Communication system

Abstract

This prevents the electronic control unit from becoming unable to switch between the on and off states. [Solution] The vehicle control system 1 comprises control ECUs 3 and 4, slave ECUs 6 and 8, a management ECU 2, and communication lines 31, 32, and 34. Control ECUs 3 and 4 receive power via power supply paths 21 and 22. Slave ECUs 6 and 8 receive power via power supply paths 24 and 26. The management ECU 2 generates an NM frame containing switching information for slave ECUs 6 and 8 in response to an event. Communication lines 31 and 32 connect the management ECU 2 to control ECUs 3 and 4. Communication line 34 connects control ECUs 3 and 4. Control ECUs 3 and 4 are each connected to slave ECUs 6 and 8 for data communication.

Description

Technical Field

[0001] The present disclosure relates to a communication system including a plurality of electronic control units.

Background Art

[0002] Patent Document 1 describes an in-vehicle network system that includes a power relay for individually switching on / off the power supply of an electronic control unit for each of a plurality of electronic control units, determines control content for switching on / off the power supply of a specific electronic control unit corresponding to a specific scene specified based on the vehicle situation, and switches on / off the power supply supplied to the specific electronic control unit using the power relay based on the determined control content.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] As a result of the inventors' detailed examination, in a communication system configured to be able to individually switch between an on state and an off state for a plurality of electronic control units including the plurality of electronic control units, it has been found that there is a problem that the on state and the off state of the electronic control unit may become unable to be switched.

[0005] An object of the present disclosure is to suppress the inability to switch between the on state and the off state of an electronic control unit.

Means for Solving the Problems

[0006] One aspect of the present disclosure is a communication system (1) including a plurality of electronic control units (2 to 11) connected to be able to transmit and receive communication frames. The communication system of this disclosure comprises a first control device (3), a second control device (4), a first slave device (6), a second slave device (8), a management device (2), a first communication path (31), a second communication path (32), and a relay communication path (34).

[0007] The first control device is configured to receive power via the first power supply path (21) as the electronic control device described above. The second control device, as an electronic control device, is configured to receive power via a second power supply path (22) that is not connected to the first power supply path.

[0008] The first slave device, as the electronic control device described above, is configured to receive power via a third power supply path (24) connected to the first power supply path. The second slave device, as the electronic control device described above, is configured to receive power via a fourth power supply path (26) connected to the second power supply path.

[0009] The management device is configured to generate a management frame, which is a communication frame containing state identification information that can determine whether to turn on or turn off each of the multiple electronic control devices in response to a detected event.

[0010] The first communication path is a communication path that connects the management device and the first control device so that communication frames can be sent and received between the management device and the first control device. The second communication path is a communication path that connects the management device and the second control device, enabling the sending and receiving of communication frames between the management device and the second control device.

[0011] The relay communication path is a communication path that connects the first control device and the second control device so that communication frames can be sent and received between the first control device and the second control device. The management device is configured to transmit management frames to the first control device via the first direct communication path.

[0012] The management device is configured to transmit management frames to the second control device via a second direct communication path. The first control unit and the first slave unit are connected to each other in a manner that enables data communication.

[0013] The second control unit and the second slave unit are connected to each other in a manner that enables data communication. In the communication system of this disclosure configured in this manner, the management device generates a management frame in response to an event and transmits the management frame to the first and second control devices via the first and second communication paths, thereby enabling the first control device, the second control device, the first slave device, and the second slave device to be turned on or off in response to an event.

[0014] Furthermore, in the communication system of this disclosure, even if the management device cannot transmit a management frame to the first control device via the first communication path, the management device can transmit a management frame to the first control device via the second communication path and the relay communication path. In addition, the first control device can transmit a management frame to the first slave device.

[0015] Furthermore, in the communication system of this disclosure, even if the management device cannot transmit a management frame to the second control device via the second communication path, the management device can transmit a management frame to the second control device via the first communication path and the relay communication path. In addition, the second control device can transmit a management frame to the second slave device.

[0016] Therefore, the communication system of this disclosure can prevent the first control unit, the second control unit, the first slave device, and the second slave device from being unable to switch between the on state and the off state.

[0017] Furthermore, in the communication system of the present disclosure, even when the first control device cannot receive power supply via the first power supply path, the second control device that receives power supply via the second power supply path not connected to the first power supply path can operate. Therefore, the communication system of the present disclosure can suppress the situation where both the first and second slave devices cannot simultaneously switch between the on state and the off state.

[0018] As described above, the communication system of the present disclosure can suppress the situation where the first control device, the second control device, the first slave device, and the second slave device cannot switch between the on state and the off state.

[0019] Another aspect of the present disclosure is a communication system including a first control device (3), a second control device (4), a first power supply switching unit (65), a second power supply switching unit (85), a management device (2), a first communication path (31), a second communication path (32), and a relay communication path (34).

[0020] The first power supply switching unit is configured to switch the third power supply path (24) between an on state in which the third power supply path is made conductive and an off state in which the third power supply path is cut off. The third power supply path is connected to the first power supply path and supplies power to the first slave device (6) that is communicably connected to the first control device.

[0021] The second power supply switching unit is configured to switch the fourth power supply path (26) between an on state in which the fourth power supply path is made conductive and an off state in which the fourth power supply path is cut off. The fourth power supply path is connected to the second power supply path and supplies power to the second slave device (8) that is communicably connected to the second control device.

[0022] The management device is configured to transmit a management frame to the first control device via the first communication path. The management device is configured to transmit a management frame to the second control device via the second communication path.

[0023] The first control device is configured to control the operation of the first power supply switching unit based on the state specifying information included in the management frame. The second control device is configured to control the operation of the second power supply switching unit based on the state specifying information included in the management frame.

[0024] In the communication system of the present disclosure configured as described above, since the management device generates a management frame in response to an event and transmits the management frame to the first and second control devices via the first and second communication paths, the first and second control devices can turn on or off the first and second power supply switching units in response to the event.

[0025] And, in the communication system of the present disclosure, even when the management device cannot transmit the management frame to the first control device via the first communication path, the management device can transmit the management frame to the first control device via the second communication path and the relay communication path. Also, in the communication system of the present disclosure, even when the management device cannot transmit the management frame to the second control device via the second communication path, the management device can transmit the management frame to the second control device via the first communication path and the relay communication path. Therefore, the communication system of the present disclosure can suppress the situation where it becomes impossible to switch between permission and prohibition of power supply to the first and second slave devices.

[0026] Furthermore, in the communication system of the present disclosure, even when the first control device cannot receive power supply via the first power supply path and thus cannot control the operation of the first power supply switching unit, the second control device that receives power supply via the second power supply path not connected to the first power supply path can control the operation of the second power supply switching unit. Therefore, the communication system of the present disclosure can suppress the situation where it becomes impossible to switch between permission and prohibition of power supply to both the first and second slave devices simultaneously.

[0027] Based on the above, the communication system of this disclosure can prevent the first slave device and the second slave device from being unable to switch between the on state and the off state. [Brief explanation of the drawing]

[0028] [Figure 1] This is a block diagram showing the configuration of a vehicle control system. [Figure 2] This is a flowchart showing the frame transmission process. [Figure 3] This is a flowchart showing the frame transfer process. [Figure 4] This is a flowchart showing the fault detection process. [Figure 5] This is a flowchart showing the master startup process. [Figure 6] This is a flowchart showing the slave startup process. [Figure 7] This is a flowchart showing the restart process. [Figure 8] This is a flowchart showing the master data shutdown process. [Figure 9] This is a flowchart showing the slave shutdown process. [Figure 10] This is a flowchart showing the terminal termination process. [Figure 11] This is a flowchart showing the anomaly detection process. [Modes for carrying out the invention]

[0029] [First Embodiment] A first embodiment of this disclosure is described below with reference to the drawings. The vehicle control system 1 of this embodiment is mounted on a vehicle and, as shown in Figure 1, comprises a management ECU 2, control ECUs 3, 4, and 5, slave ECUs 6, 7, 8, 9, 10, and 11, and batteries 12 and 13. ECU stands for Electronic Control Unit.

[0030] The management ECU2 integrates the control ECUs 3, 4, and 5, thereby achieving coordinated control for the entire vehicle. Control ECUs 3, 4, and 5 are provided for each zone into which the vehicle is divided, and primarily perform control of the slave ECUs located within that zone.

[0031] Slave ECUs 6 and 7 belong to the same zone as control ECU 3. Slave ECUs 8 and 9 belong to the same zone as control ECU 4. Slave ECUs 10 and 11 belong to the same zone as control ECU 5.

[0032] Batteries 12 and 13 supply power to various parts of the vehicle with a DC battery voltage (for example, 12V). The control ECU 3 receives power from the battery 12 via a power supply path 21 between the battery 12 and the control ECU 3.

[0033] The control ECU 4 receives power from the battery 13 via a power supply path 22 between the battery 13 and the control ECU 4. The control ECU 5 receives power from the battery 13 via a power supply path 23 between the battery 13 and the control ECU 5.

[0034] The slave ECUs 6 and 7 each receive power from the battery 12 via power supply paths 24 and 25 between the control ECU 3 and the slave ECUs 6 and 7, respectively. The slave ECUs 8 and 9 each receive power from the battery 13 via power supply paths 26 and 27 between the control ECU 4 and the slave ECUs 8 and 9, respectively.

[0035] The slave ECUs 10 and 11 each receive power from the battery 13 via power supply paths 28 and 29 between the control ECU 5 and the slave ECUs 10 and 11, respectively. The management ECU2 and the control ECU3 are connected to each other via a communication line 31, enabling data communication between them.

[0036] The management ECU2 and the control ECU4 are connected to each other via a communication line 32, enabling them to communicate data with one another. The management ECU2 and the control ECU5 are connected to each other via a communication line 33, enabling data communication between them.

[0037] Control ECUs 3 and 4 are connected to each other via a communication line 34, enabling data communication between them. Control ECUs 4 and 5 are connected to each other via a communication line 35, enabling data communication between them.

[0038] The control ECU3 and slave ECUs6 and7 are connected to each other via a communication bus 36, enabling data communication between them. The control ECU 4 and the slave ECUs 8 and 9 are connected to each other via the communication bus 37, enabling data communication between them.

[0039] The control ECU 5 and the slave ECUs 10 and 11 are connected to each other via a communication bus 38, enabling data communication between them. The management ECU2 comprises a control unit 41, a communication unit 42, and a storage unit 43.

[0040] The control unit 41 is an electronic control unit centered around a microcomputer equipped with a CPU 51, ROM 52, RAM 53, etc. The various functions of the microcomputer are realized by the CPU 51 executing a program stored in a non-transitional physical recording medium. In this example, the ROM 52 corresponds to the non-transitional physical recording medium that stores the program. Furthermore, the execution of this program executes the method corresponding to the program. Note that some or all of the functions executed by the CPU 51 may be configured in hardware by one or more ICs, etc. Also, the number of microcomputers that make up the control unit 41 may be one or more.

[0041] The communication unit 42 communicates with the control ECU 3 connected to the communication line 31, with the control ECU 4 connected to the communication line 32, and with the control ECU 5 connected to the communication line 33 by sending and receiving communication frames, for example, based on the Ethernet communication protocol. Ethernet is a registered trademark.

[0042] The memory unit 43 is a storage device for storing various types of data. The memory unit 43 stores the management table 56, which will be described later. The control ECU3 comprises a control unit 61, a communication unit 62, a CAN communication unit 63, a storage unit 64, and power distribution switches 65 and 66. CAN stands for Controller Area Network.

[0043] The control unit 61 is an electronic control unit centered around a microcomputer equipped with a CPU 71, ROM 72, RAM 73, etc. The various functions of the microcomputer are realized by the CPU 71 executing a program stored in a non-transitional physical recording medium. In this example, ROM 72 corresponds to the non-transitional physical recording medium that stores the program. Furthermore, the execution of this program executes the method corresponding to the program. Note that some or all of the functions executed by the CPU 71 may be configured hardware-wise by one or more ICs, etc. Also, the number of microcomputers that make up the control unit 61 may be one or more.

[0044] The communication unit 62 communicates with the management ECU 2 connected to the communication line 31 and with the control ECU 4 connected to the communication line 34 by sending and receiving communication frames, for example, based on the Ethernet communication protocol.

[0045] The CAN communication unit 63 communicates with slave ECUs 6 and 7 connected to the communication bus 36 by sending and receiving communication frames based on the CAN communication protocol. The memory unit 64 is a memory device for storing various types of data.

[0046] The power distribution switch 65 is located on the power supply path 24, which is connected to the power supply path 21. The power distribution switch 65 is configured to open or close the power supply path 24 according to commands from the control unit 61.

[0047] The power distribution switch 66 is located on the power supply path 25, which is connected to the power supply path 21. The power distribution switch 66 is configured to open or close the power supply path 25 according to commands from the control unit 61.

[0048] The control ECU4 comprises a control unit 81, a communication unit 82, a CAN communication unit 83, a storage unit 84, and power distribution switches 85 and 86. The control unit 81 is an electronic control unit centered around a microcomputer equipped with a CPU 91, ROM 92, RAM 93, etc. The various functions of the microcomputer are realized by the CPU 91 executing a program stored in a non-transitional physical recording medium. In this example, ROM 92 corresponds to the non-transitional physical recording medium that stores the program. Furthermore, the execution of this program executes the method corresponding to the program. Note that some or all of the functions executed by the CPU 91 may be configured hardware-wise by one or more ICs, etc. Also, the number of microcomputers that make up the control unit 81 may be one or more.

[0049] The communication unit 82 communicates with the management ECU 2 connected to the communication line 32, with the control ECU 3 connected to the communication line 34, and with the control ECU 5 connected to the communication line 35 by sending and receiving communication frames, for example, based on the Ethernet communication protocol.

[0050] The CAN communication unit 83 communicates with slave ECUs 8 and 9 connected to the communication bus 37 by sending and receiving communication frames based on the CAN communication protocol. The memory unit 84 is a memory device for storing various types of data.

[0051] The power distribution switch 85 is located on the power supply path 26, which is connected to the power supply path 22. The power distribution switch 85 is configured to open or close the power supply path 26 according to commands from the control unit 81.

[0052] The power distribution switch 86 is located on the power supply path 27, which is connected to the power supply path 22. The power distribution switch 86 is configured to open or close the power supply path 27 according to commands from the control unit 81.

[0053] The control ECU 5 comprises a control unit 101, a communication unit 102, a CAN communication unit 103, a storage unit 104, and power distribution switches 105 and 106. The control unit 101 is an electronic control unit centered around a microcomputer equipped with a CPU 111, ROM 112, RAM 113, etc. The various functions of the microcomputer are realized by the CPU 111 executing a program stored in a non-transitional physical recording medium. In this example, ROM 112 corresponds to the non-transitional physical recording medium that stores the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions performed by the CPU 111 may be configured in hardware using one or more ICs, etc. Also, the number of microcomputers constituting the control unit 101 may be one or more.

[0054] The communication unit 102 communicates with the management ECU 2 connected to the communication line 33, and with the control ECU 4 connected to the communication line 35, by sending and receiving communication frames based on, for example, the Ethernet communication protocol.

[0055] The CAN communication unit 103 communicates with the slave ECUs 10 and 11 connected to the communication bus 38 by sending and receiving communication frames based on the CAN communication protocol. The memory unit 104 is a storage device for storing various types of data.

[0056] The power distribution switch 105 is located on the power supply path 28, which is connected to the power supply path 23. The power distribution switch 105 is configured to conduct or interrupt the power supply path 28 according to commands from the control unit 101.

[0057] The power distribution switch 106 is located on the power supply path 29, which is connected to the power supply path 23. The power distribution switch 106 is configured to open or close the power supply path 29 according to commands from the control unit 101.

[0058] The management table 56 contains the correspondence between each of the multiple events and the power distribution switches that should be turned on and turned off. Specifically, the management table 56 contains six pieces of switching information for each event, indicating whether to turn on or off each of the power distribution switches 65, 66, 85, 86, 105, and 106.

[0059] For example, for an event where the vehicle's power state switches from accessory-on to ignition-on, six switching information settings are configured, such as turning on power distribution switch 65, turning on power distribution switch 66, turning off power distribution switch 85, turning off power distribution switch 86, turning on power distribution switch 105, and turning off power distribution switch 106.

[0060] For example, in the case of a door-opening event when a vehicle door is opened, six switching information settings are configured, such as setting power distribution switch 65 to the off state, power distribution switch 66 to the off state, power distribution switch 85 to the on state, power distribution switch 86 to the on state, power distribution switch 105 to the off state, and power distribution switch 106 to the on state.

[0061] For example, if the slave ECU6 is a door control ECU, when the door switch is turned ON, the slave ECU6 sends information indicating a door open event to the management ECU2 via the control ECU4. This allows the management ECU2 to detect the occurrence of the door open event.

[0062] When the management ECU2 detects an event, it extracts six pieces of switching information corresponding to the detected event from the management table 56. The management ECU2 then generates a communication frame containing the six extracted pieces of switching information as an NM frame and transmits the generated NM frame. NM stands for Network Management.

[0063] When the control ECU 3 receives an NM frame transmitted by the management ECU 2, it extracts the switching information of the power distribution switches 65 and 66 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 65 and 66 to the ON state or the OFF state.

[0064] When the control ECU4 receives an NM frame transmitted by the management ECU2, it extracts the switching information of the power distribution switches 85 and 86 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 85 and 86 to the ON state or the OFF state.

[0065] When the control ECU 5 receives an NM frame transmitted by the management ECU 2, it extracts the switching information of the power distribution switches 105 and 106 under its control from the NM frame, and based on the extracted switching information, it sets the power distribution switches 105 and 106 to either the ON or OFF state.

[0066] Next, the procedure for frame transmission processing performed by the control unit 41 of the management ECU2 will be described. Frame transmission processing is a process that is repeatedly performed while the management ECU2 is operating. When the frame transmission process is executed, the CPU 51 of the control unit 41 determines in S10 whether or not an event has been detected, as shown in Figure 2. If no event has been detected, the CPU 51 terminates the frame transmission process.

[0067] On the other hand, if an event is detected, CPU 51 extracts six pieces of switching information corresponding to the detected event from management table 56 in S20 and generates an NM frame containing the six extracted pieces of switching information.

[0068] In S30, CPU 51 starts the process of sending the NM frame generated in S20 to control ECUs 3, 4, and 5 via communication lines 31, 32, and 33, respectively, and then finishes the frame transmission process. As a result, management ECU 2 periodically and repeatedly sends the NM frame generated in S20.

[0069] Next, the procedure for frame transfer processing performed by the control units 61, 81, and 101 of the control ECUs 3, 4, and 5 will be described. Frame transfer processing is a process that is repeatedly performed while the control ECUs 3, 4, and 5 are operating.

[0070] When frame transfer processing is executed, the CPUs 71, 91, and 111 of the control units 61, 81, and 101 determine in S110 whether or not an NM frame has been received, as shown in Figure 3. If an NM frame has not been received, the CPUs 71, 91, and 111 terminate the frame transfer processing.

[0071] On the other hand, when an NM frame is received, CPUs 71, 91, and 111 forward the received NM frame in S120 via the remaining communication lines, excluding the communication lines 31, 32, and 33 connected to the management ECU2 and the communication line used to receive the NM frame in S110.

[0072] For example, if the control ECU 3 receives an NM frame from the management ECU 2 via the communication line 31, it forwards the NM frame to the control ECU 4 via the communication line 34. For example, if the control ECU 3 receives an NM frame from the control ECU 4 via the communication line 34, it does not perform the forwarding of the NM frame.

[0073] For example, if the control ECU 4 receives an NM frame from the management ECU 2 via the communication line 32, it forwards the NM frame to the control ECUs 3 and 5 via the communication lines 34 and 35. For example, if the control ECU 4 receives an NM frame from the control ECU 3 via the communication line 34, it forwards the NM frame to the control ECU 5 via the communication line 35.

[0074] For example, if control ECU 4 receives an NM frame from control ECU 5 via communication line 35, it forwards the NM frame to control ECU 3 via communication line 34. For example, if the control ECU 5 receives an NM frame from the management ECU 2 via the communication line 33, it forwards the NM frame to the control ECU 4 via the communication line 35.

[0075] For example, if the control ECU 5 receives an NM frame from the control ECU 4 via the communication line 35, it does not perform the forwarding of the NM frame. CPUs 71, 91, and 111 determine in S130 whether they have already received an NM frame from the same source (i.e., management ECU2) within the period between the time S110 determines that an NM frame has been received and the time S110 determines that an NM frame has been received (hereinafter referred to as the same frame reception determination period). Note that the NM frame contains a source address indicating the source.

[0076] The same frame reception determination period is set based on the difference in the timing of receiving NM frames for each communication line when the control ECU receives NM frames via multiple communication lines.

[0077] For example, in control ECU 4, the same frame reception determination period is set based on the differences in timing when an NM frame is received from communication line 31, when an NM frame is received via communication lines 32 and 34, and when an NM frame is received via communication lines 33, 34, and 35. The same frame reception determination period may be the same for control ECUs 3, 4, and 5, or it may be different for control ECUs 3, 4, and 5.

[0078] If an NM frame from the same source has already been received within the same frame reception determination period, CPUs 71, 91, and 111 terminate the frame transfer process. On the other hand, if no NM frame from the same source has already been received within the same frame reception determination period, CPUs 71, 91, and 111 return an acknowledgment in S140 via the communication line on which the NM frame was received in S110.

[0079] For example, if the control ECU 4 receives an NM frame from the management ECU 2 via the communication line 32, it returns an acknowledgment to the management ECU 2 via the communication line 32. Also, if the control ECU 4 receives an NM frame from the control ECU 3 via the communication line 34, it returns an acknowledgment to the control ECU 3 via the communication line 34.

[0080] CPUs 71, 91, and 111, in S150, turn on or off the power distribution switches under them based on the switching information contained in the NM frame received in S110, and then terminate the frame transfer process.

[0081] Next, the procedure for fault detection processing performed by the control units 61, 81, and 101 of the control ECUs 3, 4, and 5 will be described. Fault detection processing is a process that is repeatedly performed while the control ECUs 3, 4, and 5 are operating.

[0082] When fault detection processing is executed, the CPUs 71, 91, and 111 of the control units 61, 81, and 101 determine in S210, as shown in Figure 4, whether or not there is currently a communication line that is periodically receiving NM frames. If there is no communication line currently receiving NM frames periodically, the CPUs 71, 91, and 111 terminate the fault detection processing.

[0083] On the other hand, if there is currently a communication line that is receiving NM frames periodically, CPUs 71, 91, and 111 determine in S220 whether other communication lines identified in S210 are currently receiving NM frames periodically.

[0084] If, at this point, NM frames are being received periodically on other communication lines besides the one identified in S210, CPUs 71, 91, and 111 terminate the fault detection process. On the other hand, if NM frames are not being received periodically on other communication lines besides the one identified in S210, CPUs 71, 91, and 111 determine in S230 that a communication interruption has occurred on the communication line that is not currently receiving NM frames periodically.

[0085] For example, if communication line 32 is disconnected, control ECU 4 will periodically receive NM frames from control ECUs 3 and 5 via communication lines 34 and 35, but will not be able to receive NM frames from management ECU 2 via communication line 32. Therefore, control ECU 4 will determine that a communication interruption has occurred on communication line 32.

[0086] For example, if communication line 34 is disconnected, control ECU 4 will periodically receive NM frames from management ECU 2 and control ECU 5 via communication lines 32 and 35, but will not be able to receive NM frames from control ECU 3 via communication line 34. Therefore, control ECU 4 will determine that a communication interruption has occurred on communication line 34.

[0087] For example, if communication line 31 is disconnected, control ECU 3 will periodically receive NM frames from control ECU 4 via communication line 34, but will not be able to receive NM frames from management ECU 2 via communication line 31. Therefore, control ECU 3 will determine that a communication interruption has occurred on communication line 31.

[0088] CPUs 71, 91, and 111 notify the management ECU 2 of the communication line interruption determination result in S240, indicating the communication line that has been interrupted. Upon receiving the interruption determination result, the management ECU 2 stores the diagnostic information indicating the received interruption determination result in the storage unit 43 as a fail-safe action. The management ECU 2 may also notify the vehicle occupants that a communication interruption has occurred.

[0089] CPUs 71, 91, and 111 store the diagnostic information indicating the interruption determination result notified in S240 in memory units 64, 84, and 104 in S250, and terminate the fault detection process. This fault detection process does not need to be performed if the control ECU, which is the communication partner, is in sleep mode.

[0090] The vehicle control system 1 configured in this way includes ECUs 2 to 11 that are connected to send and receive communication frames. The vehicle control system 1 comprises a control ECU 3, a control ECU 4, a slave ECU 6, a slave ECU 8, a management ECU 2, a communication line 31, a communication line 32, and a communication line 34.

[0091] The control ECU 3 is configured to receive power via the power supply path 21. The control ECU 4 is configured to receive power via a power supply path 22 that is not connected to the power supply path 21.

[0092] The slave ECU 6 is configured to receive power via a power supply path 24 connected to a power supply path 21. The slave ECU8 is configured to receive power via a power supply path 26 connected to a power supply path 22.

[0093] The power distribution switch 65 is configured to switch between an ON state, which allows the power supply path 24 to conduct, and an OFF state, which disconnects the power supply path 24. The power distribution switch 85 is configured to switch between an ON state, which allows the power supply path 26 to conduct, and an OFF state, which disconnects the power supply path 26.

[0094] The management ECU2 is configured to generate an NM frame, which is a communication frame containing switching information indicating whether to turn on or off each of the slave ECU6 and slave ECU8, depending on the event it detects.

[0095] The communication line 31 is a communication path that connects the management ECU 2 and the control ECU 3, enabling the sending and receiving of communication frames between the management ECU 2 and the control ECU 3. The communication line 32 is a communication path that connects the management ECU 2 and the control ECU 4, enabling the sending and receiving of communication frames between the management ECU 2 and the control ECU 4.

[0096] The communication line 34 is a communication path that connects the control ECU 3 and the control ECU 4, enabling the transmission and reception of communication frames between the control ECU 3 and the control ECU 4. The management ECU2 is configured to transmit NM frames to the control ECU3 via the communication line 31.

[0097] The management ECU2 is configured to transmit NM frames to the control ECU4 via the communication line 32. The control ECU3 and the slave ECU6 are connected to each other in a way that enables data communication.

[0098] The control ECU4 and the slave ECU8 are connected to each other in a way that enables data communication. In this vehicle control system 1, the management ECU 2 generates an NM frame in response to an event and transmits the NM frame to the control ECUs 3 and 4 via communication lines 31 and 32, so that the slave ECUs 6 and 8 can be turned on or off depending on the event.

[0099] Furthermore, in the vehicle control system 1, even if the management ECU 2 cannot transmit the NM frame to the control ECU 3 via the communication line 31, the management ECU 2 can transmit the NM frame to the control ECU 3 via the communication lines 32 and 34. In addition, the control ECU 3 can transmit the NM frame to the slave ECU 6.

[0100] Furthermore, in the vehicle control system 1, even if the management ECU 2 cannot transmit the NM frame to the control ECU 4 via the communication line 32, the management ECU 2 can transmit the NM frame to the control ECU 4 via the communication lines 31 and 34. In addition, the control ECU 4 can transmit the NM frame to the slave ECU 8.

[0101] Therefore, the vehicle control system 1 can prevent the slave ECUs 6 and 8 from being unable to switch between the on and off states. Furthermore, in the vehicle control system 1, even if the control ECU 3 is unable to receive power via the power supply path 21, the control ECU 4, which receives power via the power supply path 22 that is not connected to the power supply path 21, can still operate. Therefore, the vehicle control system 1 can prevent the inability to simultaneously switch between the on and off states in both the slave ECUs 6 and 8.

[0102] Based on the above, the vehicle control system 1 can suppress the inability of the electronic control unit to switch between the on state and the off state. The vehicle control system 1 also includes a power distribution switch 65 and a power distribution switch 85.

[0103] The power distribution switch 65 is configured to switch between an ON state that allows the power supply path 24 to conduct and an OFF state that shuts off the power supply path 24. The power distribution switch 85 is configured to switch between an ON state that allows the power supply path 26 to conduct and an OFF state that shuts off the power supply path 26.

[0104] The control ECU 3 is configured to control the operation of the power distribution switch 65 based on the switching information contained in the NM frame. The control ECU 4 is configured to control the operation of the power distribution switch 85 based on the switching information contained in the NM frame.

[0105] This vehicle control system 1 can switch between an on state and an off state in the slave ECUs 6 and 8 by controlling the operation of the power distribution switches 65 and 85. Furthermore, even when communication line 32 is available, the control ECU 3 is configured to transmit the NM frame received from the management ECU 2 to the control ECU 4 via communication line 34. The control ECU 4 is configured to transmit the NM frame received from the management ECU 2 to the control ECU 3 via communication line 34, even when communication line 31 is available. In such a vehicle control system 1, the control ECUs 3 and 4 transmit the NM frame via communication line 34 even under normal circumstances when both communication lines 31 and 32 are available. Therefore, the vehicle control system 1 can omit the process of determining whether or not communication lines 31 and 32 are available.

[0106] The vehicle control system 1 also includes a control ECU 5, a slave ECU 10, a power distribution switch 105, a communication line 33, and a communication line 35. The control ECU 5 is configured to receive power via a power supply path 23 that is not connected to the power supply path 21 but is connected to the power supply path 22.

[0107] The slave ECU 10 is configured to receive power via a power supply path 28 connected to a power supply path 23. The power distribution switch 105 is configured to switch between an ON state, which allows the power supply path 28 to conduct, and an OFF state, which disconnects the power supply path 28.

[0108] Communication line 33 is a communication path that connects the management ECU 2 and the control ECU 5, enabling the sending and receiving of communication frames between the management ECU 2 and the control ECU 5. The communication line 35 is a communication path that connects the control ECU 4 and the control ECU 5, enabling the transmission and reception of communication frames between the control ECU 4 and the control ECU 5.

[0109] The NM frame further includes switching information indicating whether to turn the power distribution switch 105 on or off. The management ECU2 is configured to transmit NM frames to the control ECU5 via the communication line 35.

[0110] The control ECU 5 is configured to control the operation of the power distribution switch 105 based on the switching information contained in the NM frame. Even when communication lines 31 and 32 cannot be used, such a vehicle control system 1 can transmit NM frames to control ECUs 3 and 4 via communication lines 33, 34, and 35, thereby further suppressing the inability to switch between allowing and denying power supply to slave ECUs 6 and 8.

[0111] Furthermore, the control ECU 3 is configured to turn on or off the power distribution switch 65 based on the first NM frame received when an NM frame is received from each of the communication lines 31 and 34 connected to the control ECU 3 within a preset same frame reception determination period. The control ECU 4 is configured to turn on or off the power distribution switch 85 based on the first NM frame received when an NM frame is received from each of the communication lines 32, 34, and 35 connected to the control ECU 4 within a preset same frame reception determination period. The control ECU 5 is configured to turn on or off the power distribution switch 105 based on the first NM frame received when an NM frame is received from each of the communication lines 33 and 35 connected to the control ECU 5 within a preset same frame reception determination period. Note that NM frames that are not the first to be received are discarded after reception.

[0112] This vehicle control system 1 can prevent control ECUs 3, 4, and 5 from unnecessarily repeating the same control to power distribution switches 65, 85, and 105 when they receive multiple identical NM frames.

[0113] Furthermore, control ECUs 3, 4, and 5 are configured to determine that a communication interruption has occurred in communication line 31 to 35 if they periodically receive a management frame on at least one of the communication lines 31 to 35 connected to them, and do not periodically receive an NM frame on at least one of the communication lines 31 to 35 connected to them.

[0114] Such a vehicle control system 1 can identify the communication lines 31-35 where an abnormality is occurring. Furthermore, control ECUs 3, 4, and 5 are configured to notify management ECU 2 of the communication interruption detection result when they determine that a communication interruption has occurred.

[0115] Such a vehicle control system 1 can allow the management ECU 2 to recognize the communication lines 31-35 where an abnormality is occurring. In the embodiments described above, the vehicle control system 1 corresponds to a communication system, ECUs 2 to 11 correspond to electronic control devices, management ECU 2 corresponds to a management device, control ECU 3 corresponds to a first control device, and control ECU 4 corresponds to a second control device.

[0116] Furthermore, slave ECU6 corresponds to the first slave device, slave ECU8 corresponds to the second slave device, power distribution switch 65 corresponds to the first power supply switching unit, and power distribution switch 85 corresponds to the second power supply switching unit.

[0117] Furthermore, power supply route 21 corresponds to the first power supply route, power supply route 22 corresponds to the second power supply route, power supply route 24 corresponds to the third power supply route, and power supply route 26 corresponds to the fourth power supply route. Furthermore, communication line 31 corresponds to the first communication path, communication line 32 corresponds to the second communication path, communication line 34 corresponds to the relay communication path, NM frames correspond to management frames, and switching information corresponds to state identification information.

[0118] Furthermore, the control ECU 5 corresponds to the third control device, the slave ECU 10 corresponds to the third slave device, the power distribution switch 105 corresponds to the third power supply switching unit, the power supply path 23 corresponds to the fifth power supply path, the power supply path 28 corresponds to the sixth power supply path, the communication line 33 corresponds to the third communication path, and the communication line 35 corresponds to the second relay communication path.

[0119] Furthermore, the same frame reception determination period corresponds to the first same frame reception determination period and the second same frame reception determination period. Furthermore, the S210-S230 operations performed by the control unit 61 correspond to the processing of the first communication interruption determination unit, and the S210-S230 operations performed by the control unit 81 correspond to the processing of the second communication interruption determination unit.

[0120] Furthermore, S240 executed by the control unit 61 corresponds to processing as the first interruption notification unit, and S240 executed by the control unit 81 corresponds to processing as the second interruption notification unit. [Second Embodiment] The second embodiment has the same basic configuration as the first embodiment, so the differences will be explained below. Note that the same reference numerals as in the first embodiment indicate the same components, and refer to the preceding description.

[0121] In the first embodiment described above, the management ECU 2 was configured to transmit NM frames to each of the multiple communication lines 31 to 33, and the control ECUs 3, 4, and 5 were configured to relay the NM frames to each other. In contrast, in the second embodiment, a communication path to be used (for example, a normally used communication path) is predetermined for each communication partner, and the management ECU 2 transmits NM frames to only one communication line 31 to 33 that corresponds to the communication path set up in association with a predetermined communication partner. This differs from the first embodiment in that the NM frames are relayed according to that communication path.

[0122] As described above, in the vehicle control system 1 of the second embodiment, a communication path is set in advance for each communication partner. Specifically, the memory unit 43 of the management ECU 2 and the memory units 64, 84, and 104 of the control ECUs 3, 4, and 5 store information regarding the communication path to be used for each communication partner in a rewritable format. The information regarding the communication path is, for example, information about the ports corresponding to the communication lines 31 to 38 that should be used for each communication partner, and other information necessary when communicating along a predetermined communication path.

[0123] The communication paths between each device constituting the vehicle control system 1 (i.e., management ECU2, control ECUs 3, 4, 5, and slave ECUs 6-11) are basically configured to minimize the number of hops. For example, the communication path from management ECU2 to slave ECU6 is configured to communicate via communication line 31, control ECU3, and communication bus 36 in that order. Also, for example, the communication path from slave ECU8 to management ECU2 is configured to communicate via communication bus 37, control ECU4, and communication line 32 in that order. Also, for example, the communication path from slave ECU6 to slave ECU8 is configured to communicate via communication bus 36, control ECU3, communication line 34, control ECU4, and communication bus 37 in that order.

[0124] In the second embodiment, assuming that a communication interruption occurs, several processes are described below to ensure that NM frames are relayed properly in this case. These processes include [A] a process to start the slave ECU and [B] a process to stop the slave ECU.

[0125] First, we will explain the process of starting up slave ECU6 as part of the process of starting up slave ECU [A]. Note that the process shown below can be applied not only to the process of starting up slave ECU6, but also to the process of identifying the communication partner and sending an NM frame.

[0126] Figure 5 is a flowchart showing the master startup process. The master startup process is a process that starts, for example, when the management ECU2 starts up, and is executed by the CPU 51 of the management ECU2.

[0127] In the master startup process, as shown in Figure 5, first, the CPU 51 of the management ECU 2 performs a disconnection check in S310. This process is the same as S230 described above. In other words, this process detects a communication interruption. Note that this process may also detect abnormalities in the communication path, such as a broken wire or excessive delay.

[0128] Next, the CPU 51 of the management ECU2 determines in S320 whether or not there is a communication interruption. If there is no communication interruption, it returns to S310. If there is a communication interruption, it proceeds to S325. Next, in S325, the CPU 51 of the management ECU2 sends an anomaly notification regarding the detected anomaly within the management ECU2. That is, the function in the management ECU2 that notifies of anomalies sends an anomaly notification, and the function in the management ECU2 that selects the communication path (for example, the function in S330 described below) receives the anomaly notification. The anomaly notification is a notification that includes information to identify the anomaly location (for example, one of the communication lines 31 to 35) where the anomaly occurred among multiple communication paths.

[0129] Next, when the CPU 51 of the management ECU2 receives an abnormality notification in S330, it selects a new communication path that avoids the abnormal part. Specifically, for example, if the communication path from the management ECU2 to the slave ECU6 shown in Figure 1 includes a communication line 31 and a communication bus 36, and a communication interruption is detected on the communication line 31, then a new communication path that avoids the communication line 31 is established.

[0130] The management ECU2 stores a routing map in the storage unit 43, which is a selection of communication paths configured based on which communication lines each device is connected to. For example, the management ECU2 selects a new communication path that avoids communication line 31, going from the management ECU2 to the slave ECU6 in the following order: communication line 32, control ECU4, communication line 34, control ECU3, and communication bus 36.

[0131] The management ECU2 stores the new communication path and the communication path used before the anomaly detection (hereinafter referred to as the old communication path) in the storage unit 43. These new and old communication paths are configured to be readable from the storage unit 43 when the management ECU2 is restarted.

[0132] Next, the CPU 51 of the management ECU2 determines in S340 whether an event exists. The event here may be the same as the event described in S10 above, or it may be a different event. In this example embodiment, it determines whether there is an event that should start the slave ECU6. If there is no event, S340 is repeated. If there is an event, the process proceeds to S350.

[0133] Next, the CPU 51 of the management ECU 2 selects the ECU to be activated in response to the event using S350. In this example, the slave ECU 6 is selected. Next, the CPU 51 of the management ECU 2 sends an NM frame to the new communication path in S360. This NM frame contains a configuration notification and a start command. The configuration notification informs the devices that make up the new communication path, including multiple control ECUs 3, 4, and 5, that communication will be conducted using the selected new communication path. The start command is a command to start the slave ECU 6.

[0134] Next, the management ECU2 is configured in S370 to calculate the diagnostic mask time. The diagnostic mask time is the time it takes for a newly joined device (e.g., control ECU3) to operate normally. The diagnostic mask time is calculated based on the known startup time of the slave ECU6.

[0135] Each ECU constituting the vehicle control system 1 is configured to send a diagnostic (e.g., an error code) if communication with the target ECU is interrupted (e.g., due to a timeout). In this embodiment, each ECU ignores frames related to newly joined devices for the duration of the diagnostic mask time. Thus, a diagnostic mask temporarily ignores frames from the target ECU, so that even if one of the ECUs determines that communication has been interrupted, it is not considered an abnormality.

[0136] Furthermore, the diagnostic mask time may be set taking into account the increase in communication delay time due to the length of the communication path. This increase in communication delay time may also be considered when setting other parameters such as the SWOFF time, as described later.

[0137] In the absence of a communication interruption, the diagnostic mask time for the slave ECU6 is calculated based, for example, on the startup time of the slave ECU6 and the delay time on the old communication path (e.g., communication line 31 and communication bus 36). On the other hand, in the absence of a communication interruption, this diagnostic mask time is calculated based on the startup time of the slave ECU6 and the delay time on the new communication path (e.g., with the addition of control ECU4, communication line 32, communication line 34, and communication bus 36).

[0138] Furthermore, each device constituting the vehicle control system 1 may perform time synchronization to determine the timing of signal transmission and reception according to a common time. In this case, the time synchronization may be corrected according to the communication delay time. That is, the time held by each ECU may be corrected taking into account the communication delay time to ensure accurate synchronization. In addition, the control timing may be adjusted taking into account the communication delay time. For example, the control timing may be adjusted to match the timing at which the ECU that receives the frame the latest receives that frame.

[0139] When a diagnostic mask time is set for a communication partner device in each device, signals related to that communication partner device are ignored within the diagnostic mask time. More specifically, for example, within the diagnostic mask time period for slave ECU6, signals related to slave ECU6 are ignored in all devices.

[0140] Next, the CPU 51 of the management ECU 2 is configured in S380 to notify at least several control ECUs 3, 4, and 5 of diagnostic mask information. The diagnostic mask information includes the diagnostic mask time. Once this process is complete, this process terminates. The diagnostic mask time may also be notified from control ECU 3 to slave ECUs 6 and 7, from control ECU 4 to slave ECUs 8 and 9, and from control ECU 5 to slave ECUs 10 and 11.

[0141] Next, Figure 6 is a flowchart showing the slave startup process for starting slave ECUs 6-11, which is executed by the CPUs 71, 91, and 111 (hereinafter referred to as CPU 71, etc.) of multiple control ECUs 3, 4, and 5, respectively. The slave startup process is a process that starts, for example, when the power to control ECUs 3, 4, and 5 is turned on.

[0142] In the slave startup process, as shown in Figure 6, the CPU 71 and other components first determine in S410 whether or not an NM frame has been received. The NM frame here may include a configuration notification and a startup command sent by the management ECU 2.

[0143] Next, in S415, the CPU 71 and other components configure the system to communicate using the new communication path according to the configuration notification. The CPU 71 and other components store the new and old communication paths in the memory units 64, 84, and 104. These new and old communication paths are configured to be readable from the memory units 64, 84, and 104 when the CPU 71 and other components are restarted.

[0144] Next, CPU 71 and others determine in S420 whether or not to start the subordinate ECUs according to the NM frame. The subordinate ECUs refer to slave ECUs 6-11 that are subordinate to control ECUs 3, 4, and 5. Slave ECUs 6 and 7 are subordinate to control ECU 3, slave ECUs 8 and 9 are subordinate to control ECU 4, and slave ECUs 10 and 11 are subordinate to control ECU 5. Note that control ECUs 3, 4, and 5 may also be considered subordinate ECUs from the perspective of management ECU 2.

[0145] In S420, for example, if the control ECU4 does not need to start the subordinate ECUs and simply relays the NM frame, it is judged negatively, and if the control ECU3 starts the slave ECU6, it is judged positively. If the subordinate ECUs are not started, the process proceeds to S450. If the subordinate ECUs are started, the process proceeds to S430.

[0146] Next, CPU 71 and other components, in S430, turn on the power distribution switches corresponding to the subordinate ECUs. This supplies power to the subordinate ECUs, causing them to start up. For example, when control ECU 3 turns on the power to slave ECU 6 (i.e., supplies power), it turns on power distribution switch 65.

[0147] Next, CPU71 and other components determine in S440 whether the startup time has elapsed. The startup time is the time from when the power to the subordinate ECU is turned on until the startup is complete. The startup time is approximately the same as the diagnostic mask time. If the startup time has not elapsed, S440 is repeated. If the startup time has elapsed, the process moves to S450.

[0148] Next, CPU71 and other units send an NM frame to the relay control ECU or subordinate ECUs in S450. The NM frame sent here may contain configuration notifications and startup commands, similar to the NM frame received from management ECU2. However, when sending an NM frame to a subordinate ECU, a startup command is unnecessary because the subordinate ECU is already running. Once this process is complete, this process terminates.

[0149] The NM frame may include not only a start command, but also stop information (described later), or commands to wake up or put the ECU to sleep. If the subordinate ECU is in sleep mode, the control ECUs 3, 4, and 5 may send a wake-up command to the subordinate ECU in S430. Also, if the configuration allows the subordinate ECU to recognize the NM frame while in sleep mode, the transmission of the wake-up command from the control ECUs 3, 4, and 5 may be omitted. Furthermore, the subordinate ECU may receive the NM frame transmitted in S450 and wake up itself.

[0150] Next, Figure 7 is a flowchart showing the restart process. The restart process is a process that starts when the management ECU2 goes into sleep mode or powers off due to, for example, turning off the ignition after a change in the communication path, and then starts up again. This process is executed by the CPU 51 of the management ECU2.

[0151] Next, the CPU 51 of the management ECU2 determines in S460 whether it is configured to use the new communication path. Here, the management ECU2 is pre-configured to either use the new communication path or the old communication path (the one used before the communication interruption) when it restarts after detecting a communication interruption. This setting can be changed at will, and this setting is shared with each device that makes up the network using NM frames, etc. If the new communication path is to be used, the process moves to S470; if the old communication path is to be used, the process moves to S480.

[0152] Next, the CPU 51 of the management ECU2 is configured in S470 to use the new communication path. In this case, communication resumes using the new communication path without using the old one.

[0153] Meanwhile, the CPU 51 of the management ECU2 is configured in S480 to use the old communication path. In this case, if a communication interruption is detected again during the master startup process described above, the new communication path will be used. Once these processes are completed, the restart process will end. Note that whether to use the new communication path or the old communication path is notified to each device via the NM frame setting notification.

[0154] Next, we will explain the process of stopping slave ECU6 as part of the process of stopping the slave ECU. Note that the process shown below is not limited to stopping slave ECU6, but can be applied to any process that requires consideration of waiting time, such as when putting slave ECU6 to sleep, and that identifies the communication partner and sends an NM frame.

[0155] Figure 8 is a flowchart showing the master shutdown process. The master shutdown process is a process that starts, for example, when the management ECU2 is started up, and is executed by the CPU 51 of the management ECU2.

[0156] The process from S310 to S340 in the master shutdown process is the same as the process from S310 to S340 in the master startup process. As shown in Figure 8, if an event occurs in S340, the process proceeds to S510.

[0157] Next, the CPU 51 of the management ECU 2 selects an ECU to be stopped in response to an event at S510. In this example, the slave ECU 6 is selected. Next, the CPU 51 of the management ECU2 sends an NM frame via S520 to the new communication path. This NM frame contains stop information to stop the slave ECU6, as well as the aforementioned configuration notification. The stop information is transmitted sequentially along the new communication path.

[0158] Next, the CPU 51 of the management ECU2 calculates the waiting time until SWOFF (i.e., SWOFF time, or OFF waiting time) in S530. The waiting time until SWOFF is the time until the shutdown sequence in the slave ECU6 is completed and the power distribution switch 65 can be turned OFF. This time is set taking into account the time required for the shutdown sequence by the slave ECU6 after receiving the stop information. Note that the time it takes for the slave ECU6 to shut down is known.

[0159] Next, in S540, the CPU 51 of the management ECU2 determines whether the waiting time has elapsed since it was set. If the waiting time has not elapsed, S540 is repeated. If the waiting time has elapsed, the process proceeds to S550.

[0160] Next, the CPU 51 of the management ECU 2 sends an NM frame at S550 to perform processing related to the slave ECU 6. Specifically, it sends an NM frame containing a SWOFF instruction, which is an instruction to turn off the power distribution switch 65 in order to stop the power supply to the slave ECU 6. These NM frames are transmitted sequentially along the new communication path. Once this processing is complete, the master shutdown process is finished.

[0161] Next, Figure 9 is a flowchart showing the slave stop process performed by the CPU 71 and other components to stop the slave ECU 6. The slave stop process is initiated, for example, when the power to the CPU 71 and other components is turned on. The slave stop process is also performed, for example, when a communication interruption is detected on communication line 31, and communication is performed in the following order: communication line 32, control ECU 4, communication line 34, control ECU 3, and communication bus 36, in which case control ECUs 3 and 4 perform the process.

[0162] In the slave stop process, as shown in Figure 9, the CPU 71 and other components first determine in S610 whether or not an NM frame has been received. Specifically, they determine whether or not stop information has been received. The NM frame contains a configuration notification sent by the management ECU 2. If no NM frame has been received, S610 is repeated. If an NM frame has been received, the process proceeds to S415.

[0163] Next, CPU71 and other components are configured in S415 to communicate using the new communication path, according to the configuration notification. Next, CPU 71 and other components relay the received NM frame containing the stop information along a new communication path in S620. For example, control ECU 4 relays the NM frame to control ECU 3, and control ECU 3 relays the NM frame to slave ECU 6. Once this process is complete, this process terminates.

[0164] Next, Figure 10 is a flowchart showing the terminal shutdown process performed by the CPUs (not shown) of each of the slave ECUs 6 to 11. The terminal shutdown process is a process that starts, for example, when the power to slave ECUs 6 to 11 is turned on.

[0165] In the terminal stop process, as shown in Figure 10, slave ECUs 6-11 first determine in S660 whether or not they have received an NM frame. Specifically, they determine whether or not they have received stop information. If they have not received an NM frame, they repeat S660. If they have received an NM frame, they proceed to S670.

[0166] Next, slave ECUs 6-11 perform the necessary steps to shut down their own devices in S670, according to the received stop information. In other words, they perform a shutdown. Once this process is complete, this process ends.

[0167] Furthermore, the process for stopping the device itself is not limited to a shutdown; a sleep process may also be used. Sleep is a state in which at least frame transmission is stopped, and it consumes less power than the normal state (for example, a state in which frames can be transmitted). In addition, the NM frame containing the stop information may be transmitted by the management ECU2, or by the control ECUs 3, 4, and 5.

[0168] The second embodiment described in detail above provides the following effects. The vehicle control system 1 is a system configured so that a management ECU 2 and multiple control ECUs 3, 4, and 5 managed by the management ECU 2 can communicate with each other by selectively using one of multiple communication paths. Each device is connected, for example, in a ring shape by communication lines 31 to 35.

[0169] In S330, the CPU 51 of the management ECU2 is configured to select a new communication path that avoids the abnormal part when it receives an anomaly notification indicating that the abnormal part is located in one of the communication paths used before the anomaly was detected. In S360, the CPU 51 of the management ECU2 is configured to send a configuration notification to at least several control ECUs 3, 4, and 5, informing them that communication will be performed using the newly selected communication path.

[0170] The CPU 51 of the management ECU2 is configured in S310 to detect abnormalities in the communication path. The CPU 51 of the management ECU2 is configured in S325 to send an abnormality notification within the management ECU2 regarding the detected abnormality.

[0171] The CPUs 71, 91, and 111 of the multiple control ECUs 3, 4, and 5 are configured in S415 to set up a new communication path and communicate according to the configuration notification. With this configuration, if an abnormality occurs in the communication path, a new communication path that avoids the abnormal part can be established, and communication can be carried out using this new communication path, thus making it less likely that necessary communication will be impossible.

[0172] The vehicle control system 1 further comprises slave ECUs 6 to 11, which are devices that are communicatively connected to at least one of the multiple control ECUs 3, 4, and 5. The management ECU 2 is configured in S370 and S530 to calculate the processing waiting time (e.g., diagnostic mask time, SWOFF time) for the management ECU 2 or the multiple control ECUs 3, 4, and 5, taking into account the required waiting time for the slave ECUs 6 to 11. The required waiting time includes, for example, the communication delay time from the synchronization time, the ECU startup time, and the power-off time.

[0173] Furthermore, the management ECU2 and at least one of the multiple control ECUs 3, 4, and 5 perform processing related to the target device after waiting for a processing waiting time in S450 and S550.

[0174] Specifically, the CPU 51 of the management ECU 2 is configured in S380 to notify at least several control ECUs 3, 4, and 5 of the processing waiting time. Furthermore, the CPU 51 of the management ECU 2 is configured to wait for a processing delay period in S550, and then send control instructions (e.g., NM frames) to at least several control ECUs 3, 4, and 5.

[0175] With this configuration, the processing wait time for the management ECU2 or multiple control ECUs 3, 4, and 5 is calculated taking into account the required waiting time, and processing can be performed after waiting for the processing wait time.

[0176] In the vehicle control system 1, the management ECU 2, the multiple control ECUs 3, 4, and 5, and the slave ECUs 6 to 11 may be configured to synchronize their time with respect to communication. The CPU 51 of the management ECU 2 is configured in S370 and S530 to calculate the communication delay time due to changes in the communication path, which is the processing waiting time, taking into account the communication time required to reach the target device, which is the required waiting time.

[0177] With this configuration, even if the communication delay time increases, it is possible to take that increase into account and correct the synchronization time, set the processing timing, etc. In the vehicle control system 1, the management ECU 2 includes a storage unit 43 configured to store a new communication path and the old communication path before the new communication path was established. When the management ECU 2 is restarted, it is configured to start communication using the old communication path.

[0178] With this configuration, when the management ECU2 is restarted, communication can be performed using the old communication path as usual. This is effective when restarting the management ECU2 restores the communication path to its normal state.

[0179] In the vehicle control system 1, the management ECU 2 may include a storage unit 43 configured to store a new communication path and the old communication path before the new communication path was set. When the management ECU 2 is restarted, the management ECU 2 may start communication using the new communication path.

[0180] With this configuration, when the management ECU2 is restarted, communication can be performed using a new communication path. This is effective when the situation does not improve even after the management ECU2 is restarted, such as when there is physical damage to the communication path.

[0181] In the vehicle control system 1, the CPU 51 of the management ECU 2 is configured in S360 to send a start command to start the target device along a new communication path. In S370 and S530, the CPU 51 of the management ECU 2 is configured to calculate the diagnostic mask time for the target device as a processing wait time, taking into account the start time of the target device as a required waiting time.

[0182] This configuration makes it possible to prevent the target device from being mistakenly identified as abnormal during the time it is being started up and operating normally. In other words, it is possible to prevent incorrect diagnostics from being stored in each device.

[0183] In the embodiments described above, S370 and S530 correspond to processing as a time calculation unit, and S450 and S550 correspond to processing as a processing execution unit. Although one embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment and can be implemented in various modified forms.

[0184] [Example 1] In the above embodiment, an acknowledgment is shown when an NM frame from the same sender has not already been received within the same frame reception determination period. However, an acknowledgment may also be shown when an NM frame from the same sender has already been received within the same frame reception determination period.

[0185] [Differentiation 2] In the second embodiment described above, the management ECU2 is configured to detect abnormalities in the communication path, but the embodiment is not limited to this. It is not limited to the management ECU2, but may be provided in, for example, at least one of the multiple control ECUs 3, 4, 5.

[0186] When control ECUs 3, 4, and 5 detect an abnormality in the communication path, the process shown in Figure 11 is performed, for example. Figure 11 is a flowchart showing the abnormality detection process executed by the CPU 71, etc. The abnormality detection process is a process that starts, for example, when the power to control ECUs 3, 4, and 5 is turned on.

[0187] In the anomaly detection process, as shown in Figure 11, the CPU 71 and others first perform an interruption determination in S420. This process is the same as S230 and S310 described above. Next, CPU 71 and others determine in S720 whether or not there is a communication interruption. This process is the same as in S320 mentioned above. If there is no communication interruption, the process returns to S710. If there is a communication interruption, the process proceeds to S730.

[0188] CPU71 and other components send an NM frame to the management ECU2 via S730. This NM frame contains an error notification. Furthermore, if an abnormality in the communication path is detected, control ECUs 3-5 may use broadcasting, for example, to notify management ECU 2 of the abnormality. This is because control ECUs 3-5 may not be aware of the network configuration (i.e., how each device is connected). However, if control ECUs 3-5 are aware of the network configuration, they may use any available communication path to management ECU 2 to notify the abnormality. Once this process is complete, this process terminates.

[0189] If an abnormality notification is sent during this process, the management ECU2 should perform the processes from S325 onwards of the master startup process and master shutdown process, and in process S325, it should acquire the abnormality notification sent by CPU71, etc.

[0190] [Difference 3] In the second embodiment described above, the system is configured to immediately change the communication path when an abnormality is detected, but it is not limited to this. When an abnormality is detected, if predetermined conditions are met, such as when a pre-set event occurs, the communication path may not be changed. In this case, when the vehicle's power is cut off and then the vehicle's power is restored (for example, when the ignition is turned on), communication may be performed using the new communication path.

[0191] [Differentiation Example 4] In the second embodiment described above, an example was given in which only the slave ECU6 is started as the target device in S360. However, if the control ECUs 3, 4, and 5 are in sleep mode, the control ECUs 3, 4, and 5 may also be started as target devices. In such cases, the CPU 51 of the management ECU2 may send start commands to the target devices in order from the starting point to the ending point, according to the connection order of the multiple target devices from the starting point to the ending point in the new communication path. For example, if the management ECU2 starts the slave ECU 10 while the control ECU 5 and slave ECUs 10 and 11 are in sleep mode, the CPU 51 of the management ECU2 may start the control ECU 5 first and then start the slave ECU 10.

[0192] With this configuration, it is possible to start up each of the multiple target devices sequentially, taking the connection order into consideration. [Difference 5] In the first embodiment described above, the slave ECUs 6, 7, 8, 9, 10, and 11 were switched between an on state and an off state by switching the power distribution switches 65, 66, 85, 86, 105, and 106 between an on state and an off state. However, the management ECU 2 may generate a communication frame as an NM frame that includes state identification information that can identify whether each of the slave ECUs 6, 7, 8, 9, 10, and 11 is in a wake-up state or a sleep state, and transmit the generated NM frame. As a result, the vehicle control system 1 can maintain the power distribution switches 65, 66, 85, 86, 105, and 106 in an on state and switch the slave ECUs 6, 7, 8, 9, 10, and 11 between a wake-up state and a sleep state based on the NM frame. Note that the wake-up state of the slave ECUs 6 to 11 corresponds to the on state of the electronic control unit, and the sleep state of the slave ECUs 6 to 11 corresponds to the off state of the electronic control unit.

[0193] In such a vehicle control system 1, even if the management ECU 2 cannot transmit the NM frame to the control ECU 3 via the communication line 31, the management ECU 2 can transmit the NM frame to the control ECU 3 via the communication lines 32 and 34. This allows the control ECU 3 to transmit the NM frame to the slave ECUs 6 and 7 via the communication bus 36. Therefore, the vehicle control system 1 can prevent the slave ECUs 6 and 7 from being unable to switch between the wake-up state and the sleep state.

[0194] [Modification 6] In the first embodiment described above, the slave ECUs 6, 7, 8, 9, 10, and 11 were switched between an on state and an off state by switching the power distribution switches 65, 66, 85, 86, 105, and 106 between an on state and an off state. However, the management ECU 2 may generate a communication frame as an NM frame that includes state identification information that can identify whether each of the control ECUs 3, 4 and the slave ECUs 6 to 11 should be in a wake-up state or a sleep state, and transmit the generated NM frame.

[0195] In such a vehicle control system 1, even if the management ECU 2 is unable to transmit an NM frame to the control ECU 3 via the communication line 31, the management ECU 2 can still transmit an NM frame to the control ECU 3 via the communication lines 32 and 34. This allows the control ECU 3 to switch between the wake-up state and the sleep state based on the NM frame received via the communication lines 32 and 34. Therefore, the vehicle control system 1 can prevent the control ECU 3 from being unable to switch between the wake-up state and the sleep state.

[0196] [Difference 7] In the first embodiment described above, a communication frame containing six switching pieces of information indicating whether each of the power distribution switches 65, 66, 85, 86, 105, and 106 should be in the ON state or the OFF state was shown to be transmitted as an NM frame. However, the NM frame may also contain state identification information indicating the vehicle mode. The control ECUs 3, 4, and 5 may then switch the power distribution switches 65, 66, 85, 86, 105, and 106 between the ON state and the OFF state based on the vehicle mode indicated by the state identification information contained in the received NM frame.

[0197] For example, in the first vehicle mode, the settings are configured to turn on power distribution switch 65, turn on power distribution switch 66, turn off power distribution switch 85, turn off power distribution switch 86, turn on power distribution switch 105, and turn off power distribution switch 106.

[0198] For example, in the second vehicle mode, the settings are configured to turn off power distribution switch 65, turn off power distribution switch 66, turn on power distribution switch 85, turn on power distribution switch 86, turn off power distribution switch 105, and turn on power distribution switch 106.

[0199] The control units 41, 61, 81, 101 and their methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. Alternatively, the control units 41, 61, 81, 101 and their methods described in this disclosure may be implemented by a dedicated computer provided by configuring a processor by one or more dedicated hardware logic circuits. Alternatively, the control units 41, 61, 81, 101 and their methods described in this disclosure may be implemented by one or more dedicated computers configured by a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by the computer on a computer-readable non-transitional tangible recording medium. The methods for implementing the functions of each part included in the control units 41, 61, 81, 101 do not necessarily need to include software, and all of its functions may be implemented using one or more hardware components.

[0200] Multiple functions of one component in the above embodiment may be realized by multiple components, or one function of one component may be realized by multiple components. Furthermore, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, some parts of the configuration of the above embodiment may be omitted. Furthermore, at least some parts of the configuration of the above embodiment may be added to or replaced with the configuration of other above embodiments.

[0201] In addition to the ECUs 2-5 described above, this disclosure can also be realized in various forms, such as a system comprising the ECUs 2-5, a program for causing the computer to function as the ECUs 2-5, a non-transitional physical recording medium such as semiconductor memory on which this program is recorded, and a communication control method. [Technical Concept Disclosed in This Specified Specification] [Item 1] A communication system (1) comprising a plurality of electronic control devices (2 to 11) connected to enable the transmission and reception of communication frames, The aforementioned electronic control device includes a first control device (3) configured to receive power via a first power supply path (21), The electronic control device includes a second control device (4) configured to receive power via a second power supply path (22) that is not connected to the first power supply path, The electronic control device includes a first slave device (6) configured to receive power via a third power supply path (24) connected to the first power supply path, The electronic control device includes a second slave device (8) configured to receive power via a fourth power supply path (26) connected to the second power supply path, The electronic control device includes a management device (2) configured to generate a management frame, which is a communication frame containing state identification information that can determine whether to turn on or turn off each of the multiple electronic control devices in response to a detected event, A first communication path (31) is a communication path that connects the management device and the first control device so that the communication frame can be sent and received between the management device and the first control device, A second communication path (32) is a communication path that connects the management device and the second control device so that the communication frame can be sent and received between the management device and the second control device, A relay communication path (34) is a communication path that connects the first control device and the second control device so that the communication frame can be sent and received between the first control device and the second control device. Equipped with, The management device is configured to transmit the management frame to the first control device via the first communication path. The management device is configured to transmit the management frame to the second control device via the second communication path. The first control device and the first slave device are connected to each other so as to be able to communicate data. The second control device and the second slave device are connected to each other in a communication system that enables data communication. [Item 2] The communication system described in item 1, further, A first power supply switching unit (65) is configured to switch between an ON state that conducts the third power supply path and an OFF state that blocks the third power supply path, The system includes a second power supply switching unit (85) configured to switch between an ON state that allows the fourth power supply path to conduct and an OFF state that blocks the fourth power supply path, The first control device is configured to control the operation of the first power supply switching unit based on the state identification information included in the management frame. The second control device is a communication system configured to control the operation of the second power supply switching unit based on the state identification information included in the management frame.

[0202] [Item 3] The communication system described in item 2, Even when the second communication path can be used, the first control device is configured to transmit the management frame received from the management device to the second control device via the relay communication path. A communication system configured such that the second control device transmits the management frame received from the management device to the first control device via the relay communication path, even when the first communication path can be used.

[0203] [Item 4] A communication system as described in item 2 or item 3, further, The electronic control device includes a third control device (5) configured to receive power via a fifth power supply path (23) that is not connected to the first power supply path but is connected to the second power supply path, The electronic control device includes a third slave device (10) configured to receive power via a sixth power supply path (28) connected to the fifth power supply path, A third power supply switching unit (105) is configured to switch between an ON state that conducts to the sixth power supply path and an OFF state that blocks the sixth power supply path, A third communication path (33) is a communication path that connects the management device and the third control device so that the communication frame can be sent and received between the management device and the third control device, The relay communication path is designated as the first relay communication path, and the system includes a second relay communication path (35) which is a communication path connecting the second control device and the third control device so that the communication frames can be sent and received between the second control device and the third control device. The aforementioned state identification information further includes information indicating whether the third power supply switching unit should be set to the ON state or the OFF state. The management device is configured to transmit the management frame to the third control device via the third communication path. The third control device is a communication system configured to control the operation of the third power supply switching unit based on the state identification information included in the management frame.

[0204] [Item 5] A communication system described in any one of items 2 to 4, The first control device is The first power supply switching unit is configured to turn on or off based on the management frame received first, based on the management frame received first, when the management frame is received from each of the multiple communication paths connected to the first control device within a preset first same-frame reception determination period. The second control device is A communication system configured to turn on or off the second power supply switching unit based on the first received management frame when the management frame is received from each of a plurality of communication paths connected to the second control device within a preset second identical frame reception determination period.

[0205] [Item 6] A communication system described in any one of items 2 to 5, The first control device is The system includes a first communication interruption determination unit (61, S210~S230) configured to determine that a communication interruption has occurred in the communication path that does not periodically receive the management frame if at least one of the multiple communication paths connected to the first control device periodically receives the management frame, and at least one of the multiple communication paths connected to the first control device periodically does not receive the management frame. The second control device is A communication system comprising a second communication interruption determination unit (81, S210~S230) configured to determine that a communication interruption has occurred in the communication path that does not periodically receive the management frame if at least one of the multiple communication paths connected to the second control device periodically receives the management frame, and at least one of the multiple communication paths connected to the second control device does not periodically receive the management frame.

[0206] [Item 7] The communication system described in item 6, The above control device further, The system includes a first interruption notification unit (61, S240) configured to notify the management device of the determination result made by the first communication interruption determination unit when the first communication interruption determination unit determines that an interruption has occurred. The second control device further, A communication system comprising a second interruption notification unit (81, S240) configured to notify the management device of the determination result by the second interruption determination unit when the second interruption determination unit determines that the aforementioned communication interruption has occurred.

[0207] [Item 8] A communication system described in any one of items 2 to 7, The aforementioned control device further, The system includes a time calculation unit (S370, S530) configured to calculate the processing waiting time for the management device or the first control device, taking into account the required waiting time for the first slave device. At least one of the management device and the first control device further, A communication system comprising a processing unit (S450, S550) that performs processing related to the first slave device after waiting for the aforementioned processing waiting time.

[0208] [Item 9] A communication system (1) comprising a plurality of electronic control devices (2 to 11) connected to enable the transmission and reception of communication frames, The aforementioned electronic control device includes a first control device (3) configured to receive power via a first power supply path (21), The electronic control device includes a second control device (4) configured to receive power via a second power supply path (22) that is not connected to the first power supply path, Regarding the third power supply path (24) which is connected to the first power supply path and provides power to the first slave device (6) which is connected to the first control device in a manner that enables data communication, the first power supply switching unit (65) is configured to switch between an ON state that makes the third power supply path conductive and an OFF state that blocks the third power supply path, Regarding the fourth power supply path (26) which is connected to the second power supply path and provides power to the second slave device (8) which is connected to the second control device in a manner that enables data communication, the second power supply switching unit (85) is configured to switch between an ON state that makes the fourth power supply path conductive and an OFF state that blocks the fourth power supply path, The electronic control device includes a management device (2) configured to generate a management frame, which is a communication frame containing state identification information that can determine whether to turn on or turn off each of the multiple electronic control devices in response to a detected event, A first communication path (31) is a communication path that connects the management device and the first control device so that the communication frame can be sent and received between the management device and the first control device, A second communication path (32) is a communication path that connects the management device and the second control device so that the communication frame can be sent and received between the management device and the second control device, A relay communication path (34) is a communication path that connects the first control device and the second control device so that the communication frame can be sent and received between the first control device and the second control device. Equipped with, The management device is configured to transmit the management frame to the first control device via the first communication path. The management device is configured to transmit the management frame to the second control device via the second communication path. The first control device is configured to control the operation of the first power supply switching unit based on the state identification information included in the management frame. The second control device is a communication system configured to control the operation of the second power supply switching unit based on the state identification information included in the management frame. [Explanation of symbols]

[0209] 1...Vehicle control system, 2...Management ECU, 3,4...Control ECU, 6,8...Slave ECU, 21,22,24,26...Power supply route, 31,32,34...Communication line, 65,85...Power distribution switch

Claims

1. A communication system (1) comprising a plurality of electronic control devices (2 to 11) connected to enable the transmission and reception of communication frames, The aforementioned electronic control device includes a first control device (3) configured to receive power via a first power supply path (21), The electronic control device includes a second control device (4) configured to receive power via a second power supply path (22) that is not connected to the first power supply path, The electronic control device includes a first slave device (6) configured to receive power via a third power supply path (24) connected to the first power supply path, The electronic control device includes a second slave device (8) configured to receive power via a fourth power supply path (26) connected to the second power supply path, The electronic control device includes a management device (2) configured to generate a management frame, which is a communication frame containing state identification information that can determine whether to turn on or turn off each of the multiple electronic control devices in response to a detected event, A first communication path (31) is a communication path that connects the management device and the first control device so that the communication frame can be sent and received between the management device and the first control device, A second communication path (32) is a communication path that connects the management device and the second control device so that the communication frame can be sent and received between the management device and the second control device, A relay communication path (34) is a communication path that connects the first control device and the second control device so that the communication frame can be sent and received between the first control device and the second control device. Equipped with, The management device is configured to transmit the management frame to the first control device via the first communication path. The management device is configured to transmit the management frame to the second control device via the second communication path. The first control device and the first slave device are connected to each other so as to be able to communicate data. The second control device and the second slave device are connected to each other in a communication system that enables data communication.

2. The communication system according to claim 1, further, A first power supply switching unit (65) is configured to switch between an ON state that allows the third power supply path to conduct and an OFF state that blocks the third power supply path, The system includes a second power supply switching unit (85) configured to switch between an ON state that allows the fourth power supply path to conduct and an OFF state that blocks the fourth power supply path. The first control device is configured to control the operation of the first power supply switching unit based on the state identification information included in the management frame. The second control device is a communication system configured to control the operation of the second power supply switching unit based on the state identification information included in the management frame.

3. A communication system according to claim 2, Even when the second communication path can be used, the first control device is configured to transmit the management frame received from the management device to the second control device via the relay communication path. A communication system configured such that the second control device transmits the management frame received from the management device to the first control device via the relay communication path, even when the first communication path can be used.

4. A communication system according to claim 2 or claim 3, further comprising: The electronic control device includes a third control device (5) configured to receive power via a fifth power supply path (23) that is not connected to the first power supply path but is connected to the second power supply path, The electronic control device includes a third slave device (10) configured to receive power via a sixth power supply path (28) connected to the fifth power supply path, A third power supply switching unit (105) is configured to switch between an ON state that allows the sixth power supply path to conduct and an OFF state that blocks the sixth power supply path, A third communication path (33) is a communication path that connects the management device and the third control device so that the communication frame can be sent and received between the management device and the third control device, The system includes a second relay communication path (35) which is a communication path that connects the second control device and the third control device so that the communication frames can be sent and received between the second control device and the third control device, with the aforementioned relay communication path being the first relay communication path. The aforementioned state identification information further includes information indicating whether the third power supply switching unit should be set to the ON state or the OFF state. The management device is configured to transmit the management frame to the third control device via the third communication path. The third control device is a communication system configured to control the operation of the third power supply switching unit based on the state identification information included in the management frame.

5. A communication system according to claim 2 or claim 3, The first control device is The first power supply switching unit is configured to turn on or off based on the management frame received first, based on the management frame received first, when the management frame is received from each of the multiple communication paths connected to the first control device within a preset first same-frame reception determination period. The second control device is A communication system configured to turn on or off the second power supply switching unit based on the first received management frame when the management frame is received from each of a plurality of communication paths connected to the second control device within a preset second identical frame reception determination period.

6. A communication system according to claim 2 or claim 3, The first control device is The first communication interruption determination unit (61, S210 to S230) is configured to determine that a communication interruption has occurred in the communication path that does not periodically receive the management frame if at least one of the plurality of communication paths connected to the first control device periodically receives the management frame, The second control device is A communication system comprising a second communication interruption determination unit (81, S210 to S230) configured to determine that a communication interruption has occurred in the communication path that does not periodically receive the management frame if at least one of the plurality of communication paths connected to the second control device periodically receives the management frame, and at least one of the plurality of communication paths connected to the second control device does not periodically receive the management frame.

7. A communication system according to claim 6, The first control device further, The system includes a first interruption notification unit (61, S240) configured to notify the management device of the determination result made by the first communication interruption determination unit when the first communication interruption determination unit determines that an interruption has occurred. The second control device further, A communication system comprising a second interruption notification unit (81, S240) configured to notify the management device of the determination result by the second interruption determination unit when the second interruption determination unit determines that the aforementioned communication interruption has occurred.

8. A communication system according to claim 2 or claim 3, The aforementioned control device further, The system includes a time calculation unit (S370, S530) configured to calculate the processing waiting time for the management device or the first control device, taking into account the necessary waiting time for the first slave device, At least one of the management device and the first control device further, A communication system comprising a processing unit (S450, S550) that performs processing related to the first slave device after waiting for the aforementioned processing waiting time.

9. A communication system (1) comprising a plurality of electronic control devices (2 to 11) connected to enable the transmission and reception of communication frames, The aforementioned electronic control device includes a first control device (3) configured to receive power via a first power supply path (21), The electronic control device includes a second control device (4) configured to receive power via a second power supply path (22) that is not connected to the first power supply path, Regarding the third power supply path (24) which is connected to the first power supply path and provides power to the first slave device (6) which is connected to the first control device in a manner that enables data communication, the first power supply switching unit (65) is configured to switch between an ON state that makes the third power supply path conductive and an OFF state that blocks the third power supply path, Regarding the fourth power supply path (26) which is connected to the second power supply path and provides power to the second slave device (8) which is connected to the second control device in a manner that enables data communication, the second power supply switching unit (85) is configured to switch between an ON state that makes the fourth power supply path conductive and an OFF state that blocks the fourth power supply path, The electronic control device includes a management device (2) configured to generate a management frame, which is a communication frame containing state identification information that can determine whether to turn on or turn off each of the multiple electronic control devices in response to a detected event, A first communication path (31) is a communication path that connects the management device and the first control device so that the communication frame can be sent and received between the management device and the first control device, A second communication path (32) is a communication path that connects the management device and the second control device so that the communication frame can be sent and received between the management device and the second control device, A relay communication path (34) is a communication path that connects the first control device and the second control device so that the communication frame can be sent and received between the first control device and the second control device. Equipped with, The management device is configured to transmit the management frame to the first control device via the first communication path. The management device is configured to transmit the management frame to the second control device via the second communication path. The first control device is configured to control the operation of the first power supply switching unit based on the state identification information included in the management frame. The second control device is a communication system configured to control the operation of the second power supply switching unit based on the state identification information included in the management frame.

Images