Power supply control device, power supply control system, and power supply control method

Abstract

To provide a power feeding control device, a power feeding control system, and a power feeding control method that can stop occurrence of an abnormality when an abnormality occurs in data transmitted via a communication bus.SOLUTION: A plurality of ECUs (communication devices) 1 is mounted on a vehicle C and is connected to a communication bus B1. A relay device (power feeding control device) 4 controls power supply to the plurality of ECUs 1. The relay device 4 determines whether an abnormality has occurred in data received via the communication bus B1. When determining that an abnormality has occurred, the relay device 4 selects one out of the plurality of ECUs 1 and stops power supply to the selected ECU 1. After stopping power supply, the relay device 4 determines whether the occurrence of the abnormality has stopped. When determining that the occurrence of the abnormality has stopped, the relay device 4 maintains the stop of power supply to the selected ECU 1.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a power supply control device, a power supply control system, and a power supply control method.

Background Art

[0002] Patent Document 1 discloses a communication system in which a plurality of communication devices mounted on a vehicle are connected to a communication bus. Each communication device communicates with other communication devices via the communication bus.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In Patent Document 1, for example, when one communication device repeatedly transmits data via a communication bus at short time intervals, an abnormality occurs in the data transmitted via the communication bus. When this abnormality occurs, the communication bus is occupied by one communication device, and other communication devices cannot communicate. Patent Document 1 does not consider a method for stopping the occurrence of an abnormality when an abnormality occurs in the data transmitted via the communication bus.

[0005] The present invention has been made in view of such circumstances, and an object thereof is to provide a power supply control device, a power supply control system, and a power supply control method capable of stopping the occurrence of an abnormality when an abnormality occurs in the data transmitted via a communication bus.

Means for Solving the Problems

[0006] A power supply control device according to an aspect of the present disclosure is a power supply control device that is mounted on a vehicle and controls power supply to a plurality of communication devices connected to a communication bus, and includes a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing. The processing unit determines whether an abnormality has occurred in the data received by the receiving unit. If it is determined that the abnormality has occurred, one of the plurality of communication devices is selected, and a stop of power supply to the selected communication device is instructed. After instructing the stop of power supply, it is determined whether the occurrence of the abnormality has stopped. If it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0007] A power supply control system according to an aspect of the present disclosure includes a plurality of communication devices that are mounted on a vehicle and connected to a communication bus, and a power supply control device that controls power supply to the plurality of communication devices. The power supply control device has a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing. The processing unit determines whether an abnormality has occurred in the data received by the receiving unit. If it is determined that the abnormality has occurred, one of the plurality of communication devices is selected, and a stop of power supply to the selected communication device is instructed. After instructing the stop of power supply, it is determined whether the occurrence of the abnormality has stopped. If it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0008] In a power supply control method according to an aspect of the present disclosure, a computer executes steps of determining whether an abnormality has occurred in data transmitted via a communication bus in a power supply control method for controlling power supply to a plurality of communication devices mounted on a vehicle and connected to the communication bus, selecting one of the plurality of communication devices when it is determined that the abnormality has occurred, instructing a stop of power supply to the selected communication device, and determining whether the occurrence of the abnormality has stopped after instructing the stop of power supply. If it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0009] Note that the present disclosure can be implemented not only as a power supply control device including such a characteristic processing unit, but also as a power supply control method including such characteristic processing as steps, or as a computer program for causing a computer to execute such steps. Further, the present disclosure can be implemented as a semiconductor integrated circuit that realizes part or all of the power supply control device, or as a power supply control system including the power supply control device.

Advantages of the Invention

[0010] According to the above aspect, when an abnormality occurs in the data transmitted via the communication bus, the occurrence of the abnormality can be stopped.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Modes for Carrying Out the Invention

[0012] [Description of Embodiments of the Present Disclosure] First, embodiments of the present disclosure will be listed and described. At least a part of the embodiments described below may be arbitrarily combined.

[0013] (1) A power supply control device according to an aspect of the present disclosure is a power supply control device that is mounted on a vehicle and controls power supply to a plurality of communication devices connected to a communication bus, and includes a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing. The processing unit determines whether an abnormality has occurred with respect to the data received by the receiving unit. When it is determined that the abnormality has occurred, one of the plurality of communication devices is selected, and a stop of power supply to the selected communication device is instructed. After instructing the stop of power supply, it is determined whether the occurrence of the abnormality has stopped. When it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0014] (2) In the power supply control device according to an aspect of the present disclosure, the data transmitted via the communication bus includes identification information for identifying the data transmission source. The processing unit determines that an abnormality has occurred when the data amount of the common data received by the receiving unit within a predetermined period is equal to or greater than a threshold value with respect to the common data including the common identification information.

[0015] (3) A power supply control device according to an aspect of the present disclosure includes a second receiving unit that receives data transmitted via a second communication bus different from the communication bus. The data transmitted via the communication bus includes predetermined specific data. The processing unit determines whether the received specific data is abnormal based on data received by the receiving unit or the second receiving unit and different from the specific data when the receiving unit receives the specific data. When the receiving unit receives abnormal specific data, it is determined that an abnormality has occurred with respect to the data received by the receiving unit.

[0016] (4) In the power supply control device according to one aspect of the present disclosure, when the processing unit determines that the occurrence of the abnormality has not stopped, the processing unit instructs power supply to the selected communication device and selects a communication device that has not been selected among the plurality of communication devices.

[0017] (5) In the power supply control device according to one aspect of the present disclosure, the plurality of communication devices include a second communication device that is irrelevant to the travel control of the vehicle. When the processing unit determines that the abnormality has occurred, the processing unit selects one second communication device included in the plurality of communication devices.

[0018] (6) In the power supply control device according to one aspect of the present disclosure, the second communication device is a device having an ASIL (Automotive Safety Integrity Level) level of QM (Quality Management).

[0019] (7) In the power supply control device according to one aspect of the present disclosure, when the processing unit determines that the occurrence of the abnormality has not stopped, the processing unit instructs power supply to the selected second communication device, determines whether all the second communication devices included in the plurality of communication devices have been selected, and when it is determined that not all the second communication devices have been selected, selects one second communication device that has not been selected.

[0020] (8) In the power supply control device according to one aspect of the present disclosure, when the processing unit determines that the occurrence of the abnormality has not stopped, the processing unit instructs power supply to the selected second communication device, determines whether all the second communication devices included in the plurality of communication devices have been selected, and when it is determined that all the second communication devices have been selected, and when the ignition switch of the vehicle is off, selects one of the plurality of communication devices that have not been selected.

[0021] (9) The power supply control system according to one aspect of the present disclosure includes a plurality of communication devices mounted on a vehicle and connected to a communication bus, and a power supply control device that controls power supply to the plurality of communication devices. The power supply control device has a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing. The processing unit determines whether an abnormality has occurred in the data received by the receiving unit. If it is determined that the abnormality has occurred, one of the plurality of communication devices is selected, and an instruction to stop power supply to the selected communication device is issued. After issuing the instruction to stop power supply, it is determined whether the occurrence of the abnormality has stopped. If it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0022] (10) A power supply control method according to one aspect of the present disclosure is a power supply control method for controlling power supply to a plurality of communication devices mounted on a vehicle and connected to a communication bus. The method includes steps of determining whether an abnormality has occurred in data transmitted via the communication bus, selecting one of the plurality of communication devices if it is determined that the abnormality has occurred, instructing to stop power supply to the selected communication device, and determining whether the occurrence of the abnormality has stopped after issuing the instruction to stop power supply. When a computer executes these steps and it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained.

[0023] In the power supply control device, power supply control system, and power supply control method according to the above aspect, when an abnormality occurs in data received via a communication bus, power supply to one communication device is stopped. As a result, when the occurrence of the abnormality stops, the stop of power supply is maintained, and thus the occurrence of the abnormality can be stopped.

[0024] In the power supply control device according to the above aspect, when the data amount of common data received within a predetermined period is large, the occurrence of an abnormality is detected.

[0025] In the power supply control device according to the above aspect, it is determined whether the specific data is abnormal based on data different from the specific data. When abnormal specific data is received, the occurrence of an abnormality is detected.

[0026] In the power supply control device according to the above aspect, if the occurrence of an abnormality does not stop by stopping the power supply to the selected communication device, the power supply to the selected communication device is resumed. One of the plurality of unselected communication devices is selected, and the power supply to the selected communication device is stopped. Thereby, the occurrence of an abnormality can be surely stopped.

[0027] In the power supply control device according to the above aspect, when an abnormality occurs, a second communication device unrelated to the travel control of the vehicle is selected, and the power supply to the selected second communication device is stopped.

[0028] In the power supply control device according to the above aspect, the second communication device is a device whose ASIL level is QM.

[0029] In the power supply control device according to the above aspect, if the occurrence of an abnormality does not stop by stopping the power supply to the selected second communication device, the power supply to the selected second communication device is resumed. When not all of the second communication devices are selected, an unselected second communication device is selected, and the power supply to the selected second communication device is stopped.

[0030] In the power supply control device according to the above aspect, if the occurrence of an abnormality does not stop by stopping the power supply to the selected second communication device, the power supply to the selected second communication device is resumed. When all of the second communication devices are selected, the processing unit waits until the ignition switch of the vehicle is switched off. When the ignition switch is off, one communication device different from the second communication device is selected from among the plurality of communication devices, and the power supply to the selected communication device is stopped.

[0031] [Details of Embodiments of the Present Disclosure] A specific example of a communication system (power supply control system) according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present invention is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0032] (Embodiment 1) <Configuration of Communication System> FIG. 1 is a block diagram showing a main configuration of a communication system 100 in Embodiment 1. The communication system 100 is mounted on a vehicle C. The communication system 100 includes a plurality of ECUs (Electronic Control Units) 1, a plurality of ECUs 2, a plurality of ECUs 3, a relay device 4, and a DC power supply 5. In FIG. 1, connection lines related to power supply are shown by thick lines. Connection lines unrelated to power supply are shown by thin lines.

[0033] Three communication buses B1, B2, and B3 are separately connected to the relay device 4. A plurality of ECUs 1 are connected to the communication bus B1. A plurality of ECUs 2 are connected to the communication bus B2. A plurality of ECUs 3 are connected to the communication bus B3. Each of the ECUs 1, 2, and 3 is grounded. Each of the ECUs 1, 2, and 3 is connected to the relay device 4. The relay device 4 is connected to the positive electrode of the DC power supply 5. The negative electrode of the DC power supply 5 is grounded. Grounding is realized, for example, by connection to the body of the vehicle C.

[0034] One or both of a sensor and an electrical device are connected to each of the ECUs 1, 2, and 3. The sensor detects a vehicle value related to the vehicle C, for example, the speed of the vehicle C, and notifies the detected vehicle value to the ECU to which the sensor is connected. An operation signal indicating an operation to be executed is input from the ECU to the electrical device. When an operation signal is input to the electrical device, the electrical device executes the operation indicated by the input operation signal.

[0035] The plurality of ECUs 1 include an ECU 1a that is irrelevant to the running control of the vehicle C and an ECU 1b that is related to the running control of the vehicle C. Similarly, the plurality of ECUs 2 include an ECU 2a that is irrelevant to the running control of the vehicle C and an ECU 2b that is related to the running control of the vehicle C. The plurality of ECUs 3 include an ECU 3a that is irrelevant to the running control of the vehicle C and an ECU 3b that is related to the running control of the vehicle C.

[0036] The number of each of the ECUs 1a, 1b, 2a, 2b, 3a, and 3b may be 1 or may be 2 or more. Hereinafter, an example in which the number of each of the ECUs 1a, 1b, 2a, 2b, 3a, and 3b is 2 or more will be described.

[0037] Regarding each of the ECUs 1a, 2a, and 3a to which the sensors are connected, the sensors detect values that are irrelevant to the running control of the vehicle C. Regarding each of the ECUs 1a, 2a, and 3a to which the electrical devices are connected, the operations of the electrical devices are irrelevant to the running control of the vehicle C. Each of the ECUs 1b, 2b, and 3b is connected to a sensor that detects a value related to the running control of the vehicle C or an electrical device related to the running control of the vehicle C.

[0038] The DC power supply 5 supplies power to the ECUs 1, 2, and 3 via the relay device 4. The current flows from the positive electrode of the DC power supply 5 to each of the ECUs 1, 2, and 3 via the relay device 4. The current output from each of the ECUs 1, 2, and 3 flows to the negative electrode of the DC power supply 5. The relay device 4 separately controls the power supply from the DC power supply 5 to the plurality of ECUs 1, 2, and 3. The relay device 4 functions as a power supply control device. Each of the ECUs 1, 2, and 3 operates using the power supplied from the DC power supply 5. Among the plurality of ECUs 1, 2, and 3, the ECUs that are not supplied with power from the DC power supply 5 have stopped operating.

[0039] ECU1 and relay device 4 transmit data via communication bus B1. ECU2 and relay device 4 transmit data via communication bus B2. ECU3 and relay device 4 transmit data via communication bus B3. The data transmitted via communication bus B1 is received by all devices connected to communication bus B1. Similarly, the data transmitted via communication bus B2 is received by all devices connected to communication bus B2. The data transmitted via communication bus B3 is received by all devices connected to communication bus B3.

[0040] The transmission and reception of data via communication buses B1, B2, and B3 respectively are performed according to communication protocols such as CAN (Controller Area Network), CAN-FD (Controller Area Network with Flexible Data rate), Ethernet (registered trademark), LIN (Local Interconnect Network), CXPI (Clock Extension Peripheral Interface), etc. Note that the communication protocols used for the transmission and reception of data via communication buses B1, B2, and B3 respectively may be different from the communication protocols used for the transmission and reception of data via other communication buses.

[0041] Each of ECU1, 2, and 3 functions as a communication device. Each of ECU1a, 2a, and 3a functions as a second communication device. Communication system 100 functions as a power supply control system.

[0042] Identification information is pre-assigned to each of the plurality of ECUs 1, 2, and 3. The identification information is ID (Identification Data). The data transmitted by each of ECUs 1, 2, and 3 via communication buses B1, B2, and B3 contains the identification information. Based on the identification information, the transmission source of the data containing the identification information can be identified.

[0043] Each of ECUs 1, 2, and 3 transmits data indicating vehicle values detected by sensors, for example. When each of ECUs 1, 2, and 3 receives data, it determines whether to write the received data into a storage unit (not shown) based on the identification information of the received data. When each of ECUs 1, 2, and 3 determines to write the data, it writes the received data into the storage unit. Each of ECUs 1, 2, and 3 controls the operation of electrical devices connected thereto based on the data stored in the storage unit, for example. When each of ECUs 1, 2, and 3 determines not to write the data, it discards the received data.

[0044] Among the plurality of ECUs 1, 2, and 3, there is an ECU that periodically transmits data. When the relay device 4 receives data from one of the communication buses B1, B2, and B3, it determines whether relaying is necessary. When the relay device 4 determines that relaying is not necessary, it discards the received data. When the relay device 4 determines that relaying is necessary, it transmits the data via a communication bus different from the communication bus used for transmitting the received data among the three communication buses B1, B2, and B3. When the relay device 4 performs relaying, two ECUs connected to each of the two communication buses communicate with each other. For example, ECU 1 communicates with ECU 2.

[0045] Ignition information indicating on or off of the ignition switch of the vehicle C is periodically input to the relay device 4. The ignition information indicates the state of the ignition switch at the time when the ignition information is transmitted.

[0046] <Configuration of Relay Device 4> FIG. 2 is a block diagram showing a main part configuration of the relay device 4. The relay device 4 has a plurality of power switches 40, a drive circuit 41, and a microcomputer (hereinafter referred to as a microcontroller) 42. In FIG. 2 as well, connection lines related to power supply are shown by thick lines. Connection lines irrelevant to power supply are shown by thin lines.

[0047] Each of the plurality of ECUs 1, 2, 3 is connected to one end of a power switch 40. The number of power switches 40 is the same as the total number of ECUs 1, 2, 3. The other end of each power switch 40 is connected to the positive pole of a DC power supply 5.

[0048] The microcomputer 42 has an output unit 60, three communication units 61, 62, 63, an input unit 64, a storage unit 65, and a control unit 66. These are connected to an internal bus 67. The output unit 60 is further connected to a drive circuit 41. Each of the communication units 61, 62, 63 is further connected to communication buses B1, B2, B3.

[0049] The drive circuit 41 switches each of the plurality of power switches 40 on or off. When the drive circuit 41 switches a power switch 40 on, the DC power supply 5 supplies power to the ECU via the power switch 40 that is on. When the drive circuit 41 switches a power switch 40 off, the power supply from the DC power supply 5 to the ECU stops.

[0050] Among the plurality of ECUs 1, 2, 3, power is supplied from the DC power supply 5 to one or more ECUs connected to the power switch 40 that is on. Among the plurality of ECUs 1, 2, 3, power is not supplied to one or more ECUs connected to the power switch 40 that is off. As described above, the ECUs to which power is not supplied are stopped.

[0051] The control unit 66 instructs the output unit 60 to supply power to at least one ECU included in the plurality of ECUs 1, 2, 3. When the control unit 66 instructs to supply power to at least one ECU included in the plurality of ECUs 1, 2, 3, the output unit 60 instructs the drive circuit 41 to switch one or more power switches 40 on for the one or more ECUs to which power supply is instructed. The drive circuit 41 switches one or more power switches 40 on according to the instruction of the output unit 60.

[0052] The control unit 66 instructs the output unit 60 to stop power supply to at least one ECU among the plurality of ECUs 1, 2, and 3. When the control unit 66 instructs to stop power supply to at least one ECU among the plurality of ECUs 1, 2, and 3, the output unit 60 instructs the drive circuit 41 to switch one or more power switches 40 corresponding to the one or more ECUs to which power supply stop has been instructed to OFF. The drive circuit 41 switches one or more power switches 40 to OFF according to the instruction of the output unit 60.

[0053] The communication unit 61 receives data transmitted by each of the plurality of ECUs 1 via the communication bus B1. Similarly, the communication unit 62 receives data transmitted by each of the plurality of ECUs 2 via the communication bus B2. The communication unit 63 receives data transmitted by each of the plurality of ECUs 3 via the communication bus B3. Each of the communication units 61, 62, and 63 functions as a receiving unit. Each of the communication units 61, 62, and 63 transmits data via the communication buses B1, B2, and B3 according to the instruction of the control unit 66. Ignition information is periodically input to the input unit 64.

[0054] The storage unit 65 is composed of, for example, a volatile memory and a non-volatile memory. Three state tables T1, T2, and T3 are stored in the storage unit 65. FIG. 3 is a chart showing the content of the state table T1. The state table T1 shows the identification information of each of the plurality of ECUs 1. A value of an abnormality flag is shown in association with each of the plurality of identification information. The value of the abnormality flag indicates whether an abnormality has occurred in the ECU 1. The value of the abnormality flag is 0 or 1. Regarding the value of the abnormality flag, 0 means that no abnormality has occurred. 1 means that an abnormality has occurred.

[0055] In the state table T1, the level of ASIL (Automotive Safety Integrity Level) is indicated in association with each of a plurality of identification information. As the levels of ASIL, A, B, C, D, and QM (Quality Management) are defined. An ECU whose level is one of A, B, C, and D is an ECU related to the driving control of vehicle C. The degree of relation to the driving control increases in the order of A, B, C, and D. An ECU whose level is QM is an ECU unrelated to the driving control of vehicle C. In the example of FIG. 3, the four ECUs 1 corresponding to 001 to 004 are ECU1b. The two ECUs 1 corresponding to 005 and 006 are ECU1a.

[0056] As described above, the state table T1 indicates the value of the abnormality flag corresponding to the identification information of ECU1 and the level of ASIL. Similar to the state table T1, the state table T2 indicates the value of the abnormality flag corresponding to the identification information of ECU2 and the level of ASIL. Similar to the state table T1, the state table T3 indicates the value of the abnormality flag corresponding to the identification information of ECU3 and the level of ASIL.

[0057] Each of ECU1a, 2a, and 3a is an ECU whose ASIL level is QM. Each of ECU1b, 2b, and 3b is an ECU whose ASIL level is A, B, C, or D. Regarding each of the state tables T1, T2, and T3, the value of the abnormality flag is changed to 0 or 1 by the control unit 66.

[0058] The memory unit 65 shown in FIG. 2 stores a computer program P. The control unit 66 has a processing element for executing processing, for example, a CPU (Central Processing Unit). The control unit 66 functions as a processing unit. The processing element (computer) of the control unit 66 executes relay processing and three power supply stop processes, etc. by executing the computer program P. The relay processing is a process of relaying communication between two ECUs connected to two of the three communication buses B1, B2, B3. Each of the three power supply stop processes corresponds to one of the three communication buses B1, B2, B3. The power supply stop process corresponding to the communication bus B1 is a process of stopping power supply to ECU1. Similarly, the power supply stop process corresponding to the communication bus B2 is a process of stopping power supply to ECU2. The power supply stop process corresponding to the communication bus B3 is a process of stopping power supply to ECU3.

[0059] Note that the computer program P may be provided to the microcomputer 42 using a non-transitory storage medium A that stores the computer program P in a readable manner. The storage medium A is, for example, a portable memory. Examples of the portable memory include a CD-ROM, a USB (Universal Serial Bus) memory, an SD card, a micro SD card, or a compact flash (registered trademark), etc. When the storage medium A is a portable memory, the processing element of the control unit 66 may read the computer program P from the storage medium A using a reading device (not shown). The read computer program P is written into the memory unit 65. Further, the computer program P may be provided to the microcomputer 42 when a communication unit (not shown) of the microcomputer 42 communicates with an external device. In this case, the processing element of the control unit 66 acquires the computer program P through the communication unit. The acquired computer program P is written into the memory unit 65.

[0060] Also, the number of processing elements included in the control unit 66 is not limited to 1 and may be 2 or more. When the control unit 66 has a plurality of processing elements, the plurality of processing elements may cooperate to execute relay processing and three power supply stop processes, etc.

[0061] <Relay processing> In the relay processing, the control unit 66 waits until one of the three communication units 61, 62, and 63 receives data. When one of the three communication units 61, 62, and 63 receives data, the control unit 66 determines whether relay is necessary based on the identification information of the received data. If the control unit 66 determines that relay is not necessary, the relay processing ends. If the control unit 66 determines that relay is necessary, it selects a communication unit from among the three communication units 61, 62, and 63 to transmit the received data. The control unit 66 causes the selected communication unit to transmit the received data. Thereby, two ECUs connected to two of the three communication buses B1, B2, and B3 communicate with each other. After the control unit 66 ends the relay processing, it executes the relay processing again.

[0062] <Power supply stop processing corresponding to communication bus B1> FIG. 4 and FIG. 5 are flowcharts showing the procedure of the power supply stop processing corresponding to communication bus B1. In the state table T1, the power switch 40 connected to ECU1 with the value of the abnormality flag being 0 is on. Power is supplied to ECU1 with the value of the abnormality flag being 0. The power switch 40 connected to ECU1 with the value of the abnormality flag being 1 is off. Power supply to ECU1 with the value of the abnormality flag being 1 is stopped. Hereinafter, the power supply stop processing corresponding to communication bus B1 when the values of all the abnormality flags in the state table T1 are 0 will be described. In the power supply stop processing corresponding to communication bus B1, the control unit 66 determines whether an abnormality has occurred in the data received by the communication unit 61 (step S1).

[0063] FIG. 6 is a chart showing the abnormal determination conditions. When one of the conditions 1 and 2 shown in FIG. 6 is satisfied, the control unit 66 determines that an abnormality has occurred in step S1. Condition 1 is that, regarding the common data including the common identification information, the data amount of the common data received by the communication unit 61 within a predetermined period is equal to or greater than a threshold value. The predetermined period is a fixed value and is set in advance. The start point of the predetermined period is a point in time retroactively by the predetermined period from the time when step S1 is executed. The end point of the predetermined period is the time when step S1 is executed.

[0064] Condition 2 is that, regarding the common data including the common identification information, the time interval for receiving the common data is less than a predetermined interval. The predetermined interval is a fixed value and is set in advance.

[0065] As described above, when the data amount of the common data received in the predetermined period is large, or when the time interval for the communication unit 61 to receive the common data is short, the control unit 66 detects the occurrence of an abnormality in step S1.

[0066] When the control unit 66 determines that no abnormality has occurred (S1: NO), it executes step S1 again. The control unit 66 waits until an abnormality occurs in the data received via the communication bus B1. When the control unit 66 determines that an abnormality has occurred (S1: YES), it selects one ECU1a that stops power supply from among the plurality of ECUs 1 connected to the communication bus B1 (step S2). When it is determined that an abnormality has occurred in step S1 and the level of the ECU1 indicated by the identification information of the common data is QM, in step S2, the control unit 66 selects, for example, the ECU1a indicated by the identification information of the common data.

[0067] Next, the control unit 66 instructs the output unit 60 to stop power supply to the ECU1a selected in step S2 (step S3). As a result, the drive circuit 41 switches off the power switch 40 connected to the ECU1a selected in step S2. As a result, the ECU1a selected in step S2 stops operating.

[0068] After executing step S3, the control unit 66 determines whether or not the occurrence of an abnormality has stopped (step S4). When condition 1 is satisfied in step S1, in step S4, the control unit 66 determines whether or not the amount of common data received by the communication unit 61 within a predetermined period is less than the threshold value. When condition 2 is satisfied in step S1, in step S4, the control unit 66 determines whether or not the interval at which the communication unit 61 receives the common data is equal to or longer than a predetermined interval.

[0069] When the control unit 66 determines that the occurrence of an abnormality has stopped (S4: YES), in the state table T1, it changes the value of the abnormality flag corresponding to the identification information of the ECU1a selected in step S2 to 1 (step S5). The control unit 66 ends the power supply stop process in a state where the power supply to the ECU1a selected in step S2 has stopped. After ending the power supply stop process, the control unit 66 executes the power supply stop process corresponding to the communication bus B1 again. The stop of the power supply to the ECU1 with the value of the abnormality flag being 1 is maintained. Therefore, the stop of the power supply to the ECU1a selected in step S2 is maintained.

[0070] When the control unit 66 determines that the occurrence of an abnormality has not stopped (S4: NO), it instructs the output unit 60 to supply power to the ECU1a selected in step S2 (step S6). As a result, the drive circuit 41 switches the power switch 40 connected to the ECU1a selected in step S2 to the ON state. Consequently, the ECU1a selected in step S2 operates again.

[0071] After executing step S6, the control unit 66 determines whether or not all of the ECU1a have been selected since the start of the power supply stop process being executed (step S7). When the control unit 66 determines that not all of the ECU1a have been selected (S7: NO), it executes step S2 again. In step S2 for the second and subsequent times, the control unit 66 selects an ECU1a that has not been selected among the plurality of ECU1. When all of the ECU1a have been selected, the cause of the occurrence of the abnormality lies in the ECU1b.

[0072] When the control unit 66 determines that all the ECUs 1a have been selected (S7: YES), it determines whether the ignition switch of the vehicle C is off based on the ignition information input to the input unit 64 (step S8). When the control unit 66 determines that the ignition switch is not off (S8: NO), it executes step S8 again. The control unit 66 waits until the ignition switch is switched on.

[0073] When the control unit 66 determines that the ignition switch is off (S8: YES), it selects an ECU 1b for which power supply is to be stopped from among the plurality of ECUs 1 connected to the communication bus B1 (step S9). In step S9, the control unit 66 may select an ECU 1b with the lowest ASIL level, that is, the lowest degree of relevance to driving control, among the unselected ECUs 1b.

[0074] Next, the control unit 66 instructs the output unit 60 to stop the power supply to the ECU 1b selected in step S9 (step S10). As a result, the drive circuit 41 switches off the power switch 40 connected to the ECU 1b selected in step S9. Consequently, the ECU 1b selected in step S9 stops operating.

[0075] After executing step S10, the control unit 66 determines whether the occurrence of an abnormality has stopped, similar to step S4 (step S11). When the control unit 66 determines that the occurrence of an abnormality has stopped (S11: YES), in the state table T1, it changes the value of the abnormality flag corresponding to the identification information of the ECU 1b selected in step S9 to 1 (step S12). The control unit 66 ends the power supply stop process while the power supply to the ECU 1b selected in step S9 is stopped. In this case, for example, after the ignition switch is switched on, the control unit 66 executes the power supply stop process again.

[0076] ECU1b is necessary to control the running of vehicle C. Therefore, when the ignition switch is switched on, the control unit 66 instructs the output unit 60 to supply power to the power switch 40 connected to all the ECU1b, and changes the value of the abnormality flag corresponding to the identification information of all the ECU1b to 0. When the control unit 66 changes the value of the abnormality flag corresponding to the identification information of the ECU1b to 1, the abnormality of the ECU1b may be notified to the passengers of the vehicle C by lighting the lamp or displaying a message, etc.

[0077] If the control unit 66 determines that the occurrence of the abnormality has not stopped (S11: NO), it instructs the output unit 60 to supply power to the ECU1b selected in step S9 (step S13). As a result, the drive circuit 41 switches on the power switch 40 connected to the ECU1b selected in step S9. As a result, the ECU1b selected in step S9 operates again.

[0078] After executing step S13, the control unit 66 determines whether all the ECU1b have been selected since the start of the power supply stop process being executed (step S14). If the control unit 66 determines that not all the ECU1b have been selected (S14: NO), it executes step S9 again. In the second and subsequent executions of step S9, the control unit 66 selects the unselected ECU1b. If all the ECU1b have been selected, the cause of the occurrence of the abnormality is unknown.

[0079] If the control unit 66 determines that all the ECU1b have been selected (S14: YES), it ends the power supply stop process. In this case, the control unit 66, for example, executes the power supply stop process again after the ignition switch is switched on.

[0080] As described above, when an abnormality occurs in the data received by the communication unit 61 via the communication bus B1, the power supply to one ECU1a is stopped. As a result, if the occurrence of the abnormality stops, the power supply stop is maintained. As a result, the relay device 4 can stop the occurrence of the abnormality.

[0081] If the occurrence of an abnormality does not stop even though the drive circuit 41 has stopped the power supply to the ECU1a selected by the control unit 66, the drive circuit 41 resumes the power supply to the ECU1a selected by the control unit 66. The control unit 66 selects an unselected ECU1a. The drive circuit 41 stops the power supply to the ECU1a selected by the control unit 66. Thereby, the relay device 4 can surely stop the occurrence of an abnormality.

[0082] Even when the power supply to all the ECU1a has been stopped and the occurrence of an abnormality has not stopped, the control unit 66 stops the power supply to the ECU1b in a state where the ignition switch is off, that is, in a state where running control is unnecessary. After that, the control unit 66 determines whether or not the occurrence of an abnormality has stopped.

[0083] When the values of all the abnormality flags in the state table T1 are not 0, in step S2, the control unit 66 selects one ECU1a from among the plurality of ECUs1 to which power is being supplied and stops the power supply. In step S7, the control unit 66 determines whether or not all the ECU1a to which power was being supplied at the time when the power supply stop process was started have been selected.

[0084] <Power supply stop process corresponding to communication bus B2> The control unit 66 executes the power supply stop process corresponding to the communication bus B2 in the same manner as the power supply stop process corresponding to the communication bus B1. Each of the ECU1, 1a, 1b, the communication bus B1, and the state table T1 corresponds to the ECU2, 2a, 2b, the communication bus B2, and the state table T2.

[0085] <Power supply stop process corresponding to communication bus B3> The control unit 66 executes the power supply stop process corresponding to the communication bus B3 in the same manner as the power supply stop process corresponding to the communication bus B1. Each of the ECU1, 1a, 1b, the communication bus B1, and the state table T1 corresponds to the ECU3, 3a, 3b, the communication bus B3, and the state table T3.

[0086] (Embodiment 2) In Embodiment 1, when one of Conditions 1 and 2 in FIG. 6 is satisfied, the control unit 66 detects the occurrence of an abnormality. The control unit 66 may also detect the occurrence of an abnormality when other conditions different from Conditions 1 and 2 are satisfied. Hereinafter, for Embodiment 2, the differences from Embodiment 1 will be described. For other configurations except the configurations described later, since they are common to Embodiment 1, the same reference numerals as those in Embodiment 1 are assigned to the constituent parts common to Embodiment 1, and the description thereof is omitted.

[0087] <Configuration of Relay Device 4> FIG. 7 is a block diagram showing the main configuration of the relay device 4 in Embodiment 2. Also in FIG. 7, the connection lines related to power supply are shown by thick lines. The connection lines irrelevant to power supply are shown by thin lines. In Embodiment 2, a database DB is provided in the storage unit 65 of the microcomputer 42. The data transmitted via the communication bus B1 includes specific data. The specific data is predetermined. The communication unit 61 of the microcomputer 42 repeatedly receives the specific data via the communication bus B1. As described in the description of Embodiment 1, each of the communication units 62 and 63 receives the data transmitted via the communication buses B2 and B3. In Embodiment 2, the communication unit 61 functions as a receiving unit. Each of the communication units 62 and 63 functions as a second receiving unit.

[0088] The specific data is predetermined data. The specific data is, for example, position data indicating the position of the vehicle C. The control unit 66 of the microcomputer 42 determines whether the specific data is abnormal based on determination data different from the specific data.

[0089] When the specific data is position data, examples of the determination data include speed data, acceleration data, and steering wheel data. The speed data indicates the speed of the vehicle C. The acceleration data indicates the acceleration of the vehicle C. The steering wheel data is data related to the rotation of the steering wheel of the vehicle C. The determination data is received by at least one of the three communication units 61, 62, and 63. When the position of the vehicle C indicated by the position data is significantly different from the position of the vehicle C estimated based on the determination data, the control unit 66 detects an abnormality in the specific data (position data).

[0090] The control unit 66 of the microcomputer 42 executes an abnormality detection process in addition to the relay process and the three power supply stop processes by executing the computer program P. The abnormality detection process is a process for detecting an abnormality in the specific data.

[0091] <Relay process> FIG. 8 is a flowchart showing the procedure of the relay process. In the relay process, the control unit 66 determines whether one of the three communication units 61, 62, and 63 has received data (step S21). When the control unit 66 determines that none of the three communication units 61, 62, and 63 has received data (S21: NO), it executes step S21 again. The control unit 66 waits until one of the three communication units 61, 62, and 63 receives data.

[0092] When the control unit 66 determines that one of the three communication units 61, 62, and 63 has received data (S21: YES), it determines whether the received data is the determination data (step S22). When the control unit 66 determines that the received data is the determination data (S22: YES), it writes the received data into the database DB (step S23). When the control unit 66 determines that the received data is not the determination data (S22: NO), or after executing step S23, it determines whether relay is necessary based on the identification information of the received data (step S24).

[0093] When the control unit 66 determines that relaying is necessary (S24: YES), it selects a communication unit among the three communication units 61, 62, and 63 to transmit the received data (step S25). The communication unit selected in step S25 is different from the communication unit that received the data. Next, the control unit 66 instructs the communication unit selected in step S25 to transmit the received data (step S26). When the control unit 66 determines that relaying is not necessary (S24: NO), or after executing step S26, it ends the relaying process. After ending the relaying process, the control unit 66 executes the relaying process again. As described above, in the relaying process, the control unit 66 writes the determination data into the database DB.

[0094] <Abnormality detection process> FIG. 9 is a flowchart showing the procedure of the abnormality detection process. In the abnormality detection process, the control unit 66 determines whether the communication unit 61 has received specific data (step S31). When the control unit 66 determines that the communication unit 61 has not received the specific data (S31: NO), it executes step S31 again. The control unit 66 waits until the communication unit 61 receives the specific data.

[0095] When the control unit 66 determines that the communication unit 61 has received the specific data (S31: YES), it determines whether the specific data received by the communication unit 61 is abnormal based on one or more pieces of determination data stored in the database DB (step S32). As described above, when the content indicated by the specific data is significantly different from the content estimated based on one or more pieces of determination data, the control unit 66 determines that the specific data is abnormal. In other cases, the control unit 66 determines that the specific data is not abnormal.

[0096] When the control unit 66 determines that the specific data is abnormal (S32: YES), it discards the specific data received by the communication unit 61 (step S33). When the control unit 66 determines that the specific data is not abnormal (S32: NO), or after executing step S33, it ends the abnormality detection process. After ending the abnormality detection process, the control unit 66 executes the abnormality detection process again.

[0097] For example, the specific data received by the communication unit 61 is configured to be transmitted to the ECU 2 by the communication unit 62 in the relay process. In this configuration, when the specific data received by the communication unit 61 is abnormal, the specific data will not be transmitted by the communication unit 62 in the relay process. When the specific data received by the communication unit 61 is not abnormal, the specific data will be transmitted by the communication unit 62 in the relay process.

[0098] <Power supply stop process corresponding to communication bus B1> The control unit 66 executes the power supply stop process corresponding to the communication bus B1 in the same manner as in the first embodiment. In step S1 of the power supply stop process in the second embodiment, when one of the conditions 1 to 3 is satisfied, the control unit 66 determines that an abnormality has occurred in the data received by the communication unit 61.

[0099] FIG. 10 is a chart showing the determination conditions for abnormalities. As shown in FIG. 10, condition 3 is that the communication unit 61 receives abnormal specific data. Therefore, when it is determined that the specific data received by the communication unit 61 in the abnormality detection process is abnormal, the control unit 66 determines that an abnormality has occurred in step S1. Therefore, when the communication unit 61 receives abnormal specific data, the control unit 66 detects the occurrence of an abnormality.

[0100] When condition 3 is satisfied in step S1, in steps S4 and S11 of the power supply stop process, the control unit 66 determines whether the communication unit 61 has repeatedly received specific data and whether the reception of abnormal specific data has stopped. When the control unit 66 determines that the communication unit 61 has repeatedly received specific data and the reception of abnormal specific data has stopped, the control unit 66 determines that the occurrence of the abnormality has stopped.

[0101] <Power supply stop process corresponding to communication buses B2 and B3> The communication units 62 and 63 do not receive specific data. For this reason, the control unit 66 executes the power supply stop process corresponding to each of the communication buses B2 and B3 in the same manner as in the first embodiment.

[0102] <Effect of Relay Device 4> The relay device 4 in Embodiment 2 exhibits the same effects as the relay device 4 in Embodiment 1.

[0103] <Modification Example> In Embodiments 1 and 2, all ECUs 1 may be ECU1a. In this case, since there is no ECU1b, it is not necessary for the control unit 66 to execute steps S8 to S14 of the power supply stop process corresponding to the communication bus B1. When the control unit 66 determines that all ECUs 1a have been selected (S7: YES), the power supply stop process ends. Similarly, all ECUs 2 may be ECU2a. All ECUs 3 may be ECU3a. The content of each power supply stop process corresponding to the communication buses B2 and B3 is appropriately changed in the same manner as the power supply stop process corresponding to the communication bus B1.

[0104] In Embodiments 1 and 2, there is no problem as long as the number of communication buses connected to the relay device 4 is 2 or more. Therefore, the number of communication buses connected to the relay device 4 is not limited to 3. The number of power supply stop processes matches the number of communication buses. In Embodiment 1, the number of communication buses connected to the relay device 4 may be 1. In this case, the control unit 66 of the relay device 4 does not execute the relay process and separately controls the power supply to the plurality of ECUs. The relay device 4 functions as a power supply control device that does not have a relay function.

[0105] In Embodiments 1 and 2, the timing at which the control unit 66 stops the power supply to the ECU related to the running control of the vehicle C is not limited to the timing when the ignition switch is off, and may be, for example, the timing when the vehicle C stops.

[0106] The technical features (constituent elements) described in Embodiments 1 and 2 can be combined with each other, and new technical features can be formed by the combination. The disclosed Embodiments 1 and 2 should be considered illustrative in all respects and not restrictive. The scope of the present invention is shown not by the above description but by the claims, and it is intended that all modifications within the meaning and scope equivalent to the claims be included.

Explanation of Signs

[0107] C Vehicle 1, 1b, 2, 2b, 3, 3b ECU (Communication Device) 1a, 2a, 3a ECU (Communication Device, Second Communication Device) 4 Relay Device (Power Supply Control Device) 5 DC Power Supply 40 Power Switch 41 Drive Circuit 42 Microcomputer 60 Output Unit 61 Communication Unit (Receiving Unit) 62, 63 Communication Unit (Receiving Unit, Second Receiving Unit) 64 Input Unit 65 Storage Unit 66 Control Unit (Processing Unit) 67 Internal Bus 100 Communication System (Power Supply Control System) A Storage Medium B1, B2, B3 Communication Bus C Vehicle DB Database P Computer Program T1, T2, T3 State Table

Claims

1. A power supply control device that is mounted on a vehicle and controls power supply to a plurality of communication devices connected to a communication bus, a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing and is provided with, wherein the processing unit determines whether an abnormality has occurred in the data received by the receiving unit, if it is determined that the abnormality has occurred, selects one of the plurality of communication devices, instructs to stop power supply to the selected communication device, after instructing to stop the power supply, determines whether the occurrence of the abnormality has stopped, if it is determined that the occurrence of the abnormality has stopped, maintains the stop of power supply to the selected communication device, the data transmitted via the communication bus includes identification information for identifying the data transmission source, the processing unit determines that the abnormality has occurred when the data volume of the common data received by the receiving unit within a predetermined period is equal to or greater than a threshold value for the common data including common identification information Power supply control device.

2. A power supply control device that is mounted on a vehicle and controls power supply to a plurality of communication devices connected to a communication bus, a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing and is provided with, wherein the processing unit determines whether an abnormality has occurred in the data received by the receiving unit, if it is determined that the abnormality has occurred, selects one of the plurality of communication devices, instructs to stop power supply to the selected communication device, after instructing to stop the power supply, determines whether the occurrence of the abnormality has stopped, if it is determined that the occurrence of the abnormality has stopped, maintains the stop of power supply to the selected communication device, is provided with a second receiving unit that receives data transmitted via a second communication bus different from the communication bus, the data transmitted via the communication bus includes predetermined specific data, wherein the processing unit when the receiving unit receives specific data, determines whether the received specific data is abnormal based on data received by the receiving unit or the second receiving unit and different from the specific data, if the receiving unit receives abnormal specific data, determines that an abnormality has occurred in the data received by the receiving unit Power supply control device.

3. wherein the processing unit if it is determined that the occurrence of the abnormality has not stopped, instructs to supply power to the selected communication device, selects a communication device that has not been selected among the plurality of communication devices The power supply control device according to claim 1 or claim 2.

4. A power supply control device mounted on a vehicle and controlling power supply to a plurality of communication devices connected to a communication bus, a receiving unit that receives data transmitted via the communication bus, a processing unit that executes processing and comprising: wherein the processing unit determines whether an abnormality has occurred in the data received by the receiving unit, if it is determined that the abnormality has occurred, selects one of the plurality of communication devices, instructs to stop power supply to the selected communication device, after instructing to stop the power supply, determines whether the occurrence of the abnormality has stopped, if it is determined that the occurrence of the abnormality has stopped, maintains the stop of power supply to the selected communication device, the plurality of communication devices include a second communication device unrelated to the running control of the vehicle, wherein the processing unit if it is determined that the abnormality has occurred, selects one second communication device included in the plurality of communication devices Power supply control device.

5. The second communication device is a device having an ASIL (Automotive Safety Integrity Level) level of QM (Quality Management) The power supply control device according to claim 4.

6. wherein the processing unit if it is determined that the occurrence of the abnormality has not stopped, instructs power supply to the selected second communication device, determines whether all the second communication devices included in the plurality of communication devices have been selected, if it is determined that not all the second communication devices have been selected, selects one second communication device that has not been selected The power supply control device according to claim 4 or claim 5.

7. wherein the processing unit if it is determined that the occurrence of the abnormality has not stopped, instructs power supply to the selected second communication device, determines whether all the second communication devices included in the plurality of communication devices have been selected, when it is determined that all the second communication devices have been selected, and when the ignition switch of the vehicle is off, selects one of the plurality of communication devices that have not been selected The power supply control device according to any one of claims 4 to 6.

8. a plurality of communication devices mounted on a vehicle and connected to a communication bus, a power supply control device that controls power supply to the plurality of communication devices and comprising: wherein the power supply control device has a receiving unit that receives data transmitted via the communication bus, a processing unit that executes processing and having: wherein the processing unit Determine whether an abnormality has occurred in the data received by the receiving unit, if it is determined that the abnormality has occurred, select one of the plurality of communication devices, instruct to stop power supply to the selected communication device, after instructing to stop the power supply, determine whether the occurrence of the abnormality has stopped, if it is determined that the occurrence of the abnormality has stopped, maintain the stop of the power supply to the selected communication device, the data transmitted via the communication bus includes identification information for identifying the data source, when the data volume of the common data received by the receiving unit within a predetermined period regarding the common data including the common identification information is equal to or greater than a threshold value, the processing unit determines that the abnormality has occurred Power supply control system.

9. A plurality of communication devices mounted on a vehicle and connected to a communication bus, and a power supply control device for controlling power supply to the plurality of communication devices comprising, the power supply control device, a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing having, the processing unit, determine whether an abnormality has occurred in the data received by the receiving unit, if it is determined that the abnormality has occurred, select one of the plurality of communication devices, instruct to stop power supply to the selected communication device, after instructing to stop the power supply, determine whether the occurrence of the abnormality has stopped, if it is determined that the occurrence of the abnormality has stopped, maintain the stop of the power supply to the selected communication device, the power supply control device includes a second receiving unit that receives data transmitted via a second communication bus different from the communication bus, the data transmitted via the communication bus includes predetermined specific data, the processing unit, when the receiving unit receives specific data, determine whether the received specific data is abnormal based on data received by the receiving unit or the second receiving unit and different from the specific data, when the receiving unit receives abnormal specific data, determine that an abnormality has occurred in the data received by the receiving unit Power supply control system.

10. A plurality of communication devices mounted on a vehicle and connected to a communication bus, and a power supply control device for controlling power supply to the plurality of communication devices comprising, the power supply control device, a receiving unit that receives data transmitted via the communication bus, and a processing unit that executes processing having, the processing unit, determine whether an abnormality has occurred in the data received by the receiving unit, When it is determined that the abnormality has occurred, one of the plurality of communication devices is selected, an instruction to stop power supply to the selected communication device is given, after giving the instruction to stop the power supply, it is determined whether or not the occurrence of the abnormality has stopped, when it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained, the plurality of communication devices includes a second communication device that is irrelevant to the travel control of the vehicle, the processing unit, when it is determined that the abnormality has occurred, one second communication device included in the plurality of communication devices is selected Power supply control system.

11. A power supply control method for controlling power supply to a plurality of communication devices mounted on a vehicle and connected to a communication bus, comprising: determining whether an abnormality has occurred with respect to data transmitted via the communication bus; when it is determined that the abnormality has occurred, selecting one of the plurality of communication devices; instructing to stop power supply to the selected communication device; after instructing to stop the power supply, determining whether or not the occurrence of the abnormality has stopped is executed by a computer, when it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained, the computer includes a receiving unit that receives data transmitted via the communication bus, the data transmitted via the communication bus includes identification information for identifying the data transmission source, the computer determines that the abnormality has occurred when the data amount of the common data received by the receiving unit within a predetermined period is equal to or greater than a threshold value with respect to the common data including common identification information Power supply control method.

12. A power supply control method for controlling power supply to a plurality of communication devices mounted on a vehicle and connected to a communication bus, comprising: determining whether an abnormality has occurred with respect to data transmitted via the communication bus; when it is determined that the abnormality has occurred, selecting one of the plurality of communication devices; instructing to stop power supply to the selected communication device; after instructing to stop the power supply, determining whether or not the occurrence of the abnormality has stopped is executed by a computer, when it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained, The computer includes a receiving unit that receives data transmitted via the communication bus, and a second receiving unit that receives data transmitted via a second communication bus different from the communication bus. The data transmitted via the communication bus includes predetermined specific data. The computer When the receiving unit receives specific data, it determines whether the received specific data is abnormal based on data received by the receiving unit or the second receiving unit and different from the specific data. When the receiving unit receives abnormal specific data, it determines that an abnormality has occurred in the data received by the receiving unit. Power supply control method.

13. A power supply control method for controlling power supply to a plurality of communication devices mounted on a vehicle and connected to a communication bus, comprising: Determining whether an abnormality has occurred in the data transmitted via the communication bus; When it is determined that the abnormality has occurred, selecting one of the plurality of communication devices; Instructing to stop power supply to the selected communication device; After instructing to stop the power supply, determining whether the occurrence of the abnormality has stopped; The computer executes the steps, When it is determined that the occurrence of the abnormality has stopped, the stop of power supply to the selected communication device is maintained. The plurality of communication devices include a second communication device that is irrelevant to the running control of the vehicle. The computer When it is determined that the abnormality has occurred, select one second communication device included in the plurality of communication devices. Power supply control method.

Images