Communication system, management device, and management program

Abstract

To improve the accuracy of abnormality detection in a communication system.SOLUTION: A communication system 1 includes slave ECUs 3 and 4 and a master ECU 2. The slave ECU 3 receives power from a battery 5 via an electronic fuse 15. The slave ECU 4 is connected so as to be able to perform data communication with the slave ECU 3. The master ECU 2 is connected so as to be able to perform data communication with the slave ECUs 3 and 4, and controls the operation of the electronic fuse 15. The master ECU 2 executes at least one of a prior-notification process and a post-notification process. The prior-notification process transmits power cutoff prior-notification information to the slave ECU 4 before the electronic fuse 15 is turned off. The post-notification process transmits power cutoff post-notification information to the slave ECU 4 after the electronic fuse 15 is turned off.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a communication system including an electronic fuse, a management device, and a management program. [Background technology]

[0002] Patent document 1 describes an in-vehicle network system that includes a power supply relay that individually switches the power supply of each of a plurality of electronic control devices on / off, determines the control content for switching the power supply of a specific electronic control device on / off for a specific electronic control device that corresponds to a scene identified based on the vehicle situation, and uses the power supply relay to switch the power supplied to the specific electronic control device on / off based on the determined control content. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-81021 A Summary of the Invention [Problem to be solved by the invention]

[0004] As a result of detailed investigation by the inventors, it was found that in a communication system having multiple electronic control devices and configured to use electronic fuses to switch the power supply to the electronic control devices on and off, there is a problem in that a communication interruption is erroneously detected, resulting in reduced accuracy in detecting the abnormality.

[0005] The present disclosure aims to improve the accuracy of anomaly detection in a communication system. [Means for solving the problem]

[0006] One aspect of the present disclosure is a communication system (1, 100) including a first control device (3, 108), a second control device (4, 109), a switching control unit (2, 101, 104), and a power cutoff notification unit (S30, S120, S330).

[0007] The first control device receives power from a power source (5, 117) via an electronic fuse (15, 195). The second control device is connected to the first control device so as to be able to perform data communication therebetween.

[0008] The switching control unit is configured to execute switching control for switching the electronic fuse between an on state and an off state. The power cutoff notification unit is configured to execute at least one of an advance notification process and a post-notification process. The advance notification process transmits power cutoff advance notification information to the second control device notifying the second control device that power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off to cut off the power supply from the power source to the first control device. The post-notification process transmits power cutoff post-notification information to the second control device notifying the second control device that power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off to cut off the power supply from the power source to the first control device.

[0009] The second control device is configured to store the received power-off advance notification information and power-off post-notification information. In the communication system of the present disclosure thus configured, when the switching control unit cuts off the power supply to the first control device due to the electronic fuse being turned off, the power cutoff notification unit transmits at least one of power cutoff advance notification information and power cutoff post notification information to the second control device. That is, the communication system of the present disclosure can determine whether the electronic fuse has been turned off based on whether the second control device stores power cutoff advance notification information and power cutoff post notification information. Therefore, even if the second control device detects an abnormality related to the first control device that is caused by the electronic fuse being turned off and is caused by the electronic fuse being turned off, if the second control device stores power cutoff advance notification information and power cutoff post notification information, the communication system of the present disclosure can determine that no abnormality has occurred in the first control device. That is, the communication system of the present disclosure can suppress the occurrence of a situation in which it is determined that an abnormality has occurred in the first control device even when no abnormality has occurred in the first control device. As a result, the communication system of the present disclosure can improve the accuracy of abnormality detection.

[0010] Another aspect of the present disclosure is a management device (2) including an electronic fuse control unit (S40), a communication unit (13), and a power cutoff notification unit (S30, S120, S330). The electronic fuse control unit is configured to control the operation of an electronic fuse (15) that is configured to switch between a conductive state that connects a power supply path that supplies power from the power source (5) to the first control device (3) and a cut-off state that cuts off the power supply path.

[0011] The communication unit is configured to perform data communication with a second control device (4) that is connected to the first control device so as to be able to perform data communication with the first control device. The management device of the present disclosure is a device provided in the communication system of the present disclosure, and can obtain the same effects as the communication system of the present disclosure.

[0012] Yet another aspect of the present disclosure is a management program for causing a computer to function as an electronic fuse control unit (S40), a communication unit (13), and a power cutoff notification unit (S30, S120, S330).

[0013] A computer controlled by the management program of the present disclosure can constitute part of the management device of the present disclosure, and can obtain the same effects as the center of the present disclosure. [Brief description of the drawings]

[0014] [Figure 1] 1 is a block diagram showing a configuration of a communication system according to a first embodiment. [Diagram 2] 5 is a flowchart showing a prior notification process according to the first embodiment. [Diagram 3] 13 is a flowchart showing a post-notification process. [Figure 4] 13 is a flowchart showing a process of disabling a diagnostic interruption; [Diagram 5] FIG. 11 is a block diagram showing a configuration of a communication system according to a second embodiment. [Figure 6] 13 is a flowchart showing a prior notification process according to the second embodiment. [Figure 7] 13 is a flowchart showing a monitoring management process. [Figure 8] 10 is a timing chart showing a specific example of the start and end of monitoring in the second embodiment. [Figure 9] 13 is a timing chart showing a specific example of the start and end of monitoring in another embodiment. [Figure 10] FIG. 13 is a block diagram showing a configuration of a communication system according to a third embodiment. [Figure 11] FIG. 2 is a diagram showing a correspondence relationship between control objects and clusters. [Figure 12] FIG. 13 is a block diagram showing a configuration of a communication system according to a fourth embodiment. [Figure 13] FIG. 13 is a block diagram showing the configuration of a central ECU and an upstream power distribution unit according to a fourth embodiment. [Figure 14]FIG. 13 is a first block diagram showing a configuration of a zone ECU according to a fourth embodiment. [Figure 15] FIG. 13 is a second block diagram showing the configuration of a zone ECU according to the fourth embodiment. [Figure 16] FIG. 13 is a block diagram showing a configuration of a slave ECU according to a fourth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] [First embodiment] A first embodiment of the present disclosure will be described below with reference to the drawings. A communication system 1 according to the present embodiment is mounted on a vehicle, and includes a master ECU 2, slave ECUs 3 and 4, and a battery 5, as shown in Fig. 1. ECU is an abbreviation for Electronic Control Unit. In the following description, the master ECU 2 and the slave ECUs 3 and 4 are also collectively referred to as nodes.

[0016] The master ECU 2 and the slave ECU 3 are connected to each other via a communication bus 6 so as to be able to communicate data with each other. The master ECU 2 and the slave ECU 4 are connected to each other via a communication bus 7 so as to be able to communicate data with each other.

[0017] The battery 5 supplies electric power to each part of the vehicle at a DC battery voltage (for example, 12 V). The master ECU 2 and the slave ECUs 3 and 4 operate by receiving electric power from the battery 5.

[0018] The master ECU 2 includes a control unit 11, CAN communication units 12 and 13, a storage unit 14, and electronic fuses 15 and 16. CAN is an abbreviation for Controller Area Network. The control unit 11 is an electronic control device mainly composed of a microcomputer including a CPU 21, a ROM 22, a RAM 23, etc. Various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-transient real recording medium. In this example, the ROM 22 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 21 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 11 may be one or more.

[0019] The CAN communication unit 12 communicates with the slave ECU 3 connected to the communication bus 6 by transmitting and receiving communication frames based on the CAN communication protocol. The CAN communication unit 13 communicates with the slave ECU 4 connected to the communication bus 7 by transmitting and receiving communication frames based on the CAN communication protocol. Hereinafter, a CAN communication frame is referred to as a CAN frame.

[0020] The storage unit 14 is a storage device for storing various data. The storage unit 14 stores a startup table 25, which will be described later. The electronic fuse 15 is disposed on the power supply path between the battery 5 and the slave ECU 3. The electronic fuse 16 is disposed on the power supply path between the battery 5 and the slave ECU 4.

[0021] The electronic fuses 15 and 16 each include a switching element (e.g., a MOSFET) and a control circuit. The control circuit of the electronic fuses 15 and 16 is configured to switch the switching element from an on state to an off state to cut off the power supply path when the current value flowing through the power supply path exceeds a preset overcurrent determination value.

[0022] The control circuits of the electronic fuses 15 and 16 are configured to turn on or off the switching elements in accordance with commands from the control unit 11, thereby making or breaking the power supply path conductive.

[0023] The slave ECUs 3 and 4 each include a control unit 31 , a CAN communication unit 32 , and a storage unit 33 . The control unit 31 is an electronic control device mainly composed of a microcomputer including a CPU 41, a ROM 42, a RAM 43, etc. Various functions of the microcomputer are realized by the CPU 41 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 42 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 41 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 31 may be one or more.

[0024] The CAN communication unit 32 of the slave ECU 3 communicates with a communication device (that is, the master ECU 2) connected to the communication bus 6 based on the CAN communication protocol. The CAN communication unit 32 of the slave ECU 4 communicates with a communication device (that is, the master ECU 2) connected to the communication bus 7 based on the CAN communication protocol.

[0025] The storage unit 33 is a storage device for storing various data. The communication system 1 is configured such that the slave ECU 3 and the slave ECU 4 can transmit and receive CAN frames to and from each other via the master ECU 2 .

[0026] A power switch 8 is also provided inside the vehicle cabin. The power switch 8 is operated by the driver when starting an engine or a motor generator mounted in the vehicle, or when switching the power supply state of the vehicle. When the power switch 8 is pressed down, the power switch 8 outputs a power switch signal indicating that the power switch 8 has been pressed down.

[0027] When the driver depresses the power switch 8 while depressing the brake pedal of the vehicle, the engine or the motor generator starts. In addition, each time the driver presses down power switch 8 without stepping on the vehicle's brake pedal, the vehicle's power state changes in the following order: power off state → accessory on state (hereinafter referred to as ACC on state) → ignition on state (hereinafter referred to as IG on state) → power off state →...

[0028] In the activation table 25, a correspondence relationship is set between the power supply state and the electronic fuses to be turned on (hereinafter, conductive fuses) and the electronic fuses to be turned off (hereinafter, cutoff fuses).

[0029] The activation table 25 is set so that, for example, when the power supply state is the power-off state, the electronic fuses 15 and 16 are blowing fuses. The startup table 25 is set so that, for example, when the power supply state is the ACC on state, the electronic fuse 16 is the conduction fuse and the electronic fuse 15 is the blowing fuse.

[0030] The startup table 25 is set so that, for example, when the power supply state is the IG ON state, the electronic fuses 15 and 16 are conductive fuses. Next, a description will be given of a procedure of the advance notification process executed by the control unit 11 of the master ECU 2. The advance notification process is a process that is repeatedly executed while the master ECU 2 is running.

[0031] 2, when the advance notification process is executed, the CPU 21 of the control unit 11 determines in S10 whether or not the power supply state of the vehicle will be switched based on the input of the power switch signal from the power switch 8. Here, if the power supply state of the vehicle will not be switched, the CPU 21 ends the advance notification process.

[0032] On the other hand, when the power supply state of the vehicle is switched, the CPU 21 identifies the conductive fuses and the blown fuses in the power supply state after the switch based on the start-up table 25 in S20.

[0033] In S30, the CPU 21 transmits power cutoff advance notification information notifying that the power supply from the battery 5 via the electronic fuse will be cut off and power state notification information notifying the power state after switching to the slave ECU connected to the conductive fuse. The power cutoff advance notification information includes cutoff fuse identification information that identifies the cutoff fuse.

[0034] The slave ECUs 3 and 4 store the power cutoff advance notification information and the cutoff fuse identification information received from the master ECU 2 in the storage unit 33 . For example, when the cutoff fuse is the electronic fuse 15 and the conduction fuse is the electronic fuse 16, the CPU 21 transmits power cutoff advance notification information and power supply state notification information to the slave ECU 4. The cutoff fuse identification information included in the power cutoff advance notification information indicates that the cutoff fuse is the electronic fuse 15.

[0035] In S40, the CPU 21 turns on the conduction fuse identified in S20 based on the power supply state of the vehicle, turns off the interruption fuse identified in S20, and ends the advance notification process.

[0036] Next, a description will be given of the procedure of the post-event notification process executed by the control unit 11 of the master ECU 2. The post-event notification process is a process that is repeatedly executed while the master ECU 2 is running. When the post-notification process is executed, the CPU 21 of the control unit 11 determines whether the electronic fuse has spontaneously switched to the OFF state in S110, as shown in Fig. 3. The electronic fuses 15, 16 are configured to output an OFF notification signal indicating that they have spontaneously switched to the OFF state, to the master ECU 2, when the value of the current flowing through the power supply path exceeds an overcurrent determination value and the electronic fuses 15, 16 switch from the ON state to the OFF state. Therefore, when the CPU 21 receives an OFF notification signal from the electronic fuses 15, 16, it determines that the electronic fuses 15, 16 have spontaneously switched to the OFF state.

[0037] If there is no electronic fuse that has spontaneously switched to the OFF state, the CPU 21 ends the post-notification process. On the other hand, if there is an electronic fuse that has spontaneously switched to the OFF state, the CPU 21 transmits power cutoff post-notification information notifying that the power supply from the battery 5 via the electronic fuse has been cut off to the slave ECU connected to the conductive fuse in S120, and ends the post-notification process. The power cutoff post-notification information includes cutoff fuse identification information that identifies the cutoff fuse.

[0038] The slave ECUs 3 and 4 store the post-power-off notification information and the cutoff fuse identification information received from the master ECU 2 in the storage unit 33 . Next, there will be described the procedure of the interruption diagnosis disabling process executed by the control unit 31 of the slave ECU 3, 4. The interruption diagnosis disabling process is a process that is repeatedly executed while the slave ECU 3, 4 is in operation.

[0039] 4, when the interruption diagnosing invalidation process is executed, the CPU 41 of the control unit 31 determines in S210 whether or not communication interruption diagnosing information of other nodes is stored in the storage unit 33. The communication interruption diagnosing information of other nodes is information indicating the occurrence of an abnormality in which communication with other nodes is interrupted.

[0040] If the communication disruption diagnosing information of the other node is not stored here, the CPU 41 ends the disruption diagnosing invalidation process. On the other hand, if communication interruption diagnostic information of another node is stored, the CPU 41 determines in S220 whether or not it has stored pre-power-off notification information or post-power-off notification information including blown fuse specific information of the electronic fuse connected to the other node corresponding to the stored communication interruption diagnostic information.

[0041] If the pre-power-off notification information or post-power-off notification information including the blown fuse specification information of the electronic fuse connected to the other node is not stored, the CPU 41 ends the interruption diagnosis invalidation process.

[0042] On the other hand, if the CPU 41 has stored power cutoff pre-notification information or power cutoff post-notification information including cutoff fuse identification information of an electronic fuse connected to another node, the CPU 41 invalidates communication interruption diagnosing information related to the slave ECU connected to the electronic fuse corresponding to the stored power cutoff pre-notification information or power cutoff post-notification information, and ends the interruption diagnosing invalidation process. For example, if the cutoff fuse identification information included in the power cutoff pre-notification information or power cutoff post-notification information indicates the electronic fuse 15, the CPU 41 invalidates communication interruption diagnosing information related to the slave ECU 3.

[0043] Specifically, for example, the communication disruption diagnosing information may be invalidated by adding invalidation information to the communication disruption diagnosing information. In this way, when the fault diagnosis device acquires the communication disruption diagnosing information from the slave ECUs 3 and 4 of the communication system 1, the fault diagnosis device can determine whether to invalidate the communication disruption diagnosing information based on whether the invalidation information has been added to the communication disruption diagnosing information.

[0044] The communication system 1 configured in this manner includes a slave ECU 3, a slave ECU 4, and a master ECU 2. The slave ECU 3 receives power from the battery 5 via an electronic fuse 15 .

[0045] The slave ECU 4 is connected to the slave ECU 3 so as to be able to communicate data with each other. The master ECU 2 is connected to the slave ECU 3 and the slave ECU 4 so as to be able to communicate data with each other, and is configured to control the operation of the electronic fuse 15 .

[0046] The master ECU 2 is configured to execute at least one of an advance notification process and a post-notification process. The advance notification process transmits power cutoff advance notification information to the slave ECU 4 notifying that power supply from the battery 5 via the electronic fuse 15 will be cut off before the electronic fuse 15 is turned off to cut off the power supply from the battery 5 to the slave ECU 3. The post-notification process transmits power cutoff post-notification information to the slave ECU 4 notifying that power supply from the battery 5 via the electronic fuse 15 has been cut off after the electronic fuse 15 is turned off to cut off the power supply from the battery 5 to the slave ECU 3.

[0047] In such a communication system 1, when the master ECU 2 cuts off the power supply to the slave ECU 3 due to the electronic fuse 15 being turned off, the master ECU 2 transmits at least one of power cutoff advance notification information and power cutoff post notification information to the slave ECU 4. That is, the communication system 1 can determine whether the electronic fuse 15 has been turned off based on whether the slave ECU 4 stores the power cutoff advance notification information and the power cutoff post notification information. Therefore, even if the slave ECU 4 detects an abnormality related to the slave ECU 3 caused by the electronic fuse 15 being turned off, the communication system 1 can determine that no abnormality has occurred in the slave ECU 3 if the slave ECU 4 stores the power cutoff advance notification information and the power cutoff post notification information. That is, the communication system 1 can suppress the occurrence of a situation in which it is determined that an abnormality has occurred in the slave ECU 3 even when no abnormality has occurred in the slave ECU 3. This allows the communication system 1 to improve the abnormality detection accuracy.

[0048] The power cutoff advance notification information and the power cutoff post notification information include cutoff fuse identification information for identifying an electronic fuse to be turned off. This enables the communication system 1 to make the slave ECU 4 recognize the slave ECU (i.e., the slave ECU 3) to which the power supply is to be cut off.

[0049] The slave ECU 4 is configured to invalidate communication interruption diagnostic information indicating that communication with the slave ECU 3 has been interrupted when the slave ECU 4 receives the power shutoff advance notification information or the power shutoff post notification information. This allows the communication system 1 to determine that no communication interruption abnormality has occurred in the slave ECU 3 even if communication from the slave ECU 3 has been interrupted due to the electronic fuse 15 being turned off. In other words, the communication system 1 can suppress the occurrence of a situation in which it is determined that a communication interruption abnormality has occurred in the slave ECU 3 even when no abnormality has occurred in the slave ECU 3. This allows the communication system 1 to further improve the abnormality detection accuracy.

[0050] The master ECU 2 is further configured to transmit power supply state notification information indicating the power supply state after the change. This allows the communication system 1 to cause the slave ECU 4 to recognize the power supply state after the electronic fuse 15 has been turned off. The slave ECU 4 that has received the power supply state notification information can execute processing corresponding to the power supply state indicated by the power supply state notification information. For example, when the slave ECU 4 receives the power supply state notification information and the power supply state indicated by the received power supply state notification information is a power off state, the slave ECU 4 executes processing to store predetermined data in the storage unit 33.

[0051] In the embodiment described above, the slave ECU 3 corresponds to the first control device, the battery 5 corresponds to the power source, the slave ECU 4 corresponds to the second control device, the master ECU 2 corresponds to the switching control unit and the management device, S30 and S120 correspond to the processing as a power supply cutoff notification unit, and S220 and S230 correspond to the processing as an invalidation unit.

[0052] [Second embodiment] A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0053] The communication system 1 of the second embodiment differs from the first embodiment in that the configuration of the communication system 1 has been changed, the advance notification process has been changed, the master ECU 2 does not execute the post notification process, the slave ECUs 3 and 4 do not execute the interruption diagnosis disable process, and a monitoring management process has been added.

[0054] As shown in FIG. 5, the communication system 1 of the second embodiment differs from the first embodiment in that the configuration of the master ECU 2 is changed and a slave ECU 9 is added. The master ECU 2 of the second embodiment differs from the first embodiment in that the CAN communication unit 12 is omitted and an electronic fuse 17 is added.

[0055] Like the slave ECUs 3 and 4, the slave ECU 9 includes a control unit 31, a CAN communication unit 32, and a storage unit 33. The CAN communication unit 13 is connected to the CAN communication units 32 of the slave ECUs 3, 4, and 9 via a communication bus 7.

[0056] The electronic fuse 17 is disposed on the power supply path between the battery 5 and the slave ECU 9. A control circuit for the electronic fuse 17 is configured to turn a switching element on or off in response to a command from the control unit 11, thereby making the power supply path conductive or cut off.

[0057] Next, the procedure of the advance notification process according to the second embodiment will be described. When the advance notification process of the second embodiment is executed, the CPU 21 of the control unit 11 determines in S310 whether or not the power supply state of the vehicle will be switched based on the input of the power switch signal from the power switch 8, as shown in Fig. 6. If the power supply state of the vehicle will not be switched, the CPU 21 ends the advance notification process.

[0058] On the other hand, when the power supply state of the vehicle is switched, the CPU 21 determines in S320, based on the activation table 25, whether each of the electronic fuses 15, 16, 17 is a conducting fuse or a blowing fuse in the power supply state after the switch.

[0059] In S330, the CPU 21 transmits fuse state information to the slave ECUs 3, 4, and 9. The fuse state information indicates whether each of the electronic fuses 15, 16, and 17 is a conductive fuse or a blown fuse.

[0060] In S340, the CPU 21 turns on the conduction fuse identified in S320. For example, if the CPU 21 identifies the electronic fuse 15 as a conduction fuse in S320, the CPU 21 turns on the electronic fuse 15.

[0061] At S350, the CPU 21 turns off the cutoff fuse identified at S320 after a preset cutoff waiting time has elapsed since transmitting the fuse state information at S330, and ends the advance notification process. The cutoff waiting time may be the same for the electronic fuses 15 to 17, or may be set to a different value for each of the electronic fuses 15 to 17 depending on the slave ECUs 3, 4, and 9 connected to the electronic fuses 15, 16, and 17. The cutoff waiting time is set to be longer than the maximum value of the predicted communication delay time.

[0062] Next, there will be described the procedure of the monitoring management process executed by the control unit 31 of the slave ECUs 3, 4, and 9. The monitoring management process is repeatedly executed while the slave ECUs 3, 4, and 5 are running.

[0063] 7, when the monitoring management process is executed, the CPU 41 of the control unit 31 determines in S410 whether or not the fuse state information has been received from the master ECU 2. If the fuse state information has not been received, the CPU 41 ends the monitoring management process.

[0064] On the other hand, if fuse state information has been received, the CPU 41 stops, in S420, monitoring for communication interruption that monitors whether or not communication has been interrupted for other nodes connected to the blown fuse indicated by the fuse state information.

[0065] In the communication interruption monitoring, when a CAN frame transmitted from another node is not transmitted for a period exceeding a preset abnormality determination time, the CPU 41 stores communication interruption diagnostic information indicating that a communication interruption abnormality has occurred in the other node. The abnormality determination time is set to a time longer than the frame transmission period in which the other node transmits the CAN frame.

[0066] In S430, the CPU 41 starts the above-mentioned communication interruption monitoring for the other node connected to the conductive fuse indicated by the fuse state information after a monitoring standby time preset for the other node has elapsed, and ends the monitoring management process. The monitoring standby time is set to be longer than the time required for the corresponding other node to start up and become capable of communication.

[0067] Next, a specific example of starting and stopping communication interruption monitoring will be described. As shown in FIG. 8, at time t0, the electronic fuses 15 and 16 are in the OFF state, and the slave ECU 9 is not monitoring the slave ECUs 3 and 4 for communication interruption.

[0068] At time t1, the master ECU 2 turns on the electronic fuse 15. The master ECU 2 also transmits fuse state information indicating that the electronic fuse 15 is a conducting fuse and the electronic fuse 16 is a blown fuse.

[0069] At time t2 when a monitoring standby time MT1 has elapsed since the slave ECU 9 received the fuse state information, the slave ECU 9 starts monitoring for a communication interruption of the slave ECU 3. The monitoring standby time MT1 is set to be longer than the time required for the slave ECU 3 to start up and become capable of communication.

[0070] At time t3, the master ECU 2 turns on the electronic fuse 16. The master ECU 2 also transmits fuse state information indicating that the electronic fuses 15 and 16 are conductive fuses.

[0071] At time t4 when a monitoring standby time MT2 has elapsed since the slave ECU 9 received the fuse state information, the slave ECU 9 starts monitoring for a communication interruption of the slave ECU 4. The monitoring standby time MT2 is set to be longer than the time required for the slave ECU 4 to start up and become capable of communication.

[0072] At time t5, the master ECU 2 determines to turn off the electronic fuse 15. The master ECU 2 then transmits fuse state information indicating that the electronic fuse 15 is a blown fuse and the electronic fuse 16 is a conducting fuse.

[0073] When the slave ECU 9 receives the fuse state information at time t6, the slave ECU 9 stops monitoring the slave ECU 3 for a communication interruption. The master ECU 2 turns off the electronic fuse 15 at time t7 when the cutoff waiting time CT1 has elapsed from time t5.

[0074] At time t8, the master ECU 2 determines to turn off the electronic fuse 16. Then, the master ECU 2 transmits fuse state information indicating that the electronic fuses 15 and 16 are blown fuses.

[0075] When the slave ECU 9 receives the fuse state information at time t9, it stops monitoring the slave ECU 4 for a communication interruption. The master ECU 2 turns off the electronic fuse 16 at time t10 when the cutoff waiting time CT2 has elapsed since time t8.

[0076] In the communication system 1 configured in this manner, the master ECU 2 transmits fuse state information to the slave ECU 4 notifying the slave ECU 4 that the electronic fuse 15 will be turned off before the electronic fuse 15 is turned off to cut off the power supply from the battery 5 to the slave ECU 3. The master ECU 2 is further configured to turn the electronic fuse 15 off after a preset cutoff waiting time has elapsed since transmitting the fuse state information.

[0077] In such a communication system 1, the master ECU 2 turns off the electronic fuse 15 after the cutoff standby time has elapsed since the master ECU 2 transmitted the fuse state information to the slave ECU 4. Therefore, even if a communication delay occurs and the arrival of the fuse state information at the slave ECU 4 is delayed, the communication system 1 can prevent the electronic fuse 15 from turning off before the fuse state information arrives at the slave ECU 4. In other words, the communication system 1 can prevent the occurrence of a situation in which it is determined that a communication interruption abnormality has occurred in the slave ECU 3 even though a communication interruption abnormality has not occurred in the slave ECU 3. This allows the communication system 1 to improve the accuracy of abnormality detection.

[0078] Furthermore, the slave ECU 4 is configured to stop monitoring the slave ECU 3 for communication disruption when it receives fuse state information notifying the electronic fuse 15 to be turned off. In such a communication system 1, the slave ECU 4 quickly stops monitoring the slave ECU 3 for communication disruption, which further prevents the slave ECU 4 from determining that a communication disruption has occurred in the slave ECU 3 when no communication disruption has occurred in the slave ECU 3.

[0079] Furthermore, when the master ECU 2 sets the electronic fuse 15 to an ON state, the master ECU 2 is configured to transmit fuse state information notifying the slave ECU 4 that the electronic fuse 15 will be set to an ON state. The slave ECU 4 is configured to start monitoring the slave ECU 3 after a preset monitoring standby time has elapsed since receiving the fuse state information. In such a communication system 1, the slave ECU 4 can start monitoring the slave ECU 3 after the electronic fuse 15 is set to an ON state, the slave ECU 3 is started up, and the communication is possible. Therefore, the communication system 1 can further suppress the occurrence of a situation in which it is determined that a communication interruption abnormality has occurred in the slave ECU 3 even though a communication interruption abnormality has not occurred in the slave ECU 3.

[0080] In the embodiment described above, S330 corresponds to processing as a power shutdown notification unit, the fuse state information corresponds to power shutdown advance notification information and power continuity notification information, S350 corresponds to processing as a shutdown unit, and S420 corresponds to processing as a monitoring cancellation unit.

[0081] [Third embodiment] A third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0082] As shown in FIG. 10, the communication system 1 of the third embodiment differs from the first embodiment in that a smart sensor 501, a smart actuator 502, a wireless device 503, electronic fuses 504 and 505, and a slave ECU 506 are added.

[0083] The smart sensor 501 is a sensor having a communication function. The smart sensor 501 is connected to the communication bus 6. The smart actuator 502 is an actuator having a communication function. The smart actuator 502 is connected to the communication bus 6.

[0084] The wireless device 503 is a wireless communication device for performing wireless communication with an external communication device installed outside the vehicle. The wireless device 503 is, for example, a DCM. DCM is an abbreviation for Data Communication Module.

[0085] The electronic fuse 504 is disposed on the power supply path between the battery 5 and the smart sensor 501. The electronic fuse 505 is disposed on the power supply path between the battery 5 and the smart actuator 502.

[0086] Each of the electronic fuses 504 and 505 is configured to switch, in response to a command from the control unit 11, between a conductive state in which the power supply path is conductive and a cut-off state in which the power supply path is cut off.

[0087] Hereinafter, the master ECU 2, the slave ECUs 3 to 5, the smart sensor 501, the smart actuator 502, and the slave ECU 506 are also collectively referred to as nodes. (Prerequisite) The master ECU 2 and the slave ECU 506 are always powered by the battery 5 without using an electronic fuse, and can switch to a wake-up state or a sleep state independently. Hereinafter, the master ECU 2 and the slave ECU 506 are also referred to as NM-equipped nodes. An NM-equipped node is a node that has a function of generating an NM frame.

[0088] The slave ECUs 3 and 4, the smart sensor 501, and the smart actuator 502 are powered via electronic fuses, and cannot be switched to a wake-up state or a sleep state by themselves. That is, they enter a wake-up state when the electronic fuse is turned on, and enter a sleep state when the electronic fuse is turned off. Hereinafter, the slave ECU 3, the slave ECU 4, the smart sensor 501, and the smart actuator 502 are also referred to as non-NM nodes. A non-NM node is a node that does not have the function of generating and interpreting an NM frame.

[0089] The non-NM node includes at least one of an actuator and a sensor in addition to an ECU having a control function. The power supply paths of the non-NM nodes are connected to electronic fuses 15, 16, 504, and 505 of the master ECU 2, respectively.

[0090] A non-NM node and an electronic fuse may be connected on a one-to-one basis, or multiple non-NM nodes belonging to the same cluster (i.e., a group that starts up simultaneously) may be connected under one electronic fuse.

[0091] The master ECU 2 and the NM-equipped node have a CAN communication unit and are capable of transmitting and receiving NM frames. An NM-equipped node determines whether to be in a wake-up or sleep state based on the NM frames it sends and receives via the communication bus.

[0092] The master ECU 2 turns on or off the electronic fuses 15, 16, 504, and 505 to which the non-NM nodes are connected, based on the NM frame transmitted and received via the communication bus.

[0093] The payload (i.e., data area) of the NM frame transmitted and received by the master ECU 2 and the NM-equipped node stores one or more bits of information indicating which cluster to start.

[0094] One or more master ECUs (ie, ECUs with built-in electronic fuses) are installed in a vehicle. As shown in Fig. 11, one or more nodes belonging to each cluster are determined in advance by the system developer. Although it is possible to assign a cluster to each node, multiple nodes can be registered in one cluster. When the bit corresponding to each cluster is active (i.e., bit=1), the cluster wakes up. In the case of the master ECU, waking up means turning on the electronic fuse.

[0095] (First startup example) The first activation example is an operation example in which a fault diagnosis of the slave ECU 3 is performed in response to a request from the cloud.

[0096] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud.

[0097] Next, the master ECU2 determines a service called "fault diagnosis of the slave ECU3" based on the event, and generates an NM frame in which the bit of the third cluster to which only the slave ECU3 belongs is enabled in order to start the slave ECU3.

[0098] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 6 and 7. Since there are no NM-equipped nodes belonging to the third cluster on communication buses 6 and 7, there are no changes in the devices on the communication buses.

[0099] Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the third cluster is enabled at the same time as the above. Next, when the control unit 11 of the master ECU 2 determines to issue a wake-up instruction to the third cluster, the control unit 11 turns on the electronic fuse 15 since the third cluster includes the electronic fuse 15.

[0100] When the electronic fuse 15 is turned on, power is supplied to the downstream slave ECU 3 and the slave ECU 3 starts up. The master ECU 2 waits for the slave ECU 3 to start up, requests a diagnostic code from the slave ECU 3, and transmits a response from the slave ECU 3 to the base station via the wireless device 503.

[0101] (Second startup example) The second activation example is an operation example in which a fault diagnosis of the slave ECU 506 is performed in response to a request from the cloud.

[0102] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud.

[0103] Next, the master ECU 2 determines a service called "fault diagnosis of the slave ECU 506" based on the event, and generates an NM frame in which the bit of the fourth cluster to which only the slave ECU 506 belongs is enabled in order to start the slave ECU 506.

[0104] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 6 and 7. Since the slave ECU 506 is present on the communication bus 6 as a node belonging to the fourth cluster, the slave ECU 506 wakes up.

[0105] Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the fourth cluster is enabled at the same time as the above. Next, even if the control unit 11 of the master ECU 2 determines to issue a wake-up instruction to the fourth cluster based on the NM frame, the fourth cluster does not include the corresponding electronic fuse, so the control unit 11 ignores the instruction.

[0106] When the slave ECU 506 is started, the master ECU 2 requests a diagnostic code from the slave ECU 506 via the communication bus, and transmits a response from the slave ECU 506 to the base station via the wireless device 503.

[0107] (Third startup example) The third activation example is an operation example in which a user activates a remote air conditioning device using a smartphone. First, the user issues a command to turn on the vehicle air conditioner via the smartphone.

[0108] When the wireless device 503 receives the instruction signal from the smartphone and determines that the instruction signal is valid, it transmits the event received from the cloud (i.e., the instruction signal) to the master ECU 2.

[0109] The master ECU2 determines the "air conditioning service" based on the event, and generates an NM frame in which the second cluster is activated as the air conditioning cluster. The master ECU 2 periodically transmits the generated NM frame to the communication buses 6 and 7 until an instruction to stop the air conditioner is received. If it is desired to continue the active state, it is necessary to continue transmitting the NM frame periodically. At the same time, the control unit 11 of the master ECU 2 executes processing based on the NM frame.

[0110] When an NM frame that activates the second cluster occurs on the communication bus 6, the slave ECU 506 (ie, the air conditioner ECU) that belongs to the second cluster receives the NM frame and wakes up in accordance with the received NM frame.

[0111] When the control unit 11 of the master ECU 2 detects that the second cluster is active, it turns on the electronic fuses 504 and 505 that belong to the second cluster. When electronic fuse 504 and electronic fuse 505 are in the ON state, power is provided to smart sensor 501 (ie, temperature sensor) and smart actuator 502 (ie, compressor).

[0112] As a result of the above, power supply to the air conditioner ECU, smart sensor 501, and smart actuator 502 begins, making it possible to turn on the in-vehicle air conditioner. When the user issues an instruction to turn off the in-vehicle air conditioner via the smartphone, the master ECU 2 stops the periodic transmission of the NM frame.

[0113] When the NM frame is interrupted, the slave ECU 506 transitions to a sleep state, and the master ECU 2 turns off the electronic fuse 504 and the electronic fuse 505. This stops the in-vehicle air conditioner.

[0114] (4th startup example) The fourth activation example is an operation example in which the slave ECU 506 activates the vehicle air conditioner. Since the slave ECU 506 is always supplied with power even when the vehicle is stopped, it is possible for the slave ECU 506 to wake up when it detects an input of a signal indicating that a start switch connected to the slave ECU 506 has been turned on, even when the slave ECU 506 is in a sleep state.

[0115] When the woken up slave ECU 506 confirms an input to start the in-vehicle air conditioner, it generates an NM frame with the bit corresponding to the second cluster turned on. The slave ECU 506 transmits the generated NM frame via the CAN communication unit 32. When the master ECU 2 receives this NM frame, the master ECU 2 turns on the electronic fuses 504 and 505 that belong to the second cluster.

[0116] When the start switch of the in-vehicle air conditioner is turned off, the slave ECU 506 stops transmitting NM frames and enters a sleep state after a while. When the NM frame is discontinued, the master ECU 2 turns off the electronic fuses 504 and 505 after a while and ends the control.

[0117] If the master ECU 2 determines that control needs to continue even after the transmission of the NM frame has stopped, the master ECU 2 transmits an NM frame with the bit corresponding to the second cluster turned on. This allows the slave ECU 506, the smart sensor 501, and the smart actuator 502 to remain active until the transmission of the NM frame generated by the master ECU 2 stops.

[0118] [Fourth embodiment] A fourth embodiment of the present disclosure will be described below with reference to the drawings. 12, the communication system 100 of the fourth embodiment is mounted on a vehicle and includes a central ECU 101, upstream power distribution units 102, 103, zone ECUs 104, 105, 106, 107, slave ECUs 108, 109, 110, 111, 112, 113, 114, 115, 116, and a battery 117. Hereinafter, the central ECU 101, zone ECUs 104 to 107, and slave ECUs 108 to 116 will be collectively referred to as nodes.

[0119] The battery 117 supplies power to each part of the vehicle at a DC battery voltage (for example, 12 V). The central ECU 101, the upstream power distribution units 102 and 103, the zone ECUs 104 to 107, and the slave ECUs 108 to 116 operate by receiving power supplied from the battery 117.

[0120] The upstream power supply distribution unit 102 receives power supply from the battery 117 via a power supply path 121 between the battery 117 and the upstream power supply distribution unit 102 . The upstream power supply distribution unit 103 receives power supply from the battery 117 via a power supply path 122 between the battery 117 and the upstream power supply distribution unit 103 .

[0121] The zone ECUs 104 and 105 receive power from a battery 117 via power supply paths 123 and 124 between the upstream power distribution unit 102 and the zone ECUs 104 and 105, respectively.

[0122] The zone ECUs 106 and 107 receive power from a battery 117 via power supply paths 125 and 126 between the upstream power distribution unit 103 and the zone ECUs 106 and 107, respectively.

[0123] The slave ECUs 108 and 109 receive power from the battery 117 via power supply paths 127 and 128 between the zone ECU 104 and the slave ECUs 108 and 109, respectively.

[0124] The slave ECUs 110 and 111 are supplied with power from a battery 117 via power supply paths 129 and 130 between the zone ECU 105 and the slave ECUs 110 and 111, respectively.

[0125] The slave ECUs 112, 113, and 114 receive power from a battery 117 via power supply paths 131, 132, and 133 between the zone ECU 106 and the slave ECUs 112, 113, and 114, respectively.

[0126] The slave ECUs 115 and 116 are supplied with power from a battery 117 via power supply paths 134 and 135 between the zone ECU 107 and the slave ECUs 115 and 116, respectively.

[0127] The central ECU 101 and the upstream power distribution unit 102 are connected to each other via a communication line 141 so as to be able to communicate data with each other. The central ECU 101 and the upstream power distribution unit 103 are connected to each other via a communication line 142 so as to be able to communicate data with each other.

[0128] The central ECU 101 and the zone ECUs 104, 105, 106, and 107 are connected to each other via communication lines 143, 144, 145, and 146, respectively, so as to be able to communicate data with each other.

[0129] The zone ECU 104 and the slave ECUs 108 and 109 are connected to each other via a communication bus 147 so as to be able to communicate data with each other. The zone ECU 105 and the slave ECUs 110 and 111 are connected to each other via a communication bus 148 so as to be able to communicate data with each other.

[0130] The zone ECU 106 and the slave ECUs 112, 113, and 114 are connected to each other via a communication bus 149 so as to be able to communicate data with each other. The zone ECU 107 and the slave ECUs 115 and 116 are connected to each other via a communication bus 150 so as to be able to communicate data with each other.

[0131] As shown in FIG. 13, the central ECU 101 includes a control unit 151, communication units 152, 153, 154, 155, 156, and 157, and a storage unit 158. The control unit 151 is an electronic control device mainly composed of a microcomputer including a CPU 161, a ROM 162, a RAM 163, etc. Various functions of the microcomputer are realized by the CPU 161 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 162 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 161 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 151 may be one or more.

[0132] The communication unit 152 communicates with the upstream power distribution unit 102 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. Ethernet is a registered trademark.

[0133] The communication unit 153 communicates with the upstream power distribution unit 103 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 154 communicates with the zone ECU 104 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0134] The communication unit 155 communicates with the zone ECU 105 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 156 communicates with the zone ECU 106 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0135] The communication unit 157 communicates with the zone ECU 107 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The storage unit 158 ​​is a storage device for storing various data. The storage unit 158 ​​stores a startup table 165, which will be described later.

[0136] The upstream power distribution unit 102 includes a control circuit 171 , a communication unit 172 , and electronic fuses 173 and 174 . The control circuit 171 performs control to switch the electronic fuses 173 and 174 between an on state and an off state based on an instruction obtained from the central ECU 101 via a communication unit 172 .

[0137] The communication unit 172 communicates with the central ECU 101 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0138] The electronic fuse 173 is disposed between the power supply path 121 and the power supply path 123. The electronic fuse 174 is disposed between the power supply path 121 and the power supply path . The upstream power distribution unit 103 includes a control circuit 181 , a communication unit 182 , and electronic fuses 183 and 184 .

[0139] The control circuit 181 performs control to switch the electronic fuses 183 and 184 between the on state and the off state based on an instruction obtained from the central ECU 101 via the communication unit 182 .

[0140] The communication unit 182 communicates with the central ECU 101 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0141] The electronic fuse 183 is disposed between the power supply path 122 and the power supply path 125. The electronic fuse 184 is disposed between the power supply path 122 and the power supply path 126. As shown in FIG. 14, the zone ECU 104 includes a control unit 191, a communication unit 192, a CAN communication unit 193, a storage unit 194, and electronic fuses 195 and 196.

[0142] The control unit 191 is an electronic control device mainly composed of a microcomputer including a CPU 201, a ROM 202, a RAM 203, etc. Various functions of the microcomputer are realized by the CPU 201 executing a program stored in a non-transient real recording medium. In this example, the ROM 202 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 201 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 191 may be one or more.

[0143] The communication unit 192 communicates with the central ECU 101 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0144] The CAN communication unit 193 communicates with the slave ECUs 108 and 109 connected to the communication bus 147 by transmitting and receiving communication frames based on the CAN communication protocol.

[0145] The storage unit 194 is a storage device for storing various data. The storage unit 194 stores a startup table 205, which will be described later. The electronic fuse 195 is disposed between the power supply path 123 and the power supply path 127. The electronic fuse 196 is disposed between the power supply path 123 and the power supply path 128.

[0146] The zone ECU 105 includes a control unit 211, a communication unit 212, a CAN communication unit 213, a storage unit 214, and electronic fuses 215 and 216. The control unit 211 is an electronic control device mainly composed of a microcomputer including a CPU 221, a ROM 222, a RAM 223, etc. Various functions of the microcomputer are realized by the CPU 221 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 222 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 221 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 211 may be one or more.

[0147] The communication unit 212 communicates with the central ECU 101 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0148] The CAN communication unit 213 communicates with the slave ECUs 110 and 111 connected to the communication bus 148 by transmitting and receiving communication frames based on the CAN communication protocol.

[0149] The storage unit 214 is a storage device for storing various data. The storage unit 214 stores a startup table 225, which will be described later. The electronic fuse 215 is disposed between the power supply path 124 and the power supply path 129. The electronic fuse 216 is disposed between the power supply path 124 and the power supply path 130.

[0150] As shown in FIG. 15, the zone ECU 106 includes a control unit 231, a communication unit 232, a CAN communication unit 233, a storage unit 234, and electronic fuses 235, 236, and 237. The control unit 231 is an electronic control device mainly composed of a microcomputer including a CPU 241, a ROM 242, a RAM 243, etc. Various functions of the microcomputer are realized by the CPU 241 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 242 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 241 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 231 may be one or more.

[0151] The communication unit 232 communicates with the central ECU 101 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0152] The CAN communication unit 233 communicates with the slave ECUs 112, 113, and 114 connected to the communication bus 149 by transmitting and receiving communication frames based on the CAN communication protocol.

[0153] The storage unit 234 is a storage device for storing various data. The storage unit 234 stores a startup table 245, which will be described later. The electronic fuse 235 is disposed between the power supply path 125 and the power supply path 131. The electronic fuse 236 is disposed between the power supply path 125 and the power supply path 132. The electronic fuse 237 is disposed between the power supply path 125 and the power supply path 133.

[0154] The zone ECU 107 includes a control unit 251, a communication unit 252, a CAN communication unit 253, a storage unit 254, and electronic fuses 255 and 256. The control unit 251 is an electronic control device mainly composed of a microcomputer including a CPU 261, a ROM 262, a RAM 263, etc. Various functions of the microcomputer are realized by the CPU 261 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 262 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 261 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 251 may be one or more.

[0155] The communication unit 252 communicates with the central ECU 101 connected to the communication line 146 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0156] The CAN communication unit 253 communicates with the slave ECUs 115 and 116 connected to the communication bus 150 by transmitting and receiving communication frames based on the CAN communication protocol.

[0157] The storage unit 254 is a storage device for storing various data. The storage unit 254 stores a startup table 265, which will be described later. The electronic fuse 255 is disposed between the power supply path 126 and the power supply path 134. The electronic fuse 256 is disposed between the power supply path 126 and the power supply path 135.

[0158] As shown in FIG. 16, the slave ECUs 108 and 109 each include a control unit 271, a CAN communication unit 272, and a storage unit 273. The control unit 271 is an electronic control device mainly composed of a microcomputer including a CPU 281, a ROM 282, a RAM 283, etc. Various functions of the microcomputer are realized by the CPU 281 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 282 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 281 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 271 may be one or more.

[0159] The CAN communication unit 272 communicates with the zone ECUs 104 connected to the communication bus 147 based on the CAN communication protocol. The storage unit 273 is a storage device for storing various data. The storage unit 273 stores a startup table 285, which will be described later.

[0160] The slave ECUs 110 and 111 each include a control unit 291 , a CAN communication unit 292 , and a storage unit 293 . The control unit 291 is an electronic control device mainly composed of a microcomputer including a CPU 301, a ROM 302, a RAM 303, etc. Various functions of the microcomputer are realized by the CPU 301 executing a program stored in a non-transient real recording medium. In this example, the ROM 302 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 301 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 291 may be one or more.

[0161] The CAN communication unit 292 communicates with the zone ECU 105 connected to the communication bus 148 based on the CAN communication protocol. The storage unit 293 is a storage device for storing various data. The storage unit 293 stores a startup table 305, which will be described later.

[0162] The slave ECUs 112 , 113 , and 114 each include a control unit 311 , a CAN communication unit 312 , and a storage unit 313 . The control unit 311 is an electronic control device mainly composed of a microcomputer including a CPU 321, a ROM 322, a RAM 323, etc. Various functions of the microcomputer are realized by the CPU 321 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 322 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 321 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 311 may be one or more.

[0163] The CAN communication unit 312 communicates with the zone ECU 106 connected to the communication bus 149 based on the CAN communication protocol. The storage unit 313 is a storage device for storing various data. The storage unit 313 stores a startup table 325, which will be described later.

[0164] The slave ECUs 115 and 116 each include a control unit 331 , a CAN communication unit 332 , and a storage unit 333 . The control unit 331 is an electronic control device mainly composed of a microcomputer including a CPU 341, a ROM 342, a RAM 343, etc. Various functions of the microcomputer are realized by the CPU 341 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 342 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 341 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 331 may be one or more.

[0165] The CAN communication unit 332 communicates with the zone ECU 107 connected to the communication bus 150 based on the CAN communication protocol. The storage unit 333 is a storage device for storing various data. The storage unit 333 stores a startup table 345, which will be described later.

[0166] A communication group to be activated (that is, an activation group) is set for each event in the activation tables 165, 205, 225, 245, 265, 285, 305, 325, and 345. The event also includes the power supply state of the vehicle.

[0167] The activation table 165 of the central ECU 101 further stores a correspondence between the activation groups and the electronic fuses to be turned on among all the electronic fuses 173, 174, 183, 184, 195, 196, 215, 216, 235, 236, 237, 255, and 256 included in the communication system 100.

[0168] When the power supply state of the vehicle is switched (S10), the central ECU 101 identifies the conductive fuses and the blown fuses in the power supply state after the switch based on the activation table 165 (S20).

[0169] Then, the central ECU 101 instructs the zone ECUs 104 to 107 to turn on the identified conduction fuses and turn off the identified breaker fuses.

[0170] Based on an instruction from the central ECU 101, the zone ECUs 104 to 107 transmit power cutoff advance notification information and power state notification information to the slave ECUs under their control before turning off the electronic fuses under their control (S30). The power cutoff advance notification information includes cutoff fuse specification information.

[0171] The slave ECUs 108 to 116 store the received power cutoff advance notification information and power supply state notification information. After transmitting the power cutoff advance notification information and the power supply state notification information to the slave ECUs under their control, the zone ECUs 104 to 107 turn on or off the electronic fuses under their control based on an instruction from the central ECU 101 (S40).

[0172] When an electronic fuse under the control of the zone ECU 104-107 is spontaneously switched to the OFF state (S110), the zone ECU 104-107 transmits post-power-off notification information to the slave ECU under the control of the zone ECU (S120). The post-power-off notification information includes fuse-identifying information.

[0173] The slave ECUs 108 to 116 store the received post-power-off notification information and cutoff fuse identification information. The communication system 100 thus configured includes a slave ECU 108 , a slave ECU 109 , a central ECU 101 , and a zone ECU 104 .

[0174] The slave ECU 108 receives power from the battery 117 via an electronic fuse 195 . The slave ECU 109 is connected to the slave ECU 108 so as to be able to communicate data with each other.

[0175] The central ECU 101 and the zone ECUs 104 are configured to execute a switching control for switching the electronic fuse 195 to an on state or an off state. The zone ECU 104 is configured to execute at least one of an advance notification process and a post-notification process. The advance notification process transmits power cutoff advance notification information to the slave ECU 109 notifying that power supply from the battery 117 via the electronic fuse 195 will be cut off before the electronic fuse 195 is turned off to cut off the power supply from the battery 117 to the slave ECU 108. The post-notification process transmits power cutoff post-notification information to the slave ECU 109 notifying that power supply from the battery 117 via the electronic fuse 195 has been cut off after the electronic fuse 195 is turned off to cut off the power supply from the battery 117 to the slave ECU 108.

[0176] The slave ECU 109 is configured to store the received power-off advance notification information and power-off post notification information. In such a communication system 100, the central ECU 101 and the zone ECU 104 transmit at least one of power cutoff advance notification information and power cutoff post notification information to the slave ECU 109 when cutting off the power supply to the slave ECU 108 due to the electronic fuse 195 being turned off. That is, the communication system 100 can determine whether the electronic fuse 195 has been turned off based on whether the slave ECU 109 stores the power cutoff advance notification information and the power cutoff post notification information. Therefore, even if the slave ECU 109 detects an abnormality related to the slave ECU 108 caused by the electronic fuse 195 being turned off and if the slave ECU 109 stores the power cutoff advance notification information and the power cutoff post notification information, the communication system 100 can determine that no abnormality has occurred in the slave ECU 108. That is, the communication system 100 can suppress the occurrence of a situation in which it is determined that an abnormality has occurred in the slave ECU 108 even when no abnormality has occurred in the slave ECU 108. This enables the communication system 100 to improve the accuracy of anomaly detection.

[0177] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the battery 117 corresponds to the power source, the slave ECU 109 corresponds to the second control device, the central ECU 101 and the zone ECU 104 correspond to the switching control unit, and the zone ECU 104 corresponds to the power supply cutoff notification unit.

[0178] [Fifth embodiment] A fifth embodiment of the present disclosure will be described below with reference to the drawings. In the fifth embodiment, only the parts different from the fourth embodiment will be described. The same reference numerals will be used to designate the same components.

[0179] When the power supply state of the vehicle is switched (S10), the central ECU 101 identifies the conductive fuses and the blown fuses in the power supply state after the switch based on the activation table 165 (S20).

[0180] The central ECU 101 transmits the power cutoff advance notification information and the power supply state notification information to the slave ECUs 108 to 116 using the zone ECUs 104 to 107 as repeaters (S30). The power cutoff advance notification information includes cutoff fuse specification information.

[0181] The slave ECUs 108 to 116 store the received power cutoff advance notification information and power supply state notification information. The central ECU 101 instructs the zone ECUs 104 to 107 to turn on the identified conduction fuses and turn off the identified breaker fuses.

[0182] Based on an instruction from the central ECU 101, the zone ECUs 104 to 107 turn the electronic fuses under their control on or off (S40). Furthermore, when an electronic fuse under the control of the zone ECUs 104 to 107 spontaneously switches to the OFF state (S110), the zone ECUs 104 to 107 transmit post-power-off notification information to the central ECU 101. The post-power-off notification information includes cut-off fuse identification information.

[0183] When the central ECU 101 receives the post-power-off notification information from the zone ECUs 104 to 107, the central ECU 101 transmits the post-power-off notification information to the slave ECUs 108 to 116 using the zone ECUs 104 to 107 as repeaters (S120).

[0184] The slave ECUs 108 to 116 store the received post-power-off notification information and cutoff fuse identification information. When the slave ECUs 108-116 store communication disruption diagnosing information of other nodes and store pre-power cutoff notification information or post-power cutoff notification information of other nodes, they invalidate communication disruption diagnosing information related to the other nodes.

[0185] In the communication system 100 configured in this manner, the central ECU 101 is configured to execute at least one of a pre-notification process and a post-notification process. Such a communication system 100 can obtain the same effects as the communication system 100 of the third embodiment.

[0186] In the above-described embodiment, the central ECU 101 corresponds to a power cutoff notification unit. Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modified forms.

[0187] [Variation 1] In the above embodiment, both the advance notification process and the post-notification process are executed. However, it is also possible to execute either the advance notification process or the post-notification process.

[0188] [Variation 2] In the above embodiment, the slave ECUs 3 and 4 are connected to the master ECU 2 via the communication buses 6 and 7, but the slave ECUs 3 and 4 may be connected to the master ECU 2 via direct wiring. Also, the slave ECU 4 may be connected to the master ECU 2 via the communication bus 6.

[0189] [Variation 3] In the above embodiment, the engine or the motor generator is started by the driver depressing the power switch 8 while depressing the brake pedal of the vehicle. However, the engine or the motor generator may be started when a person carrying a key or a smartphone approaches the vehicle.

[0190] [Variation 4] In the above embodiment, the conductive fuse and the cutoff fuse are identified based on the power supply state of the vehicle. However, the conductive fuse and the cutoff fuse may be identified based on whether the vehicle is running or the driver is in the vehicle. For example, when a user who has a smart key unlocks the door of the vehicle, it may be determined that the driver is in the vehicle. Also, when the shift of the vehicle is in "D" (i.e., "drive") and the vehicle speed is greater than 0 km / h, it may be determined that the vehicle is running.

[0191] As shown in FIG. 9, at time t0, the vehicle is neither running nor being ridden, so the electronic fuses 15 and 16 are in the OFF state, and the slave ECU 9 is not monitoring the slave ECUs 3 and 4 for communication interruption.

[0192] At time t1, the vehicle is in operation, and the master ECU 2 turns on the electronic fuse 16. The master ECU 2 also transmits fuse state information indicating that the electronic fuse 15 is a blown fuse and the electronic fuse 16 is a conductive fuse.

[0193] The slave ECU 9 starts monitoring for a communication interruption of the slave ECU 4 at time t2 when the monitoring standby time MT2 has elapsed since the reception of the fuse state information. At time t3, the vehicle is in motion, and the master ECU 2 turns on the electronic fuse 15. The master ECU 2 also transmits fuse state information indicating that the electronic fuses 15 and 16 are conductive fuses.

[0194] The slave ECU 9 starts monitoring for a communication interruption of the slave ECU 3 at time t4 when the monitoring standby time MT1 has elapsed since the reception of the fuse state information. At time t5, the vehicle is no longer in motion, and the master ECU 2 determines to turn off the electronic fuse 15. The master ECU 2 then transmits fuse state information indicating that the electronic fuse 15 is a blown fuse and the electronic fuse 16 is a conducting fuse.

[0195] When the slave ECU 9 receives the fuse state information at time t6, the slave ECU 9 stops monitoring the slave ECU 3 for a communication interruption. The master ECU 2 turns off the electronic fuse 15 at time t7 when the cutoff waiting time CT1 has elapsed from time t5.

[0196] At time t8, the vehicle is no longer occupied, and the master ECU 2 determines to turn off the electronic fuse 16. The master ECU 2 then transmits fuse state information indicating that the electronic fuses 15, 16 are blown fuses.

[0197] When the slave ECU 9 receives the fuse state information at time t9, it stops monitoring the slave ECU 4 for a communication interruption. The master ECU 2 turns off the electronic fuse 16 at time t10 when the cutoff waiting time CT2 has elapsed since time t8.

[0198] [Variation 5] In the above first embodiment, when communication interruption diagnosing information of another node is stored, and further when power cutoff advance notification information or power cutoff post notification information including cutoff fuse specification information of an electronic fuse connected to the other node is stored, communication interruption diagnosing information related to a slave ECU connected to an electronic fuse corresponding to the power cutoff advance notification information or power cutoff post notification information is invalidated. However, even when communication interruption with another node is detected, if power cutoff advance notification information corresponding to the other node is stored, communication interruption diagnosing information of the other node may not be stored.

[0199] In this way, when communication interruption diagnosing information of other nodes is not stored, the invalidation may be terminated when a preset invalidation termination condition is satisfied. The invalidation termination condition is, for example, receiving an NM frame from the other node, or receiving ON notification information indicating that an electronic fuse connected to the other node has been turned ON.

[0200] [Variation 6] In the above-described first embodiment, the power cutoff advance notification information and the power cutoff post notification information are transmitted to the slave ECU connected to the conductive fuse. However, the power cutoff advance notification information and the power cutoff post notification information may be transmitted to all ECUs included in the communication system 1.

[0201] [Variation 7] In the above-described first embodiment, the master ECU 2 transmits to the slave ECU shutoff fuse identification information that identifies the shutoff fuse. However, the master ECU 2 may transmit to the slave ECU information that identifies the slave ECU connected to the shutoff fuse instead of the shutoff fuse identification information. In this case, the master ECU 2 needs to be provided with a linking table that links the shutoff fuse with the slave ECU connected to the shutoff fuse.

[0202] The control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in the control unit 11, 31 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0203] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0204] In addition to the above-mentioned ECUs 2-4, 101, 104-116, the present disclosure can also be realized in various forms, such as a system having the ECUs 2-4, 101, 104-116 as components, a program for causing a computer to function as the ECUs 2-4, 101, 104-116, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a communication method. [Technical idea disclosed in this specification] [Item 1] a first control device (3, 108) that receives power from a power source (5, 117) via an electronic fuse (15, 195); A second control device (4, 109) connected to the first control device so as to be capable of data communication; A switching control unit (2, 101, 104) configured to execute switching control for switching the electronic fuse between an on state and an off state; a power cutoff notification unit (S30, S120, S330) configured to execute at least one of a pre-notification process of transmitting power cutoff pre-notification information to the second control device, notifying the second control device that power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device, notifying the second control device that power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off to cut off the power supply from the power source to the first control device; Equipped with The second control device is a communication system (1, 100) configured to store the received power-off advance notification information and the received power-off post-notification information.

[0205] [Item 2] Item 1 is a communication system according to the present invention, The communication system, wherein the power-off advance notification information and the power-off post-notification information include fuse-cutting specification information for specifying the electronic fuse to be turned off.

[0206] [Item 3] The communication system according to item 1 or 2, The second control device is A communication system comprising an invalidation unit (S220, S230) configured to invalidate communication interruption diagnosing information indicating that communication with the first control device has been interrupted when the power-off advance notification information or the power-off post-notification information is received.

[0207] [Item 4] A communication system according to any one of items 1 to 3, The power cutoff notification unit is configured to transmit the power cutoff advance notification information before turning off the electronic fuse in response to a change in a power supply state of a vehicle equipped with the communication system.

[0208] [Item 5] A communication system according to any one of items 1 to 4, The power-off notification unit is configured to transmit the post-power-off notification information after the electronic fuse spontaneously turns off.

[0209] [Item 6] Item 5. A communication system according to item 4, The power cutoff notification unit is further configured to transmit power state notification information indicating the power state after the change.

[0210] [Item 7] Item 1 is a communication system according to the present invention, The power cutoff notification unit (S330) is configured to execute the advance notification process, The switching control unit further A communication system comprising a shutoff unit (S350) configured to turn off the electronic fuse after a preset shutoff waiting time has elapsed since the power shutoff notification unit transmitted the power shutoff advance notification information.

[0211] [Item 8] Item 7. A communication system according to item 7, The second control device further includes: A communication system comprising: a monitoring stopping unit (S420) configured to stop monitoring the first control device when the power cutoff advance notification information is received.

[0212] [Item 9] The communication system according to item 7 or 8, the switching control unit is configured to transmit power continuity notification information when turning on the electronic fuse; The second control device is configured to start monitoring the first control device after a preset monitoring standby time has elapsed since the second control device received the power continuity notification information.

[0213] [Item 10] an electronic fuse control unit (S40) configured to control the operation of an electronic fuse (15) configured to switch between a conductive state for connecting a power supply path that supplies power from a power source (5) to a first control device (3) and a cut-off state for cutting off the power supply path; a communication unit (13) configured to perform data communication with a second control device (4) connected to the first control device so as to be able to perform data communication with the first control device; a power cutoff notification unit (S30, S120, S330) configured to execute at least one of a pre-notification process of transmitting power cutoff pre-notification information to the second control device notifying that power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device notifying that power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device; A management device (2) comprising:

[0214] [Item 11] Item 11. A management device according to item 10, The power cutoff notification unit (S330) is configured to execute the advance notification process, The management device further comprises: A management device comprising a shutoff unit (S350) configured to turn off the electronic fuse after a preset shutoff waiting time has elapsed since the power shutoff notification unit transmitted the power shutoff advance notification information.

[0215] [Item 12] Item 3. A communication system according to item 3, The invalid portion is A communication system configured to invalidate communication interruption diagnosing information by not storing the communication interruption diagnosing information even when a communication interruption with the first control device is detected and the power cutoff advance notification information corresponding to the first control device is stored.

[0216] [Item 13] Item 13. A communication system according to item 12, The communication system is configured such that the invalidation unit terminates the invalidation when a preset invalidation termination condition is met.

[0217] [Item 14] Item 3. A communication system according to item 3, The invalidation unit is configured to invalidate the stored communication disruption diag information by adding invalidation information indicating that the communication disruption diag information is invalid.

[0218] [Item 15] A communication system according to any one of items 1 to 8 and items 12 to 14, The power cutoff notification unit is configured to transmit the power cutoff advance notification information and the power cutoff post notification information to all electronic control devices included in the communication system.

[0219] [Item 16] A communication system according to any one of items 1 to 8 and items 12 to 15, The communication system, wherein the power-off advance notification information and the power-off post-notification information include shutoff device identification information for identifying an electronic control device connected to the electronic fuse to be turned off.

[0220] [Item 17] Item 17. A communication system according to item 16, The power supply cut-off notification unit is configured to generate the cut-off device identification information by referring to a linking table that links the electronic fuse to be turned off and the electronic control device connected to the electronic fuse.

[0221] [Item 18] A communication system according to any one of items 1 to 8 and items 12 to 17, The communication system (101) includes: The system includes a zone control device (104) connected to the slave control devices so as to be able to perform data communication with the first control device and the second control device (108, 109), and a central control device (101) connected to the zone control devices so as to be able to perform data communication with the zone control devices, The zone control device is a communication system including the switching control unit and the power cutoff notification unit.

[0222] [Item 19] A communication system according to any one of items 1 to 8 and items 12 to 17, The communication system (101) includes: The system includes a zone control device (104) connected to the slave control devices so as to be able to perform data communication with the first control device and the second control device (108, 109), and a central control device (101) connected to the zone control devices so as to be able to perform data communication with the zone control devices, the central control device includes the power cutoff notification unit, The zone control device is a communication system including the switching control unit.

[0223] [Item 20] Computer, an electronic fuse control unit (S40) configured to control the operation of an electronic fuse (15) configured to switch between a conductive state for conducting a power supply path that supplies power from a power source (5) to the first control device (3) and a cut-off state for cutting off the power supply path; A communication unit (13) configured to perform data communication with a second control device (4) connected to the first control device so as to be able to perform data communication with the first control device; and a power cutoff notification unit (S30, S120, S330) configured to execute at least one of a pre-notification process of transmitting power cutoff pre-notification information to the second control device notifying that the power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device notifying that the power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off to cut off the power supply from the power source to the first control device; A management program to function as a. [Explanation of symbols]

[0224] 1... communication system, 2... master ECU, 3, 4... slave ECU, 5... battery, 11... control unit, 13... CAN communication unit, 15... electronic fuse, 100... communication system, 101... central ECU, 104... zone ECU, 108, 109... slave ECU, 117... battery, 195... electronic fuse

Claims

1. a first control device (3, 108) receiving power from a power source (5, 117) via an electronic fuse (15, 195); A second control device (4, 109) connected to the first control device so as to be capable of data communication; A switching control unit (2, 101, 104) configured to execute switching control for switching the electronic fuse between an on state and an off state; a power cutoff notification unit (S30, S120, S330) configured to execute at least one of a pre-notification process of transmitting power cutoff pre-notification information to the second control device, notifying the second control device that power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device, notifying the second control device that power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off to cut off the power supply from the power source to the first control device; Equipped with The second control device is a communication system (1, 100) configured to store the received power-off advance notification information and the received power-off post-notification information.

2. 2. The communication system according to claim 1, The communication system, wherein the power-off advance notification information and the power-off post-notification information include fuse-cutting specification information for specifying the electronic fuse to be turned off.

3. A communication system according to claim 1 or 2, The second control device is A communication system comprising an invalidation unit (S220, S230) configured to invalidate communication interruption diagnosing information indicating that communication with the first control device has been interrupted when the power-off pre-notification information or the power-off post-notification information is received.

4. A communication system according to claim 1 or 2, The power cutoff notification unit is configured to transmit the power cutoff advance notification information before turning off the electronic fuse in response to a change in a power supply state of a vehicle equipped with the communication system.

5. A communication system according to claim 1 or 2, The power-off notification unit is configured to transmit the post-power-off notification information after the electronic fuse spontaneously turns off.

6. 5. The communication system according to claim 4, The power cutoff notification unit is further configured to transmit power state notification information indicating the power state after the change.

7. 2. The communication system according to claim 1, The power cutoff notification unit (S330) is configured to execute the advance notification process, The switching control unit further A communication system comprising a shutoff unit (S350) configured to turn off the electronic fuse after a preset shutoff waiting time has elapsed since the power shutoff notification unit transmitted the power shutoff advance notification information.

8. 8. The communication system according to claim 7, The second control device further includes: A communication system comprising: a monitoring canceling unit (S420) configured to cancel monitoring of the first control device when the power cutoff advance notification information is received.

9. A communication system according to claim 7 or claim 8, the switching control unit is configured to transmit power continuity notification information when turning on the electronic fuse; The second control device is configured to start monitoring the first control device after a preset monitoring standby time has elapsed since receiving the power supply continuity notification information.

10. an electronic fuse control unit (S40) configured to control the operation of an electronic fuse (15) configured to switch between a conductive state for conducting a power supply path that supplies power from a power source (5) to a first control device (3) and a cut-off state for cutting off the power supply path; A communication unit (13) configured to perform data communication with a second control device (4) connected to the first control device so as to be able to perform data communication with the first control device; a power cutoff notification unit (S30, S120, S330) configured to execute at least one of an advance notification process of transmitting power cutoff advance notification information to the second control device, notifying the second control device that the power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device, notifying the second control device that the power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device; A management device (2).

11. The management device according to claim 10, The power cutoff notification unit (S330) is configured to execute the advance notification process, The management device further comprises: A management device comprising a shutoff unit (S350) configured to turn off the electronic fuse after a preset shutoff waiting time has elapsed since the power shutoff notification unit transmitted the power shutoff advance notification information.

12. 4. The communication system according to claim 3, The invalid portion is A communication system configured to invalidate communication interruption diagnosing information by not storing the communication interruption diagnosing information even when a communication interruption with the first control device is detected and the power cutoff advance notification information corresponding to the first control device is stored.

13. 13. A communication system according to claim 12, comprising: The communication system is configured such that the invalidation unit terminates the invalidation when a preset invalidation termination condition is met.

14. 4. The communication system according to claim 3, The invalidation unit is configured to invalidate the stored communication disruption diag information by adding invalidation information indicating that the communication disruption diag information is invalid.

15. A communication system according to claim 1 or 2, The power cutoff notification unit is configured to transmit the power cutoff advance notification information and the power cutoff post notification information to all electronic control devices included in the communication system.

16. 2. The communication system according to claim 1, The communication system, wherein the power-off advance notification information and the power-off post-notification information include shutoff device identification information for identifying an electronic control device connected to the electronic fuse to be turned off.

17. 17. A communication system according to claim 16, comprising: The power supply cut-off notification unit is configured to generate the cut-off device identification information by referring to a linking table that links the electronic fuse to be turned off and the electronic control device connected to the electronic fuse.

18. A communication system according to claim 1 or 2, The communication system (100) comprises: The system includes a zone control device (104) that includes the first control device and the second control device as slave control devices (108, 109) and is connected to the slave control devices so as to be able to perform data communication with the slave control devices, and a central control device (101) that is connected to the zone control devices so as to be able to perform data communication with the zone control devices, The zone control device is a communication system including the switching control unit and the power cutoff notification unit.

19. A communication system according to claim 1 or 2, The communication system (100) comprises: The system includes a zone control device (104) that includes the first control device and the second control device as slave control devices (108, 109) and is connected to the slave control devices so as to be able to perform data communication with the slave control devices, and a central control device (101) that is connected to the zone control devices so as to be able to perform data communication with the zone control devices, the central control device includes the power cutoff notification unit, The zone control device is a communication system including the switching control unit.

20. Computer, an electronic fuse control unit (S40) configured to control the operation of an electronic fuse (15) configured to switch between a conductive state for conducting a power supply path that supplies power from a power source (5) to a first control device (3) and a cut-off state for cutting off the power supply path; A communication unit (13) configured to perform data communication with a second control device (4) connected to the first control device so as to be able to perform data communication with the first control device; and a power cutoff notification unit (S30, S120, S330) configured to execute at least one of a pre-notification process of transmitting power cutoff pre-notification information to the second control device notifying that the power supply from the power source via the electronic fuse will be cut off before the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device, and a post-notification process of transmitting power cutoff post-notification information to the second control device notifying that the power supply from the power source via the electronic fuse has been cut off after the electronic fuse is turned off in order to cut off the power supply from the power source to the first control device; A management program to function as a.

Images