Communication system

Abstract

To improve reliability of control for performing power supply to a control device.SOLUTION: A communication system 1 comprises: a slave ECU 3; and a master ECU 2. The slave ECU 3 receives power supply from a battery 7 via a relay 15. The master ECU 2 is connected to the slave ECU 3, and can perform data communication, and controls an operation of the relay 15. The master ECU 2 determines whether or not the slave ECU 3 is in a state where the relay 15 can be set to a disconnection state (hereinbelow, a disconnection available state). The master ECU 2 sets the relay 15 to a disconnection state in the case where it determines that the slave ECU 3 is in the disconnection available state.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a communication system including a plurality of control devices. [Background technology]

[0002] Patent document 1 describes an in-vehicle network system that includes a power supply relay that individually switches the power supply of each of a plurality of electronic control devices on / off, determines the control content for switching the power supply of a specific electronic control device on / off for a specific electronic control device that corresponds to a scene identified based on the vehicle situation, and uses the power supply relay to switch the power supplied to the specific electronic control device on / off based on the determined control content. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-81021 A Summary of the Invention [Problem to be solved by the invention]

[0004] As a result of detailed investigation by the inventors, it was found that there is a problem that the relay may be switched from an on state to an off state even though the power supply to the control device should not be cut off, or that the relay may continue to be in the on state even though the power supply to the control device may be cut off.

[0005] An object of the present disclosure is to improve the reliability of control of power supply to a control device. [Means for solving the problem]

[0006] One aspect of the present disclosure is a communication system (1, 100) including a first control device (3, 108, 104) and a second control device (2, 101, 104). The first control device receives power from a power source (7, 117) via a power supply switching unit (15, 195, 173) configured to switch between a conductive state that connects the power supply path and a cut-off state that cuts off the power supply path.

[0007] The second control device is connected to the first control device so as to be able to perform data communication with the first control device, and is configured to control the operation of the power supply switching unit. The second control device includes a state confirmation unit (S20 to S30, S220 to S260, S510 to S530, S710 to S720, S810 to S860) and a power supply control unit (S40, S270, S540, S730, S870).

[0008] The state confirmation unit is configured to determine whether or not the first control device is in a cutoff possible state in which the power supply switching unit may be put into a cutoff state. The power supply control unit is configured to set the power supply switching unit to the cut-off state when the state confirmation unit determines that the first control device is in a cut-off possible state.

[0009] In the communication system of the present disclosure configured as described above, it is determined whether the first control device is in a state where it can be cut off, and if the first control device is in a state where it can be cut off, the power supply switching unit is set to a cut-off state. This makes it possible for the communication system of the present disclosure to suppress occurrence of a situation in which the power supply switching unit switches from a conductive state to a cut-off state even when the power supply to the first control device should not be cut off, or the power supply switching unit continues to be in a conductive state even when the power supply to the first control device can be cut off. Therefore, the communication system of the present disclosure can improve the reliability of the control of power supply to the control device. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing a configuration of a communication system according to first, second, third and fourth embodiments. [Diagram 2] 11 is an explanatory diagram illustrating an example of affiliation information and startup information; [Diagram 3]4 is a flowchart showing a management process according to the first embodiment. [Figure 4] 5 is a flowchart showing a response process according to the first embodiment. [Diagram 5] FIG. 4 is a sequence diagram showing a procedure for turning off a relay in the first embodiment. [Figure 6] 13 is a flowchart showing a management process according to a second embodiment. [Figure 7] 13 is a flowchart showing a response process according to the second embodiment. [Figure 8] FIG. 11 is a sequence diagram showing a procedure for turning off a relay in the second embodiment. [Figure 9] 13 is a flowchart showing a notification process according to the third embodiment. [Figure 10] 13 is a flowchart showing a management process according to a third embodiment. [Figure 11] FIG. 13 is a sequence diagram showing a procedure for turning off a relay in the third embodiment. [Figure 12] 13 is a flowchart showing a request process according to the fourth embodiment. [Figure 13] 13 is a flowchart showing a management process according to a fourth embodiment. [Figure 14] FIG. 13 is a sequence diagram showing a procedure for turning off a relay in the fourth embodiment. [Figure 15] FIG. 13 is a block diagram showing a configuration of a communication system according to a fifth embodiment. [Figure 16] 13 is a flowchart showing a management process according to a fifth embodiment. [Figure 17] FIG. 13 is a diagram showing the configuration of a management table. [Figure 18] FIG. 13 is a block diagram showing a configuration of a communication system according to a sixth embodiment. [Figure 19] FIG. 2 is a diagram showing a correspondence relationship between control objects and clusters. [Figure 20] FIG. 13 is a block diagram showing a configuration of a communication system according to a seventh embodiment. [Figure 21] FIG. 23 is a block diagram showing the configuration of a central ECU and an upstream power distribution unit according to a seventh embodiment. [Figure 22] FIG. 23 is a first block diagram showing a configuration of a zone ECU according to a seventh embodiment. [Figure 23] FIG. 23 is a second block diagram showing the configuration of the zone ECU according to the seventh embodiment. [Figure 24] FIG. 13 is a block diagram showing a configuration of a slave ECU according to a seventh embodiment. [Diagram 25] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the seventh embodiment. [Figure 26] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the eighth embodiment. [Figure 27] FIG. 13 is a sequence diagram showing a procedure for turning off an electronic fuse in the ninth embodiment. [Figure 28] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the eleventh embodiment. [Figure 29] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the twelfth embodiment. [Diagram 30] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the thirteenth embodiment. [Diagram 31] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the fourteenth embodiment. [Diagram 32] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the fifteenth embodiment. [Diagram 33] FIG. 23 is a sequence diagram showing a procedure for turning off an electronic fuse in the sixteenth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] [First embodiment] A first embodiment of the present disclosure will be described below with reference to the drawings. A communication system 1 according to the present embodiment is mounted on a vehicle, and includes a master ECU 2, slave ECUs 3, 4, 5, and 6, and a battery 7, as shown in Fig. 1. ECU is an abbreviation for Electronic Control Unit. In the following description, the master ECU 2 and the slave ECUs 3 to 6 are also collectively referred to as nodes.

[0012] The master ECU 2 and the slave ECUs 3, 4, and 5 are connected to each other via a communication bus 8 so as to be able to communicate data with each other. The master ECU 2 and the slave ECU 6 are connected to each other via a communication bus 9 so as to be able to communicate data with each other.

[0013] The battery 7 supplies power to each part of the vehicle at a DC battery voltage (for example, 12 V). The master ECU 2 and the slave ECUs 3 to 6 operate by receiving power from the battery 7.

[0014] The master ECU 2 includes a control unit 11, CAN communication units 12 and 13, a storage unit 14, and relays 15, 16, and 17. CAN is an abbreviation for Controller Area Network. Note that the communication protocol of the communication system 1 is not limited to CAN.

[0015] The control unit 11 is an electronic control device mainly composed of a microcomputer including a CPU 21, a ROM 22, a RAM 23, etc. Various functions of the microcomputer are realized by the CPU 21 executing a program stored in a non-transient real recording medium. In this example, the ROM 22 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 21 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 11 may be one or more.

[0016] The CAN communication unit 12 communicates with the slave ECUs 3, 4, and 5 connected to the communication bus 8 by transmitting and receiving communication frames based on the CAN communication protocol. The CAN communication unit 13 communicates with the slave ECU 6 connected to the communication bus 9 by transmitting and receiving communication frames based on the CAN communication protocol. Hereinafter, a CAN communication frame is referred to as a CAN frame.

[0017] The storage unit 14 is a storage device for storing various data, and stores a management table 25, which will be described later. The relay 15 is disposed on the power supply path between the battery 7 and the slave ECU 3. The relay 16 is disposed on the power supply path between the battery 7 and the slave ECU 4. The relay 17 is disposed on the power supply path between the battery 7 and the slave ECU 5.

[0018] The relays 15, 16, and 17 are configured to switch between a conductive state in which the power supply path is connected and a cut-off state in which the power supply path is cut off in accordance with a command from the control unit 11. Hereinafter, the conductive state is also referred to as an on state, and the cut-off state is also referred to as an off state.

[0019] Each of the slave ECUs 3 to 6 includes a control unit 31, a CAN communication unit 32, and a storage unit 33. The control unit 31 is an electronic control device mainly composed of a microcomputer including a CPU 41, a ROM 42, a RAM 43, etc. Various functions of the microcomputer are realized by the CPU 41 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 42 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 41 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 31 may be one or more.

[0020] The CAN communication units 32 of the slave ECUs 3 to 5 communicate with the communication devices (that is, the master ECU 2 and the slave ECUs 3 to 5) connected to the communication bus 8 based on the CAN communication protocol.

[0021] The CAN communication unit 32 of the slave ECU 6 communicates with a communication device (that is, the master ECU 2) connected to the communication bus 9 based on the CAN communication protocol. The storage unit 33 is a storage device for storing various data.

[0022] A CAN frame consists of a start of frame, an arbitration field, a control field, a data field, a CRC field, an ACK field, and an end of frame. The arbitration field consists of an 11-bit or 29-bit identifier (i.e., ID) and a 1-bit RTR bit.

[0023] The 11-bit identifier used in CAN communication is called CANID. The CANID is preset based on the contents of the data included in the CAN frame, the sender of the CAN frame, the destination of the CAN frame, etc.

[0024] The data field is a payload made up of first data, second data, third data, fourth data, fifth data, sixth data, seventh data, and eighth data, each of which is 8 bits (i.e., 1 byte).

[0025] The communication system 1 forms a partial network, which is a power supply control method based on the communication control of the CAN protocol standard specified in ISO11898-6. For this reason, the communication system 1 achieves low power consumption by collectively transitioning one or more nodes belonging to each communication group (described later) to a wake-up state (i.e., an active state) or a sleep state (i.e., a dormant state) individually for each communication group. By waking up, a node enters a normal operating state in which the functions assigned to the node can be used without restrictions, and by sleeping, it enters a low-power operating state in which the available functions are restricted.

[0026] In the communication system 1, when waking up a node in a sleep state, an NM frame, which is a CAN frame including startup information that specifies an activation group, is used. NM is an abbreviation for Network Management.

[0027] The activation information is set, for example, as shown in FIG. 2. DLC is an abbreviation for Data Length Code, and is an area that indicates the size of the data field in the CAN frame in bytes. That is, the activation information is stored in the data field of the CAN frame. For ease of explanation, a case where DLC is 1 byte (i.e., 8 bits) is shown here. An activation group is associated with each bit of the 8-bit data that indicates the activation information. Note that an activation group may be associated with a data string of 1 or more bits.

[0028] In the activation information set in the NM frame, a bit corresponding to the activation group to be activated is set to 1. Each node stores affiliation information that indicates the activation group to which the node belongs. The affiliation information has the same data length as the activation information, and the allocation of each bit is also the same as the activation information. In the affiliation information, the bit corresponding to the activation group to which the node belongs is set to 1.

[0029] Each node compares the activation information extracted from the NM frame with the membership information stored in the node itself to determine whether or not the communication group to which the node itself belongs is an activation target.

[0030] For example, the affiliation information shown in Fig. 2 indicates that the node belongs to the first communication group, the third communication group, and the fifth communication group. The startup information shown in Fig. 2 indicates that the second communication group, the third communication group, the fourth communication group, and the fifth communication group are to be started. Since the third communication group and the fifth communication group are included in both the affiliation information and the startup information shown in Fig. 2, the local node determines that the local node is to be started as the third communication group and the fifth communication group.

[0031] The management table 25 shown in FIG. 1 sets, as shown in FIG. 17, a correspondence between a service and switching information for each of a plurality of services provided to a vehicle occupant using the master ECU 2 and the slave ECUs 3 to 6.

[0032] For example, for the first service, the management table 25 sets the switching information for relay 15 to the on state, the switching information for relay 16 to the off state, and the switching information for relay 17 to the on state.

[0033] For example, for the second service, the management table 25 sets the switching information for relay 15 to the off state, the switching information for relay 16 to the on state, and the switching information for relay 17 to the on state.

[0034] When the slave ECUs 3 to 6 detect that the start condition of a service is satisfied, they transmit a service request for requesting execution of the corresponding service to the master ECU 2. When the master ECU 2 receives the service request, it extracts switching information corresponding to the corresponding service from the management table 25, and turns the relays 15, 16, and 17 on or off based on the extracted switching information.

[0035] When the master ECU 2 detects that the start condition of the service is satisfied, it extracts switching information corresponding to the relevant service from the management table 25, and turns the relays 15, 16, and 17 on or off based on the extracted switching information.

[0036] Next, a description will be given of the procedure of the management process executed by the control unit 11 of the master ECU 2. The management process is a process that is repeatedly executed while the master ECU 2 is running. When the management process is executed, the CPU 21 of the control unit 11 determines in S10 whether or not at least one of the relays 15, 16, and 17 needs to be switched from an on state to an off state, as shown in Fig. 3. Specifically, the CPU 21 determines whether or not the relays 15, 16, and 17 need to be switched from an on state to an off state, based on switching information extracted from the management table 25 due to the master ECU 2 detecting that a service start condition has been satisfied. The CPU 21 also determines whether or not the relays 15, 16, and 17 need to be switched from an on state to an off state, based on switching information extracted from the management table 25 due to the master ECU 2 detecting that a service start condition has been satisfied.

[0037] In addition, when multiple service requests are received or when the start conditions for multiple services are met, the relay is turned on by the OR (i.e., logical sum) of the switching information, and the relay is turned off by the AND (i.e., logical product) of the switching information.

[0038] If there is no need to switch the relays 15, 16, and 17 from the on state to the off state, the CPU 21 ends the management process. On the other hand, when at least one of the relays 15, 16, 17 needs to be switched from the on state to the off state, the CPU 21 transmits in S20 a cutoff notification indicating that the power supply will be cut off to the slave ECUs 3, 4, 5 connected to the relays 15, 16, 17 that are to be switched from the on state to the off state. For example, when the relay 16 is to be switched from the on state to the off state, the CPU 21 transmits a cutoff notification to the slave ECU 4.

[0039] In step S30, the CPU 21 determines whether or not a completion response has been received from the slave ECU to which the shutdown notification has been transmitted. If the completion response has not been received, the CPU 21 waits until the completion response is received by repeating the process of step S30.

[0040] Then, when the completion response is received, the CPU 21 switches, in S40, the relay connected to the slave ECU that is the sender of the received completion response to the off state. For example, when the sender of the received completion response is the slave ECU 4, the CPU 21 switches the relay 16 to the off state.

[0041] In S50, the CPU 21 determines whether or not it has received a completion response from all slave ECUs to which it has transmitted a shutdown notification. If there is a slave ECU to which it has not received a completion response, the CPU 21 proceeds to S30. On the other hand, if it has received a completion response from all slave ECUs to which it has transmitted a shutdown notification, the CPU 21 ends the management process.

[0042] Next, there will be described the procedure of the response process executed by the control unit 31 of each of the slave ECUs 3 to 5. The response process is a process that is repeatedly executed while each of the slave ECUs 3 to 5 is running. When the response process is executed, as shown in Fig. 4, the CPU 41 of the control unit 31 determines in S110 whether or not a cutoff notification has been received from the master ECU 2. If a cutoff notification has not been received, the CPU 41 ends the response process.

[0043] On the other hand, when the response process is received, the CPU 41 starts a shutdown sequence in S120. The shutdown sequence is a process performed to transition from a wake-up state to a sleep state. Processes to be executed in the shutdown sequence are set in advance for each of the ECUs 2 to 6. An example of the shutdown sequence is storing setting value information for an in-vehicle air conditioner.

[0044] In S130, the CPU 41 determines whether or not the shutdown sequence has been completed. If the shutdown sequence has not been completed, the CPU 41 repeats the process of S130 to wait until the shutdown sequence is completed.

[0045] Then, when the shutdown sequence is completed, the CPU 41 transmits a completion response to the master ECU 2 in S140, and ends the response process. As shown in FIG. 5, after the master ECU 2 and the slave ECUs 3 to 5 execute a handshake of the shutdown sequence, the relays 15, 16, and 17 are switched from the on state to the off state.

[0046] 5, the master ECU 2 transmits a shutdown notification to the slave ECUs 3 to 5. The slave ECUs 3 to 5 that receive the shutdown notification execute a shutdown sequence as shown in process P2.

[0047] When the shutdown sequence is completed, the slave ECUs 3 to 5 transmit a completion response to the master ECU 2 as shown in process P3. Upon receiving the completion response, the master ECU 2 switches the relays 15, 16, and 17 from the on state to the off state as shown in process P4.

[0048] The communication system 1 configured in this manner includes the slave ECU 3 and the master ECU 2. The slave ECU 3 receives power supply from the battery 7 via a relay 15 configured to switch between a conductive state for connecting the power supply path and a cut-off state for cutting off the power supply path.

[0049] The master ECU 2 is connected to the slave ECU 3 so as to be able to communicate data with each other, and is configured to control the operation of the relay 15 . The master ECU 2 is configured to determine whether the slave ECU 3 is in a state in which the relay 15 may be switched to a cut-off state (hereinafter, cut-off possible state) by performing data communication with the slave ECU 3. Specifically, the master ECU 2 is configured to transmit a cut-off notification indicating that the relay 15 is to be switched to the cut-off state to the slave ECU 3, and determine that the slave ECU 3 is in a cut-off possible state when the master ECU 2 receives from the slave ECU 3 a completion response indicating that the shutdown sequence has been completed.

[0050] The master ECU 2 is configured to bring the relay 15 into the cut-off state when it is determined that the slave ECU 3 is in the cut-off possible state. Such a communication system 1 can suppress the occurrence of a situation in which the relay 15 is switched from a conductive state to a cut-off state even though the power supply to the slave ECU 3 should not be cut off because the shutdown sequence has not been completed. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 3.

[0051] In the embodiment described above, the slave ECU 3 corresponds to the first control device, the master ECU 2 corresponds to the second control device, the relay 15 corresponds to the power supply switching unit, and the battery 7 corresponds to the power source.

[0052] Moreover, steps S20 to S30 correspond to the processing performed by the state confirmation unit, and step S40 corresponds to the processing performed by the power supply control unit. [Second embodiment] A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0053] The communication system 1 of the second embodiment differs from the first embodiment in that the management process and response process are changed. Next, a description will be given of a procedure of the management process of the second embodiment. The management process of the second embodiment is a process that is repeatedly executed while the master ECU 2 is running.

[0054] When the management process of the second embodiment is executed, the CPU 21 of the control unit 11 determines in S210 whether or not it is necessary to switch at least one of the relays 15, 16, and 17 from the on state to the off state, in the same manner as in S10, as shown in Fig. 6. If it is not necessary to switch the relays 15, 16, and 17 from the on state to the off state, the CPU 21 ends the management process.

[0055] On the other hand, when it is necessary to switch at least one of the relays 15, 16, 17 from the on state to the off state, the CPU 21, in S220, transmits a cut-off notification indicating that the power supply will be cut off to the slave ECUs 3, 4, 5 connected to the relays 15, 16, 17 that are to be switched from the on state to the off state, in the same manner as in S20.

[0056] In step S230, the CPU 21 determines whether or not an acknowledgement response has been received from the slave ECU to which the cutoff notification has been transmitted. If an acknowledgement response has not been received, the CPU 21 waits until an acknowledgement response is received by repeating the process of step S230.

[0057] Then, when the acknowledgement response is received, the CPU 21 extracts the completion time information included in the acknowledgement response and sets the completion time indicated by the extracted completion time information as the waiting time until the relay connected to the slave ECU that is the transmission source of the received acknowledgement response is switched to the OFF state at S240. For example, when the transmission source of the received completion response is the slave ECU 4, the CPU 21 sets the completion time indicated by the extracted completion time information as the waiting time until the relay 16 is switched to the OFF state.

[0058] In S250, the CPU 21 determines whether or not it has received an acknowledgement response from all of the slave ECUs to which it transmitted the cutoff notification. If there is a slave ECU from which it has not received an acknowledgement response, the CPU 21 proceeds to S230.

[0059] On the other hand, when the CPU 21 has received an acknowledgement response from all the slave ECUs to which it transmitted the cutoff notification, the CPU 21 determines in S260 whether or not the completion time set in S240 has elapsed. If the completion time has not elapsed, the CPU 21 proceeds to S280. On the other hand, if the completion time has elapsed, the CPU 21 switches to the off state in S270 the relay connected to the slave ECU corresponding to the elapsed completion time, and proceeds to S280.

[0060] At S280, the CPU 21 determines whether the relays connected to all slave ECUs that have transmitted the cutoff notification have been switched to the off state. If there is a slave ECU whose relay has not been switched to the off state, the CPU 21 proceeds to S260. On the other hand, if the relays have been switched to the off state for all slave ECUs that have transmitted the cutoff notification, the CPU 21 ends the management process.

[0061] Next, a procedure of the response process according to the second embodiment will be described. The response process according to the second embodiment is a process that is repeatedly executed while the slave ECUs 3 to 5 are running. When the response process of the second embodiment is executed, the CPU 41 of the control unit 31 determines in S310 whether or not a cutoff notification has been received from the master ECU 2, as shown in Fig. 7. If a cutoff notification has not been received, the CPU 41 ends the response process.

[0062] On the other hand, when the response process has been received, in S320, the CPU 41 transmits an acknowledgment response to the master ECU 2. The acknowledgment response includes completion time information indicating a completion time that is preset as the time from the start to the completion of the shutdown sequence.

[0063] The CPU 41 executes a shutdown sequence in S330, and after the shutdown sequence ends, ends the response process. As shown in FIG. 8, after the master ECU 2 and the slave ECUs 3 to 5 execute a handshake of the shutdown sequence, the relays 15, 16, and 17 are switched from the on state to the off state.

[0064] Specifically, as shown in process P11 of FIG. 8, the master ECU 2 transmits a cutoff notification to the slave ECUs 3 to 5. The slave ECUs 3 to 5 that have received the cutoff notification transmit an acknowledgement response to the master ECU 2 as shown in process P12.

[0065] The slave ECUs 3 to 5 that have transmitted the acknowledgement responses execute a shutdown sequence as shown in process P13. Having received the completion response, the master ECU 2 waits until the completion time has elapsed, as shown in process P14.

[0066] When the completion time has elapsed, the master ECU 2 switches the relays 15, 16, and 17 from the ON state to the OFF state as shown in process P15. The communication system 1 configured in this manner includes the slave ECU 3 and the master ECU 2.

[0067] The master ECU 2 is configured to determine whether the slave ECU 3 is in a state in which the relay 15 may be switched to a cut-off state (hereinafter, cut-off possible state) by performing data communication with the slave ECU 3. Specifically, the master ECU 2 is configured to transmit a cut-off notification indicating that the relay 15 is to be switched to a cut-off state to the slave ECU 3, and when the master ECU 2 receives an acknowledgement response including completion time information indicating a completion time required to complete the shutdown sequence from the slave ECU 3 after transmitting the cut-off notification, to determine that the slave ECU 3 is in a cut-off possible state if the completion time has elapsed since receiving the acknowledgement response.

[0068] The master ECU 2 is configured to bring the relay 15 into the cut-off state when it is determined that the slave ECU 3 is in the cut-off possible state. Such a communication system 1 can suppress the occurrence of a situation in which the relay 15 is switched from a conductive state to a cut-off state even though the power supply to the slave ECU 3 should not be cut off because the shutdown sequence has not been completed. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 3.

[0069] In the embodiment described above, steps S220 to S260 correspond to the processing performed by the state confirmation section, and step S270 corresponds to the processing performed by the power supply control section. [Third embodiment] A third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0070] The communication system 1 of the third embodiment differs from the first embodiment in that a notification process is executed instead of a response process, and in that the management process is changed. Next, the procedure of the notification process will be described. The notification process is repeatedly executed while the slave ECUs 3 to 5 are running.

[0071] When the notification process is executed, the CPU 41 of the control unit 31 determines whether or not it is necessary to transition from the wakeup state to the sleep state in S410, as shown in Fig. 9. If it is not necessary to transition to the sleep state, the notification process is terminated.

[0072] On the other hand, when it is necessary to transition from the wakeup state to the sleep state, the CPU 41 transmits a sleep notification indicating the transition to the sleep state to the master ECU 2 in S420.

[0073] In S430, the CPU 41 determines whether or not an acknowledgment response has been received from the master ECU 2. If an acknowledgment response has not been received, the CPU 41 waits until an acknowledgment response is received by repeating the process of S430.

[0074] Then, when the acknowledgement response is received, the CPU 41 starts the shutdown sequence in S440. In S450, the CPU 41 determines whether or not the shutdown sequence has been completed. If the shutdown sequence has not been completed, the CPU 41 waits until the shutdown sequence is completed by repeating the process of S450.

[0075] Then, when the shutdown sequence is completed, the CPU 41 transmits a completion response to the master ECU 2 in S460, and ends the response process. Next, a description will be given of a procedure of the management process of the third embodiment. The management process of the third embodiment is a process that is repeatedly executed while the master ECU 2 is running.

[0076] When the management process of the third embodiment is executed, the CPU 21 of the control unit 11 determines in S510 whether or not a sleep notification has been received from the slave ECUs 3 to 5, as shown in Fig. 10. If a sleep notification has not been received, the CPU 21 ends the management process.

[0077] On the other hand, if a sleep notification has been received, the CPU 21 transmits an acknowledgement response to the slave ECU that is the source of the received sleep notification in S520. In step S530, the CPU 21 determines whether or not a completion response has been received from the slave ECU that transmitted the acknowledgement response. If the completion response has not been received, the CPU 21 waits until the completion response is received by repeating the process of step S530.

[0078] Then, when the completion response is received, the CPU 21 switches, in S540, the relay connected to the slave ECU that is the source of the received completion response to the OFF state, and ends the management process.

[0079] As shown in FIG. 11, after the master ECU 2 and the slave ECUs 3 to 5 execute a handshake of the shutdown sequence, the relays 15, 16, and 17 are switched from the on state to the off state.

[0080] Specifically, as shown in process P21 of FIG. The master ECU 2, which has received the sleep notification, transmits an acknowledgement response to the slave ECUs 3 to 5 as shown in process P22.

[0081] The slave ECUs 3 to 5 that have transmitted the acknowledgement responses execute a shutdown sequence as shown in process P23. When the shutdown sequence is completed, the slave ECUs 3 to 5 transmit a completion response to the master ECU 2 as shown in process P24.

[0082] Upon receiving the completion response, the master ECU 2 switches the relays 15, 16, and 17 from the ON state to the OFF state as shown in process P25. The communication system 1 configured in this manner includes the slave ECU 3 and the master ECU 2.

[0083] The master ECU 2 is configured to determine whether the slave ECU 3 is in a state in which the relay 15 may be switched off (hereinafter, referred to as a "switch-off possible state") by performing data communication with the slave ECU 3. Specifically, when the master ECU 2 receives from the slave ECU 3 a sleep notification indicating that the slave ECU 3 will transition to a sleep state, the master ECU 2 transmits an acknowledgement response to the slave ECU 3, and when the master ECU 2 receives from the slave ECU 3 a completion response indicating that the shutdown sequence has been completed after transmitting the acknowledgement response, the master ECU 2 determines that the slave ECU 3 is in a switch-off possible state.

[0084] The master ECU 2 is configured to bring the relay 15 into the cut-off state when it is determined that the slave ECU 3 is in the cut-off possible state. Such a communication system 1 can suppress the occurrence of a situation in which the relay 15 continues to be conductive even though the power supply to the slave ECU 3 may be cut off because the slave ECU 3 is transitioning to a sleep state. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 3.

[0085] In the embodiment described above, steps S510 to S530 correspond to the processing performed by the state confirmation section, and step S540 corresponds to the processing performed by the power supply control section. [Fourth embodiment] A fourth embodiment of the present disclosure will be described below with reference to the drawings. In the fourth embodiment, only the parts different from the third embodiment will be described. The same reference numerals will be used to designate the same components.

[0086] The communication system 1 of the fourth embodiment differs from the third embodiment in that a request process is executed instead of a notification process, and in that the management process is changed. Next, a procedure of the request process will be described. The request process is a process that is repeatedly executed while the slave ECUs 3 to 5 are running.

[0087] When the requested process is executed, the CPU 41 of the control unit 31 determines whether or not it is necessary to transition from the wakeup state to the sleep state in S610, as shown in Fig. 12. If it is not necessary to transition to the sleep state, the requested process is terminated.

[0088] On the other hand, when it is necessary to transition from the wake-up state to the sleep state, in S620, the CPU 41 transmits a cut-off request for requesting cut-off of the power supply to the master ECU 2. The cut-off request includes completion time information indicating a completion time that is preset as the time from the start to the completion of the shutdown sequence.

[0089] The CPU 41 executes a shutdown sequence in S630, and after the shutdown sequence is completed, ends the request process. Next, a procedure of the management process of the fourth embodiment will be described. The management process of the fourth embodiment is a process that is repeatedly executed while the master ECU 2 is running.

[0090] When the management process of the fourth embodiment is executed, the CPU 21 of the control unit 11 determines in S710 whether or not a cutoff request has been received from the slave ECUs 3 to 5, as shown in Fig. 13. If a cutoff request has not been received, the CPU 21 ends the management process.

[0091] On the other hand, when a cutoff request is received, the CPU 21 determines in S720 whether or not the completion time indicated by the completion time information included in the received cutoff request has elapsed. If the completion time has not elapsed, the process of S720 is repeated to wait until the completion time has elapsed.

[0092] When the completion time has elapsed, the CPU 21 switches, in step S730, the relay connected to the slave ECU that is the source of the received cutoff request to the OFF state, and ends the management process.

[0093] As shown in FIG. 14, after the master ECU 2 and the slave ECUs 3 to 5 execute a handshake of the shutdown sequence, the relays 15, 16, and 17 are switched from the on state to the off state.

[0094] Specifically, the slave ECUs 3 to 5 transmit a cutoff request to the master ECU 2 as shown in process P31 of FIG. The slave ECUs 3 to 5 that have transmitted the shutdown request execute a shutdown sequence as shown in process P32.

[0095] The master ECU 2 that has received the cutoff request waits until the completion time has elapsed, as shown in process P33. When the completion time has elapsed, the master ECU 2 switches the relays 15, 16, and 17 from the ON state to the OFF state as shown in process P34.

[0096] The communication system 1 configured in this manner includes the slave ECU 3 and the master ECU 2. The master ECU 2 is configured to determine whether the slave ECU 3 is in a state in which the relay 15 may be switched to a cutoff state (hereinafter, cutoff possible state) by performing data communication with the slave ECU 3. Specifically, the master ECU 2 is configured to determine that the slave ECU 3 is in a cutoff possible state when the master ECU 2 receives a cutoff request from the slave ECU 3, the cutoff request including completion time information indicating a completion time required to complete the shutdown sequence, and when the completion time has elapsed since the master ECU 2 received the cutoff request.

[0097] The master ECU 2 is configured to bring the relay 15 into the cut-off state when it is determined that the slave ECU 3 is in the cut-off possible state. Such a communication system 1 can suppress the occurrence of a situation in which the relay 15 continues to be conductive even though the power supply to the slave ECU 3 may be cut off because the slave ECU 3 is transitioning to a sleep state. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 3.

[0098] In the embodiment described above, steps S710 to S720 correspond to the processing performed by the state confirmation section, and step S730 corresponds to the processing performed by the power supply control section. [Fifth embodiment] A fifth embodiment of the present disclosure will be described below with reference to the drawings. In the fifth embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same configurations.

[0099] The communication system 1 of the fifth embodiment differs from the first embodiment in that electronic fuses 18, 19, and 20 are provided instead of the relays 15, 16, and 17, as shown in FIG. The electronic fuse 18 is disposed on the power supply path between the battery 7 and the slave ECU 3. The electronic fuse 19 is disposed on the power supply path between the battery 7 and the slave ECU 4. The electronic fuse 20 is disposed on the power supply path between the battery 7 and the slave ECU 5.

[0100] The electronic fuses 18 to 20 each include a switching element (e.g., a MOSFET) and a control circuit. The control circuit of the electronic fuses 18 to 20 is configured to switch the switching element from an on state to an off state to cut off the power supply path when the current value flowing through the power supply path exceeds a preset overcurrent determination value.

[0101] The control circuits of the electronic fuses 18 to 20 are configured to turn on or off the switching elements in accordance with instructions from the control unit 11, thereby making or breaking the power supply path.

[0102] The control circuits of the electronic fuses 18 to 20 are configured to measure the values ​​of currents flowing through the electronic fuses 18 to 20 and output, to the master ECU 2, current value information indicating the measured current values. The communication system 1 of the fifth embodiment differs from the first embodiment in that the management process is changed and that the slave ECUs 3 to 5 do not execute a response process.

[0103] Next, a procedure of the management process of the fifth embodiment will be described. The management process of the fifth embodiment is a process that is repeatedly executed while the master ECU 2 is running. When the management process of the fifth embodiment is executed, the CPU 21 of the control unit 11 acquires current value information from the electronic fuses 18 to 20 in S810, as shown in FIG.

[0104] At S820, the CPU 21 sets a value of a current consumed by the slave ECUs 3 to 5 when the slave ECUs 3 to 5 are in a steady operation (hereinafter, a steady operation current value). The steady operation is an operation performed by the slave ECUs 3 to 5 in a steady state after a startup process executed to start the slave ECUs 3 to 5 is completed when power supply from the battery 7 starts or when the slave ECUs transition from a sleep state to a wake-up state.

[0105] Specifically, for example, when the value of the current flowing through the electronic fuse remains within a predetermined current range set as a current value during steady operation for a preset steady operation determination time, the CPU 21 sets the average of multiple current values ​​indicated by multiple pieces of current value information acquired within the steady operation determination time as the steady operation current value. Note that the steady operation current values ​​of the slave ECUs 3, 4, and 5 are set based on the current value information acquired from each of the electronic fuses 18, 19, and 20.

[0106] In S830, the CPU 21 calculates, for each of the slave ECUs 3 to 5, a current consumption difference obtained by subtracting the current value indicated by the current value information acquired in S810 from the steady-state operating current value set in S820.

[0107] At S840, the CPU 21 checks whether or not an NM frame instructing activation of each of the slave ECUs 3 to 5 has been transmitted between the current time and a preset transmission determination time. The storage unit 14 of the master ECU 2 stores an activation group table in which a correspondence between an activation group and an ECU belonging to the activation group is set for each of a plurality of activation groups. The activation group table is set so that, for example, the master ECU 2 and the slave ECUs 3 and 6 belong to a first communication group, and the master ECU 2 and the slave ECUs 4 and 5 belong to a second communication group.

[0108] Therefore, when the CPU 21 receives an NM frame, it identifies an activation group based on the activation information included in the NM frame, and further identifies the ECUs that belong to the identified activation group by referring to the activation group table. If the identified ECU is one of the slave ECUs 3 to 5, the CPU 21 determines that an NM frame instructing the slave ECUs 3 to 5 to activate has been transmitted.

[0109] In S850, the CPU 21 determines whether or not the current consumption difference calculated in S830 is greater than a preset OFF determination value for each of the slave ECUs 3 to 5. If the current consumption difference for all of the slave ECUs 3 to 5 is equal to or less than the OFF determination value, the CPU 21 ends the management process.

[0110] On the other hand, if the current consumption difference for at least one of the slave ECUs 3 to 5 is greater than the off judgment value, the CPU 21 determines in S860, based on the confirmation result in S840, whether or not an NM frame has been transmitted to instruct the startup of the slave ECU whose current consumption difference is greater than the off judgment value.

[0111] If the NM frames instructing the start-up of the slave ECUs have been transmitted to all of the slave ECUs whose current consumption differences are greater than the OFF determination value, the CPU 21 ends the management process.

[0112] On the other hand, if there is a slave ECU whose current consumption difference is greater than the OFF judgment value and to which an NM frame instructing startup has not been transmitted, the CPU 21 turns off the electronic fuses connected to the slave ECUs whose current consumption difference is greater than the OFF judgment value and to which an NM frame instructing startup has not been transmitted in S870, and ends the management process. For example, if the current consumption difference for the slave ECU 4 is greater than the OFF judgment value and an NM frame instructing startup of the slave ECU 4 has not been transmitted, the CPU 21 turns off the electronic fuse 19 connected to the slave ECU 4.

[0113] The communication system 1 configured in this manner includes the slave ECU 3 and the master ECU 2. The slave ECU 3 receives power from the battery 7 via an electronic fuse 18 that is configured to switch between a conductive state that connects the power supply path and a cut-off state that cuts off the power supply path.

[0114] The master ECU 2 is connected to the slave ECU 3 so as to be able to communicate data with each other, is configured so as to be able to transmit and receive CAN frames, and is configured so as to control the operation of the electronic fuse 18 . The master ECU 2 is configured to determine whether the slave ECU 3 is in a state in which the relay 15 may be switched off (hereinafter, referred to as a switchable state). Specifically, the master ECU 2 is configured to calculate, as a current consumption difference, the difference between a steady-state operating current value, which is the value of the current consumed by the slave ECU 3 during steady operation, and the value of the current consumed at the present time.

[0115] The master ECU 2 is configured to check whether an NM frame, which is a CAN frame including startup information indicating whether or not to start the slave ECU 3, has been transmitted to the master ECU 2.

[0116] The master ECU 2 is configured to cut off the electronic fuse 18 when it is determined that the slave ECU 3 is in a cutoff possible state. Specifically, the master ECU 2 is configured to cut off the electronic fuse 18 when a preset cutoff determination condition indicating that the current consumption difference is large is satisfied and an NM frame instructing the slave ECU 3 to start up has not been transmitted to the master ECU 2. The cutoff determination condition in this embodiment is that the current consumption difference is larger than a preset off determination value.

[0117] Such a communication system 1 can suppress the occurrence of a situation in which the relay 15 continues to be conductive even though the slave ECU 3 has transitioned to a sleep state and power supply to the slave ECU 3 may be cut off. Therefore, the communication system 1 can improve the reliability of the control of power supply to the slave ECU 3.

[0118] The master ECU 2 is configured to set a steady-state operating current value by measuring a current flowing through the power supply switching unit during steady-state operation, thereby enabling the communication system 1 to set a steady-state operating current value based on a current value actually consumed by the slave ECU 3 during steady-state operation.

[0119] In the embodiment described above, the electronic fuse 18 corresponds to a power supply switching unit, S810 to S830 correspond to the processing performed by a current difference calculation unit, S840 corresponds to the processing performed by a management frame confirmation unit, and S850 to S870 correspond to the processing performed by a power supply control unit.

[0120] [Sixth embodiment] A sixth embodiment of the present disclosure will be described below with reference to the drawings. In the sixth embodiment, only the parts different from the first embodiment will be described. The same reference numerals will be used to designate the same components.

[0121] As shown in FIG. 18, the communication system 1 of the sixth embodiment differs from the first embodiment in that a smart sensor 501, a smart actuator 502, a wireless device 503, and relays 504 and 505 are added.

[0122] The smart sensor 501 is a sensor having a communication function. The smart sensor 501 is connected to a communication bus 8. The smart actuator 502 is an actuator having a communication function. The smart actuator 502 is connected to a communication bus 8.

[0123] The wireless device 503 is a wireless communication device for performing wireless communication with an external communication device installed outside the vehicle. The wireless device 503 is, for example, a DCM. DCM is an abbreviation for Data Communication Module.

[0124] The relay 504 is disposed on the power supply path between the battery 7 and the smart sensor 501. The relay 505 is disposed on the power supply path between the battery 7 and the smart actuator 502.

[0125] Each of the relays 504 and 505 is configured to switch, in response to a command from the control unit 11, between a conductive state in which the power supply path is connected and a cut-off state in which the power supply path is cut off. Hereinafter, the master ECU 2, the slave ECUs 3 to 6, the smart sensor 501, and the smart actuator 502 are also collectively referred to as nodes.

[0126] (Prerequisite) The master ECU 2 and the slave ECU 6 are always powered by the battery 7 without using a relay, and can switch to a wake-up state or a sleep state independently. Hereinafter, the master ECU 2 and the slave ECU 6 are also referred to as NM-equipped nodes. An NM-equipped node is a node that has a function of generating an NM frame.

[0127] The slave ECUs 3 to 5, the smart sensor 501, and the smart actuator 502 are powered via relays, and cannot be switched to a wake-up state or a sleep state by themselves. That is, they enter a wake-up state when the relay is turned on, and enter a sleep state when the relay is turned off. Hereinafter, the slave ECUs 3 to 5, the smart sensor 501, and the smart actuator 502 are also referred to as non-NM nodes. A non-NM node is a node that does not have the function of generating and interpreting an NM frame.

[0128] The non-NM node includes at least one of an actuator and a sensor in addition to an ECU having a control function. The power supply paths of the non-NM nodes are connected to relays 15, 16, 17, 504, and 505 of the master ECU 2, respectively.

[0129] A non-NM node and a relay may be connected on a one-to-one basis, or multiple non-NM nodes belonging to the same cluster (i.e., a group that starts up simultaneously) may be connected under one relay.

[0130] The master ECU 2 and the NM-equipped node have a CAN communication unit and are capable of transmitting and receiving NM frames. An NM-equipped node determines whether it is in a wake-up state or a sleep state based on the NM frames it sends and receives via the communication bus.

[0131] The master ECU 2 turns on or off the relays 15, 16, 17, 504, and 505 to which the non-NM nodes are connected, based on the NM frame transmitted and received via the communication bus. The payload (i.e., data area) of the NM frame transmitted and received by the master ECU 2 and the NM-equipped node stores one or more bits of information indicating which cluster to start.

[0132] One or more master ECUs (ie, ECUs with built-in relays) are installed in a vehicle. As shown in Figure 19, one or more nodes belonging to each cluster are determined in advance by the system developer. Although it is possible to assign a cluster to each node, multiple nodes can be registered in one cluster. When the bit corresponding to each cluster is active (i.e., bit=1), the cluster wakes up. In the case of the master ECU, waking up means turning on the relay. Here, bit=1 indicates an active value, and bit=0 indicates an inactive value.

[0133] (First startup example) The first activation example is an operation example in which a fault diagnosis of the slave ECU 3 is performed in response to a request from the cloud.

[0134] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud. Next, the master ECU 2 determines a service called "fault diagnosis of the slave ECU 3" based on the event, and generates an NM frame in which the bit of the third cluster to which only the slave ECU 3 belongs is enabled in order to start the slave ECU 3.

[0135] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 8 and 9. Since there are no NM-equipped nodes belonging to the third cluster on communication buses 8 and 9, there are no changes in the devices on the communication buses. Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the third cluster is enabled at the same time as the above.

[0136] Next, the control unit 11 of the master ECU 2 determines a wake-up instruction to the third cluster based on the NM frame, and turns on the relay 15 since the third cluster includes the relay 15. When the relay 15 is turned on, power is supplied to the downstream slave ECU 3 and the slave ECU 3 is started up.

[0137] The master ECU 2 waits for the slave ECU 3 to start up, requests a diagnostic code from the slave ECU 3, and transmits a response from the slave ECU 3 to the base station via the wireless device 503.

[0138] (Second startup example) The second startup example is an operation example in which a fault diagnosis of the slave ECU 6 is performed in response to a request from the cloud.

[0139] First, a connection request is sent from the base station (i.e., the cloud) to the vehicle's wireless device 503. Next, if the wireless device 503 determines that the connection is valid, it notifies the master ECU 2 of the event received from the cloud. Next, the master ECU 2 determines a service called "fault diagnosis of the slave ECU 6" based on the event, and generates an NM frame in which the bit of the fourth cluster to which only the slave ECU 6 belongs is enabled in order to start the slave ECU 6.

[0140] Next, the master ECU 2 transmits the generated NM frame onto the communication buses 8 and 9. Since the slave ECU 6 is present on the communication bus 9 as a node belonging to the fourth cluster, the slave ECU 6 wakes up.

[0141] Next, the master ECU 2 executes processing based on the NM frame in the control unit 11, assuming that it has received an NM frame in which the bit of the fourth cluster is enabled at the same time as the above. Next, even if the control unit 11 of the master ECU 2 determines to issue a wake-up instruction to the fourth cluster based on the NM frame, the fourth cluster does not include the corresponding relay, so the control unit 11 ignores the instruction.

[0142] When the slave ECU 6 is started, the master ECU 2 requests a diagnostic code from the slave ECU 6 via the communication bus, and transmits a response from the slave ECU 6 to the base station via the wireless device 503.

[0143] (Third startup example) The third activation example is an operation example in which a user activates a remote air conditioning device using a smartphone. First, the user issues a command to turn on the vehicle air conditioner via the smartphone.

[0144] When the wireless device 503 receives the instruction signal from the smartphone and determines that the instruction signal is valid, it transmits the event received from the cloud (i.e., the instruction signal) to the master ECU 2. The master ECU2 determines the "air conditioning service" based on the event, and generates an NM frame in which the second cluster is activated as the air conditioning cluster.

[0145] The master ECU 2 periodically transmits the generated NM frame to the communication buses 8 and 9 until an instruction to stop the air conditioner is received. If it is desired to continue the active state, it is necessary to continue transmitting the NM frame periodically. At the same time, the control unit 11 of the master ECU 2 executes processing based on the NM frame. When an NM frame that activates the second cluster occurs on the communication bus 9, the slave ECU 6 (that is, the air conditioner ECU) registered in the second cluster receives the NM frame and wakes up in accordance with the received NM frame.

[0146] When the control unit 11 of the master ECU 2 detects that the second cluster is active, it turns on the relays 504 and 505 that belong to the second cluster. When relay 504 and relay 505 are in the ON state, power is supplied to smart sensor 501 (ie, temperature sensor) and smart actuator 502 (ie, compressor).

[0147] As a result of the above, power supply to the air conditioner ECU, smart sensor 501, and smart actuator 502 begins, making it possible to turn on the in-vehicle air conditioner. When the user issues an instruction to turn off the in-vehicle air conditioner via the smartphone, the master ECU 2 stops the periodic transmission of the NM frame.

[0148] When the NM frame is interrupted, the slave ECU 6 transitions to a sleep state, and the master ECU 2 turns off the relays 504 and 505. This stops the in-vehicle air conditioner. (4th startup example) The fourth activation example is an operation example in which the slave ECU 6 activates the vehicle air conditioner.

[0149] Since the slave ECU 6 is always supplied with power even when the vehicle is stopped, it is possible for the slave ECU 6 to wake up when it detects the input of a signal indicating that the start switch connected to the slave ECU 6 has been turned on, even when the slave ECU 6 is in sleep mode.

[0150] When the woken up slave ECU 6 confirms an input to start the in-vehicle air conditioner, it generates an NM frame with the bit corresponding to the second cluster turned on. The slave ECU 6 transmits the generated NM frame via the CAN communication unit 32. When the master ECU 2 receives this NM frame, the master ECU 2 turns on the relays 504 and 505 that belong to the second cluster.

[0151] When the start switch of the in-vehicle air conditioner is turned off, the slave ECU 6 stops transmitting NM frames and enters a sleep state after a while. When the NM frame is discontinued, the master ECU 2 turns off the relays 504 and 505 after a while and ends the control.

[0152] If the master ECU 2 determines that control needs to continue even after the transmission of the NM frame has stopped, the master ECU 2 transmits an NM frame with the bit corresponding to the second cluster turned on. This allows the slave ECU 6 and relays 504 and 505 to maintain their running state until the transmission of the NM frame generated by the master ECU 2 stops.

[0153] (Power shutdown process extension) NM-equipped nodes are supplied with power without going through a relay, and can execute shutdown processing to transition to a low power consumption state. However, non-NM-equipped nodes cannot execute shutdown processing if the power supply is suddenly cut off by turning off the relay. Examples of shutdown processing include saving logs during operation, saving diagnostics, saving learning results, and setting input / output devices to their initial positions for the next startup.

[0154] The communication system 1 of the third embodiment can take the following first, second, third and fourth measures in order to secure time for the termination process. (First Measure) Before turning off the relays, the master ECU 2 controlling the relays 15, 16, 17, 504, and 505 notifies the subordinate nodes (i.e., the slave ECUs 3, 4, and 5, the smart sensor 501, and the smart actuator 502) of a relay-off notice message via the CAN communication unit 12. The master ECU 2 also stops transmission of CAN communications other than emergency communications. The notice message may have a predetermined CAN ID and data pattern.

[0155] The master ECU 2 manages the time required for the shutdown process of the subordinate nodes. After sending the above-mentioned notice message, the master ECU 2 measures the elapsed time, and if the above-mentioned required time for the shutdown process is exceeded, it turns off relays 15, 16, 17, 504, and 505. When a non-NM-equipped node receives the relay-off notice message, it stops communication, executes the shutdown process, and waits for the power supply to be cut off.

[0156] (Second Measure) Before turning off the relay, the master ECU 2 notifies the subordinate nodes of a relay-off notice message via the CAN communication unit 12. The master ECU 2 also stops transmission of CAN communications other than emergency communications. The notice message may have a predetermined CAN ID and data pattern.

[0157] The master ECU2 manages the time required for the shutdown process of each subordinate node. After sending the above-mentioned notice message, the master ECU2 measures the elapsed time, and if the above-mentioned required time for the shutdown process is exceeded, it sequentially turns off the relays corresponding to the nodes. When a non-NM-equipped node receives the relay-off notice message, it stops communication, executes the shutdown process, and waits for the power supply to be cut off.

[0158] (Third Measure) The master ECU 2 and the NM-equipped node transmit and receive NM frames to each other, thereby enabling them to synchronize their sleep timing.

[0159] When the sleep condition is satisfied due to the end of the service it provides, the master ECU 2 stops communication including NM frames. The master ECU 2 then turns off the relay when the total time (e.g., 5 seconds) of the time it takes for the non-NM node to determine that NM frames have been interrupted (e.g., 3 seconds) and the time required for the non-NM node to complete its termination process (e.g., 2 seconds) has elapsed. The non-NM node monitors NM frames on the communication bus 8, and when it detects that NM frames have been interrupted for a certain period of time (e.g., 3 seconds), it stops transmission from its own node onto the communication bus 8, executes termination processing, and waits for the power supply to be cut off.

[0160] In addition, if a non-NM node is not likely to be able to complete the termination process within a predetermined required time, it can send a predetermined command to the master ECU 2 to request an extension of the time until the relay is turned off.

[0161] (Fourth Measure) The master ECU 2 and the NM-equipped node transmit and receive NM frames to each other, thereby enabling them to synchronize their sleep timing.

[0162] When the sleep condition of a specific cluster is satisfied with the end of a service provided, the master ECU2 sets the bit corresponding to the cluster in the NM frame to 0 (i.e., off value). Then, when a certain time (e.g., 3 seconds) has elapsed since all the bits became 0, the master ECU2 stops communication including the NM frame. After that, when the time required for the termination process of the non-NM node (e.g., 2 seconds) has elapsed, the master ECU2 sets the relay to the off state. The non-NM node here has a function to receive and interpret the NM frame. The non-NM node constantly monitors the NM frame transmitted by the master ECU2, and starts the termination process when all the bits of the cluster including the upstream relay that supplies power to the node itself are 0. This allows the non-NM node to complete the termination process before the relay that supplies power to the node itself is turned off. The NM-equipped node goes to sleep according to the NM frame transmitted to and from the master ECU2.

[0163] If the non-NM node is unlikely to be able to complete the termination process within a predetermined required time, it can send a predetermined command to the master ECU 2 to request an extension of the time before turning off the relay. In this case, the master ECU 2 waits for the relay to be turned off while receiving the extension request from the non-NM node.

[0164] [Seventh embodiment] A seventh embodiment of the present disclosure will be described below with reference to the drawings. In the seventh embodiment, differences from the first embodiment will be described.

[0165] 20, the communication system 100 of the seventh embodiment includes a central ECU 101, upstream power distribution units 102 and 103, zone ECUs 104, 105, 106, and 107, slave ECUs 108, 109, 110, 111, 112, 113, 114, 115, and 116, a battery 117, and a slave ECU 118. Hereinafter, the central ECU 101, the zone ECUs 104 to 107, and the slave ECUs 108 to 116 and 118 are also collectively referred to as nodes. Hereinafter, the zone ECU may be an ECU that bundles slave ECUs located in a predetermined area in the vehicle, or an ECU that bundles slave ECUs that belong to a predetermined domain.

[0166] The battery 117 supplies power to each part of the vehicle at a DC battery voltage (for example, 12 V). The central ECU 101, the upstream power distribution units 102 and 103, the zone ECUs 104 to 107, and the slave ECUs 108 to 116 and 118 operate by receiving power supplied from the battery 117.

[0167] The upstream power supply distribution unit 102 receives power supply from the battery 117 via a power supply path 121 between the battery 7 and the upstream power supply distribution unit 102 . The upstream power supply distribution unit 103 receives power supply from the battery 117 via a power supply path 122 between the battery 7 and the upstream power supply distribution unit 103 .

[0168] The zone ECUs 104 and 105 receive power from a battery 117 via power supply paths 123 and 124 between the upstream power distribution unit 102 and the zone ECUs 104 and 105, respectively.

[0169] The zone ECUs 106 and 107 receive power from a battery 117 via power supply paths 125 and 126 between the upstream power distribution unit 103 and the zone ECUs 106 and 107, respectively.

[0170] The slave ECUs 108 and 109 receive power from the battery 117 via power supply paths 127 and 128 between the zone ECU 104 and the slave ECUs 108 and 109, respectively.

[0171] The slave ECUs 110 and 111 are supplied with power from a battery 117 via power supply paths 129 and 130 between the zone ECU 105 and the slave ECUs 110 and 111, respectively.

[0172] The slave ECUs 112, 113, and 114 receive power from a battery 117 via power supply paths 131, 132, and 133 between the zone ECU 106 and the slave ECUs 112, 113, and 114, respectively.

[0173] The slave ECUs 115 and 116 receive power from a battery 117 via power supply paths 134 and 135 between the zone ECU 107 and the slave ECUs 115 and 116, respectively.

[0174] The slave ECU 118 receives power from the battery 117 via a power supply path 136 . The central ECU 101 and the upstream power distribution unit 102 are connected to each other via a communication line 141 so as to be able to communicate data with each other.

[0175] The central ECU 101 and the upstream power distribution unit 103 are connected to each other via a communication line 142 so as to be able to communicate data with each other. The central ECU 101 and the zone ECUs 104, 105, 106, and 107 are connected to each other via communication lines 143, 144, 145, and 146, respectively, so as to be able to communicate data with each other.

[0176] The zone ECU 104 and the slave ECUs 108, 109, and 118 are connected to each other via a communication bus 147 so as to be able to communicate data with each other. The zone ECU 105 and the slave ECUs 110 and 111 are connected to each other via a communication bus 148 so as to be able to communicate data with each other.

[0177] The zone ECU 106 and the slave ECUs 112, 113, and 114 are connected to each other via a communication bus 149 so as to be able to communicate data with each other. The zone ECU 107 and the slave ECUs 115 and 116 are connected to each other via a communication bus 150 so as to be able to communicate data with each other.

[0178] As shown in FIG. 21, the central ECU 101 includes a control unit 151, communication units 152, 153, 154, 155, 156, and 157, and a storage unit 158. The control unit 151 is an electronic control device mainly composed of a microcomputer including a CPU 161, a ROM 162, a RAM 163, etc. Various functions of the microcomputer are realized by the CPU 161 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 162 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 161 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 151 may be one or more.

[0179] The communication unit 152 communicates with the upstream power distribution unit 102 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. Ethernet is a registered trademark.

[0180] The communication unit 153 communicates with the upstream power distribution unit 103 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 154 communicates with the zone ECU 104 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0181] The communication unit 155 communicates with the zone ECU 105 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The communication unit 156 communicates with the zone ECU 106 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol.

[0182] The communication unit 157 communicates with the zone ECU 107 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The storage unit 158 ​​is a storage device for storing various data, and stores a management table 165 and a diagnostic mask table 167, which will be described later.

[0183] The upstream power distribution unit 102 includes a control circuit 171 , a communication unit 172 , and electronic fuses 173 and 174 . The control circuit 171 performs control to switch the electronic fuses 173 and 174 between an on state and an off state based on an instruction obtained from the central ECU 101 via a communication unit 172 .

[0184] The communication unit 172 communicates with the central ECU 101 connected to the communication line 141 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The electronic fuse 173 is disposed between the power supply path 121 and the power supply path 123. The electronic fuse 174 is disposed between the power supply path 121 and the power supply path .

[0185] The upstream power distribution unit 103 includes a control circuit 181 , a communication unit 182 , and electronic fuses 183 and 184 . The control circuit 181 performs control to switch the electronic fuses 183 and 184 between the on state and the off state based on an instruction obtained from the central ECU 101 via the communication unit 182 .

[0186] The communication unit 182 communicates with the central ECU 101 connected to the communication line 142 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The electronic fuse 183 is disposed between the power supply path 122 and the power supply path 125. The electronic fuse 184 is disposed between the power supply path 122 and the power supply path 126.

[0187] As shown in FIG. 22, the zone ECU 104 includes a control unit 191, a communication unit 192, a CAN communication unit 193, a storage unit 194, and electronic fuses 195 and 196. The control unit 191 is an electronic control device mainly composed of a microcomputer including a CPU 201, a ROM 202, a RAM 203, etc. Various functions of the microcomputer are realized by the CPU 201 executing a program stored in a non-transient real recording medium. In this example, the ROM 202 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 201 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 191 may be one or more.

[0188] The communication unit 192 communicates with the central ECU 101 connected to the communication line 143 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The CAN communication unit 193 communicates with the slave ECUs 108 and 109 connected to the communication bus 147 by transmitting and receiving communication frames based on the CAN communication protocol.

[0189] The storage unit 194 is a storage device for storing various data. The storage unit 194 stores a management table 205 and a diagnostic mask table 207, which will be described later. The electronic fuse 195 is disposed between the power supply path 123 and the power supply path 127. The electronic fuse 196 is disposed between the power supply path 123 and the power supply path 128.

[0190] The zone ECU 105 includes a control unit 211, a communication unit 212, a CAN communication unit 213, a storage unit 214, and electronic fuses 215 and 216. The control unit 211 is an electronic control device mainly composed of a microcomputer including a CPU 221, a ROM 222, a RAM 223, etc. Various functions of the microcomputer are realized by the CPU 221 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 222 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 221 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 211 may be one or more.

[0191] The communication unit 212 communicates with the central ECU 101 connected to the communication line 144 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The CAN communication unit 213 communicates with the slave ECUs 110 and 111 connected to the communication bus 148 by transmitting and receiving communication frames based on the CAN communication protocol.

[0192] The storage unit 214 is a storage device for storing various data. The storage unit 214 stores a management table 225 and a diagnostic mask table 227, which will be described later. The electronic fuse 215 is disposed between the power supply path 124 and the power supply path 129. The electronic fuse 216 is disposed between the power supply path 124 and the power supply path 130.

[0193] As shown in FIG. 23, the zone ECU 106 includes a control unit 231, a communication unit 232, a CAN communication unit 233, a storage unit 234, and electronic fuses 235, 236, and 237. The control unit 231 is an electronic control device mainly composed of a microcomputer including a CPU 241, a ROM 242, a RAM 243, etc. Various functions of the microcomputer are realized by the CPU 241 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 242 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 241 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 231 may be one or more.

[0194] The communication unit 232 communicates with the central ECU 101 connected to the communication line 145 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The CAN communication unit 233 communicates with the slave ECUs 112, 113, and 114 connected to the communication bus 149 by transmitting and receiving communication frames based on the CAN communication protocol.

[0195] The storage unit 234 is a storage device for storing various data. The storage unit 194 stores a management table 245 and a diagnostic mask table 247, which will be described later. The electronic fuse 235 is disposed between the power supply path 125 and the power supply path 131. The electronic fuse 236 is disposed between the power supply path 125 and the power supply path 132. The electronic fuse 237 is disposed between the power supply path 125 and the power supply path 133.

[0196] The zone ECU 107 includes a control unit 251, a communication unit 252, a CAN communication unit 253, a storage unit 254, and electronic fuses 255 and 256. The control unit 251 is an electronic control device mainly composed of a microcomputer including a CPU 261, a ROM 262, a RAM 263, etc. Various functions of the microcomputer are realized by the CPU 261 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 262 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 261 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 251 may be one or more.

[0197] The communication unit 252 communicates with the central ECU 101 connected to the communication line 146 by transmitting and receiving communication frames based on, for example, the Ethernet communication protocol. The CAN communication unit 253 communicates with the slave ECUs 115 and 116 connected to the communication bus 150 by transmitting and receiving communication frames based on the CAN communication protocol.

[0198] The storage unit 254 is a storage device for storing various data. The storage unit 254 stores a management table 265 and a diagnostic mask table 267, which will be described later. The electronic fuse 255 is disposed between the power supply path 126 and the power supply path 134. The electronic fuse 256 is disposed between the power supply path 126 and the power supply path 135.

[0199] As shown in FIG. 24, the slave ECUs 108, 109, and 118 each include a control unit 271, a CAN communication unit 272, and a storage unit 273. The control unit 271 is an electronic control device mainly composed of a microcomputer including a CPU 281, a ROM 282, a RAM 283, etc. Various functions of the microcomputer are realized by the CPU 281 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 282 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 281 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 271 may be one or more.

[0200] The CAN communication unit 272 communicates with the zone ECUs 104 connected to the communication bus 147 based on the CAN communication protocol. The storage unit 273 is a storage device for storing various data. The storage unit 273 stores a management table 285 and a diagnostic mask table 287, which will be described later.

[0201] The slave ECUs 110 and 111 each include a control unit 291 , a CAN communication unit 292 , and a storage unit 293 . The control unit 291 is an electronic control device mainly composed of a microcomputer including a CPU 301, a ROM 302, a RAM 303, etc. Various functions of the microcomputer are realized by the CPU 301 executing a program stored in a non-transient real recording medium. In this example, the ROM 302 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 301 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 291 may be one or more.

[0202] The CAN communication unit 292 communicates with the zone ECU 105 connected to the communication bus 148 based on the CAN communication protocol. The storage unit 293 is a storage device for storing various data. The storage unit 293 stores a management table 305 and a diagnostic mask table 307, which will be described later.

[0203] The slave ECUs 112 , 113 , and 114 each include a control unit 311 , a CAN communication unit 312 , and a storage unit 313 . The control unit 311 is an electronic control device mainly composed of a microcomputer including a CPU 321, a ROM 322, a RAM 323, etc. Various functions of the microcomputer are realized by the CPU 321 executing a program stored in a non-transient real recording medium. In this example, the ROM 322 corresponds to the non-transient real recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 321 may be configured as hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 311 may be one or more.

[0204] The CAN communication unit 312 communicates with the zone ECU 106 connected to the communication bus 149 based on the CAN communication protocol. The storage unit 313 is a storage device for storing various data, and stores a management table 325 and a diagnostic mask table 327, which will be described later.

[0205] The slave ECUs 115 and 116 each include a control unit 331 , a CAN communication unit 332 , and a storage unit 333 . The control unit 331 is an electronic control device mainly composed of a microcomputer including a CPU 341, a ROM 342, a RAM 343, etc. Various functions of the microcomputer are realized by the CPU 341 executing a program stored in a non-transitive substantial recording medium. In this example, the ROM 342 corresponds to the non-transitive substantial recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 341 may be configured in hardware form using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 331 may be one or more.

[0206] The CAN communication unit 332 communicates with the zone ECU 107 connected to the communication bus 150 based on the CAN communication protocol. The storage unit 333 is a storage device for storing various data. The storage unit 333 stores a management table 345 and a diagnostic mask table 347, which will be described later.

[0207] The management tables 165, 205, 225, 245, 265, 285, 305, 325, and 345 set, for each of a plurality of services provided to vehicle occupants using the central ECU 101, the zone ECUs 104 to 107, and the slave ECUs 108 to 116, and 118, a correspondence relationship between the service and the switching information and start information.

[0208] The switching information is information indicating whether to turn on the electronic fuses 173, 174, 183, 184, 195, 196, 215, 216, 235, 236, 237, 255, and 256. The startup information is information indicating whether to turn the slave ECU 118 into a wake-up state.

[0209] The management tables 165, 205, 225, 245, 265, 285, 305, 325, and 345 do not need to store switch information and start information for a service for which the device itself cannot detect the satisfaction of the start condition of the service.

[0210] The diagnostic mask tables 167, 207, 227, 247, 267, 287, 307, 327, and 347 correspond, for each service, the slave ECU to which power supply via the electronic fuse is cut off (hereinafter referred to as the cut-off ECU), the slave ECU to which the power supply is cut off (hereinafter referred to as the sleep ECU), and the CAN ID of the CAN frame that is not received (hereinafter referred to as the non-received frame ID).

[0211] Therefore, when the central ECU 101, the zone ECUs 104-107, and the slave ECUs 108-116, 118 detect that the start condition of a service is satisfied, they extract the switching information and start-up information corresponding to the corresponding service from the management tables 165, 205, 225, 245, 265, 285, 305, 325, 345, and generate and transmit an NM frame including the extracted switching information and start-up information. Furthermore, the central ECU 101, the zone ECUs 104-107, and the slave ECUs 108-116, 118 extract a combination of a cut-off ECU or sleep ECU corresponding to the corresponding service and a non-received frame ID from the diagnostic mask tables 167, 207, 227, 247, 267, 287, 307, 327, 347, and transmit the extracted combination as diagnostic mask information.

[0212] A manner in which the zone ECU 104 executes a handshake will be described with reference to FIG. When the central ECU 101 receives an event notification (eg, IG off), it determines a node (eg, the slave ECU 108) to be turned off as shown in process P101 of FIG.

[0213] In process P102, the central ECU 101 transmits a fuse-off command to the zone ECU 104 to turn off the electronic fuse 195. When the zone ECU 104 receives the fuse-off command, it transmits a cutoff notification to the slave ECU 108 under its control in process P103.

[0214] The slave ECU 108 that has received the cutoff notification transmits an acknowledgement response to the zone ECU 104 as shown in process P104. The slave ECU 108 that has transmitted the acknowledgement response executes a shutdown sequence as shown in process P105.

[0215] The zone ECU 104 that has transmitted the acknowledgement sets the completion time corresponding to the received acknowledgement as the standby time, as shown in process P106. The zone ECU 104 waits until the completion time has elapsed, as shown in process P107. Once the completion time has elapsed, the zone ECU 104 switches the electronic fuse 195 from the ON state to the OFF state, as shown in process P108.

[0216] In the communication system 100 configured in this manner, when the zone ECU 104 receives a fuse off instruction from the central ECU 101 to turn off the electronic fuse 195, it transmits a shutdown notification to the slave ECU 108, and after transmitting the shutdown notification, when it receives an acknowledgement response from the slave ECU 108 including completion time information indicating the completion time required to complete the shutdown sequence, if the completion time has elapsed since receiving the acknowledgement response, it is configured to determine that the slave ECU 108 is in a shutdown-enabled state.

[0217] Such a communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 is switched from a conductive state to a cut-off state even though the power supply to the slave ECU 108 should not be cut off because the shutdown sequence has not been completed. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 108.

[0218] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, the electronic fuse 195 corresponds to the power supply switching unit, and the battery 117 corresponds to the power source.

[0219] [Eighth embodiment] An eighth embodiment of the present disclosure will be described below with reference to the drawings. In the eighth embodiment, differences from the seventh embodiment will be described.

[0220] A method in which the central ECU 101 requests a handshake from the zone ECU 104 will be described with reference to FIG. When the central ECU 101 receives the event notification (eg, IG OFF), it determines the node (eg, the slave ECU 108) to be turned off as shown in process P111 of FIG.

[0221] In process P112, the central ECU 101 transmits a pre-turn-off notification to turn off the electronic fuse 195 to the zone ECU 104. The pre-turn-off notification corresponds to a handshake request.

[0222] When the zone ECU 104 receives the advance OFF notification, in process P113, the zone ECU 104 transmits a shut-off notification to the slave ECU 108 under its control. The slave ECU 108 that has received the cutoff notification transmits an acknowledgement to the zone ECU 104 as shown in process P114.

[0223] The slave ECU 108 that has transmitted the acknowledgement response executes a shutdown sequence as shown in process P115. The zone ECU 104 that has transmitted the acknowledgment sets the completion time corresponding to the received acknowledgment as the standby time, as shown in process P116.

[0224] The zone ECU 104 waits until the completion time has elapsed, as shown in process P117. When the completion time has elapsed, the zone ECU 104 transmits a handshake completion notification to the central ECU 101, as shown in process P118.

[0225] Upon receiving the handshake completion notification, the central ECU 101 transmits a fuse-off instruction to the zone ECU 104 to turn off the electronic fuse 195, as shown in process P119.

[0226] When the zone ECU 104 receives the fuse-off command, it switches the electronic fuse 195 from the on state to the off state as shown in process P120. In the communication system 100 configured in this manner, when the zone ECU 104 receives from the central ECU 101 a pre-off notification for turning off the electronic fuse 195, the zone ECU 104 transmits a shutoff notification to the slave ECU 108. When the zone ECU 104 receives from the slave ECU 108 an acknowledgment response including completion time information indicating the completion time required to complete the shutdown sequence after transmitting the shutoff notification, the zone ECU 104 transmits a handshake completion notification to the central ECU 101 if the completion time has elapsed since receiving the acknowledgment response. When the zone ECU 104 receives from the central ECU 101 a fuse off instruction for turning off the electronic fuse 195 after transmitting the handshake completion notification, the zone ECU 104 determines that the slave ECU 108 is in a shutoff possible state.

[0227] Such a communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 is switched from a conductive state to a cut-off state even though the power supply to the slave ECU 108 should not be cut off because the shutdown sequence has not been completed. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 108.

[0228] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, and the electronic fuse 195 corresponds to the power supply switching unit. Moreover, the slave ECU 108 corresponds to a slave control device, the zone ECU 104 corresponds to a zone control device, and the central ECU 101 corresponds to a central control device.

[0229] Further, the advance turn-off notification corresponds to an advance cutoff notification, and the fuse-off instruction corresponds to a power cutoff instruction. [Ninth embodiment] A ninth embodiment of the present disclosure will be described below with reference to the drawings. In the ninth embodiment, differences from the seventh embodiment will be described.

[0230] A mode in which the central ECU 101 executes a handshake will be described with reference to FIG. When the central ECU 101 receives an event notification (eg, IG off), it determines the node (eg, the slave ECU 108) to be turned off as shown in process P131 of FIG.

[0231] In process P132, the central ECU 101 transmits a cutoff notification to the zone ECU 104 to turn off the electronic fuse 195. When the zone ECU 104 receives the cutoff notification, in process P133, the zone ECU 104 transmits the cutoff notification to the slave ECU 108 under its control.

[0232] The slave ECU 108 that has received the cutoff notification transmits an acknowledgement to the zone ECU 104 as shown in process P134. The slave ECU 108 that has transmitted the acknowledgement response executes a shutdown sequence as shown in process P135.

[0233] The zone ECU 104 that has transmitted the acknowledgement transmits the acknowledgement to the central ECU 101 as shown in process P136. Upon receiving the acknowledgment, the central ECU 101 sets the completion time corresponding to the received acknowledgment as the standby time, as shown in process P137.

[0234] The central ECU 101 waits until the completion time has elapsed, as shown in process P138. When the completion time has elapsed, the central ECU 101 transmits a fuse-off command to the zone ECUs 104 to turn off the electronic fuse 195, as shown in process P139.

[0235] When the zone ECU 104 receives the fuse-off command, it switches the electronic fuse 195 from the on state to the off state as shown in process P140. In the communication system 100 configured in this manner, the central ECU 101 transmits a shutdown notification to the slave ECU 108 via the zone ECU 104. After transmitting the shutdown notification, the central ECU 101 receives an acknowledgement response from the slave ECU 108 via the zone ECU 104, the acknowledgement response including completion time information indicating the completion time required to complete the shutdown sequence. If the completion time has elapsed since receiving the acknowledgement response, the central ECU 101 determines that the slave ECU 108 is in the shutdown possible state.

[0236] Such a communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 is switched from a conductive state to a cut-off state even though the power supply to the slave ECU 108 should not be cut off because the shutdown sequence has not been completed. Therefore, the communication system 1 can improve the reliability of the control of the power supply to the slave ECU 108.

[0237] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, and the electronic fuse 195 corresponds to the power supply switching unit.

[0238] [Tenth embodiment] A tenth embodiment of the present disclosure will be described below with reference to the drawings. In the tenth embodiment, differences from the seventh embodiment will be described.

[0239] The zone ECUs 104 to 107 are configured to execute processes corresponding to the management process of the fifth embodiment. That is, the zone ECUs 104-107 calculate the current consumption difference by acquiring current value information from the electronic fuses under their control. Then, the zone ECUs 104-107 turn off the electronic fuses connected to the slave ECUs to which the calculated current consumption difference is greater than the OFF determination value and to which the NM frame instructing startup has not been transmitted. The zone ECUs 104-107 may notify the central ECU 101 that the electronic fuses have been turned off.

[0240] In the communication system 100 configured in this manner, the zone ECU 104 calculates the current consumption difference for the slave ECU 108, and checks whether an NM frame including startup information indicating whether to start the slave ECU 108 has been transmitted to the zone ECU 104. The zone ECU 104 determines that the slave ECU 108 is in a state in which it can be shut off when a preset cutoff determination condition indicating that the current consumption difference is large is satisfied and an NM frame instructing the slave ECU 108 to start up has not been transmitted to the zone ECU 104.

[0241] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0242] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, and the electronic fuse 195 corresponds to the power supply switching unit.

[0243] [Eleventh embodiment] An eleventh embodiment of the present disclosure will be described below with reference to the drawings. In the eleventh embodiment, differences from the seventh embodiment will be described.

[0244] A mode in which the zone ECU 104 measures current and the central ECU 101 transmits a fuse-off command will be described with reference to FIG. The zone ECU 104 obtains current value information from the electronic fuse 195 connected to the slave ECU 108, as shown in process P151 of FIG.

[0245] The zone ECU 104 transmits the obtained current value information to the central ECU 101 as shown in process P152. The central ECU 101 sets a steady-state operating current value for the slave ECU 108 as shown in process P153.

[0246] The central ECU 101 calculates the current consumption difference for the slave ECU 108 in step P154. As shown in process P155, the central ECU 101 checks whether or not an NM frame instructing the start-up of the slave ECU has been transmitted to the slave ECU .

[0247] As shown in process P156, the central ECU 101 determines whether or not the current consumption difference of the slave ECU 108 is greater than a preset OFF determination value. As shown in process P157, the central ECU 101 determines whether or not an NM frame instructing the activation of the slave ECU 108 has been transmitted.

[0248] If the current consumption difference for the slave ECU 108 is greater than the off judgment value and an NM frame instructing the slave ECU 108 to start up has not been transmitted, the central ECU 101 transmits a fuse off instruction to the zone ECU 104 to turn off the electronic fuse 195, as shown in process P158.

[0249] When the zone ECU 104 receives the fuse-off command, it switches the electronic fuse 195 from the on state to the off state as shown in process P159. In the communication system 100 configured in this manner, the central ECU 101 calculates the current consumption difference for the slave ECU 108, and checks whether an NM frame including startup information indicating whether to start the slave ECU 108 has been transmitted to the central ECU 101. The central ECU 101 determines that the slave ECU 108 is in a state in which it can be shut down when a preset cutoff determination condition indicating that the current consumption difference is large is satisfied and an NM frame instructing the startup of the slave ECU 108 has not been transmitted to the central ECU 101.

[0250] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0251] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, and the electronic fuse 195 corresponds to the power supply switching unit.

[0252] [Twelfth embodiment] A twelfth embodiment of the present disclosure will be described below with reference to the drawings. In the twelfth embodiment, differences from the seventh embodiment will be described.

[0253] A mode in which the central ECU 101 turns off the zone ECUs 104 after the completion time has elapsed will be described with reference to FIG. When the central ECU 101 receives an event notification (eg, IG OFF), it determines the node (eg, the zone ECU 104) to be turned off as shown in process P161 of FIG.

[0254] In process P162, the central ECU 101 transmits a cutoff notification to the zone ECU 104 to turn off the electronic fuse 173. The zone ECU 104 that has received the cutoff notification transmits an acknowledgement to the central ECU 101 as shown in process P163.

[0255] Furthermore, the zone ECU 104 transmits a cutoff notification to the slave ECUs 108 and 109 under its control, as shown in steps P164 and P165. The slave ECUs 108 and 109 that have received the cutoff notification transmit an acknowledgement to the zone ECU 104 as shown in steps P166 and P167.

[0256] The slave ECUs 108 and 109 that have transmitted the acknowledgement responses execute a shutdown sequence as shown in steps P168 and P169. The zone ECU 104 that has transmitted the acknowledgment sets the completion time corresponding to the received acknowledgment as a standby time, as shown in process P170. The standby time is the longer of the completion time of the slave ECU 108 and the completion time of the slave ECU 109.

[0257] The zone ECU 104 waits until the completion time has elapsed as shown in process P171. When the completion time has elapsed, the zone ECU 104 turns off the electronic fuses 195 and 196 as shown in process P172.

[0258] The zone ECU 104 executes a shutdown sequence as shown in process P173. The central ECU 101, which has transmitted the acknowledgment response from the zone ECU 104, sets the completion time corresponding to the received acknowledgment response as the standby time, as shown in process P174. The completion time of process P174 is set to be longer than the total time of the completion time of P170 and the time of the shutdown sequence of process P173.

[0259] The central ECU 101 waits until the completion time has elapsed, as shown in process P175. When the completion time has elapsed, the central ECU 101 transmits a fuse-off instruction to turn off the electronic fuse 173 to the upstream power distribution unit 102, as shown in process P176.

[0260] Upon receiving the fuse-off instruction, the upstream power distribution unit 102 switches the electronic fuse 173 from the on state to the off state as shown in process P177. In the communication system 100 configured in this manner, when the zone ECU 104 receives a shutoff notification from the central ECU 101 to turn off the electronic fuse 173, the zone ECU 104 transmits an acknowledgment response including completion time information indicating the completion time required to completely shut off the electronic fuse 173 to the central ECU 101. The zone ECU 104 further transmits a shutoff notification to the slave ECU 108, and when the zone ECU 104 receives an acknowledgment response including completion time information indicating the completion time required to complete the shutdown sequence from the slave ECU 108 after transmitting the shutoff notification, the zone ECU 104 determines that the slave ECU 108 is in a shutoff possible state if the completion time has elapsed since receiving the acknowledgment response.

[0261] When the central ECU 101 receives an acknowledgment response from the zone ECU 104 after sending the shutdown notification, the central ECU 101 sends a fuse-off instruction to the upstream power distribution unit 102 to shut off the electronic fuse 173 if a completion time has elapsed since receiving the acknowledgment response.

[0262] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0263] In the embodiment described above, the slave ECU 108 corresponds to the first control device, the central ECU 101 and the zone ECU 104 correspond to the second control device, the electronic fuse 195 corresponds to the first power supply switching unit, and the electronic fuse 173 corresponds to the second power supply switching unit.

[0264] In addition, the cut-off notification of process P162 corresponds to a power supply cut-off notification, the information indicating the completion time corresponding to the acknowledgement response of process P166 corresponds to second completion time information indicating the second completion time, and the acknowledgement response of process P166 corresponds to the second acknowledgement response.

[0265] In addition, the information indicating the completion time corresponding to the acknowledgement response of process P163 corresponds to first completion time information indicating the first completion time, the acknowledgement response of process P163 corresponds to the first acknowledgement response, and the fuse off instruction of process P176 corresponds to the second power supply cut-off instruction.

[0266] [Thirteenth embodiment] A thirteenth embodiment of the present disclosure will be described below with reference to the drawings. In the thirteenth embodiment, differences from the seventh embodiment will be described.

[0267] A mode in which the central ECU 101 turns off the zone ECUs 104 after receiving a completion response will be described with reference to FIG. When the central ECU 101 receives an event notification (eg, IG OFF), it determines the node (eg, the zone ECU 104) to be turned off as shown in process P181 of FIG.

[0268] In process P182, the central ECU 101 transmits a cutoff notification to the zone ECU 104 to turn off the electronic fuse 173. The zone ECU 104 that has received the cutoff notification transmits an acknowledgement to the central ECU 101 as shown in process P183.

[0269] Furthermore, the zone ECU 104 transmits a cutoff notification to the slave ECUs 108 and 109 under its control, as shown in steps P184 and P185. The slave ECUs 108 and 109 that have received the cutoff notification transmit an acknowledgement to the zone ECU 104 as shown in steps P186 and P187.

[0270] The slave ECUs 108 and 109 that have transmitted the acknowledgement responses execute a shutdown sequence as shown in steps P188 and P189. When the slave ECUs 108 and 109 complete the shutdown sequence, they transmit a completion response to the zone ECU 104 as shown in processes P190 and P191.

[0271] When the zone ECU 104 receives the completion responses from both the slave ECUs 108 and 109, it turns off the electronic fuses 195 and 196 as shown in process P192. The zone ECU 104 transmits a completion response to the central ECU 101 as shown in process P193.

[0272] When the central ECU 101 receives the completion response from the zone ECU 104, as shown in process P194, it transmits a fuse-off instruction to the upstream power distribution unit 102 to turn off the electronic fuse 173.

[0273] Upon receiving the fuse-off instruction, the upstream power distribution unit 102 switches the electronic fuse 173 from the on state to the off state as shown in process P195. In the communication system 100 configured in this manner, when the zone ECU 104 receives a cutoff notification from the central ECU 101 to turn off the electronic fuse 173, it transmits an acknowledgement response to the central ECU 101 and further transmits a cutoff notification to the slave ECU 108. If the zone ECU 104 receives a completion response from the slave ECU 108 after transmitting the cutoff notification, it determines that the slave ECU 108 is in a cutoff possible state, turns off the electronic fuse 195, and further transmits this to the central ECU 101.

[0274] When the central ECU 101 receives a completion response from the zone ECU 104 after transmitting the cutoff notification, the central ECU 101 transmits a fuse-off instruction to the upstream power distribution unit 102 to put the electronic fuse 173 into a cutoff state.

[0275] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0276] In the embodiment described above, the cutoff notification of process P182 corresponds to a power supply cutoff notification, the acceptance response of process P183 corresponds to a first acceptance response, the completion response of process P190 corresponds to a first completion response, the completion response of process P193 corresponds to a second completion response, and the fuse off instruction of process P194 corresponds to a second power supply cutoff instruction.

[0277] [Fourteenth embodiment] A fourteenth embodiment of the present disclosure will be described below with reference to the drawings. In the fourteenth embodiment, differences from the seventh embodiment will be described.

[0278] A mode in which the upstream power distribution unit 102 measures current and the central ECU 101 transmits a fuse-off command will be described with reference to FIG. The upstream power distribution unit 102 acquires current value information from the electronic fuse 173 connected to the zone ECU 104, as shown in process P201 of FIG.

[0279] The upstream power supply distribution unit 102 transmits the obtained current value information to the central ECU 101 as shown in process P202. The central ECU 101 sets a steady-state operating current value for the zone ECU 104 as shown in process P203.

[0280] The central ECU 101 calculates the current consumption difference for the zone ECUs 104 as shown in process P204. As shown in process P205, the central ECU 101 checks whether or not an NM frame instructing the activation of the zone ECU 104 has been transmitted to the zone ECU 104.

[0281] As shown in process P206, the central ECU 101 determines whether or not the current consumption difference of the zone ECU 104 is greater than a preset OFF determination value. As shown in process P207, the central ECU 101 judges whether or not an NM frame instructing the activation of the zone ECU 104 has been transmitted.

[0282] Then, when the current consumption difference for the zone ECU 104 is greater than the off judgment value and an NM frame instructing the startup of the zone ECU 104 has not been transmitted, the central ECU 101 transmits a fuse off instruction to the upstream power distribution unit 102 to turn off the electronic fuse 173, as shown in process P208.

[0283] Upon receiving the fuse-off instruction, the upstream power distribution unit 102 switches the electronic fuse 173 from the on state to the off state as shown in process P209. In the communication system 100 configured in this manner, the central ECU 101 calculates the current consumption difference for the zone ECU 104, and checks whether an NM frame including startup information indicating whether to start the zone ECU 104 has been transmitted to the central ECU 101. When a preset cutoff determination condition indicating a large current consumption difference is satisfied and an NM frame instructing the startup of the zone ECU 104 has not been transmitted to the central ECU 101, the central ECU 101 determines that the zone ECU 104 is in a cutoff possible state, and transmits a fuse off instruction to the upstream power distribution unit 102 to cut off the electronic fuse 173.

[0284] Such communication system 100 can suppress the occurrence of a situation in which electronic fuse 173 continues to be conductive even though power supply to zone ECU 104 may be cut off because zone ECU 104 has transitioned to a sleep state. Therefore, communication system 100 can improve the reliability of control of power supply to zone ECU 104.

[0285] In the embodiment described above, the electronic fuse 195 corresponds to the first power supply switching unit, the electronic fuse 173 corresponds to the second power supply switching unit, and the fuse-off instruction in process P208 corresponds to the second power supply cut-off instruction.

[0286] [Fifteenth embodiment] A fifteenth embodiment of the present disclosure will be described below with reference to the drawings. In the fifteenth embodiment, differences from the seventh embodiment will be described.

[0287] A mode in which the central ECU 101 and the slave ECU 108 switch the electronic fuse to the OFF state by using a timer will be described with reference to FIG. The central ECU 101, the zone ECUs 104 and the slave ECUs 108 receive an event notification (eg, IG off) transmitted by, for example, broadcast.

[0288] Upon receiving the event notification, the central ECU 101 determines the node (for example, the slave ECU 108) to be turned off as shown in process P211 of FIG. When the slave ECU 108 receives the event notification, as shown in process P212, it starts a second timer mounted in the slave ECU 108. The second timer is a timer that starts incrementing when started.

[0289] As shown in process P213, the slave ECU 108 waits until a preset time T2 (eg, 3 minutes) has elapsed based on the value of the second timer. When the time T2 has elapsed, the slave ECU 108 executes a shutdown sequence as shown in process P214.

[0290] After the process P211 ends, the central ECU 101 starts a first timer mounted in the central ECU 101 as shown in a process P215. The first timer is a timer that starts incrementing when started.

[0291] As shown in process P216, the central ECU 101 waits until a time T1 (for example, 5 minutes) that is preset to be longer than the time T2 based on the value of the first timer has elapsed. When the time T1 has elapsed, the central ECU 101 transmits a fuse-off command to the zone ECU 104 to turn off the electronic fuse 195, as shown in process P217.

[0292] When the zone ECU 104 receives the fuse-off command, it switches the electronic fuse 195 from the on state to the off state as shown in process P218. In the communication system 100 configured in this manner, the slave ECU 108 executes a shutdown sequence when a time T2 preset based on the event notification has elapsed since the slave ECU 108 received the event notification. When a time T1, which is set based on the event notification to be longer than the time T2, has elapsed since the central ECU 101 received the event notification, the central ECU 101 transmits a fuse-off instruction to the zone ECU 104 to turn off the electronic fuse 195.

[0293] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0294] In the embodiment described above, the time T1 corresponds to the first standby time, the time T2 corresponds to the second standby time, and the fuse-off instruction in process P217 corresponds to the power supply cutoff instruction. [Sixteenth embodiment] A sixteenth embodiment of the present disclosure will be described below with reference to the drawings. In the sixteenth embodiment, differences from the seventh embodiment will be described.

[0295] A mode in which the central ECU 101, the zone ECUs 104, and the slave ECUs 108 switch the electronic fuses to the OFF state by using timers will be described with reference to FIG. The central ECU 101, the zone ECUs 104 and the slave ECUs 108 receive an event notification (eg, IG off) transmitted by, for example, broadcast.

[0296] When the slave ECU 108 receives the event notification, as shown in process P221, it starts a second timer mounted in the slave ECU 108. The second timer is a timer that starts incrementing when it is started.

[0297] As shown in process P222, the slave ECU 108 waits until a preset time T2 (eg, 3 minutes) has elapsed based on the value of the second timer. When the time T2 has elapsed, the slave ECU 108 executes a shutdown sequence as shown in process P223.

[0298] When the zone ECU 104 receives the event notification, as shown in process P224, it starts a first timer mounted in the zone ECU 104. The first timer is a timer that starts incrementing when started.

[0299] As shown in process P225, the zone ECU 104 waits until a preset time T1 (for example, 5 minutes) longer than the time T2 has elapsed based on the value of the first timer.

[0300] After the time T1 has elapsed, the zone ECU 104 switches the electronic fuse 195 from the on state to the off state as shown in process P226. When the central ECU 101 receives the event notification, as shown in process P227, it starts a third timer mounted in the central ECU 101. The third timer is a timer that starts incrementing when it is started.

[0301] As shown in process P228, the central ECU 101 waits until a preset time T3 (eg, 3 minutes) has elapsed based on the value of the third timer. When the time T3 has elapsed, the central ECU 101 executes a sleep process in step P229, thereby transitioning to a sleep state.

[0302] In the communication system 100 configured in this manner, the slave ECU 108 executes a shutdown sequence when a time T2 preset based on the event notification has elapsed since the slave ECU 108 received the event notification. The zone ECU 104 turns off the electronic fuse 195 when a time T1, which is set based on the event notification to be longer than the time T2, has elapsed since the slave ECU 108 received the event notification.

[0303] Such communication system 100 can suppress the occurrence of a situation in which the electronic fuse 195 continues to be conductive even though the slave ECU 108 has transitioned to a sleep state and power supply to the slave ECU 108 may be cut off. Therefore, communication system 100 can improve the reliability of control of power supply to the slave ECU 108.

[0304] In the embodiment described above, the time T1 corresponds to the first waiting time, and the time T2 corresponds to the second waiting time. Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modified forms.

[0305] [Variation 1] In the above embodiment, a handshake is performed between the master ECU 2 and the slave ECUs 3 to 5 via the communication bus 8. However, the handshake may be performed via a direct line connecting the master ECU 2 and the slave ECUs 3 to 5.

[0306] [Variation 2] In the above fifth embodiment, a form has been shown in which it is confirmed whether or not an NM frame instructing the activation of each of the slave ECUs 3 to 5 has been transmitted between the current time and the transmission judgment time. However, regardless of whether an NM frame instructs the activation of the slave ECUs 3 to 5, if the master ECU 2 does not receive an NM frame between the current time and the transmission judgment time, the electronic fuse connected to the slave ECU whose consumption current difference is greater than the off judgment value may be set to the off state.

[0307] [Variation 3] In the above fifth embodiment, the steady-state operating current value is calculated based on the current value information acquired from the electronic fuses 18 to 20. However, a predetermined value that is preset as the current value during steady-state operation may be set as the steady-state operating current value.

[0308] [Variation 4] In the first to fourth embodiments, the power supply is controlled using the relays 15, 16, and 17, but electronic fuses may be used instead of the relays 15, 16, and 17. In the fifth embodiment, the power supply is controlled using the electronic fuses 18, 19, and 20, but relays may be used instead of the electronic fuses 18, 19, and 20.

[0309] [Variation 5] In the above twelfth, thirteenth and fourteenth embodiments, the central ECU 101 transmits a fuse-off instruction to the upstream power distribution unit 102 that includes the electronic fuse 173. However, when the central ECU 101 includes the electronic fuse 173, the central ECU 101 itself may turn the electronic fuse 173 off.

[0310] [Variation 6] In the above fifteenth and sixteenth embodiments, the central ECU 101, the zone ECU 104, and the slave ECU 108 receive the event notification transmitted by broadcast.

[0311] However, in the fifteenth embodiment, the central ECU 101 may transmit, for example, an instruction to "turn off in three minutes" to the slave ECU 108. The central ECU 101 may transmit an NM frame to communicate that the electronic fuse 195 is to be turned off.

[0312] In the sixteenth embodiment, the central ECU 101 may transmit, for example, an instruction to "turn off in 3 minutes" to the zone ECUs 104 and the slave ECUs 108. The central ECU 101 may transmit an NM frame to communicate that the electronic fuse 195 is to be turned off.

[0313] The control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor and a memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control unit 11, 31 and the method described in the present disclosure may be realized by one or more dedicated computers configured by a combination of a processor and a memory programmed to execute one or more functions and a processor configured with one or more hardware logic circuits. In addition, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in the control unit 11, 31 does not necessarily need to include software, and all of the functions may be realized using one or more hardware.

[0314] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Also, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0315] In addition to the above-mentioned ECUs 2-6, 101, 104-116, the present disclosure can also be realized in various forms, such as a system including the ECUs 2-6, 101, 104-116 as components, a program for causing a computer to function as the ECUs 2-6, 101, 104-116, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a communication management method. [Explanation of symbols]

[0316] 1... communication system, 2... master ECU, 3... slave ECU, 7... battery, 15... relay, 18... electronic fuse, 100... communication system, 101... central ECU, 102... upstream power distribution section, 104... zone ECU, 108... slave ECU, 117... battery, 173, 195... electronic fuse

Claims

1. a first control device (3, 108, 104) that receives power from a power source (7, 117) via a power supply switching unit (15, 195, 173) that is configured to switch between a conductive state that conducts a power supply path and a cut-off state that cuts off the power supply path; A second control device (2, 101, 104) connected to the first control device so as to be able to perform data communication with the first control device and configured to control the operation of the power supply switching unit, The second control device is A state confirmation unit (S20 to S30, S220 to S260, S510 to S530, S710 to S720, S810 to S860) configured to determine whether the first control device is in a cut-off possible state in which the power supply switching unit may be set to the cut-off state; a power supply control unit (S40, S270, S540, S730, S870) configured to set the power supply switching unit to the cut-off state when the state confirmation unit determines that the first control device is in the cut-off possible state; A communication system (1, 100) comprising:

2. 2. The communication system according to claim 1, The status confirmation unit (S20 to S30, S220 to S260, S510 to S530, S710 to S720) is configured to determine whether the first control device is in the cutoff possible state by performing data communication with the first control device.

3. 3. The communication system according to claim 2, The state confirmation unit (S20 to S30) A communication system configured to send a shutdown notification to the first control device indicating that the power supply switching unit is to be switched to the shutdown state, and determine that the first control device is in the shutdown-enabled state when a completion response indicating that a shutdown sequence has been completed is received from the first control device.

4. 3. The communication system according to claim 2, The state confirmation unit (S220 to S260) a communication system configured to send a shutdown notification to the first control device indicating that the power supply switching unit will be switched to the shutdown state, and when an acknowledgement response is received from the first control device after sending the shutdown notification, the acknowledgement response includes completion time information indicating a completion time required to complete a shutdown sequence, and when the completion time has elapsed since receiving the acknowledgement response, the first control device is configured to determine that the shutdown is possible.

5. 3. The communication system according to claim 2, The state confirmation unit (S510 to S530) A communication system configured to, when receiving a sleep notification from the first control device indicating that it will transition to a sleep state, send an acknowledgement response to the first control device, and, after sending the acknowledgement response, determine that the first control device is in the shut-down capable state if it receives a completion response from the first control device indicating that a shutdown sequence has been completed.

6. 3. The communication system according to claim 2, The state confirmation unit (S710 to S720) a communication system including completion time information indicating a completion time required to complete a shutdown sequence, and configured, upon receiving a shutdown request from the first control device requesting that the power supply switching unit be switched to the shutdown state, to determine that the first control device is in the shutdown possible state if the completion time has elapsed since receiving the shutdown request.

7. 2. The communication system according to claim 1, The status confirmation unit (S810 to S860) is configured to calculate the difference between the steady-state operating current value, which is the value of the current consumed by the first control device during steady-state operation, and the value of the current consumed at the current instant as a current consumption difference, and to confirm whether a management frame, which is a communication frame including startup information indicating whether to start up the first control device, has been transmitted to the second control device, and is further configured to determine that the first control device is in the shutdown-possible state when a predetermined shutdown determination condition indicating that the current consumption difference is large is met and the management frame has not been transmitted to the second control device.

8. 8. The communication system according to claim 7, The communication system, wherein the state confirmation unit is configured to set the steady-state operating current value by measuring a current flowing through the power supply switching unit during the steady-state operation.

9. 3. The communication system according to claim 2, The state confirmation unit is configured to send a warning message to the first control device before putting the power supply switching unit into the cut-off state, and to determine that the cut-off state is possible when a predetermined required termination processing time has elapsed as the time required for the first control device to execute termination processing after sending the warning message.

10. 10. The communication system of claim 9, a communication system in which the required termination process time is set individually for each of one or more control devices connected to one or more of the power supply switching units;

11. 3. The communication system according to claim 2, The communication system is configured to transmit and receive a management frame, which is a communication frame including switching information indicating whether or not to set the power supply switching unit to the conductive state and startup information indicating whether or not to start the second control device, The state confirmation unit is A communication system configured to stop transmitting the management frame when a preset sleep condition is met for switching the second control device to a sleep state, and to determine that the device is in the cutoff possible state when the total time of the time it takes for the first control device to determine that the management frame has been interrupted and the time required for the termination processing of the first control device has elapsed.

12. 3. The communication system according to claim 2, The communication system is configured to transmit and receive a management frame, which is a communication frame including switching information indicating whether or not to set the power supply switching unit to the conductive state and startup information indicating whether or not to start the second control device, The state confirmation unit is A communication system configured to, when a preset sleep condition is met for switching the second control device to a sleep state, change all of the data sequences corresponding to the switching information and the startup information contained in the management frame from active values ​​to inactive values, and determine that the disconnection possible state is established when a certain time has elapsed since all of the data sequences corresponding to the switching information and the startup information have become the active values.

13. 5. The communication system according to claim 4, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; The zone control device includes the state confirmation unit, the status confirmation unit of the zone control device is configured, when it receives a power cut-off instruction from the central control device to set the power supply switching unit to the cut-off state, to transmit the cut-off notification to the slave control device, and, when it receives the acknowledgement response from the slave control device after transmitting the cut-off notification, the acknowledgement response includes completion time information indicating the completion time required to complete a shutdown sequence, and when the completion time has elapsed since receiving the acknowledgement response, to determine that the slave control device is in the cut-off possible state.

14. 5. The communication system according to claim 4, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; The zone control device includes the state confirmation unit, the status confirmation unit of the zone control device is configured to: upon receiving a pre-shutdown notification from the central control device to set the power supply switching unit to the cut-off state, transmit the shutdown notification to the slave control device; upon receiving an acceptance response from the slave control device after sending the shutdown notification, the status confirmation unit transmits a handshake completion notification to the central control device if the completion time has elapsed since receiving the acceptance response, the status confirmation unit of the zone control device being configured to: upon receiving a power supply cut-off instruction from the central control device to set the power supply switching unit to the cut-off state after sending the handshake completion notification, determine that the slave control device is in the cut-off possible state.

15. 5. The communication system according to claim 4, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; The central control device includes the status confirmation unit, The zone control device includes the power supply control unit, The status confirmation unit of the central control device is configured to send the shutdown notification to the slave control device via the zone control device, and after sending the shutdown notification, receive the approval response from the slave control device via the zone control device, the approval response including completion time information indicating the completion time required to complete a shutdown sequence, and determine that the slave control device is in the shutdown-enabled state if the completion time has elapsed since receiving the approval response.

16. 8. The communication system according to claim 7, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; The zone control device includes the state confirmation unit and the power supply control unit, the state confirmation unit is configured to calculate the current consumption difference for the slave control device, and to confirm whether or not the management frame including the startup information indicating whether or not to start up the slave control device has been transmitted to the zone control device; The power supply control unit is configured to determine that the slave control device is in the cutoff possible state when the cutoff determination condition is met and the management frame has not been transmitted to the zone control device.

17. 8. The communication system according to claim 7, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; The central control device includes the status confirmation unit, The status confirmation unit is configured to calculate the current consumption difference for the slave control device and confirm whether the management frame including the startup information indicating whether to start the slave control device has been sent to the central control device, and is further configured to determine that the first control device is in the shutdown possible state when the shutdown determination condition is met and the management frame has not been sent to the central control device.

18. 5. The communication system according to claim 4, The communication system includes: a slave control device (108) as the first control device; The power supply switching unit includes a first power supply switching unit (195), The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the first power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; the zone control device is configured to receive power from the power source (117) via a second power supply switching unit (173) built into the central control device and configured to switch between the conductive state and the cut-off state; The zone control device includes the state confirmation unit, the state confirmation unit of the zone control device is configured to, when receiving a power supply cut-off notification from the central control device to set the second power supply switching unit to the cut-off state, transmit a second acknowledgement response to the central control device, the second acknowledgement response including second completion time information indicating a second completion time required to complete cut-off of the second power supply switching unit, and further transmit the cut-off notification to the slave control device, and, when receiving a first acknowledgement response from the slave control device after transmitting the cut-off notification, the first acknowledgement response including first completion time information indicating a first completion time required to complete a shutdown sequence, determine that the slave control device is in the cut-off possible state if the first completion time has elapsed since receiving the first acknowledgement response; the central control device is configured to, after sending the power supply cut-off notification, when it receives the second acceptance response from the zone control device, switch the second power supply switching unit to the cut-off state if the second completion time has elapsed since receiving the second acceptance response.

19. 4. The communication system according to claim 3, The communication system includes: a slave control device (108) as the first control device; The power supply switching unit includes a first power supply switching unit (195), The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the first power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; the zone control device is configured to receive power from the power source (117) via a second power supply switching unit (173) built into the central control device and configured to switch between the conductive state and the cut-off state; The zone control device includes the state confirmation unit, the state confirmation unit of the zone control device is configured to, when receiving a power supply cutoff notification from the central control device to set the first power supply switching unit to the cutoff state, transmit a first acknowledgement response to the central control device, and further transmit the cutoff notification to the slave control device, and, when receiving a first completion response from the slave control device after transmitting the cutoff notification, determine that the slave control device is in the cutoff possible state and transmit a second completion response to the central control device; The central control device is configured to, upon receiving the second completion response from the zone control device after transmitting the power supply cutoff notification, set the second power supply switching unit to the cutoff state.

20. 8. The communication system according to claim 7, The communication system includes: a zone control device (104) as the first control device; The power supply switching unit includes a second power supply switching unit (173), The second control device includes a central control device (101) that is connected to the zone control device so as to be capable of data communication and has the second power supply switching unit built therein, A slave control device (108) that receives power from the power source (117) via a first power supply switching unit (195) built into the zone control device, the central control device includes the state confirmation unit and the power supply control unit, The state confirmation unit of the central control device The communication system is configured to calculate the current consumption difference for the zone control device, and to check whether the management frame including the startup information indicating whether to start up the zone control device has been transmitted to the central control device, and is further configured to determine that the zone control device is in the shutdown possible state when the shutdown determination condition is met and the management frame has not been transmitted to the central control device.

21. 5. The communication system according to claim 4, The communication system includes: a slave control device (108) as the first control device; The power supply switching unit includes a first power supply switching unit (195), The second control device includes a zone control device (104) connected to the slave control device so as to be able to communicate data with the slave control device, the zone control device (104) incorporating the first power supply switching unit, and receiving power from the power source (117) via a second power supply switching unit (173) configured to switch between the conductive state and the cut-off state, and a central control device (101) connected to the zone control device so as to be able to communicate data with the zone control device, An upstream power supply distribution unit (102) incorporating the second power supply switching unit, The zone control device includes the state confirmation unit, the state confirmation unit of the zone control device is configured to, when receiving a power supply cut-off notification from the central control device to set the second power supply switching unit to the cut-off state, transmit a second acknowledgement response to the central control device, the second acknowledgement response including second completion time information indicating a second completion time required to complete cut-off of the second power supply switching unit, and further transmit the cut-off notification to the slave control device, and, when receiving a first acknowledgement response from the slave control device after transmitting the cut-off notification, the first acknowledgement response including first completion time information indicating a first completion time required to complete a shutdown sequence, determine that the slave control device is in the cut-off possible state if the first completion time has elapsed since receiving the first acknowledgement response; the central control device is configured to, when it receives the second acceptance response from the zone control device after sending the power supply cut-off notification, send a second power supply cut-off instruction to the upstream power distribution unit to set the second power supply switching unit to the cut-off state if the second completion time has elapsed since receiving the second acceptance response.

22. 4. The communication system according to claim 3, The communication system includes: a slave control device (108) as the first control device; The power supply switching unit includes a first power supply switching unit (195), The second control device includes a zone control device (104) connected to the slave control device so as to be able to communicate data with the slave control device, the zone control device (104) incorporating the first power supply switching unit, and receiving power from the power source (117) via a second power supply switching unit (173) configured to switch between the conductive state and the cut-off state, and a central control device (101) connected to the zone control device so as to be able to communicate data with the zone control device, An upstream power supply distribution unit (102) incorporating the second power supply switching unit, The zone control device includes the state confirmation unit, the state confirmation unit of the zone control device is configured to, upon receiving a power supply cutoff notification from the central control device for setting the second power supply switching unit to the cutoff state, transmit a first acknowledgement response to the central control device, and further transmit the cutoff notification to the slave control device; if a first completion response is received from the slave control device after transmitting the cutoff notification, determine that the slave control device is in the cutoff possible state, set the first power supply switching unit to the cutoff state, and further transmit a second completion response to the central control device; the central control device is configured to, when it receives the second completion response from the zone control device after sending the power supply cut-off notification, send a second power supply cut-off instruction to the upstream power distribution unit to set the second power supply switching unit to the cut-off state.

23. 8. The communication system according to claim 7, The communication system includes: a slave control device (108) as the first control device; The power supply switching unit includes a first power supply switching unit (195), The second control device includes a zone control device (104) connected to the slave control device so as to be able to communicate data with the slave control device, the zone control device (104) incorporating the first power supply switching unit, and receiving power from the power source (117) via a second power supply switching unit (173) configured to switch between the conductive state and the cut-off state, and a central control device (101) connected to the zone control device so as to be able to communicate data with the zone control device, An upstream power supply distribution unit (102) incorporating the second power supply switching unit, The central control device includes the status confirmation unit, The state confirmation unit of the central control device a communication system configured to calculate the current consumption difference for the zone control device, and to check whether the management frame including the startup information indicating whether to start up the zone control device has been transmitted to the central control device, and further configured, when the shutdown determination condition is satisfied and the management frame has not been transmitted to the central control device, to determine that the zone control device is in the shutdown possible state, and to transmit a second power supply shutdown instruction to the upstream power distribution unit to switch the second power supply switching unit to the shutdown state.

24. 2. The communication system according to claim 1, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; A pre-configured event notification is configured to be sent to the central controller, the zone controllers and the slave controllers; the slave control device is configured to execute a shutdown sequence when a second waiting time preset based on the event notification has elapsed since receiving the event notification; the central control device includes the state confirmation unit and the power supply control unit, the state confirmation unit of the central control device is configured to determine that the interruption is possible when a first waiting time, which is set to be longer than the second waiting time based on the event notification, has elapsed since receiving the event notification, the power supply control unit of the central control device is configured to transmit, to the zone control device, a power supply cut-off instruction to set the power supply switching unit to the cut-off state when the state confirmation unit determines that the cut-off state is possible.

25. 2. The communication system according to claim 1, The communication system includes: a slave control device (108) as the first control device; The second control device includes a zone control device (104) connected to the slave control device so as to be able to perform data communication therewith and configured to control the operation of the power supply switching unit, and a central control device (101) connected to the zone control device so as to be able to perform data communication therewith; A pre-configured event notification is configured to be sent to the central controller, the zone controllers and the slave controllers; the slave control device is configured to execute a shutdown sequence when a second waiting time preset based on the event notification has elapsed since receiving the event notification; The zone control device includes the state confirmation unit and the power supply control unit, The state confirmation unit of the zone control device is configured to determine that the shutoff state is established when a first waiting time, which is set to be longer than the second waiting time based on the event notification, has elapsed since receiving the event notification, and The power supply control unit of the central control device is configured to set the power supply switching unit to the cut-off state when the state confirmation unit determines that the power supply control unit is in the cut-off possible state.

Images