Vehicle-mounted devices

Abstract

The present invention provides an in-vehicle device that can suppress adverse effects on the power supply target when performing diagnostics on the power supply diagnostic unit. [Solution] The in-vehicle device 11 includes a communication control unit 31 capable of performing processing related to communication with the in-vehicle ECUs 13A to 13D, and a diagnostic control unit 33 capable of diagnosing whether the power supply cutoff units 19A to 19F can be switched between a connected state and a cutoff state, respectively. The communication control unit 31 determines, based on the communication status in the in-vehicle network, whether the vehicle's state is in a diagnosable state in which diagnosis of the power supply cutoff units 19A to 19F can be performed. If the communication control unit 31 determines that the vehicle's state is in a diagnosable state, the diagnostic control unit 33 performs switching control between the connected state and the cutoff state of the power supply cutoff units 19A to 19F to perform diagnosis of the power supply cutoff units 19A to 19F.

Description

Technical Field

[0001] The present disclosure relates to an in-vehicle device.

Background Art

[0002] Patent Document 1 below discloses a technique for detecting an abnormal adhesion of a relay using two relays. In the technique described in Patent Document 1, based on the change in the voltage difference when one of the two relays is turned on and the voltage difference when one of the relays is turned off, the presence or absence of adhesion in one of the relays is determined.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] The inventors of the present case are considering a technique of providing a power supply cut-off unit (for example, a relay) in the power supply path from the power supply device to the in-vehicle ECU so that the start and stop of power supply to the in-vehicle ECU can be switched. In such a technique, it is important to periodically diagnose whether the power supply cut-off unit operates properly. When performing such a diagnosis, a mechanism as described in Patent Document 1 above can be adopted.

[0005] However, when adopting the technique described in Patent Document 1 above, it is necessary to prepare two relays or redundant circuits for one power supply path, which increases the number of parts and man-hours required to configure the power supply path, resulting in an increase in cost.

[0006] On the other hand, it is possible to switch the power supply on and off even by supplying power through a single power cutoff unit. However, if the power cutoff unit is switched on and off in order to diagnose the single power cutoff unit, the powered device (e.g., an in-vehicle ECU or peripheral device) that is powered through that power cutoff unit will stop. Therefore, if the power cutoff unit is diagnosed while the powered device is performing some kind of processing or control, it may be interrupted before those processes or controls are completed, potentially causing adverse effects on the powered device.

[0007] In one aspect of this disclosure, it is desirable to provide an in-vehicle device that can suppress adverse effects on the power supply target from the power supply diagnostic unit when the power supply diagnostic unit performs its diagnostics. [Means for solving the problem]

[0008] One aspect of this disclosure is an in-vehicle device (11, 12) mounted on a vehicle. The vehicle is equipped with a plurality of in-vehicle ECUs (13A, 13B, 13C, 13D, 13E), and an in-vehicle network is formed by the plurality of in-vehicle ECUs and in-vehicle devices being connected to each other via communication paths (14A, 14B). The power supply paths to the in-vehicle ECUs (21A, 21B, 21C, 21D, 21E, 21F) are provided with power supply interruption units (19A, 19B, 19C, 19D, 19E, 19F) that can switch between a connected state that supplies power to the in-vehicle ECUs and an interrupted state that cuts off power to the in-vehicle ECUs. The in-vehicle device comprises a communication control unit (31) and a diagnostic control unit (33). The communication control unit is capable of performing processing related to communication with the in-vehicle ECUs. The diagnostic control unit is capable of diagnosing whether the power supply interruption units can be switched between the connected state and the interrupted state, respectively. The communication control unit is configured to determine, based on the communication status in the in-vehicle network, whether the vehicle's condition is in a diagnosable state where the power supply cutoff unit can be diagnosed (S101, S103, S201-S209, S501, S503). The diagnostic control unit is configured to perform a diagnosis of the power supply cutoff unit by executing switching control between the connected state and the cutoff state to the power supply cutoff unit when the communication control unit determines that the vehicle's condition is in a diagnosable state (S105, S301-S325, S505, S601-S619, S705, S801-S825).

[0009] With the in-vehicle device configured in this way, the communication control unit determines, based on the communication status in the in-vehicle network, whether the vehicle's state is in a diagnosable state where the power supply cutoff unit can be diagnosed. The communication status in the in-vehicle network changes depending on whether the in-vehicle ECU is operational or not. Therefore, if the communication control unit estimates that the in-vehicle ECU is operational, it determines that the vehicle's state is not in a diagnosable state; if it estimates that the in-vehicle ECU is not operational, it determines that the vehicle's state is in a diagnosable state.

[0010] When the communication control unit determines that the vehicle's status is in a diagnostic state, the diagnostic control unit performs a diagnostic check of the power supply cutoff unit by switching between the connected state and the cutoff state of the power supply cutoff unit. In other words, the diagnostic check of the power supply cutoff unit is performed when the communication status suggests that the onboard ECU is not operational. Therefore, the power supply cutoff unit is diagnosed at a time when it can be estimated that the in-vehicle ECU is not in an operational state. Thus, it is possible to prevent the in-vehicle ECU, which is the target of the power supply, from becoming unable to continue operating, and to prevent adverse effects on the target of the power supply from the power supply diagnostic unit. [Brief explanation of the drawing]

[0011] [Figure 1] Figure 1 is a block diagram showing the configuration of the in-vehicle system in the first embodiment. [Figure 2] Figure 2 is a flowchart of the main process in the first embodiment. [Figure 3] Figure 3 is a flowchart of the vehicle state determination process in the first embodiment. [Figure 4] Figure 4 is a flowchart of the diagnostic process in the first embodiment. [Figure 5] Figure 5 is a block diagram illustrating a specific configuration for measuring electrical and physical quantities in the first embodiment. [Figure 6] Figure 6 is an explanatory diagram illustrating the data structure of the diagnostic result data in the first embodiment. [Figure 7] Figure 7 is an explanatory diagram illustrating the correspondence between data values ​​stored in the diagnostic result data in the first embodiment and the diagnostic results. [Figure 8] Figure 8 is a sequence diagram illustrating the behavior of the in-vehicle system when the diagnosis is completed successfully in the first embodiment. [Figure 9] Figure 9 is a sequence diagram illustrating the behavior of the in-vehicle system when the diagnosis is discontinued in the first embodiment. [Figure 10] Figure 10 is a block diagram showing the configuration of the in-vehicle system in the second embodiment. [Figure 11] Figure 11 is a flowchart of the upper main process in the second embodiment. [Figure 12] Figure 12 is a flowchart of the upper diagnosis process in the second embodiment. [Figure 13] Figure 13 is a flowchart of the lower main process in the second embodiment. [Figure 14] Figure 14 is a flowchart of the lower diagnosis process in the second embodiment. [Figure 15] Figure 15 is a sequence diagram illustrating the behavior of the in-vehicle system when diagnosis ends normally in the second embodiment.

Embodiments for Carrying out the Invention

[0012] Next, the above in-vehicle device will be described with exemplary embodiments. (1) First Embodiment Hereinafter, the first embodiment will be described.

[0013] [Configuration of In-Vehicle System and In-Vehicle Device] The in-vehicle system 1 illustrated in FIG. 1 is a system that is mounted on a vehicle (not shown) and controls each part of the vehicle to be controlled. The in-vehicle system 1 includes an in-vehicle device 11 and a plurality of in-vehicle ECUs 13A, 13B, 13C, 13D. The in-vehicle device 11 and the plurality of in-vehicle ECUs 13A to 13D are communicably connected via communication lines 14A, 14B to form an in-vehicle network. Note that ECU is an abbreviation for Electronic Control Unit. In the following description, the in-vehicle ECUs 13A to 13D are simply referred to as ECUs 13A to 13D.

[0014] Communication lines 14A and 14B are each connected to the in-vehicle device 11. The ECU 13A is connected to the communication line 14A and is configured to be able to communicate with the in-vehicle device 11. The ECUs 13B, 13C, and 13D are connected to the communication line 14B and are configured to be able to communicate with the in-vehicle device 11. Also, the ECUs 13B, 13C, and 13D are configured to be able to communicate with each other via the communication line 14B. The communication protocol in the in-vehicle network is not particularly limited, and for example, it may be CAN, LIN, Ethernet (registered trademark), or CXPI (registered trademark). That is, it may be half-duplex communication using an access method such as CSMA / CA or CSMA / CD.

[0015] The in-vehicle system 1 includes a plurality of relay boxes 15A and 15B, and a battery 17. A plurality of power supply cut-off parts 19A, 19B, and 19C are incorporated in the relay box 15A. A plurality of power supply cut-off parts 19D, 19E, and 19F are incorporated in the relay box 15B. The power supply cut-off parts 19A to 19F are constituted by, for example, a mechanical relay having a mechanical contact or a semiconductor relay not having a mechanical contact.

[0016] The battery 17 and the relay box 15A are connected by a power line 21A. The relay box 15A and the relay box 15B are connected by a power line 21B. The relay box 15A and the ECU 13A are connected by a power line 21C. The relay box 15B and the ECU 13B are connected by a power line 21D. The relay box 15B and the ECU 13C are connected by a power line 21E. The relay box 15B and the ECU 13D are connected by a power line 21F.

[0017] These relay boxes 15A and 15B and the power lines 21A to 21F constitute a power supply path from the battery 17 to each of the plurality of ECUs 13A to 13D. The power supply cut-off parts 19A to 19F are present on the power supply path from the battery 17 to the plurality of ECUs 13A to 13D, and are configured to be able to switch between a connection state for supplying power to the ECUs 13A to 13D and a cut-off state for cutting off the power supply to the ECUs 13A to 13D.

[0018] The on-board device 11 and relay boxes 15A and 15B are connected by a signal line 25, and are configured to transmit control signals from the on-board device 11 to relay boxes 15A and 15B, respectively. The power supply cutoff units 19A to 19F are configured to switch between the above-mentioned connection state and cutoff state from one to the other according to the control signal transmitted from the on-board device 11.

[0019] The in-vehicle device 11 includes a communication control unit 31 and a diagnostic control unit 33. The communication control unit 31 is composed of equipment necessary for communication with the microcontroller and ECUs 13A to 13D, and is configured to execute processing related to communication with ECUs 13A to 13D. The diagnostic control unit 33 is composed of equipment necessary for control of the microcontroller and relay boxes 15A and 15B, and is configured to diagnose whether the power supply cutoff units 19A to 19F can be switched between the above-mentioned connected state and cutoff state, respectively.

[0020] [Diagnostic process for the power supply cutoff section] Next, the diagnostic process for the power supply interruption units 19A to 19F, which is performed in the in-vehicle device 11, will be explained with reference to the flowcharts shown in Figures 2, 3, and 4. The process described below is performed by the in-vehicle device 11 to diagnose whether the power supply interruption units 19A to 19F switch to the connected state and the interrupted state, respectively, as instructed by the in-vehicle device 11.

[0021] Of the processes described below, the process of sending and receiving data via communication lines 14A and 14B, and the pre- and post-processing for such transmission and reception, are mainly performed by the communication control unit 31. In addition, the diagnostic processing of the power supply cutoff units 19A to 19F, and the control of the power supply cutoff units 19A to 19F required for such diagnostic processing, are mainly performed by the diagnostic control unit 33. Furthermore, in some processes, the communication control unit 31 and the diagnostic control unit 33 cooperate to perform the processing. However, in the following description, the processes performed by the communication control unit 31 and the processes performed by the diagnostic control unit 33 will not be explicitly distinguished, and will be described as processes performed by the in-vehicle device 11.

[0022] When the main process shown in Figure 2 is started, the in-vehicle device 11 executes a vehicle status determination process in S101. Details of the vehicle status determination process are shown in Figure 3. In the vehicle status determination process, as shown in Figure 3, the in-vehicle device 11 determines in S201 whether or not there is any transmission or reception of communication data. If there is no transmission or reception of communication data in the communication control unit 31, S201 is determined to be NO, and in that case, the process proceeds to S203. If there is transmission or reception of communication data in the communication control unit 31, S201 is determined to be YES, and in that case, the process proceeds to S207.

[0023] The communication path in the in-vehicle network of the in-vehicle system 1 includes multiple communication lines 14A and 14B. S201 acquires information from the multiple communication lines 14A and 14B to determine whether or not there is any transmission or reception of communication data. Performing this determination allows for a more accurate determination of whether or not ECUs 13A to 13D have stopped communicating compared to acquiring information from just one of the multiple communication lines 14A and 14B.

[0024] If the process proceeds to S203, the in-vehicle device 11 determines in S203 whether a specified time has elapsed. The specified time is the period from the start of the vehicle status determination process until the end of the specified time during which it can be estimated that the ECUs 13A to 13D are in a dormant state if no communication data has been transmitted or received. The specified time can be set appropriately considering the communication frequency in the in-vehicle system 1. For example, if it is considered highly likely that the ECUs 13A to 13D are in a dormant state when there has been no transmission or reception of communication data in the communication control unit 31 for 10 seconds or more since the start of the vehicle status determination process, then the specified time can be set to 10 seconds.

[0025] If the specified time has not elapsed, S203 determines NO, and the process returns to S201. On the other hand, if the specified time has elapsed, S203 determines YES, and the process proceeds to S205. If the process proceeds to S205, the in-vehicle device 11 determines that diagnosis is possible. This determination result should be stored as information that can be referenced in later processing (for example, a flag). After completing S205, the vehicle status determination process shown in Figure 3 is terminated.

[0026] If the process proceeds from S201 to S207, the in-vehicle device 11 determines whether a timeout has occurred in S207. In S207, if the device has reached a point where it can no longer determine that a diagnosis is possible, it is determined that a timeout has occurred. For example, if the specified time is 10 seconds, the device determines whether 10 seconds or more (e.g., 15 seconds) has elapsed, and if so, it is determined that a timeout has occurred.

[0027] If a timeout occurs, S207 is judged as YES, and the process proceeds to S209. If a timeout does not occur, S207 is judged as NO, and the process returns to S201. If the process proceeds to S209, the in-vehicle device 11 determines that diagnosis is not possible in S209. This determination result should be retained as information that can be referenced in later processing, similar to S205. After completing S209, the vehicle status determination process shown in Figure 3 is terminated.

[0028] In addition, although the above explanation states that it is presumed that ECUs 13A to 13D are in a dormant state, the vehicle's status may be determined to be in a diagnostic state if it is presumed that certain ECUs among the multiple ECUs 13A to 13D are in a dormant state. For example, if the multiple power supply interruption units 19A to 19F include both units to be diagnosed and units not to be diagnosed, the vehicle's status may be determined to be in a diagnostic state if at least the ECUs supplied with power through the power supply interruption unit to be diagnosed are in a state where communication has stopped.

[0029] To give a more specific example, if power supply cutoff unit 19A is the target of diagnosis, and power supply cutoff units 19B to 19F are not, then the ECUs that receive power via power supply cutoff unit 19A are ECUs 13B, 13C, and 13D. Therefore, in this case, if it is determined that ECUs 13B, 13C, and 13D have stopped communicating, then it is sufficient to determine that the vehicle's condition is in a state where it can be diagnosed.

[0030] Furthermore, for example, if the power supply cutoff unit 19D is the target of diagnosis, and the power supply cutoff units 19A~19C, 19E~19F are not, the ECU that receives power via the power supply cutoff unit 19D is ECU 13B. Therefore, in this case, it is sufficient to determine that the vehicle's state is in a diagnostic state when it is determined that ECU 13B has stopped communicating. With this configuration, even if the ECUs 13A, 13C, and 13D that receive power via the power supply cutoff units 19A~19C, 19E~19F, which are not the target of diagnosis, have not stopped communicating, a diagnosis can still be performed on the power supply cutoff unit 19D, which is the target of diagnosis.

[0031] Furthermore, while the above explanation states that the ECUs 13A to 13D are presumed to be in a dormant state if the communication control unit 31 has not transmitted or received communication data for a specified period of time, other methods may be used to determine that the ECUs 13A to 13D are in a dormant state. For example, a communication status determination method may be adopted based on the presence or absence of communication activation request tokens that are periodically transmitted from each communication device. For instance, the communication control unit 31 may be configured to determine whether the ECUs 13A to 13D have stopped communicating based on the state transitions in AUTOSAR's NetworkManagement. More specifically, it may be configured to determine the stoppage of communication based on the "Bus Sleep Mode" of AUTOSAR NetworkManagement.

[0032] Once the vehicle status determination process shown in Figure 3 is completed, S101 shown in Figure 2 is completed, and the process proceeds to S103. In this case, the in-vehicle device 11 determines in S103 whether or not a diagnosis is possible. In S103, it determines whether or not a diagnosis is possible based on the information held in S205 or S209. If a diagnosis is possible, S103 determines it to be YES, and in that case, the process proceeds to S105. If a diagnosis is not possible, S103 determines it to be NO, and in that case, the main process shown in Figure 1 is terminated.

[0033] If the process proceeds to S105, the in-vehicle device 11 executes a diagnostic process. Details of the diagnostic process are shown in Figure 4. In the diagnostic process, as shown in Figure 4, the in-vehicle device 11 executes the repeated processes S301 to S323. This repeated process is repeated for the number of power supply interruption units, and in the case of the in-vehicle system 1 exemplified in this first embodiment, there are six repeated processes, the same number as the six power supply interruption units 19A to 19F. One of the six power supply interruption units 19A to 19F is processed sequentially in each iteration of the repeated process.

[0034] In this iterative process, the in-vehicle device 11 determines in S303 whether the vehicle status remains diagnosable. Whether the vehicle status remains diagnosable can be determined by executing a process similar to the vehicle status determination process shown in Figure 3 within the process of S303. However, it is not mandatory to execute a process similar to the vehicle status determination process shown in Figure 3 within the process of S303. For example, if the vehicle status determination process shown in Figure 3 is configured to run in parallel as a separate process from the diagnostic process shown in Figure 4, then in S303, the vehicle status can be obtained from the separate process that executes the vehicle status determination process.

[0035] If the vehicle condition remains in a state where it can be diagnosed, S303 is judged as YES, and the process proceeds to S305. If the vehicle condition is not in a state where it can be diagnosed, S303 is judged as NO, and the process proceeds to S325. If the process proceeds to S305, the on-board device 11 transmits a cutoff instruction to one of the six power supply cutoff units 19A to 19F. The following explanation will continue using the case where a cutoff instruction is transmitted to power supply cutoff unit 19A as an example.

[0036] After completing S305, the in-vehicle device 11 performs measurement of electrical and physical quantities in S307. The electrical and physical quantity to be measured can be either voltage or current. Although not shown in Figure 1, for example, as illustrated in Figure 5, a current measurement unit 35 can be provided on the power line 21B, and the measured value of the current flowing through the power line 21B can be monitored by the diagnostic control unit 33.

[0037] After completing S307, the in-vehicle device 11 determines in S309 whether the measured value is within the expected range. The measured value here is the value measured in S307. If the measured value in S307 is such that it can be considered that no current is flowing through the power line 21B, then the measured value is within the expected range, and it can be considered that the power supply interruption unit 19A has switched to the properly interrupted state. On the other hand, if the measured value in S307 is such that it can be considered that current is flowing through the power line 21B, then the measured value is not within the expected range, and there is a possibility that the power supply interruption unit 19A has not switched to the interrupted state. In other words, there is a possibility that the power supply interruption unit 19A is stuck in the connected state.

[0038] Therefore, if the measured value is within the expected range, it is determined to be YES in S309 and the process proceeds to S311. On the other hand, if the measured value is not within the expected range, it is determined to be NO in S309 and the process proceeds to S321. If the process proceeds to S311, the on-board device 11 transmits a connection instruction to the power supply interruption unit 19A. After completing S311, the on-board device 11 performs measurement of electrical and physical quantities in S313.

[0039] After completing S313, the in-vehicle device 11 determines in S315 whether the measured value is within the expected range. The measured value here is the value measured in S313. If the measured value in S313 is such that it can be considered that current is flowing through the power line 21B, then the measured value is within the expected range, and it can be considered that the power supply interruption unit 19A has switched to the properly connected state. On the other hand, if the measured value in S313 is such that it can be considered that no current is flowing through the power line 21B, then the measured value is not within the expected range, and there is a possibility that the power supply interruption unit 19A has not switched to the connected state. In other words, there is a possibility that the power supply interruption unit 19A is stuck in the interrupted state.

[0040] Therefore, if the measured value is within the expected range, the system determines YES in S315 and proceeds to S317. On the other hand, if the measured value is not within the expected range, the system determines NO in S315 and proceeds to S319. If the system proceeds to S317, the on-board device 11 determines in S317 that the power supply interruption unit 19A is functioning normally. If the system proceeds to S319, the on-board device 11 determines in S319 that the power supply interruption unit 19A is malfunctioning. The malfunction in S319 is that the unit is stuck in the interrupted state. If the system proceeds to S321, the on-board device 11 determines in S321 that the power supply interruption unit 19A is malfunctioning. The malfunction in S319 is that the unit is stuck in the connected state.

[0041] The results of the judgments in S317, S319, and S321 should be retained as information that can be referenced in later processing. After completing any of S317, S319, or S321, proceed to S323. In S323, the in-vehicle device 11 determines whether or not it has executed the six repetitions. If the six repetitions have not been completed, repeat the processing from S303 onwards. On the other hand, if the six repetitions have been completed, terminate the diagnostic process shown in Figure 4.

[0042] If the process proceeds from S303 to S325, the vehicle status is no longer in a state where it can be diagnosed, so the on-board device 11 cancels the diagnosis. In S325, it is sufficient to retain information that the diagnosis was canceled so that it can be referenced in later processing. Also in S325, the power supply cutoff units 19A to 19F are switched to the connected state.

[0043] This switching is performed because if any of the power supply cutoff units 19A to 19F remain in the cutoff state during the diagnostic process for those units, it may interfere with the power supply to the ECUs 13A to 13D. However, switching the power supply cutoff units 19A to 19F back to the connected state is not mandatory.

[0044] For example, some of the power supply interruption units 19A to 19F may have been in an interrupted state even before the diagnosis. Therefore, if the state of power supply interruption units 19A to 19F before the diagnosis is known, it is acceptable to restore them to that known state. Furthermore, it is not mandatory to perform such a switch to a connected state in S325; for example, the switch to a connected state may be performed in a separate process from the diagnostic process for power supply interruption units 19A to 19F.

[0045] After completing S325, the diagnostic process shown in Figure 4 is terminated. The time required for the diagnostic process shown in Figure 4 is not particularly limited, but it is usually less than 1 second (for example, around 0.1 to 0.2 seconds).

[0046] Once the diagnostic process shown in Figure 4 is completed, S105 shown in Figure 2 is completed, and the process proceeds to S107. In this case, the in-vehicle device 11 determines in S107 whether or not to cancel the diagnosis. In S107, it determines whether or not to cancel the diagnosis based on the information held in S325. If the diagnosis is not to be canceled, S107 determines NO, and in that case, the process proceeds to S109. If the diagnosis is to be canceled, S107 determines YES, and in that case, the main process shown in Figure 1 is terminated.

[0047] If the process proceeds to S109, the in-vehicle device 11 stores the diagnostic results in S109. The diagnostic results stored here can be read out, for example, as information to identify the fault location and circumstances during a later repair. After completing S109, the communication control unit 31 of the in-vehicle device 11 notifies the diagnostic results in S111. The targets of the notification in S111 are, for example, ECUs 13A to 13D.

[0048] For the notification recipient in S111, communication data with a data structure like that exemplified in Figure 6 is transmitted. This communication data contains a communication frame ID and data indicating the diagnostic results for each of the six power supply interruption units 19A to 19F. The communication frame ID is an ID that indicates that it is the diagnostic result of the power supply interruption units 19A to 19F by the in-vehicle device 11. Therefore, the notification recipient that needs this diagnostic result data can determine whether the received data is the diagnostic result data they need by referring to the communication frame ID of the received data.

[0049] The data indicating the diagnostic results for each of the six power supply breakers 19A to 19F is 2 bits long, and its specific content is as shown in Figure 7. Specifically, a data value of 00 indicates a normal diagnostic result, a data value of 01 indicates a stuck state on the breaker side, and a data value of 10 indicates a stuck state on the connection side. Note that a data value of 11 indicates an invalid value.

[0050] When ECU13A~13D receive notification of diagnostic results from the in-vehicle device 11, ECU13A~13D can take action such as executing fail-safe processing. However, it is optional whether or not to notify all of ECU13A~13D. Furthermore, it is also optional whether or not ECU13A~13D that receive the notification execute fail-safe processing.

[0051] For example, if the power supply cutoff unit 19A fails, ECUs 13B, 13C, and 13D may be directly affected in terms of their power supply status, but ECU 13A will not be directly affected in terms of its power supply status. Therefore, in this case, the notification may be limited to ECUs 13B, 13C, and 13D.

[0052] Alternatively, even if ECU13A is not directly affected in terms of power supply status, there is a possibility that ECU13A may be affected in some way due to the malfunction of ECU13B, 13C, and 13D. Therefore, if there is a possibility that ECU13A may be affected in any way, the notification may be extended to all ECU13A through 13D.

[0053] Alternatively, even if ECU13B, 13C, and 13D are directly affected in terms of power supply status, functionally speaking, ECU13D may be an ECU that does not transition to fail-safe processing. In such cases, ECU13D may be excluded from the notification target. In other words, which of ECU13A to 13D is included in the notification target can be arbitrarily set considering various reasons.

[0054] Furthermore, the recipient of the notification in S109 may be the vehicle driver or a communication device capable of communicating with the vehicle. If the recipient is the vehicle driver, the system should activate a warning light or sound in the vehicle's interior. If the recipient is a communication device capable of communicating with the vehicle, the system should transmit fault-related data to that device. Upon receiving the data, the communication device should use its user interface to display fault-related information.

[0055] After completing S111, the in-vehicle device 11 determines whether or not there is a malfunction in S113. In S113, it determines whether or not there is a malfunction based on the information held in S317, S319, and S321. If there is a malfunction, S113 determines YES, and in that case, the process proceeds to S115. If there is no malfunction, S113 determines NO, and in that case, the main process shown in Figure 1 is terminated.

[0056] If the process proceeds to S115, the in-vehicle device 11 performs fail-safe processing. The specific content of the fail-safe processing is not particularly limited. For example, if it is before the engine has started, it may restrict engine starting, or if it is after the engine has started, it may restrict the upper limit of the engine speed or vehicle speed. After completing S115, the main processing shown in Figure 1 is terminated.

[0057] [Behavior of the in-vehicle system when the power supply cutoff unit diagnosis is completed successfully] Next, the behavior of the in-vehicle system when the diagnosis of the power supply cutoff unit is completed successfully will be explained with reference to the sequence diagram in Figure 8. The sequence diagram in Figure 8 focuses on the in-vehicle device 11, ECU 13B, and power supply cutoff unit 19A.

[0058] As shown in Figure 8, after the communication stop process is executed in the in-vehicle device 11 and ECU 13B, the in-vehicle device 11 performs a communication stop determination in S101 as described above. This communication stop determination corresponds in detail to the vehicle status determination process shown in Figure 3. Subsequently, if the in-vehicle device 11 determines that the vehicle status is in a diagnosable state, it becomes YES in S103 as described above, and the in-vehicle device 11 starts the diagnosis in S105. This diagnosis corresponds in detail to the diagnosis process shown in Figure 4. During this diagnosis, a diagnosis of the power supply cutoff unit 19A is performed. After that, the diagnosis of the power supply cutoff unit 19A is completed in the in-vehicle device 11.

[0059] Subsequently, when ECU13B requests to initiate communication, the request is transmitted to the in-vehicle device 11, and the in-vehicle device 11 starts communication. At this time, the in-vehicle device 11 executes S111 and notifies ECU13B of the diagnostic result. ECU13B receives the diagnostic result notified by the in-vehicle device 11 and makes a judgment on the result. Then, based on the judgment result, the control processing in ECU13B is switched.

[0060] To give a specific example, if the diagnostic results include a failure in the power supply cutoff unit 19A, and the necessary countermeasures should also be taken in the ECU 13B, then the control processing in the ECU 13B will be switched from normal processing to fail-safe processing.

[0061] [Behavior of the in-vehicle system when the diagnosis of the power supply cutoff section is canceled] Next, the behavior of the in-vehicle system when the diagnosis of the power supply cutoff unit is canceled will be explained with reference to the sequence diagram in Figure 9. The sequence diagram in Figure 9 focuses on the in-vehicle device 11, ECUs 13A and 13B, and the power supply cutoff unit 19A.

[0062] As shown in Figure 9, after the communication stop process is executed in the in-vehicle device 11 and ECU 13B, the in-vehicle device 11 performs a communication stop determination in S101 as described above. This communication stop determination corresponds in detail to the vehicle status determination process shown in Figure 3. Subsequently, if the in-vehicle device 11 determines that the vehicle status is in a diagnosable state, it becomes YES in S103 as described above, and the in-vehicle device 11 starts the diagnosis in S105. This diagnosis corresponds in detail to the diagnosis process shown in Figure 4. During this diagnosis, a diagnosis of the power supply cutoff unit 19A is performed.

[0063] Subsequently, when ECU13A requests communication activation, the request is transmitted to the in-vehicle device 11. ECU13A is an ECU that is powered via a separate power supply interruption unit 19C from the power supply interruption unit 19A being diagnosed, and may request communication activation from the in-vehicle device 11 or other ECUs even while diagnosing the power supply interruption unit 19A. When the in-vehicle device 11 receives a communication activation request from ECU13A, it determines that the vehicle status is not in a state where it can be diagnosed. That is, it determines NO in S303 described above. In this case, the in-vehicle device 11 stops diagnosing the power supply interruption unit 19A, stops the power interruption by the power supply interruption unit 19A, and stops diagnosing the power supply interruption unit 19A. Subsequently, ECU13A starts communication, and the in-vehicle device 11 also starts communication.

[0064] [effect] (A) With the in-vehicle device 11 as described above, the communication control unit 31 determines, based on the communication status in the in-vehicle network, whether the vehicle's condition is in a diagnosable state in which the power supply cutoff units 19A to 19F can be diagnosed. In the example above, if the communication status in the in-vehicle network is such that there has been no transmission or reception of communication data to the communication control unit 31 for 10 seconds or more, the communication control unit 31 determines that the vehicle's condition is in a diagnosable state.

[0065] The communication status in the in-vehicle network generally fluctuates depending on the operating status of ECUs 13A to 13D. For example, when ECUs 13A to 13D are operating at high rates, the amount of communication on the in-vehicle network tends to be high. On the other hand, when ECUs 13A to 13D are idle, the amount of communication on the in-vehicle network tends to be low. Therefore, based on the communication status in the in-vehicle network, it is possible to estimate with reasonable accuracy whether or not problems will occur even if the power supply to ECUs 13A to 13D is cut off.

[0066] When the communication control unit 31 determines that the vehicle's condition is in a diagnostic state, the diagnostic control unit 33 performs switching control between the connected state and the disconnected state of the power supply cutoff units 19A to 19F to diagnose the power supply cutoff units 19A to 19F. In other words, based on the communication status in the in-vehicle network, the diagnostic control unit 33 performs a diagnosis of the power supply cutoff units 19A to 19F when it is estimated that no problems will occur even if the power supply to the ECUs 13A to 13D is cut off.

[0067] Therefore, the diagnosis of the power supply interruption units 19A to 19F is performed at a time when it is highly likely that the ECUs 13A to 13D, which are the recipients of the power supply, will not be performing any processing or control. Thus, the possibility of processing or control performed by ECUs 13A to 13D being interrupted before completion is reduced, and adverse effects on ECUs 13A to 13D can be suppressed.

[0068] Furthermore, compared to using multiple relays or redundant circuits for a single power supply line, this method reduces the number of components and man-hours required to configure the power supply line. (B) The diagnostic control unit 33 may, in S303, determine NO if the communication control unit 31 determines that the vehicle's condition is not in a state where it can be diagnosed while the diagnostics of the power supply cutoff units 19A to 19F are being performed. In this case, in S325, the diagnostics of the power supply cutoff units 19A to 19F may be stopped and the power supply cutoff units 19A to 19F may be switched to a connected state. Adopting such a configuration makes it possible to prevent the power supply cutoff units 19A to 19F from remaining in a cutoff state when the diagnostics of the power supply cutoff units 19A to 19F are stopped.

[0069] (C) The communication control unit 31 may be configured to determine that the vehicle status is in a diagnostic state when it determines that at least one of the multiple ECUs 13A to 13D that is powered via the power supply interruption unit to be diagnosed has stopped communicating. In this configuration, a diagnosis can be performed on the power supply interruption unit to be diagnosed even if an ECU that is powered via a power supply interruption unit that is not to be diagnosed has not stopped communicating.

[0070] (D) The communication control unit 31 may be configured to notify the ECUs 13A to 13D in S111 of the diagnostic results of the power supply interruption units 19A to 19F by the diagnostic control unit 33. In this configuration, the ECUs 13A to 13D can receive the diagnostic results of the power supply interruption units 19A to 19F, and each of the ECUs 13A to 13D can perform processing according to the diagnostic results.

[0071] (E) The communication control unit 31 may be configured to execute a fail-safe process in S115 if the diagnostic result of the power supply cutoff units 19A to 19F by the diagnostic control unit 33 includes a diagnostic result corresponding to a failure of the power supply cutoff units 19A to 19F. In this configuration, the in-vehicle device 11 can execute a fail-safe process corresponding to a failure of the power supply cutoff units 19A to 19F.

[0072] (F) If the diagnostic results of the power supply interruption units 19A to 19F by the diagnostic control unit 33 include a diagnostic result corresponding to a failure of the power supply interruption units 19A to 19F, the ECUs 13A to 13D may be configured to execute fail-safe processing. In this configuration, each of the ECUs 13A to 13D can execute fail-safe processing corresponding to a failure of the power supply interruption units 19A to 19F.

[0073] (G) The communication path in the in-vehicle network includes multiple communication lines 14A and 14B, and the communication control unit 31 may be configured to determine that the vehicle status is in a diagnostic state when it determines, based on information acquired via the multiple communication lines 14A and 14B, that at least the ECUs 13A to 13D, which are powered via the power supply interruption units 19A to 19F that are to be diagnosed, are in a state where communication has stopped. With this configuration, it is possible to determine more accurately whether or not the ECUs 13A to 13D are in a state where communication has stopped compared to when information is acquired via any one of the multiple communication lines 14A and 14B.

[0074] (2) Second Embodiment Next, the second embodiment will be described. Since the second embodiment shares many components with the first embodiment, the differences from the first embodiment will be the focus of the description. Furthermore, components equivalent to those in the first embodiment will be denoted by the same reference numerals, and descriptions that overlap with the first embodiment will be omitted.

[0075] [Configuration of in-vehicle systems and devices] The in-vehicle system 2 illustrated in Figure 10 is a system mounted on a vehicle (not shown) that controls various parts of the vehicle to be controlled. The in-vehicle system 2 comprises an in-vehicle device 12 and a plurality of ECUs 13A, 13B, 13C, 13D, and 13E. The in-vehicle device 12 and the plurality of ECUs 13A to 13E are connected via communication lines 14A and 14B to form an in-vehicle network.

[0076] Comparing the in-vehicle system 1 of the first embodiment with the in-vehicle system 2 of the second embodiment, the following differences exist. In the second embodiment, the relay box 15A is incorporated into the in-vehicle device 12. Also, in the second embodiment, an ECU 13E is newly added, and the relay box 15B is incorporated into the ECU 13E. Furthermore, in the second embodiment, the in-vehicle device 12 includes a communication control unit 31A and a diagnostic control unit 33A, and the ECU 13E includes a communication control unit 31B and a diagnostic control unit 33B.

[0077] The diagnostic control unit 33A and the relay box 15A are connected by a signal line 25A, and are configured to transmit control signals from the diagnostic control unit 33A to the relay box 15A. The diagnostic control unit 33B and the relay box 15B are connected by a signal line 25B, and are configured to transmit control signals from the diagnostic control unit 33B to the relay box 15B. The power supply cutoff units 19A to 19C incorporated in the in-vehicle device 12 are diagnosed by the diagnostic control unit 33A of the in-vehicle device 12. The power supply cutoff units 19D to 19F incorporated in the ECU 13E are diagnosed by the diagnostic control unit 33B of the ECU 13E.

[0078] The diagnostic control unit 33B of the ECU13E performs a diagnosis of the power supply cutoff units 19D to 19F according to instructions from the in-vehicle device 12, and notifies the in-vehicle device 12 of the diagnosis results. In the in-vehicle device 12, the diagnostic control unit 33A performs a diagnosis of the power supply cutoff units 19A to 19C. The diagnostic control unit 33A aggregates the diagnosis results of the power supply cutoff units 19A to 19C and the diagnosis results of the power supply cutoff units 19D to 19F notified by the ECU13E. The aggregated diagnosis results are then notified from the in-vehicle device 12 to the ECU13A to 13E.

[0079] In other words, in the diagnostic processing of the power supply interruption units 19A to 19E, the on-board device 12 functions as a higher-level device that oversees the ECU 13E, and the ECU 13E functions as a lower-level device that is overseen by the on-board device 12. In this configuration, the on-board device 12 and the ECU 13E each correspond to the on-board device of this disclosure. Furthermore, the entire device integrating the on-board device 12 and the ECU 13E also corresponds to the on-board device of this disclosure. Note that components with the same reference numerals as in the first embodiment are configured in the same way as in the first embodiment, so their description in the second embodiment will be omitted.

[0080] [Diagnostic process for the power supply cutoff section] Next, the diagnostic processing of the power supply interruption units 19A to 19F, which is performed in the in-vehicle device 12 and ECU 13E, will be explained with reference to the flowcharts shown in Figures 11, 12, 13, and 14. The processing described below is performed by the in-vehicle device 12 and ECU 13E to diagnose whether the power supply interruption units 19A to 19F switch to the connected state and the interrupted state, respectively, as instructed by the in-vehicle device 12 or ECU 13E.

[0081] The processes shown in Figures 11 and 12 are executed in the in-vehicle device 12. The processes shown in Figures 13 and 14 are executed in the ECU 13E. First, the processes executed in the in-vehicle device 12 will be explained.

[0082] When the upstream main processing shown in Figure 11 is started, the in-vehicle device 12 executes vehicle status determination processing in S501. The details of the vehicle status determination processing are the same as those shown in Figure 3 in the first embodiment, so the explanation for the second embodiment is omitted. After S501 is completed, the in-vehicle device 12 determines in S503 whether or not diagnosis is possible. S503 can be the same as S103 in the first embodiment. If diagnosis is possible, S503 is determined to be YES, and in that case, the process proceeds to S505. If diagnosis is not possible, S503 is determined to be NO, and in that case, the upstream main processing shown in Figure 11 is terminated.

[0083] If the process proceeds to S505, the in-vehicle device 12 executes the higher-level diagnostic process. Details of the higher-level diagnostic process are shown in Figure 12. In the higher-level diagnostic process, as shown in Figure 12, the in-vehicle device 12 executes the repeated process from S601 to S607. This repeated process is repeated for the number of ECUs corresponding to the lower-level devices that perform the diagnostic process in cooperation with it. In the case of the in-vehicle system 2 exemplified in this second embodiment, this is repeated once for the same number of ECUs as ECU 13E.

[0084] In this iterative process, the in-vehicle device 12 determines in S603 whether the vehicle status remains diagnosable. S603 may be the same process as S303 in the first embodiment. If the vehicle status remains diagnosable, S603 is determined to be YES, and in that case, the process proceeds to S605. If the process proceeds to S605, the in-vehicle device 12 sends a diagnostic instruction to the ECU corresponding to the lower-level device. The following explanation will continue using the case where a diagnostic instruction is sent to the ECU 13E as an example.

[0085] After completing S605, in S607 the in-vehicle device 12 determines whether it has executed one iterative process. In the second embodiment, since there is only one ECU 13E equivalent to a lower-level device, no actual iterative process is executed. However, if there are multiple ECUs equivalent to lower-level devices, the process from S603 onwards is repeated if multiple iterative processes have not been completed. On the other hand, if multiple iterative processes have been completed, the process proceeds to S609.

[0086] In S609, the in-vehicle device 12 performs diagnostic processing on the power supply interruption units 19A to 19C within the in-vehicle device 12. The processing in S609 is the same as the processing in S301 to S323 in the first embodiment, so a detailed explanation is omitted. After completing S609, the in-vehicle device 12 determines in S611 whether or not to discontinue the diagnosis on the power supply interruption units 19A to 19C. In S611, the determination of whether or not to discontinue the diagnosis is made using the same method as in S107. If the diagnosis is not to be discontinued, S611 is judged as NO, and in that case, the process proceeds to S613. If the diagnosis is to be discontinued, S611 is judged as YES, and in that case, the process proceeds to S617.

[0087] If the process proceeds from S611 to S613, the in-vehicle device 12 receives a diagnostic result from one ECU that has completed the diagnosis. Subsequently, in S615, the in-vehicle device 12 determines whether or not it has received diagnostic results from all ECUs. If it has received diagnostic results from all ECUs, S615 determines it to be YES, and the higher-level diagnostic process shown in Figure 12 is terminated. If it has not received diagnostic results from all ECUs, S615 determines it to be NO, and the process returns to S613. Thus, steps S613 to S615 are repeated until diagnostic results have been received from all ECUs.

[0088] As described above, in the second embodiment, there is only one ECU13E equivalent to the lower-level device, so steps S613 to S615 are executed only once and are not essentially repetitive. However, if there are multiple ECUs equivalent to the lower-level device, steps S613 to S615 will be repeated multiple times.

[0089] If the process proceeds from S603 or S611 to S617, the on-board device 12 sends a diagnostic cancellation instruction to the ECU that has already received the diagnostic instruction. Subsequently, the on-board device 12 cancels the diagnosis in S619. In S619, it is sufficient to retain information that the diagnosis has been canceled so that it can be referenced in later processing. Also in S619, the power supply cutoff units 19A to 19C are switched to the connected state. This process in S619 may be the same as the process in S325 in the first embodiment. After completing S619, the higher-level diagnostic process shown in Figure 12 is terminated.

[0090] Once the diagnostic process shown in Figure 12 is completed, S505 shown in Figure 11 is completed, and the process proceeds to S507. In this case, the in-vehicle device 12 determines in S507 whether or not to cancel the diagnosis. In S507, it determines whether or not to cancel the diagnosis based on the information held in S619. If the diagnosis is not to be canceled, S507 determines NO, and in that case, the process proceeds to S509. If the diagnosis is to be canceled, S507 determines YES, and in that case, the upper-level main process shown in Figure 11 is terminated.

[0091] If the process proceeds to S509, the in-vehicle device 12 aggregates and stores the diagnostic results in S509. The diagnostic results aggregated here are the diagnostic results of the power supply interruption units 19A to 19C acquired in S609 and the diagnostic results of the power supply interruption units 19D to 19E acquired in S613. The diagnostic results of the power supply interruption units 19D to 19E are acquired through processing by the ECU 13E, the details of which will be described later.

[0092] The diagnostic results stored in S509 can be read out, for example, as information to identify the fault location and circumstances during a later repair. After completing S509, the in-vehicle device 12 notifies the ECUs 13A to 13E of the aggregated diagnostic results in S511. Communication data with a data structure like that exemplified in Figure 8 is sent to the recipients of the notification in S511. This is the same as in the first embodiment. In the second embodiment as well, the recipients of the notification in S509 may be expanded to include the vehicle driver and communication devices capable of communicating with the vehicle.

[0093] After completing S511, the in-vehicle device 12 determines in S513 whether or not there is a malfunction. If there is a malfunction, S513 is judged as YES, and in that case, the process proceeds to S515. If there is no malfunction, S513 is judged as NO, and in that case, the upper-level main process shown in Figure 11 is terminated. If the process proceeds to S515, the in-vehicle device 11 performs fail-safe processing. The specific contents of the fail-safe processing are not particularly limited. After completing S515, the upper-level main process shown in Figure 11 is terminated.

[0094] Next, we will explain the processes performed in ECU13E. When the lower-side main processing shown in Figure 13 begins, ECU13E receives data addressed to ECU13E in S701. Subsequently, in S703, ECU13E determines whether the received data is a diagnostic instruction. A diagnostic instruction here refers to the instruction transmitted in S605 as described above. If it is a diagnostic instruction, the process proceeds to S705. If it is not a diagnostic instruction, the lower-side main processing shown in Figure 13 ends. Note that even if it is not a diagnostic instruction, some processing may be executed, but such processing is not essential to this disclosure, so further explanation is omitted.

[0095] If the process proceeds to S705, the ECU13E executes a lower-level diagnostic process. Details of the lower-level diagnostic process are shown in Figure 14. In the lower-level diagnostic process, as shown in Figure 14, the ECU13E executes the repeated process from S801 to S823. This repeated process is repeated for the number of power supply interruption units in the ECU13E, and in the case of the in-vehicle system 2 illustrated in this second embodiment, there are three repeated processes, the same number as the three power supply interruption units 19D to 19F. The three power supply interruption units 19D to 19F are processed one by one in each iteration of the repeated process.

[0096] In this iterative process, ECU13E determines in S803 whether or not it has received a diagnostic cancellation instruction. The diagnostic cancellation instruction is the instruction transmitted in S617 as described above. If a diagnostic cancellation instruction is received, S803 is determined to be YES and the process proceeds to S825. If a diagnostic cancellation instruction is not received, S803 is determined to be NO and the process proceeds to S805.

[0097] In other words, in S603, the in-vehicle device 12 decides whether or not to discontinue the diagnosis based on the vehicle status, while in S803, the ECU 13E decides whether or not to discontinue the diagnosis based on instructions from the in-vehicle device 12. However, the ECU 13E may be configured to decide whether or not to discontinue the diagnosis based on the vehicle status.

[0098] If the process proceeds to S805, steps S805 to S823 are executed. Since steps S805 to S823 are the same as steps S305 to S323 shown in Figure 4 in the first embodiment, their explanation in the second embodiment is omitted. However, in the first embodiment, six power supply interruption units 19A to 19F were the target of processing, whereas in the second embodiment, the target of the lower-side diagnostic processing is three power supply interruption units 19D to 19F, so this is a difference.

[0099] If the process proceeds from S803 to S825, the ECU13E will discontinue the diagnosis. In S825, it is sufficient to retain information that the diagnosis was discontinued, which can be referenced in subsequent processing. Also in S825, the power supply cutoff units 19D~19F are switched to the connected state. The content of the processing in S825 may be the same as in S325 in the first embodiment. After completing S825, the lower-side diagnostic processing shown in Figure 14 is terminated.

[0100] Once the lower-level diagnostic process shown in Figure 14 is completed, S705 shown in Figure 13 is completed, and the process proceeds to S707. In this case, ECU13E determines in S707 whether or not to cancel the diagnosis. In S707, it determines whether or not to cancel the diagnosis based on the information held in S825. If the diagnosis is not to be canceled, S707 determines NO, and in that case, the process proceeds to S709. If the diagnosis is to be canceled, S707 determines YES, and in that case, the lower-level main process shown in Figure 13 is terminated.

[0101] If the process proceeds to S709, the ECU13E stores the diagnostic results in S709. However, in the case of the second embodiment, the information aggregated in S509 described above is stored, so S709 may be omitted. Alternatively, if it is desired to compare and verify the information stored in S509 and the information stored in S709 afterward, it is also beneficial to store the diagnostic results in S709.

[0102] After completing S709, the communication control unit 31 of the ECU13E transmits the diagnostic results to the in-vehicle device 12 in S711. The diagnostic results transmitted here are received by the in-vehicle device 12 in S613 as described above. Subsequently, the in-vehicle device 12 notifies the ECU13E of the aggregated diagnostic results in S511 as described above. The ECU13E then receives the aggregated diagnostic results from the in-vehicle device 12 in S712.

[0103] After completing S712, ECU13E determines whether or not there is a malfunction in S713. In S713, it determines whether or not there is a malfunction based on the diagnostic results received in S712. If there is a malfunction, S713 determines YES, and in that case, proceed to S715. If there is no malfunction, S713 determines NO, and in that case, the lower-side main processing shown in Figure 13 is terminated. If proceeding to S715, ECU13E performs fail-safe processing. The specific contents of the fail-safe processing are not particularly limited. After completing S715, the lower-side main processing shown in Figure 13 is terminated.

[0104] [Behavior of the in-vehicle system when the power supply cutoff unit diagnosis is completed successfully] Next, the behavior of the in-vehicle system when the diagnosis of the power supply cutoff unit is completed successfully will be explained with reference to the sequence diagram in Figure 15. The sequence diagram in Figure 15 focuses on the in-vehicle device 12, ECU 13E, power supply cutoff unit 19A, and power supply cutoff unit 19D.

[0105] As shown in Figure 15, after the communication stop process is executed in the in-vehicle device 12 and ECU 13E, the in-vehicle device 12 performs a communication stop determination in S501 described above. This communication stop determination corresponds in detail to the vehicle state determination process shown in Figure 3 in the first embodiment. Subsequently, if the in-vehicle device 12 determines that the vehicle state is in a diagnosable state, it becomes YES in S503 described above, and the in-vehicle device 12 starts the diagnosis in S505. This diagnosis corresponds in detail to the higher-level diagnostic process shown in Figure 12.

[0106] After the diagnosis begins, a diagnostic instruction is sent from the in-vehicle device 12 to the ECU 13E in S605 as described above. During the diagnosis, a diagnosis of the power supply cutoff unit 19A is also performed. The ECU 13E receives the diagnostic instruction sent from the in-vehicle device 12 in S605 as described above in S701 as described above. As a result, the ECU 13E starts the diagnosis in S705. This diagnosis corresponds in detail to the lower-side diagnostic process shown in Figure 14. During the diagnosis in the ECU 13E, a diagnosis of the power supply cutoff unit 19D is also performed.

[0107] Subsequently, the on-board device 12 completes the diagnosis of the power supply cutoff unit 19A. Also, the ECU 13E completes the diagnosis of the power supply cutoff unit 19D. After the lower-side diagnostic processing in S705 is completed, the ECU 13E transmits the diagnostic results to the on-board device 12 in S711. In the on-board device 12, in S509 the diagnostic results from S609 and the diagnostic results received in S613 are aggregated, and the aggregated diagnostic results are transmitted to the ECU 13E in S613.

[0108] The ECU13E receives the diagnostic results notified from the in-vehicle device 12 and makes a judgment based on those results. Based on the judgment result, the ECU13E then switches the control processing. For example, if the diagnostic results include a failure of the power supply cutoff unit 19A and the ECU13E should also take action to address it, the ECU13E will switch its control processing from normal processing to fail-safe processing.

[0109] [effect] According to the in-vehicle device 12 described above, the communication control unit 31 determines, based on the communication status in the in-vehicle network, whether the vehicle's state is in a diagnosable state where the power supply cutoff units 19A to 19F can be diagnosed. If the communication control unit 31 determines that the vehicle's state is in a diagnosable state, the diagnostic control unit 33 performs switching control between the connected state and the cutoff state for the power supply cutoff units 19A to 19F to diagnose the power supply cutoff units 19A to 19F.

[0110] Therefore, as in the first embodiment, the diagnosis of the power supply interruption units 19A to 19F is performed at a time when it is highly likely that the ECUs 13A to 13D, which are the recipients of the power supply, will not perform any processing or control. Thus, the possibility of processing or control performed by ECUs 13A to 13D being interrupted before completion is reduced, and adverse effects on ECUs 13A to 13D can be suppressed.

[0111] Furthermore, compared to using multiple relays or redundant circuits for a single power supply line, this method reduces the number of components and man-hours required to configure the power supply line. Furthermore, in the second embodiment, since the diagnostic control units 33A and 33B each perform diagnostic processing, the load on each of the diagnostic control units 33A and 33B can be reduced compared to the case where a single diagnostic control unit 33 performs diagnostic processing.

[0112] (3) Other embodiments Although the above-described embodiment of the in-vehicle device has been given with reference to exemplary embodiments, the above-described embodiment is merely an example of one aspect of the present disclosure. In other words, the present disclosure is not limited to the above-described exemplary embodiment, and can be implemented in various forms without departing from the technical idea of ​​the present disclosure.

[0113] For example, in the second embodiment described above, an example was shown in which one ECU 13E functions as a lower-level device, but as also mentioned in the second embodiment, multiple ECUs may be configured to function as lower-level devices.

[0114] Furthermore, in the above embodiment, the vehicle's status was determined to be in a diagnostic state when the condition that no specific communication had occurred for a specified period of time was met. However, the determination of whether or not the vehicle is in a diagnostic state may also be based on whether or not other conditions are met.

[0115] Furthermore, multiple functions realized by one component as exemplified in the above embodiment may be realized by multiple components. One function realized by one component as exemplified in the above embodiment may be realized by multiple components. Multiple functions realized by multiple components as exemplified in the above embodiment may be realized by one component. One function realized by multiple components as exemplified in the above embodiment may be realized by one component. Some of the configurations exemplified in the above embodiment may be omitted. At least a part of the configuration exemplified in one of the above embodiments may be added to or replaced with the configuration exemplified in the other embodiments.

[0116] The in-vehicle devices and methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. Alternatively, the in-vehicle devices and methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor by one or more dedicated hardware logic circuits. Alternatively, the in-vehicle devices and methods described in this disclosure may be implemented by one or more dedicated computers configured by a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitional tangible recording medium. The methods for realizing the functions of each part included in the in-vehicle device do not necessarily need to include software, and all of its functions may be realized using one or more hardware components.

[0117] In addition to the above-mentioned in-vehicle device, this disclosure can also be implemented in various forms, such as a system that uses the in-vehicle device as a component, a program for causing the computer to function as the in-vehicle device, a non-transitional physical recording medium such as semiconductor memory that records this program, and a diagnostic method for the power supply interruption unit.

[0118] (4) The technical concept disclosed herein [Item 1] Vehicle-mounted devices (11,12) that are installed in a vehicle, The vehicle is equipped with multiple on-board ECUs (13A, 13B, 13C, 13D, 13E), and an on-board network is formed by the communication between the multiple on-board ECUs and the on-board devices via communication paths (14A, 14B). The power supply lines to the vehicle ECU (21A, 21B, 21C, 21D, 21E, 21F) are provided with power supply interruption units (19A, 19B, 19C, 19D, 19E, 19F) that can switch between a connected state that supplies power to the vehicle ECU and an interrupted state that cuts off power to the vehicle ECU. The aforementioned in-vehicle device is A communication control unit (31) capable of performing processing related to communication with the in-vehicle ECU, A diagnostic control unit (33) capable of diagnosing whether the power supply interruption unit can be switched between the connected state and the interrupted state, Equipped with, The communication control unit is configured to determine, based on the communication status in the in-vehicle network, whether the state of the vehicle is in a diagnosable state in which the power supply cutoff unit can be diagnosed (S101, S103, S201-S209, S501, S503), The diagnostic control unit is configured to perform a diagnosis of the power supply cutoff unit by executing a switching control between the connection state and the cutoff state for the power supply cutoff unit when the communication control unit determines that the vehicle is in a diagnostic state (S105, S301-S325, S505, S601-S619, S705, S801-S825). In-vehicle device.

[0119] [Item 2] The in-vehicle device described in item 1, The diagnostic control unit is configured to stop diagnosing the power supply cutoff unit and switch the power supply cutoff unit to the connected state if the communication control unit determines that the vehicle's state is not in a state where it can be diagnosed while the power supply cutoff unit is being diagnosed (S303, S325). In-vehicle device.

[0120] [Item 3] An in-vehicle device as described in item 1 or item 2, The communication control unit is configured to determine that the vehicle is in a diagnostically available state when it determines that at least one of the multiple in-vehicle ECUs, which is powered via the power supply interruption unit to be diagnosed, is in a state where communication has stopped (S201, S203, S205). In-vehicle device. [Item 4] An in-vehicle device described in any one of items 1 to 3, The communication control unit is configured to notify the vehicle ECU of the diagnostic result of the power supply cutoff unit by the diagnostic control unit (S111, S511). In-vehicle device.

[0121] [Item 5] An in-vehicle device described in any one of items 1 through 4, The communication control unit is configured to execute fail-safe processing when the diagnostic result of the diagnostic control unit for the power supply cutoff unit includes a diagnostic result corresponding to a failure of the power supply cutoff unit (S115, S515). In-vehicle device.

[0122] [Item 6] The in-vehicle device described in item 4, If the diagnostic result of the power supply cutoff unit by the diagnostic control unit includes a diagnosis result corresponding to a failure of the power supply cutoff unit, the in-vehicle ECU is configured to execute a fail-safe process (S715). In-vehicle device.

[0123] [Item 7] An in-vehicle device described in any one of items 1 through 6, The communication path in the in-vehicle network includes multiple communication lines (14A, 14B), The communication control unit is configured to determine that the vehicle is in a diagnostic state when it determines, based on information acquired via the plurality of communication lines, that at least the in-vehicle ECU, which is powered via the power supply interruption unit to be diagnosed, is in a state where communication has stopped (S201). In-vehicle device.

[0124] [Item 8] An in-vehicle device described in any one of items 1 through 7, The communication protocol in the aforementioned in-vehicle network is CAN, LIN, Ethernet®, or CXPI®. In-vehicle device.

[0125] [Item 9] An in-vehicle device described in any one of items 1 through 8, The communication control unit is configured to determine, based on state transitions in AUTOSAR®'s Network Management, whether or not the in-vehicle ECU, which is powered via the power supply interruption unit to be diagnosed, has stopped communicating. In-vehicle device.

[0126] [Item 10] An in-vehicle system (1,2) installed in a vehicle, The vehicle comprises in-vehicle devices (11, 12) and a plurality of in-vehicle ECUs (13A, 13B, 13C, 13D, 13E), and the plurality of in-vehicle ECUs and the in-vehicle devices are connected to communicate via communication paths (14A, 14B) to constitute an in-vehicle network. The power supply lines to the vehicle ECU (21A, 21B, 21C, 21D, 21E, 21F) are provided with power supply interruption units (19A, 19B, 19C, 19D, 19E, 19F) that can switch between a connected state that supplies power to the vehicle ECU and an interrupted state that cuts off power to the vehicle ECU. The aforementioned in-vehicle device is A communication control unit (31) capable of performing processing related to communication with the in-vehicle ECU, A diagnostic control unit (33) capable of diagnosing whether the power supply interruption unit can be switched between the connected state and the interrupted state, Equipped with, The communication control unit is configured to determine, based on the communication status in the in-vehicle network, whether the state of the vehicle is in a diagnosable state in which the power supply cutoff unit can be diagnosed (S101, S103, S201-S209, S501, S503), The diagnostic control unit is configured to perform a diagnosis of the power supply cutoff unit by executing a switching control between the connection state and the cutoff state for the power supply cutoff unit when the communication control unit determines that the vehicle is in a diagnostic state (S105, S301-S325, S505, S601-S619, S705, S801-S825). In-vehicle systems.

[0127] [Item 11] The in-vehicle device is an in-vehicle device described in any one of items 2 to 9. In-vehicle systems. [Explanation of symbols]

[0128] 1,2...In-vehicle system, 11,12...In-vehicle device, 13A,13B,13C,13D,13E...In-vehicle ECU, 14A,14B...Communication line, 15A,15B...Relay box, 17...Battery, 19A,19B,19C,19D,19E,19F...Power supply cutoff unit, 21A,21B,21C,21D,21E,21F...Power line, 25,25A,25B...Signal line, 31,31A,31B...Communication control unit, 33,33A,33B...Diagnostic control unit, 35...Current measurement unit.

Claims

1. Vehicle-mounted devices (11, 12) are installed in a vehicle, The vehicle is equipped with multiple on-board ECUs (13A, 13B, 13C, 13D, 13E), and an on-board network is formed by the communication between the multiple on-board ECUs and the on-board devices via communication paths (14A, 14B). The power supply lines to the vehicle ECU (21A, 21B, 21C, 21D, 21E, 21F) are provided with power supply interruption units (19A, 19B, 19C, 19D, 19E, 19F) that can switch between a connected state that supplies power to the vehicle ECU and an interrupted state that cuts off power to the vehicle ECU. The in-vehicle device is A communication control unit (31) capable of performing processing related to communication with the in-vehicle ECU, A diagnostic control unit (33) capable of diagnosing whether the power supply cutoff unit can be switched between the connected state and the cutoff state, respectively, Equipped with, The communication control unit is configured to determine, based on the communication status in the in-vehicle network, whether the state of the vehicle is in a diagnosable state in which the power supply cutoff unit can be diagnosed (S101, S103, S201-S209, S501, S503), The diagnostic control unit is configured to perform a diagnosis of the power supply cutoff unit by executing switching control between the connection state and the cutoff state for the power supply cutoff unit when the communication control unit determines that the state of the vehicle is in a diagnostic state (S105, S301-S325, S505, S601-S619, S705, S801-S825). In-vehicle device.

2. The in-vehicle device according to claim 1, The diagnostic control unit is configured to stop diagnosing the power supply cutoff unit and switch the power supply cutoff unit to the connected state if the communication control unit determines that the vehicle is not in a state where it can be diagnosed while the power supply cutoff unit is being diagnosed (S303, S325). In-vehicle device.

3. An in-vehicle device according to claim 1 or claim 2, The communication control unit is configured to determine that the vehicle is in a diagnostically ready state when it determines that at least one of the multiple in-vehicle ECUs, which is powered via the power supply interruption unit to be diagnosed, is in a state where communication has stopped (S201, S203, S205). In-vehicle device.

4. An in-vehicle device according to claim 1 or claim 2, The communication control unit is configured to notify the in-vehicle ECU of the diagnostic result of the power supply cutoff unit by the diagnostic control unit (S111, S511). In-vehicle device.

5. An in-vehicle device according to claim 1 or claim 2, The communication control unit is configured to execute a fail-safe process if the diagnostic result of the power supply interruption unit by the diagnostic control unit includes a diagnostic result corresponding to a failure of the power supply interruption unit (S115, S515). In-vehicle device.

6. The in-vehicle device according to claim 4, If the diagnostic result of the power supply cutoff unit by the diagnostic control unit includes a diagnostic result corresponding to a failure of the power supply cutoff unit, the in-vehicle ECU is configured to execute fail-safe processing (S715). In-vehicle device.

7. An in-vehicle device according to claim 1 or claim 2, The communication path in the in-vehicle network includes a plurality of communication lines (14A, 14B), The communication control unit is configured to determine that the state of the vehicle is in a diagnostic state when it determines, based on information acquired via the plurality of communication lines, that at least the in-vehicle ECU, which is powered via the power supply interruption unit to be diagnosed, is in a state where communication has stopped (S201). In-vehicle device.

Images