control device and the second control device so as to be capable of data communication with each other, a switching control unit (11, 151) configured to execute switching control for switching the first electronic fuse and the second electronic fuse to an on state or an off state; A diagnostic information storage unit (33, 273) configured to store diagnostic information related to communication with the first control device; a state information storage unit (14, 33, 158, 273) configured to store first fuse state information related to a state of the first electronic fuse, the first fuse state information being information to be referenced for invalidating the diagnosing information; A communication system comprising:

2. 2. The communication system according to claim 1, a cutoff notification transmission unit (S20, S610 to S620) configured to transmit first power cutoff related information regarding cutting off the power supply from the power source via the first electronic fuse before or after the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system, wherein the status information storage unit (S110 to S130, S240) is configured to store the first fuse status information as a result of receiving the first power supply cutoff related information.

3. 3. The communication system according to claim 2, the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying the first control device that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that, when started up by power supply from the power source, the status information storage unit (S110 to S130) determines whether the power cut-off notification information is stored in the first control device, and if the power cut-off notification information is stored, stores power recovery date and time information indicating the date and time when the first control device was most recently started up as the first fuse status information.

4. 3. The communication system according to claim 2, the shutdown notification transmission unit (S610 to S620) is configured to transmit, as the first power supply shutdown related information to the second control device, first shutdown fuse notification information notifying the first electronic fuse to be shut off and first fuse shutdown time information indicating the time to shut off the first electronic fuse, before or after the first electronic fuse is turned off in order to shut off the power supply from the power source to the first control device; The state information storage unit is configured to store the first blown fuse notification information and the first fuse blown time information received by the second control device as the first fuse state information.

5. 3. The communication system according to claim 2, The first control device includes a standby power supply (35); the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying the first control device that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The status information storage unit (S240) is configured to determine whether or not the power supply cut-off notification information has been acquired when the power supply from the power source is cut off, and if the power supply cut-off notification information has been acquired, to store power supply cut-off information indicating that the power source has been cut off as the first fuse status information.

6. 2. The communication system according to claim 1, The status information memory unit (S410 to S420) is configured to store in the management device as first fuse status information first blown fuse notification information notifying the first electronic fuse to be blown and first fuse blown time information indicating the time to blow the first electronic fuse before turning off the first electronic fuse to cut off the power supply from the power source to the first control device, and to store in the management device second blown fuse notification information notifying the second electronic fuse to be blown and second fuse blown time information indicating the time to blow the second electronic fuse before turning off the second electronic fuse to cut off the power supply from the power source to the second control device.

7. 2. The communication system according to claim 1, The first control device is a first request unit (S820) configured to transmit a second status confirmation request to the management device inquiring about a status of the second electronic fuse when second communication interruption diagnosing information indicating that communication with the second control device has been interrupted is stored; The second control device is a second request unit (S820) configured to transmit a first status confirmation request to the management device inquiring about a status of the first electronic fuse when first communication interruption diagnosing information indicating that communication with the first control device has been interrupted is stored; The management device includes: a response unit (S910 to S930) configured to, when receiving the second status confirmation request from the first control device, confirm a status of the second electronic fuse and transmit second electronic fuse status information indicating a confirmation result to the first control device, and to, when receiving the first status confirmation request from the second control device, confirm a status of the first electronic fuse and transmit first electronic fuse status information indicating a confirmation result to the second control device; The state information storage unit is configured to store the acquired first electronic fuse state information as the first fuse state information in the second control device.

8. 5. The communication system according to claim 4, The communication system is configured such that the shutdown notification sending unit transmits the first shutdown fuse notification information and the first fuse shutdown time information to all electronic control devices (4, 8, 9) connected to the same communication bus (6) as the first control device and to a communication bus (7) that can communicate with the first control device via the management device.

9. 8. The communication system according to claim 7, A communication system in which the response unit of the management device is configured to transmit the first electronic fuse status information to all electronic control devices (4, 8, 9) connected to the same communication bus (6) as the first control device and to a communication bus (7) that can communicate with the first control device via the management device.

10. 3. The communication system according to claim 2, the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying the first control device that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The status information storage unit is configured to store, when started up by power supply from the power source, power recovery date and time information indicating the date and time when the first control device was most recently started up as the first fuse status information.

11. 3. The communication system according to claim 2, The first control device includes a standby power supply (35); the cutoff notification transmission unit (S20) is configured to transmit, as the first power cutoff related information to the first control device, power cutoff notification information notifying the first control device that power supply from the power source via the first electronic fuse will be cut off before the first electronic fuse is set to the off state in order to cut off the power supply from the power source to the first control device; The communication system is configured such that, when power supply from the power source is cut off, the status information storage unit (S240) stores power cut-off information indicating that the power source has been cut off as the first fuse status information.

12. A communication system according to any one of claims 1 to 7, A communication system, wherein at least one of one or more electronic control devices included in the communication system is configured to invalidate the diagnostic information based on the first fuse status information.

13. A communication system according to any one of claims 1 to 7, A communication system, comprising: a service tool (600) connected to the communication system, configured to invalidate the diagnostic information based on the first fuse status information.

14. 4. The communication system according to claim 3, The second control device is configured to invalidate the diagnosing information based on the first fuse state information, going back to a timing when the power cutoff notification information was acquired.

15. 15. A communication system according to claim 14, comprising: The second control device is configured to end the invalidation of the diagnostic information when a preset invalidation end condition is satisfied.

16. The communication system according to any one of claims 3 to 5, The communication system is configured such that the shutdown notification transmission unit transmits the first power supply shutdown related information to all electronic control devices included in the communication system.

17. 8. The communication system according to claim 7, The communication system includes: The system includes, as the management device, a zone control device (104) that is connected to the slave control devices so as to be capable of data communication and that is configured to control the operation of the first electronic fuse (195) and the second electronic fuse (196), and a central control device (101) that is connected to the zone control devices so as to be capable of data communication; The first request unit is configured to transmit the second status confirmation request to all of the zone control devices included in the communication system, The second request unit is configured to transmit the first status confirmation request to all of the zone control devices included in the communication system.

18. 8. The communication system according to claim 7, The communication system includes: The system includes, as the management device, a zone control device (104) that is connected to the slave control devices so as to be able to communicate data with the first control device and the second control device and that is configured to control the operation of the first electronic fuse and the second electronic fuse, and a central control device (101) that is connected to the zone control devices so as to be able to communicate data with the zone control devices, the first request unit is configured to transmit the second status confirmation request to the central control device; The second request unit is configured to transmit the first status confirmation request to the central control device.

Images