Vehicle electronic control system and control method for vehicle electronic control system

Abstract

To compensate a clock function when clock means is out of order.SOLUTION: An electronic control system comprises: an ECU 100 having an RTC 130 capable of measuring a lapse time after an off-operation of IGNSW 45, and started to execute first processing when the lapse time measured by the RTC 130 reaches a setting time; and an ECU 200 communicatively connected to the ECU 100 and having a clock part 230 capable of measuring a lapse time after the off-operation of the IGNSW 45. When the RTC 130 is out of order, the ECU 200 is activated based on the lapse time measured by the clock part 230, and sends activation request signals requesting activation of the ECU 100 to the ECU 100. The ECU 100 inactivates measuring of the lapse time by the RTC 130, and executes the first processing under a condition that it is activated based on reception of the activation request signals.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an electronic control system for a vehicle including at least two electronic control devices, and a control method for the electronic control system for a vehicle. [Background technology]

[0002] It is known that two electronic control devices in a vehicle each have a timing means for measuring the elapsed time after the ignition switch is turned off, and the timing data from the two timing means are compared to detect a malfunction of the timing means (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-238021 Summary of the Invention [Problem to be solved by the invention]

[0004] However, even if a failure in the timing means can be detected, if the timing function cannot be compensated for, it will be difficult to start up at a predetermined timing after the ignition switch is turned off and perform predetermined control processing, such as diagnosing evaporative fuel leaks in the fuel supply path.

[0005] The present invention has been made in consideration of the above-mentioned problems, and aims to provide an electronic control system for a vehicle that can compensate for the timing function even if the timing means that measures the elapsed time after the ignition switch is turned off fails. [Means for solving the problem]

[0006] Therefore, the vehicle electronic control system according to the present invention has a first timer that can measure the elapsed time after the ignition switch is turned off, and is activated to perform a first process when the elapsed time measured by the first timer reaches a first set time. The first process is a leak diagnosis process for diagnosing a leak of evaporated fuel in an evaporated fuel distribution system through which evaporated fuel flows from a fuel tank that stores fuel to be injected into a fuel injection valve of an internal combustion engine. The electronic control device is provided with a first electronic control unit and a second electronic control unit that is communicatively connected to the first electronic control unit and has a second timing means that is capable of measuring the elapsed time, and when a failure occurs in the first timing means, the second electronic control unit starts up based on the elapsed time measured by the second timing means and sends a startup request signal to the first electronic control unit requesting startup of the first electronic control unit, and the first electronic control unit is configured to disable the measurement of the elapsed time by the first timing means and perform a first processing on the condition that it has started up based on receipt of the startup request signal.

[0007] Further, a control method for a vehicle electronic control system according to the present invention includes a first timer capable of measuring an elapsed time after an ignition switch is turned off, and is activated when the elapsed time measured by the first timer reaches a first set time to perform a first process. The first process is a leak diagnosis process for diagnosing a leak of evaporated fuel in an evaporated fuel distribution system through which evaporated fuel flows from a fuel tank that stores fuel to be injected into a fuel injection valve of an internal combustion engine. A control method for a vehicle electronic control system comprising a first electronic control unit and a second electronic control unit that is communicatively connected to the first electronic control unit and has a second timing means capable of measuring the elapsed time, wherein when a failure occurs in the first timing means, the second electronic control unit starts up based on the elapsed time measured by the second timing means and sends a startup request signal to the first electronic control unit requesting startup of the first electronic control unit, and the first electronic control unit disables the measurement of the elapsed time by the first timing means and performs a first processing on the condition that it has started up based on receipt of the startup request signal. [Effects of the Invention]

[0008] According to the vehicle electronic control system and control method of the present invention, even if the timer means for measuring the elapsed time after the ignition switch is turned off fails, the timer function can be compensated for. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a configuration diagram showing an application example of a vehicle electronic control system according to a first embodiment. [Figure 2] 2 is a diagram illustrating an example of a configuration of a vehicle electronic control system according to the embodiment; FIG. [Figure 3] 4 is a time chart showing an example of ECU operation when the timing means is normal in the embodiment. [Figure 4] 4 is a time chart showing an example of an operation of the ECU when a timing unit fails in the embodiment. [Figure 5] 10 is a flowchart showing an example of a first preliminary process according to the embodiment. [Figure 6] 10 is a flowchart illustrating an example of basic processing according to the embodiment. [Figure 7] 10 is a flowchart showing an example of a timing function compensation process according to the embodiment; [Figure 8] 10 is a flowchart illustrating an example of a first preliminary process according to the second embodiment. [Figure 9] 10 is a flowchart illustrating an example of basic processing according to the embodiment. [Figure 10] 10 is a flowchart showing an example of a timing function compensation process according to the embodiment; [Figure 11] FIG. 10 is a configuration diagram showing an example of a vehicle electronic control system according to a third embodiment. [Figure 12] 10 is a flowchart showing a timing function compensation process according to a first example of the embodiment. [Figure 13] 10 is a flowchart showing a parallel timing process according to a first example of the embodiment. [Figure 14] 10 is a flowchart showing an example of basic processing according to a second example of the embodiment. [Figure 15] 10 is a flowchart showing a timing function compensation process according to a second example of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0011] [First embodiment] 1 is a schematic diagram showing an example of a vehicle device to which the vehicle electronic control system according to the first embodiment is applied. The vehicle device in the figure is an internal combustion engine 1, which is a multi-cylinder gasoline engine mounted on a vehicle, and related devices.

[0012] [Internal combustion engine] The intake air of the internal combustion engine 1 flows from outside the vehicle through an intake pipe 3 in which an electronically controlled throttle valve 2 is arranged and an intake port 4 of each cylinder connected to the intake pipe 3 into a combustion chamber 6 of each cylinder while an intake valve 5 arranged in the intake port 4 is open. Also, in the internal combustion engine 1, a fuel injection valve 7 that injects fuel (gasoline) into the intake pipe 3, the intake port 4 or the combustion chamber 6 is arranged for each cylinder, and the fuel injected from the fuel injection valve 7 mixes with the intake air to form an air-fuel mixture in the combustion chamber 6.

[0013] The air-fuel mixture formed in the combustion chamber 6 is ignited and burned by spark ignition from a spark plug 10 facing the combustion chamber 6 while the intake valve 5 and an exhaust valve 9 arranged in the exhaust port 8 are closed. The resulting combustion exhaust gas is discharged to the outside via the exhaust port 8 and an exhaust pipe 11 connected to it while the exhaust valve 9 is open. The reciprocating motion of the piston 12 caused by the combustion pressure is converted into rotational motion by a crankshaft 13 connected to the piston 12, and is then transmitted to wheels (not shown) as the output of the internal combustion engine 1.

[0014] The electronic throttle valve 2, fuel injector 7, and spark plug 10 are controlled by an engine control module (hereinafter referred to as "ECM") 14, which has a built-in microcomputer. The ECM 14 receives output signals from various sensors and performs calculations based on these output signals. The various sensors provided include an air flow meter (AFM) 15 that measures the intake amount upstream of the electronic throttle valve 2, a crank angle sensor 16 that measures the rotation angle of the crankshaft 13, and an accelerator position sensor 18 that measures the depression amount of an accelerator pedal 17 (accelerator position).

[0015] Specifically, the ECM 14 determines target values ​​for fuel injection timing, fuel injection amount, ignition timing, throttle opening, etc. based on output signals from various sensors. Then, the ECM 14 outputs an injection control signal corresponding to the target fuel injection timing and fuel injection amount to the fuel injector 7, outputs an ignition control signal corresponding to the target ignition timing to the spark plug 10, and outputs a throttle control signal corresponding to the target throttle opening to the electronically controlled throttle valve 2.

[0016] [Fuel tank] The fuel injected from the fuel injection valve 7 is fuel stored in a sealed fuel tank 19. A fuel pump 20 is installed in the fuel tank 19, and the fuel drawn by the fuel pump 20 is supplied to the fuel injection valve 7 via a fuel supply pipe (not shown). The fuel tank 19 also has a fuel filler pipe 21 that serves as an introduction path for refueling fuel, and a fuel filler cap 22 that closes the fuel filler inlet 21a at the end of the fuel filler pipe 21 is removably attached to the fuel filler inlet 21a. A filler lid 23 that covers the fuel filler cap 22 of the fuel filler inlet 21a in a closed state and exposes the fuel filler cap 22 of the fuel filler inlet 21a in an open state is provided at a connection opening formed by connecting a part of the vehicle body to the fuel filler inlet 21a. The filler lid 23 is mechanically locked in a closed state when closed, but is configured to be unlocked and opened by a lid opener 24 that can be controlled externally.

[0017] [Fuel vapor treatment device] The internal combustion engine 1 is equipped with an evaporative fuel treatment device 25 as a related device. The evaporative fuel treatment device 25 temporarily adsorbs and collects the evaporative fuel generated in the fuel tank 19 in a canister 26, which is a container filled with an adsorbent such as activated carbon, and supplies purge gas containing the evaporative fuel desorbed from the canister 26 to the intake pipe 3 downstream of the electronically controlled throttle valve 2.

[0018] The fuel tank 19 and the canister 26 are connected by an evaporated fuel introduction passage 28 having a shutoff valve 27 installed therein. The shutoff valve 27 is a normally closed electromagnetic valve, and in the OFF state, where no signal to open the shutoff valve 27 is input from the outside, the shutoff valve 27 blocks the outflow of evaporated fuel from the fuel tank 19 to the canister 26. On the other hand, in the ON state, where a signal to open the shutoff valve 27 is input from the outside, the shutoff valve 27 allows the outflow of evaporated fuel from the fuel tank 19 to the canister 26.

[0019] The canister 26 and the intake pipe 3 downstream of the electronically controlled throttle valve 2 are connected by a purge passage 30 in which a purge control valve (PCV) 29 is installed. The purge control valve 29 is a normally closed electromagnetic valve, and in the OFF state where no signal to open the purge control valve 29 is input from the outside, it blocks the supply of purge gas from the canister 26 to the intake pipe 3. On the other hand, in the ON state where a signal to open the purge control valve 29 is input from the outside, the purge control valve 29 allows the supply of purge gas from the canister 26 to the intake pipe 3.

[0020] An external communication passage 31 for communicating with the outside is connected to the canister 26. This external communication passage 31 is selectively connected by an electromagnetic switching valve 32 to an atmosphere release passage 33 that is open to the atmosphere, or a pump discharge passage 35 that is connected to the discharge port of an air pump 34 that draws in the atmosphere. The switching valve 32 is configured to connect the external communication passage 31 to the atmosphere release passage 33 in an off state where no control signal is input from the outside, and to connect the external communication passage 31 to the pump discharge passage 35 in an on state where a control signal is input from the outside.

[0021] A bypass passage 36 that bypasses the switching valve 32 is provided between the pump discharge passage 35 and the external communication passage 31, and a reference orifice 37 having a reference diameter is provided in this bypass passage 36. An air filter 39 is provided on the atmosphere-opening side of two passages, the atmosphere-opening passage 33 and the pump suction passage 38 connected to the suction port of the air pump 34.

[0022] The evaporated fuel processing device 25 includes an EVAP control unit that performs various evaporated fuel processing operations by controlling the shutoff valve 27, the purge control valve 29, the switching valve 32, the air pump 34, and the lid opener 24. The EVAP control unit is one electronic control unit (hereinafter referred to as an "ECU (Electronic Control Unit)") of a vehicle electronic control system configured by connecting multiple electronic control units, including the ECM 14, so that they can communicate with each other via an on-board communication network 40 such as a CAN (Controller Area Network). Hereinafter, the EVAP control unit will be referred to as a first ECU 100.

[0023] [First ECU] The first ECU 100 incorporates a computer and receives output signals from various sensors and switches. The various sensors and switches connected to the first ECU 100 include a fuel state detection sensor 41, a current sensor 42, an open / close sensor 43, a fuel fill switch (hereinafter referred to as "RFSW") 44, and an ignition switch (hereinafter referred to as "IGNSW") 45. The fuel state detection sensor 41 measures at least one of the internal pressure and fuel temperature of the fuel tank 19, and the current sensor 42 measures the drive current of an electric motor (not shown) that drives the air pump 34, and outputs a signal corresponding to each measurement value. The open / close sensor 43 is configured to transition the potential level of its output signal when the filler lid 23 is closed and mechanically locked in the closed state. The RFSW 44 outputs a fuel fill signal RF that is maintained at an active level when turned on in response to a request for refueling the fuel tank 19, for example. The fuel supply signal RF transitions from an active level to an inactive level when the output signal of the open / close sensor 43 changes to a potential level indicating that the filler lid 23 is locked in the closed state. The IGNSW 45 outputs an ignition signal IGN that is maintained at an active level when turned on in response to a request to start the internal combustion engine 1, etc. The ignition signal IGN transitions from an active level to an inactive level when the IGNSW 45 is turned off.

[0024] The first ECU 100 performs various types of evaporated fuel processing based on information transmitted from the ECM 14 and output signals from various sensors and switches. The evaporated fuel processing includes an adsorption process, a purge process, and a leak diagnosis process. The adsorption process is a process for adsorbing evaporated fuel in the fuel tank 19 into the canister 26, and the purge process is a process for desorbing (purging) the evaporated fuel adsorbed in the canister 26. The leak diagnosis process is a process for diagnosing whether or not an evaporated fuel leak has occurred due to a crack in the piping of the evaporated fuel distribution system extending from the fuel tank 19 through the canister 26 to the purge control valve 29 or a poor seal at the joint between the piping (hereinafter referred to as "leak diagnosis").

[0025] (adsorption treatment) In the adsorption process, the first ECU 100 adsorbs evaporated fuel in the fuel tank 19 on the condition that the RFSW 44 is turned on. Specifically, the first ECU 100 outputs a control signal to the lid opener 24 in response to the refueling signal RF at an active level output from the RFSW 44, thereby unlocking the filler lid 23 and opening it. Then, when the output signal of the opening / closing sensor 43 transitions to a potential level indicating that the filler lid 23 is in the open state, the first ECU 100 turns the purge control valve 29 and the switching valve 32 off to keep them closed, and turns the stop valve 27 on to open them. The first ECU 100 ends the adsorption process when the output signal of the opening / closing sensor 43 transitions to a potential level indicating that the filler lid 23 is in the closed state.

[0026] Due to the adsorption process, the fuel tank 19 is connected to the atmosphere via the evaporated fuel introduction passage 28, the canister 26, the external communication passage 31, and the atmosphere open passage 33. Therefore, evaporated fuel generated in the fuel tank 19 flows out toward the canister 26 due to the pressure difference between the internal pressure of the fuel tank 19 and atmospheric pressure. As a result, the evaporated fuel is adsorbed and collected by the canister 26 and the internal pressure of the fuel tank 19 decreases, so that when the fuel filler cap 22 is removed from the fuel filler opening 21a, fuel can be filled while suppressing the dispersion of evaporated fuel from the fuel filler opening 21a.

[0027] (Purge process) In the purge process, the first ECU 100 purges the evaporated fuel adsorbed in the canister 26 on the condition that a purge request signal is received from the ECM 14 when the IGNSW 45 is in the ON state. Specifically, the first ECU 100 turns the purge control valve 29 ON to open it while keeping the switching valve 32 OFF. The stop valve 27 is turned OFF to close it in order to promote the purging of evaporated fuel from the canister 26. The purge request signal is transmitted when the ECM 14 determines that the operating conditions of the internal combustion engine 1, acquired from output signals from various sensors such as the air flow meter 15, the crank angle sensor 16, and the accelerator position sensor 18, satisfy predetermined purge permission conditions.

[0028] When the purge control valve 29 opens, fresh air is introduced into the canister 26 via the atmosphere open passage 33 and the external communication passage 31 due to the pressure difference between the intake negative pressure of the internal combustion engine 1 and atmospheric pressure. As a result, the evaporated fuel adsorbed in the canister 26 is purged, and purge gas containing the evaporated fuel is supplied to the intake pipe 3 via the purge passage 30. The purge gas supplied to the intake pipe 3 flows into the combustion chamber 6 together with the intake air and is used for ignition and combustion by spark ignition of the spark plug 10.

[0029] (Leak diagnosis processing) In the leak diagnosis process, the first ECU 100 performs leak diagnosis on the condition that the elapsed time after the IGNSW 45 is turned off reaches a set time Tset1 (for example, 6 hours). The set time Tset1 is a time period during which the fuel state (fuel temperature, pressure, etc. in the fuel tank 19) is stabilized and good diagnostic accuracy of the leak diagnosis can be ensured when the elapsed time after the IGNSW 45 is turned off reaches the set time Tset1.

[0030] When the time elapsed since the IGNSW 45 was turned off reaches the set time Tset1, the first ECU 100 first performs control to initialize the atmosphere of the evaporated fuel distribution system to establish the conditions for performing the leak diagnosis. Specifically, the first ECU 100 turns on and opens the block valve 27 and the purge control valve 29 while keeping the selector valve 32 in the off state, and operates the air pump 34, maintaining this state for a certain period of time. As a result, air discharged from the air pump 34 and passing through the bypass passage 36 passes through the canister 26, the purge passage 30, and the intake pipe 3, and is also released into the atmosphere through the selector valve 32 and the atmosphere open passage 33. Residual pressure and residual gas are removed from the evaporated fuel distribution system, completing the initialization.

[0031] Next, the first ECU 100 sets a reference level of leakage as a first stage of the leak diagnosis. Specifically, the first ECU 100 turns on and opens the stop valve 27 while keeping the purge control valve 29 and the switching valve 32 in the off state, and operates the air pump 34, and maintains this state for a certain period of time. As a result, air discharged from the air pump 34 and passing through the bypass passage 36 (reference orifice 37) is released into the atmosphere via the switching valve 32 and the atmosphere open path 33. After a predetermined period of time has elapsed, the first ECU 100 stores the measured value of the drive current of the air pump 34, acquired from the output signal of the current sensor 42, as the reference level of leakage.

[0032] Next, as a second stage of the leak diagnosis, the first ECU 100 measures the actual leak level. Specifically, the first ECU 100 turns on the shutoff valve 27 and the switching valve 32 while keeping the purge control valve 29 in the off state, and operates the air pump 34, maintaining this state for a predetermined time. As a result, air discharged from the air pump 34 flows from the pump discharge path 35 through the switching valve 32 to the external communication path 31, and then passes through the canister 26 and into the evaporated fuel distribution system. After the predetermined time has elapsed, the first ECU 100 stores the measured value of the drive current of the air pump 34, obtained from the output signal of the current sensor 42, as the actual leak level.

[0033] Then, in the third stage of the leak diagnosis, the first ECU 100 compares the reference level with the actual leak level and diagnoses the presence of a fuel vapor leak in the fuel vapor distribution system based on the comparison result. If the actual leak level is lower than the reference level, the driving load of the air pump 34 is higher when the discharged air passes through the reference orifice 37 than when it flows into the fuel vapor distribution system. Therefore, it can be diagnosed that a fault equivalent to a hole larger in diameter than the reference orifice 37 is present in the fuel vapor distribution system. The above-described leak diagnosis is described in detail, for example, in Japanese Patent Application Laid-Open No. 2001-12319.

[0034] [Details of the vehicle electronic control system] 2 shows ECUs related to the leak diagnosis process as part of the vehicle electronic control system according to the first embodiment. The vehicle electronic control system according to the first embodiment includes a first ECU 100, which is an EVAP control unit, as well as a second ECU 200 that is communicatively connected to the first ECU 100 via an in-vehicle communication network 40. Note that FIG. 2 shows only signals related to the activation of the first ECU 100 for the purpose of performing the leak diagnosis process (an ignition signal IGN and a communication signal via the in-vehicle communication network 40) as input signals to the first ECU 100. The same applies hereinafter.

[0035] The first ECU 100 has as its main components a power supply circuit 110, a power supply relay 120, an RTC (Real Time Clock) 130, a communication control circuit 140, an OR circuit (logical sum gate) 150, and a first controller 160, which are integrally configured, for example, as an integrated circuit.

[0036] The power supply circuit 110 is connected to the vehicle battery 46 via the power supply line 100A, and outputs an output voltage V BAT The power supply circuit 110 can supply the output voltage V BATis a power supply voltage V according to the operating voltage of each electronic device such as the first controller 160 in the first ECU 100. REG1 The temperature is adjusted and supplied.

[0037] The power supply relay 120 is a contactless relay such as a MOSFET (Metal Oxide Semiconductor Field Effect Transistor) or an electromagnetic contact relay that is interposed in the power supply line 100A and switches between an ON state and an OFF state based on a control signal from outside the relay. When the power supply relay 120 switches from an OFF state to an ON state, the output voltage V BAT is supplied to the power supply circuit 110. As a result, the first controller 160 receives the power supply voltage V REG1 is supplied, the first controller 160 is activated and put into an active state.

[0038] The RTC 130 is a timekeeping means independent of the first controller 160, and receives the output voltage V from the vehicle battery 46 via the power supply line 100A. BAT is constantly supplied to the RTC 130, enabling it to measure time even when the power relay 120 is in the off state. Specifically, the RTC 130 has a soak timer that measures the time that has elapsed since the IGNSW 45 was turned off. The RTC 130 is configured to be able to communicate with the first controller 160 via SPI (Serial Peripheral Interface) communication or the like, and receives information regarding the set time Tset1 from the first controller 160. The RTC 130 then sequentially stores the time measurement data measured by the soak timer in built-in storage means, and when the time that has elapsed since the IGNSW 45 was turned off reaches the set time Tset1, it holds the alarm signal ALM1 at an active level and outputs it to the OR circuit 150 and the first controller 160.

[0039] The communication control circuit 140 controls communication with other ECUs such as the second ECU 200 via the in-vehicle communication network 40 in accordance with a predetermined communication protocol. As a result, the communication control circuit 140 sends an output signal from the first controller 160 to the in-vehicle communication network 40, and also sends an input signal from the in-vehicle communication network 40 to the first controller 160. The communication control circuit 140 receives an output voltage V BAT is always supplied to the first ECU 100, and is operable even when the power supply relay 120 is in an off state. Furthermore, when the communication control circuit 140 receives a signal (hereinafter referred to as a "start-up request signal") from the outside via the in-vehicle communication network 40 requesting the start-up of the first ECU 100, i.e., the first controller 160, the communication control circuit 140 holds the wake-up signal WK1 at an active level and outputs it to the OR circuit 150. Furthermore, the communication control circuit 140 is configured to send the received start-up request signal to the first controller 160.

[0040] The OR circuit 150 outputs a signal that determines the on / off state of the power supply relay 120 based on four input signals. Specifically, the OR circuit 150 receives the ignition signal IGN, the alarm signal ALM1, the wake-up signal WK1, and the self-holding signal SH1 as inputs, and holds the output signal at an active level when at least one of these four input signals is at an active level. When the output signal of the OR circuit 150 becomes an active level, the power supply relay 120 is turned on, and as a result, the first controller 160 receives the power supply voltage V from the power supply circuit 110. REG1 is supplied to the IGNSW 45, causing the self-holding signal SH1 to enter an active state. Here, the self-holding signal SH1 is a signal output from the first controller 160, which transitions from an inactive level to an active level when the IGNSW 45 is turned off, and returns to the inactive level when a predetermined self-shutoff (hereinafter referred to as "SSOFF") period has elapsed.

[0041] Although not shown, the first controller 160 is a computer configured by connecting a processor such as a central processing unit (CPU), a volatile memory such as a random access memory (RAM), a nonvolatile memory such as a read-only memory (ROM), and an input / output interface via an internal bus. In an active state, the first controller 160 reads a predetermined control program from the nonvolatile memory into the volatile memory and executes a leak diagnosis process. The leak diagnosis process executed by the first controller 160 includes a process executed when the elapsed time after the IGNSW 45 is turned off reaches a set time Tset1 (hereinafter referred to as "basic process"), as well as a process executed before the basic process (hereinafter referred to as "first pre-process"). Specifically, the first controller 160 receives an ignition signal IGN, an alarm signal ALM1, a self-holding signal SH1, and a communication signal with the second ECU 200 via the input / output interface, and executes the leak diagnosis process based on these input signals. Meanwhile, the first controller 160 also receives a power supply voltage V REG1 In a shutdown state in which the supply of power is cut off and all functions are stopped, not only is it not possible to perform a leak diagnosis process, but the timekeeping function of the intrinsic timekeeping means is also lost.

[0042] 3 shows an example of the operation of the first ECU 100 in the leak diagnosis process when the soak timer of the RTC 130 is normal. In FIG. 3, the input signals to the OR circuit 150, such as the ignition signal IGN, the self-holding signal SH1, and the alarm signal ALM1, are positive logic signals that are at a high potential (H) level when active and at a low potential (L) level when inactive. The same applies to the following description.

[0043] At time t1, when the input ignition signal IGN transitions from H level to L level due to the IGNSW 45 being turned off, the first controller 160 changes the self-holding signal SH1 from L level to H level and outputs it to the OR circuit 150. As a result, the power supply relay 120 maintains the ON state, and the first controller 160 controls the power supply voltage V REG1The RTC 130 transitions to the SSOFF period while remaining in the active state in which the IGNSW 45 is supplied. At time t2 during the SSOFF period, the first controller 160, as a first pre-processing step, calculates a set time Tset1 based on the fuel state when the IGNSW 45 is turned off, and transmits the calculated value T1 (>0) to the RTC 130 as information regarding the set time Tset1. The soak timer of the RTC 130 is configured as a counter (in the illustrated example, an up-counter) whose count value changes sequentially each time a predetermined number of edges of a reference pulse having a fixed period generated by a pulse generator (not shown) using a quartz oscillator or the like are counted. Therefore, in the RTC 130, the set time Tset1 is converted into a count value (threshold value) TH required to reach the set time Tset1 based on the period of the reference pulse, and this threshold value TH is set as a substitute value for the set time Tset1 and stored in storage means built into the RTC 130. The RTC 130 starts counting using the soak timer upon setting the threshold value TH. At time t3, when the predetermined SSOFF period ends, the first controller 160 changes the self-holding signal SH1 from H level to L level and outputs it to the OR circuit 150. This causes the power supply relay 120 to change to the OFF state, and the first controller 160 turns off the power supply voltage V REG1 The RTC 130 continues counting using the soak timer even when the first controller 160 is in the shutdown state.

[0044] At time t4, when the count value of the soak timer of the RTC 130 reaches the threshold value TH, the RTC 130 changes the alarm signal ALM1 from L level to H level and outputs it to the OR circuit 150 and the first controller 160. When the alarm signal ALM1 transitions to H level, the power relay 120 changes to the ON state, which activates the first controller 160 and transitions it from the shutdown state to the active state. At this time, the first controller 160 determines that it has been activated to perform basic processing (leak diagnosis) based on the H-level alarm signal ALM1. Then, the first controller 160 performs control processing to satisfy the conditions for performing the leak diagnosis as described above, and then performs the leak diagnosis. When the leak diagnosis is completed, at time t5, the first controller 160 sends a reset request signal to the RTC 130. Upon receiving the reset request signal, the RTC 130 resets (initializes) its count value to an initial value (e.g., zero). As a result, the count value falls below the threshold value TH, and the alarm signal ALM1 transitions from H level to L level, so that the power supply relay 120 changes to the OFF state and the first controller 160 transitions to the shutdown state again.

[0045] As described above, in the first ECU 100, the time elapsed since the IGNSW 45 was turned off is measured by the RTC 130, rather than by activating the first controller 160. This is because the power consumption associated with the RTC 130 timing is smaller than the power consumption associated with the first controller 160 being activated, thereby reducing the power consumption of the vehicle battery 46. However, if the soak timer of the RTC 130 fails for some reason, the time elapsed since the IGNSW 45 was turned off cannot be measured, and the timing for performing a leak diagnosis will be missed. To address this issue, the vehicle electronic control system includes, in addition to the first ECU 100, a second ECU 200 having a soak timer similar to the RTC 130. Note that the ECM 14 does not have a timing means similar to the soak timer of the RTC 130.

[0046] Unlike the first ECU 100, the second ECU 200 is not an ECU solely for performing evaporated fuel processing, but has a function of compensating for the timing function of the RTC 130 when the RTC 130 fails. That is, the second ECU 200 measures the elapsed time after the IGNSW 45 was turned off in place of the RTC 130, and can activate the first controller 160 when the elapsed time after the IGNSW 45 was turned off reaches a set time Tset1. The second ECU 200 includes, as its main components, a power supply circuit 210, a power supply relay 220, a timing unit 230, a communication control circuit 240, an OR circuit 250, and a second controller 260, similar to the first ECU 100.

[0047] The power supply circuit 210 is connected to the vehicle battery 46 via the power supply line 200A, and outputs an output voltage V BAT The power supply circuit 210 can supply the output voltage V BAT is a power supply voltage V according to the operating voltage of each electronic device such as the second controller 260 in the second ECU 200. REG2 The temperature is adjusted and supplied.

[0048] The power supply relay 220 is a non-contact relay such as a MOSFET or an electromagnetic contact relay that is interposed in the power supply line 200A and switches between an ON state and an OFF state based on a control signal from outside the relay. When the power supply relay 220 switches from an OFF state to an ON state, the output voltage V BAT is supplied to the power supply circuit 210. As a result, the second controller 260 receives the power supply voltage V REG2 is supplied, the second controller 260 is activated and put into an active state.

[0049] The timer 230 is a timer means independent of the second controller 260, and receives the output voltage V from the vehicle battery 46 via the power supply line 200A. BATis constantly supplied, enabling timekeeping even when the power supply relay 220 is in an OFF state. Specifically, the timekeeping unit 230 has a soak timer similar to the RTC 130. The timekeeping unit 230 is configured to be able to communicate with the second controller 260 via SPI communication or the like, and receives information regarding the set time Tset2 from the second controller 260. The timekeeping unit 230 then sequentially stores the timekeeping data from the soak timer in built-in storage means, and when the elapsed time after the IGNSW 45 was turned off reaches the set time Tset2, it holds the alarm signal ALM2 at an H level and outputs it to the OR circuit 250 and the second controller 260.

[0050] The communication control circuit 240 controls communication with other ECUs such as the first ECU 100 via the in-vehicle communication network 40 in accordance with a predetermined communication protocol. As a result, the communication control circuit 240 sends an output signal from the second controller 260 to the in-vehicle communication network 40, and also sends an input signal from the in-vehicle communication network 40 to the second controller 260. The communication control circuit 240 receives an output voltage V BAT is always supplied, and is configured to be operable even when the power supply relay 220 is in the OFF state.

[0051] The OR circuit 250 outputs a signal that determines the on / off state of the power supply relay 220 based on three input signals. Specifically, the OR circuit 250 receives the ignition signal IGN, the alarm signal ALM2, and the self-holding signal SH2 as input, and holds the output signal at an active level when at least one of these three input signals is at an H level. When the output signal of the OR circuit 250 becomes active, the power supply relay 220 is turned on, and as a result, the second controller 260 receives the power supply voltage V from the power supply circuit 210. REG2 is supplied to the IGNSW 45, and the self-holding signal SH2 is set to the active state. Here, the self-holding signal SH2 is a signal output from the second controller 260, which transitions from L level to H level when the IGNSW 45 is turned off, and returns to L level when a predetermined SSOFF period has elapsed.

[0052] The second controller 260 is a computer configured similarly to the first controller 160, and in an active state, reads a predetermined control program from a non-volatile memory into a volatile memory and executes a process for compensating the timekeeping function of the RTC 130 (hereinafter referred to as "timekeeping function compensation process"). The timekeeping function compensation process executed by the second controller 260 includes a process for requesting the start and stop of the first controller 160 (hereinafter referred to as "start / stop process") and a process performed before the start / stop process (hereinafter referred to as "second pre-process"). Specifically, the second controller 260 receives the ignition signal IGN, the alarm signal ALM2, the self-holding signal SH2, and communication signals with the first ECU 100 via an input / output interface, and executes the timekeeping function compensation process based on these input signals. Meanwhile, the second controller 260 receives the power supply voltage V REG2 In a shutdown state where the supply of power is cut off, not only is it not possible to perform the timekeeping function compensation process, but the timekeeping function of the intrinsic timekeeping means is also lost.

[0053] [Operation of the vehicle electronic control system] 5 to 7, the leak diagnosis process (first preliminary process and basic process) executed by the first controller 160 and the timing function compensation process (second preliminary process and start / stop process) executed by the second controller 260 will be described. In this description, the timing of execution of steps in each process will be noted with reference to Fig. 4, which shows an example of the operation of the first ECU 100 and the second ECU 200 in the leak diagnosis process when the soak timer of the RTC 130 has failed, in addition to Fig. 3.

[0054] 5 and 6 show a first embodiment of the electronic control system for a vehicle in which the first controller 160 controls the power supply voltage V REG1 1 shows an example of a leak diagnosis process that is executed once each time the supply of power is received and the engine is started.

[0055] 5, in step S101 (abbreviated as "S101" in the drawing, and the same applies below), the first controller 160 determines whether or not the IGNSW 45 has been activated by turning it on (before time t1 or time t4 in FIG. 3, and before time t1 or time t5 in FIG. 4). Specifically, if only the ignition signal IGN among its input signals is at H level and the activation request signal has not been received, the first controller 160 determines that the IGNSW 45 has been activated by turning it on (YES), and proceeds to step S102. On the other hand, if all input signals other than the ignition signal IGN are at H level or the activation request signal has been received, the first controller 160 determines that the IGNSW 45 has not been activated by turning it on (NO), and proceeds to step S113 in FIG. 6.

[0056] In step S102 (before time t1 in FIGS. 3 and 4), the first controller 160 performs a fault diagnosis on the RTC 130. The fault diagnosis on the RTC 130 includes, for example, the following two diagnostic methods.

[0057] In the first diagnostic method, when the first controller 160 starts up, a specific time (for example, one minute) is measured using a timing means (internal clock counter) specific to the first controller 160 and a soak timer of the RTC 130, and the first controller 160 compares the two timing data. If the self-diagnosis at the time of startup of the first controller 160 shows that the specific timing means is normal and the timing data by the RTC 130 deviates from the timing data by the timing means specific to the first controller 160, it can be diagnosed that a fault has occurred in the soak timer of the RTC 130.

[0058] In the second diagnostic method, before the first controller 160 is started, two soak timers, the RTC 130 and the timing unit 230, are used to measure the time elapsed since the IGNSW 45 was turned off, and when the first controller 160 is started, the first controller 160 compares the two pieces of timing data. When the first controller 160 is started, the timing data by the timing unit 230 is transmitted from the second ECU 200 to the first controller 160 via the in-vehicle communication network 40 and the communication control circuit 140. If the soak timer of the timing unit 230 is normal and the timing data by the RTC 130 deviates from the timing data by the timing unit 230, it can be diagnosed that a fault has occurred in the soak timer of the RTC 130.

[0059] The first controller 160 may perform at least one of a plurality of diagnostic methods, including a first diagnostic method and a second diagnostic method, as a fault diagnosis of the RTC 130. When performing a plurality of diagnostic methods, if the first controller 160 diagnoses that a fault has occurred in the soak timer of the RTC 130 in at least one diagnostic method, the first controller 160 confirms the diagnosis.

[0060] In step S103 (before time t1 in FIGS. 3 and 4), the first controller 160 updates the diagnostic information stored in the writable nonvolatile memory based on the results of the fault diagnosis of the RTC 130 performed in step S102.

[0061] In step S104 (before time t1 in FIGS. 3 and 4), the first controller 160 determines whether the IGNSW 45 has been turned off. Specifically, when the ignition signal IGN transitions from H level to L level (time t1 in FIGS. 3 and 4), the first controller 160 determines that the IGNSW 45 has been turned off (YES), and proceeds to step S105 to transition to the SSOFF period. On the other hand, if the ignition signal IGN remains at H level and does not change, the first controller 160 determines that the IGNSW 45 has not been turned off (NO), and executes step S104 again.

[0062] In step S105 (time t1 in FIGS. 3 and 4), the first controller 160 changes the self-holding signal SH1 from L level to H level to enable operation during the SSOFF period, and the power supply voltage V REG1 Maintain a supply of

[0063] In step S106 (time t1 to t2 in FIGS. 3 and 4), the first controller 160 calculates a set time Tset1 based on the fuel state detected when the IGNSW 45 is turned off, for example, based on the output signal of the fuel state detection sensor 41.

[0064] In step S107 (times t1 to t2 in FIGS. 3 and 4), the first controller 160 refers to the diagnostic information stored in the nonvolatile memory, and if the RTC 130 is normal (YES), the process proceeds to step S108. On the other hand, if the RTC 130 is faulty (NO), the first controller 160 proceeds to step S112.

[0065] In step S108 (time t2 in FIG. 3), the first controller 160 transmits the calculated value T1 calculated in step S106 to the RTC 130 as information related to the set time Tset1.

[0066] In step S109 (times t2 to t3 in FIG. 3), the first controller 160 transmits the set time Tset1=0 (zero) as information related to the set time Tset1 to the second ECU 200 via the communication control circuit 140 and the in-vehicle communication network 40. The first controller 160 also transmits diagnostic information indicating that the soak timer of the RTC 130 is normal to the second ECU 200 via the communication control circuit 140 and the in-vehicle communication network 40. The reason for transmitting the set time Tset1=0 (zero) to the second ECU 200 as information related to the set time Tset1 is to prevent the second ECU 200 from measuring the elapsed time after the IGNSW 45 is turned off.

[0067] In step S110 (times t2 to t3 in FIG. 3 and times t2 to t4 in FIG. 4), the first controller 160 uses its own timing means to determine whether a predetermined SSOFF period has ended since the turning-off operation of the IGNSW 45. If the predetermined SSOFF period has ended (YES), the first controller 160 proceeds to step S111, whereas if the predetermined SSOFF period has not ended (NO), the first controller 160 executes step S110 again.

[0068] In step S111 (time t3 in FIG. 3, time t4 in FIG. 4), the first controller 160 controls the power supply voltage V REG1 In order to cut off the supply of the current, the self-holding signal SH1 is changed from H level to L level, thereby completing the first pre-processing of the leak diagnosis process.

[0069] In step S112 (time t2 in FIG. 4), the first controller 160 transmits the calculated value T1 calculated in step S106 to the second ECU 200 as information related to the set time Tset1 via the communication control circuit 140 and the in-vehicle communication network 40. The first controller 160 also transmits diagnostic information indicating that the soak timer of the RTC 130 has failed to the second ECU 200 via the communication control circuit 140 and the in-vehicle communication network 40. In this way, when the RTC 130 has failed, the first controller 160 does not transmit the calculated value T1 calculated in step S106 to the RTC 130 as information related to the set time Tset1, thereby invalidating the measurement of the elapsed time by the RTC 130.

[0070] After executing step S112, the first controller 160 further executes steps S110 and S111. The above steps S101 to S112 correspond to the first pre-processing of the leak diagnosis processing.

[0071] 6, in step S113 (times t4 to t5 in FIG. 3, and times t5 to t6 in FIG. 4), the first controller 160 performs a control process to establish the conditions for performing the leak diagnosis, and then performs the leak diagnosis, as described above. The results of the leak diagnosis are stored in a nonvolatile memory or the like of the first controller 160.

[0072] In step S114 (times t4 to t5 in FIG. 3, and times t5 to t6 in FIG. 4), if the alarm signal ALM1 is at an H level (YES), the first controller 160 determines that activation has occurred based on the alarm signal ALM1, and proceeds to step S115. On the other hand, if the alarm signal ALM1 is at an L level (NO) in step S114, the first controller 160 determines that activation has occurred due to an activation request signal from the second ECU 200, and proceeds to step S116.

[0073] In step S115 (time t5 in FIG. 3), first controller 160 transmits a reset request signal to RTC 130 to reset the count value of the soak timer of RTC 130. This ends the basic processing of the leak diagnosis processing. Meanwhile, in step S116 (time t6 in FIG. 4), first controller 160 transmits an end notification to second ECU 200 indicating that the basic processing has ended. This ends the basic processing of the leak diagnosis processing. The above-mentioned step S101 and steps S113 to S116 correspond to the basic processing of the leak diagnosis processing.

[0074] FIG. 7 shows a configuration in which the second controller 260 controls the power supply voltage V REG2 10 shows an example of a timing function compensation process that is executed once each time the device is started up upon receiving a supply of the timing function compensation process.

[0075] In step S201 (before time t1 or time t5 in FIG. 4), similar to step S101 of the leak diagnosis processing, the second controller 260 determines whether or not the device has been started by turning on the IGNSW 45. If the second controller 260 determines that the device has been started by turning on the IGNSW 45 (YES), the process proceeds to step S202. On the other hand, if the second controller 260 determines that the device has not been started by turning on the IGNSW 45 (NO), the second controller 260 determines that the device has been started based on the alarm signal ALM2, and the process proceeds to step S210.

[0076] In step S202 (before time t1 in FIG. 4), the second controller 260 determines whether the IGNSW 45 has been turned off, similarly to step S104 of the leak diagnosis processing. If the second controller 260 determines that the IGNSW 45 has been turned off (YES), the second controller 260 proceeds to step S203 to transition to the SSOFF period. On the other hand, if the second controller 260 determines that the IGNSW 45 has not been turned off (NO), the second controller 260 executes step S202 again.

[0077] In step S203 (time t1 in FIG. 4), the second controller 260 changes the self-holding signal SH2 from L level to H level to enable operation in the SSOFF period, similarly to step S105 of the first pre-processing, and REG2 Maintain a supply of

[0078] In step S204 (time t2 in FIG. 4), the second controller 260 receives information about the set time Tset1 and diagnostic information about the RTC 130 from the first ECU 100 via the in-vehicle communication network 40 and the communication control circuit 240. Then, the information about the set time Tset1 and the diagnostic information about the RTC 130 are stored in a writable nonvolatile memory. The information about the set time Tset1 in this step is information that sets the set time Tset1 to the calculated value T1 or information that sets the set time Tset1 to 0 (zero).

[0079] In step S205 (times t2 to t3 in FIG. 4), the second controller 260 determines whether the set time Tset1 is 0 (zero) or not, based on the information related to the set time Tset1 received in step S204. If the second controller 260 determines that the set time Tset1 is 0 (zero) (YES), the process proceeds to step S206. On the other hand, if the second controller 260 determines that the set time Tset1 is not 0 (zero) (NO), the process proceeds to step S208, and steps S206 and S207 are omitted.

[0080] In step S206 (times t2 to t3 in FIG. 4), the second controller 260 determines whether the soak timer of the RTC 130 is faulty based on the diagnostic information received in step S204. If the second controller 260 determines that the soak timer of the RTC 130 is faulty (YES), the process proceeds to step S207. On the other hand, if the second controller 260 determines that the soak timer of the RTC 130 is normal (NO), the process proceeds to step S208, and step S207 is omitted. Note that if the set time Tset1≠0 in step S205, the soak timer of the RTC 130 is faulty, and therefore step S206 may be omitted.

[0081] In step S207 (time t3 in FIG. 4), the second controller 260 transmits the calculated value T1 to the timer unit 230 as information on the set time Tset1 based on the information on the set time Tset1 received in step S204.

[0082] In step S208 (times t3 to t4 in FIG. 4), the second controller 260 determines whether or not the predetermined SSOFF period has ended since the IGNSW 45 was turned off, similarly to step S110. If the predetermined SSOFF period has ended (YES), the second controller 260 proceeds to step S209 and determines whether or not the power supply voltage V REG2 The second controller 260 changes the self-holding signal SH2 from H level to L level to cut off the supply of the current (time t4 in FIG. 4). This ends the second pre-processing of the timing function compensation process. On the other hand, if the predetermined SSOFF period has not ended (NO), the second controller 260 executes step S208 again. The above steps S201 to S209 correspond to the second pre-processing of the timing function compensation process.

[0083] In step S210, the second controller 260 transmits a start-up request signal to the first ECU 100 via the communication control circuit 240 and the in-vehicle communication network 40.

[0084] In step S211, the second controller 260 determines whether or not an end notification has been received from the first ECU 100 via the in-vehicle communication network 40 and the communication control circuit 240. If the second controller 260 determines that an end notification has been received (YES), the process proceeds to step S212, whereas if the second controller 260 determines that an end notification has not been received (NO), the second controller 260 executes step S211 again.

[0085] In step S212, the second controller 260 transmits a stop request signal to the first ECU 100 via the communication control circuit 240 and the in-vehicle communication network 40, requesting that the first ECU 100 be stopped, i.e., the first controller 160 be stopped. As a result, the wake-up signal WK1 output from the communication control circuit 140 of the first ECU 100 transitions from H level to L level, and the power supply relay 120 changes to the OFF state. As a result, the power supply voltage V REG1 When the supply of power is cut off, the first controller 160 transitions to a shutdown state.

[0086] In step S213, second controller 260 transmits a reset request signal to timing unit 230 to reset the count value of the soak timer of timing unit 230. This ends the start / stop process of the timing function compensation process. The above steps S201 and S210 to S213 correspond to the start / stop process of the timing function compensation process.

[0087] As described above, in the vehicle electronic control system according to the first embodiment, when the first controller 160 diagnoses that the RTC 130 has failed, it notifies the second controller 260 of the failure information, and the timing unit 230 measures the elapsed time since the IGNSW 45 was turned off. That is, even if the soak timer of the RTC 130 fails, the timing function can be compensated for by the timing unit 230. Therefore, the second controller 260 is activated when the elapsed time since the IGNSW 45 was turned off reaches the set time Tset1, and can activate the first controller 160 via the in-vehicle communication network 40. This enables the first ECU 100 to perform a leak diagnosis at the appropriate timing when the elapsed time since the IGNSW 45 was turned off reaches the set time Tset1.

[0088] [Second embodiment] Next, a vehicle electronic control system according to a second embodiment will be described. Note that the same components as those in the vehicle electronic control system according to the first embodiment will be assigned the same reference numerals, and their description will be omitted or simplified. This also applies to the following embodiments.

[0089] In the vehicle electronic control system according to the first embodiment, the second ECU 200 is activated when the time elapsed since the IGNSW 45 was turned off, as measured by the timer 230, reaches the set time Tset1. However, in the vehicle electronic control system according to the second embodiment, the second ECU 200 is configured to be activated when the time elapsed since the IGNSW 45 was turned off, as measured by the timer 230, reaches the set time Tset2 that is independent of the set time Tset1. The set time Tset2 specifies, for example, the time until the second ECU 200 performs a predetermined control process (remaining battery charge check) that is not related to the fuel vapor processing, after the IGNSW 45 is turned off.

[0090] 8 and 9 show a second embodiment of the electronic control system for a vehicle in which the first controller 160 controls the power supply voltage V REG1 1 shows an example of a leak diagnosis process that is executed once each time the supply of power is received and the engine is started.

[0091] 8, in step S301, the first controller 160 performs the same process as step S101 in Fig. 5. If the first controller 160 determines that the RTC 130 has been started by turning on the IGNSW 45 (YES), the process proceeds to step S302, whereas if the first controller 160 determines that the RTC 130 has not been started by turning on the IGNSW 45 (NO), the process proceeds to step S314 in Fig. 9. Also, in steps S302 to S307, the first controller 160 performs the same process as steps S101 to S107 in Fig. 5. If the RTC 130 is normal in step S307 (YES), the first controller 160 proceeds to step S308, where it performs the same process as step S108 in Fig. 5. On the other hand, if the RTC 130 has failed (NO) in step S307, the first controller 160 proceeds to step S312 and performs the same process as step S112 in FIG.

[0092] The second ECU 200 does not determine whether the elapsed time since the IGNSW 45 was turned off has reached the set time Tset1. Therefore, in step S309, the first controller 160 transmits diagnostic information indicating that the soak timer of the RTC 130 is normal, but does not necessarily transmit information regarding the set time Tset1. Also, in step S312, the first controller 160 transmits diagnostic information indicating that the soak timer of the RTC 130 is faulty, but does not necessarily transmit information regarding the set time Tset1.

[0093] After executing step S312, the first controller 160, in step S313, receives from the second ECU 200 via the in-vehicle communication network 40 and the communication control circuit 140 the time when the IGNSW 45 is turned off (hereinafter referred to as the "off time") t off The information of the off time t off The information is stored in the writable nonvolatile memory of the first controller 160. off The reason why the information is received from the second ECU 200 is that the time information acquired using the timekeeping function of the failed RTC 130 is unreliable.

[0094] After executing step S309 or step S313, the first controller 160 sequentially executes step S310, which is similar to step S110 in Fig. 5, and step S311, which is similar to step S111 in Fig. 5. This completes the first pre-processing of the leak diagnosis processing. The above steps S301 to S313 correspond to the first pre-processing of the leak diagnosis processing.

[0095] 9, if the alarm signal ALM1 is at an H level in step S314 (YES), the first controller 160 determines that activation has occurred based on the alarm signal ALM1, and proceeds to step S315. Then, in step S315, the first controller 160 performs a leak diagnosis similar to step S113 in FIG. 6, and in the subsequent step S316, transmits a reset request signal to the RTC 130 similar to step S115 in FIG. 6. This completes the basic process of the leak diagnosis process. On the other hand, if the alarm signal ALM1 is at an L level in step S314 (NO), the first controller 160 determines that activation has occurred due to receipt of an activation request signal from the second ECU 200, and proceeds to step S317.

[0096] In step S317, the first controller 160 receives the start time t on Receives information at startup time t on is the time when the second ECU 200 is activated based on the alarm signal ALM2, as will be described later, and is temporarily stored in the volatile memory of the first controller 160.

[0097] In step S318, the first controller 160 determines the off time t off The start time t stored in step S317 on The time from when the IGNSW 45 is turned off to when the first controller 160 is started is calculated as the down time ΔTdown.

[0098] In step S319, the first controller 160 determines whether the stop time ΔTdown calculated in step S318 is within a predetermined range including the set time Tset1 (Tset1-α≦ΔTdown≦Tset1+β), where α and β are positive constants, and the predetermined range defined by the constants α and β is a range in which variation in the results of a leak diagnosis can be ignored when the leak diagnosis is performed based on the fuel state when a stop time ΔTdown within the predetermined range has elapsed since the IGNSW 45 was turned off.

[0099] In step S319, if the first controller 160 determines that the stop time ΔTdown is within the predetermined range (YES), the process proceeds to step S320 to perform a leak diagnosis. On the other hand, in step S319, if the first controller 160 determines that the stop time ΔTdown is outside the predetermined range (NO), the process skips the leak diagnosis in step S320 and proceeds to step S321. In step S321, the first controller 160 transmits a completion notification to the second ECU 200 indicating that the basic processing has been completed, similar to step S116 in FIG. 6. This completes the basic processing of the leak diagnosis processing. The above-described steps S301 and S314 to S321 correspond to the basic processing of the leak diagnosis processing.

[0100] FIG. 10 shows a vehicle electronic control system according to the second embodiment, in which the second controller 260 controls the power supply voltage V REG2 10 shows an example of a timing function compensation process that is executed once each time the device is started up upon receiving a supply of the timing function compensation process.

[0101] In step S401, the second controller 260 performs the same process as step S201 in Fig. 7. If the second controller 260 determines that the IGNSW 45 has been activated by an ON operation (YES), the process proceeds to step S402, whereas if the second controller 260 determines that the IGNSW 45 has not been activated by an ON operation (NO), the process proceeds to step S410.

[0102] In steps S402 and S403, the second controller 260 performs the same processes as steps S201 to S203 in Fig. 7. Then, in step S404, the second controller 260 receives diagnostic information of the RTC 130 from the first ECU 100 via the in-vehicle communication network 40 and the communication control circuit 240, and stores this information in a writable non-volatile memory. However, the second ECU 200 does not determine whether the elapsed time since the IGNSW 45 was turned off has reached the set time Tset1, and therefore the second controller 260 does not receive information regarding the set time Tset1 from the first ECU 100. For the same reason, the process of step S205 in Fig. 7 is also omitted.

[0103] In step S405, the second controller 260 performs the same process as step S206 in Fig. 7. If the second controller 260 determines that the soak timer of the RTC 130 is faulty (YES), the process proceeds to step S406. On the other hand, if the second controller 260 determines that the soak timer of the RTC 130 is normal (NO), the process proceeds to step S407, and step S406 is omitted.

[0104] In step S406, the second controller 260 receives the off time t off The information is transmitted to the first ECU 100. off is not limited to the exact time when the IGNSW 45 is turned off, but may be acquired as any time from when it is determined in step S402 that the IGNSW 45 has been turned off until when step S406 is executed.

[0105] In step S407, second controller 260 transmits information related to set time Tset2 to clock unit 230. Then, in step S408, second controller 260 performs the same process as step S208 in Fig. 7, and in step S409, performs the same process as step S209 in Fig. 7. This completes the second pre-processing of the clock function compensation process. The above steps S401 to S409 correspond to the second pre-processing of the clock function compensation process.

[0106] 7, in step S410, second controller 260 transmits a start-up request signal not only to first ECU 100 but also to other ECUs that are to be started in the predetermined control process. In step S411, the same process as in step S405 is performed. Then, in step S411, if second controller 260 determines that the soak timer of RTC 130 is faulty (YES), the process proceeds to step S412. On the other hand, in step S411, if second controller 260 determines that the soak timer of RTC 130 is normal (NO), the soak timer of RTC 130 is counting, so the process proceeds to step S413 and step S412 is omitted.

[0107] In step S412, the second controller 260 calculates the start time t on and transmits the obtained start time t on The information is transmitted to the first ECU 100. on The start / stop time is not limited to the exact time when the second controller 260 is started up, but may be acquired as any time from when it is determined in step S401 that the IGNSW 45 has not been started up due to an OFF operation until the time when step S412 is executed. Then, in step S413, the second controller 260 performs the same process as step S211 in Fig. 7, and further in step S414 performs the same process as step S212 in Fig. 7. This completes the start / stop process of the timing function compensation process. The above steps S401 and S410 to S414 correspond to the start / stop process of the timing function compensation process.

[0108] In this way, in the vehicle electronic control system according to the second embodiment, when the first ECU 100 diagnoses that the RTC 130 has failed, it notifies the second ECU 200 of the failure information, and the second ECU 200 notifies the second ECU 200 of the off time t offOn the other hand, the second ECU 200 is activated when the elapsed time after the IGNSW 45 is turned off reaches the set time Tset2, without depending on the set time Tset1, and transmits an activation request signal to the first ECU 100. The activated first controller 160 receives the activation time t on The information is received and the off time t off and startup time t on The first ECU 100 determines whether the stop time ΔTdown calculated from is within a predetermined range including the set time Tset1. Therefore, even if the soak timer of the RTC 130 fails, the timing function can be compensated for by the timing unit 230. This allows the first ECU 100 to perform a leak diagnosis at an appropriate timing according to the set time Tset1, based on the elapsed time after the IGNSW 45 is turned off.

[0109] [Third embodiment] Next, a vehicle electronic control system according to a third embodiment will be described. In this embodiment, the vehicle electronic control system uses a timing function of an ECU other than the first and second ECUs 100 and 200 to ensure the timing accuracy of the timing unit 230 of the second ECU 200 and improve the reliability of the timing function compensation.

[0110] 11 shows an example of a configuration related to the leak diagnosis process in the vehicle electronic control system according to the third embodiment. This vehicle electronic control system includes a third ECU 300 for measuring time in parallel with the timing unit 230 to ensure the timing accuracy of the timing unit 230.

[0111] The third ECU 300 has, as its main components, a power supply circuit 310, a power supply relay 320, a timer unit 330, a communication control circuit 340, an OR circuit 350, and a third controller 360, which correspond to the main components of the second ECU 200, respectively. Therefore, the main components of the third ECU 300 can be explained by replacing the above description of the main components of the second ECU 200 as follows. That is, the power supply line 200A can be replaced with the power supply line 300A, the power supply circuit 210 with the power supply circuit 310, the power supply relay 220 with the power supply relay 320, the timer unit 230 with the timer unit 330, the communication control circuit 240 with the communication control circuit 340, the OR circuit 250 with the OR circuit 350, and the second controller 260 with the third controller 360, respectively. REG2 is the power supply voltage V REG3 The alarm signal ALM2 can be read as the alarm signal ALM3, and the self-holding signal SH2 can be read as the self-holding signal SH3.

[0112] However, instead of the timing function compensation process performed by the second controller 260, the third controller 360 performs a process (hereinafter referred to as "parallel timing process") of having the timing unit 330 perform timing in parallel with the timing unit 230 of the second ECU 200. Furthermore, the timing unit 330 is configured to be able to transmit timing data from its soak timer to the third controller 360, but does not have to output an alarm signal based on the timing data.

[0113] [Example 1] First, a first example of a vehicle electronic control system according to the third embodiment will be described. This first example is the vehicle electronic control system according to the first embodiment, with a third ECU 300 that executes parallel timing processing incorporated. As a result, the first controller 160 performs the leak diagnosis processing of Figures 5 and 6, while the second controller 260 performs processing that is partially different from the timing function compensation processing of Figure 7.

[0114] FIG. 12 shows a first example of a vehicle electronic control system according to the third embodiment, in which the second controller 260 controls the power supply voltage V REG112 shows an example of a clock function compensation process that is executed once each time the clock function compensation process is started upon receiving a supply of clock signal. The clock function compensation process shown in FIG. 12 differs from the clock function compensation process shown in FIG. 7 in that steps S207A, S210A, S210B, and S210C are added.

[0115] If the second controller 260 determines in step S205 that the set time Tset1≠0 and further determines in step S206 that the soak timer of the RTC 130 is malfunctioning, it performs step S207A in addition to step S207. In step S207A, the second controller 260 transmits a measurement start request signal to the third ECU 300 via the communication control circuit 240 and the in-vehicle communication network 40 to cause the timer unit 330 to measure the elapsed time since the IGNSW 45 was turned off. On the other hand, if the second controller 260 determines in step S205 that the set time Tset1=0 or determines in step S206 that the soak timer of the RTC 130 is normal, it does not perform not only step S207 but also step S207A.

[0116] In step S210, if the alarm signal ALM2 is at H level (YES), the second controller 260 proceeds to step S210A. In step S210A, the second controller 260 transmits a startup request signal requesting startup of the third ECU 300 to the third ECU 300 via the communication control circuit 240 and the in-vehicle communication network 40. After startup of the third ECU 300, in step S210B, the second controller 260 receives information on the elapsed time T3 transmitted from the third ECU 300 in step S508 (described later) via the communication control circuit 240 and the in-vehicle communication network 40. Then, in step S210C, the second controller 260 determines whether the absolute value of the difference between the set time Tset1 and the elapsed time T3 is less than a predetermined value. In step S210C, if second controller 260 determines that the absolute value of the difference is less than the predetermined value (YES), it determines that the timekeeping accuracy of timer 230 is normal and proceeds to step S211. On the other hand, in step S210C, if second controller 260 determines that the absolute value of the difference is equal to or greater than the predetermined value (NO), it skips steps S211 to S214 and ends the timekeeping function compensation process without starting up first ECU 100.

[0117] FIG. 13 shows a first example of a vehicle electronic control system according to the third embodiment, in which the third controller 360 controls the power supply voltage V REG3 This shows an example of a parallel timing process that is executed once each time it is started up after receiving a supply of the timestamp.

[0118] In steps S501 to S503, the third controller 360 performs processing similar to the processing performed by the second controller 260 in steps S201 to S203 of Fig. 7. In addition, in steps S506 to S507, the third controller 360 performs processing similar to the processing performed by the second controller 260 in steps S208 to S209 of Fig. 7. In addition, in step S510, the third controller 360 performs processing similar to the processing performed by the second controller 260 in step S214 of Fig. 7. In the following, steps S504 to S505 and S508 to S509 of Fig. 13 will be described, and a description of steps S501 to S503, S506 to S507, and S510 will be omitted.

[0119] When the third controller 360 transitions to the SSOFF period in step S503, in step S504, it receives the measurement start request signal transmitted from the second ECU 200 in step S207A of Fig. 12 via the in-vehicle communication network 40 and the communication control circuit 340. Then, in step S505, the third controller 360 transmits the measurement start request signal received in step S504 to the timer unit 330.

[0120] Furthermore, if the third controller 360 determines in step S501 that the activation is not due to an ON operation of the IGNSW 45 (NO), the process proceeds to step S508. In step S508, the third controller 360 receives information about the elapsed time T3 after the OFF operation of the IGNSW 45, measured by the timing unit 330, from the timing unit 330. Then, in step S509, the third controller 360 transmits the information about the elapsed time T3 acquired in step S508 to the second ECU 200 via the communication control circuit 340 and the in-vehicle communication network 40.

[0121] As described above, in the first example of the vehicle electronic control system according to the third embodiment, the third ECU 300 that executes parallel timing processing is incorporated into the vehicle electronic control system according to the first embodiment, thereby ensuring the timing accuracy of the timing unit 230 of the second ECU 200 and improving the reliability of the timing function compensation.

[0122] [Example 2] Next, a second example of a vehicle electronic control system according to the third embodiment will be described. This second example is a vehicle electronic control system according to the second embodiment, which incorporates a third ECU 300 that performs parallel timing processing. The parallel timing processing performed by the third controller 360 is the same as that shown in Fig. 13 in the first example, but the first controller 160 performs processing that is partially different from the leak diagnosis processing (basic processing) shown in Fig. 9, and the second controller 260 performs processing that is partially different from the timing function compensation processing shown in Fig. 10.

[0123] FIG. 14 shows a second example of the vehicle electronic control system according to the second embodiment, in which the first controller 160 controls the power supply voltage V REG1 14 shows an example of basic processing of the leak diagnosis processing that is executed once each time the supply of power is received and the system is started up. Fig. 14 differs from the leak diagnosis processing (basic processing) of Fig. 9 in that step S316A is added.

[0124] If first controller 160 determines in step S314 that alarm signal ALM1 is at L level (NO), it proceeds to step S316A. In step S316A, first controller 160 determines whether or not it has received the basic processing request signal transmitted from second ECU 200 in step S413A, which will be described later. If first controller 160 determines that it has received the basic processing request signal (YES), it proceeds to step S317. However, if it determines that it has not received the basic processing request signal (NO), it proceeds to step S321, and steps S317 to S320 are omitted.

[0125] FIG. 15 shows a second example of the vehicle electronic control system according to the third embodiment, in which the second controller 260 controls the power supply voltage V REG1 15 shows an example of a clock function compensation process that is executed once each time the clock function is started upon receiving a supply of clock signal. Figure 15 differs from the clock function compensation process of Figure 10 in that steps S411A and S411B are added and step S413 is replaced with step S413A.

[0126] After starting up the target ECUs including the first and third ECUs 100 and 300 in step S411, the second controller 260 performs step S411A. In step S411A, the second controller 260 receives information about the elapsed time T3 after the IGNSW 45 was turned off, measured by the timer 330, from the third ECU 300 via the in-vehicle communication network 40 and the communication control circuit 240, as in step S210B described above.

[0127] In step S411B, second controller 260 determines whether the absolute value of the difference between set time Tset2 and elapsed time T3 is less than a predetermined value, similar to step S210C in Fig. 12. If second controller 260 determines in step S411B that the absolute value of the difference is less than the predetermined value (YES), it determines that the timekeeping accuracy of timing unit 230 is normal, and proceeds to step S412. On the other hand, if second controller 260 determines in step S210C that the absolute value of the difference is equal to or greater than the predetermined value (NO), it proceeds to step S414, and steps S412 and S413A are omitted.

[0128] If the second controller 260 determines in step S412 that the soak timer of the RTC 130 is faulty (YES), the process proceeds to step S413A. In step S413A, the second controller 260 transmits a basic processing request signal to the first ECU 100 via the communication control circuit 240 and the in-vehicle communication network 40, requesting the first controller 160 to execute the basic processing. on Send information.

[0129] As described above, in the second example of the vehicle electronic control system according to the third embodiment, a third ECU 300 that executes parallel timing processing is incorporated into the vehicle electronic control system according to the second embodiment, thereby ensuring the timing accuracy of the timing unit 230 of the second ECU 200 and improving the reliability of the timing function compensation.

[0130] The present invention has been specifically described above with reference to preferred embodiments and modifications thereof. However, it is obvious that a person skilled in the art can adopt various modifications based on the technical ideas and teachings of the present invention.

[0131] In the second example of the vehicle electronic control system according to the second embodiment and the third embodiment, the second controller 260 performs the predetermined control process multiple times after the IGNSW 45 is turned off. Therefore, the set time Tset2 may be set multiple times at regular intervals or at predetermined times. In this case, it is advantageous to select in advance as the second ECU 200 an ECU whose difference between adjacent set times Tset2 is sufficiently smaller than the set time Tset1. This is because the increase in the stop time ΔTdown calculated each time the first ECU 100 is started in response to a start request from the second ECU 200 becomes finer, thereby improving the accuracy of determining whether the stop time ΔTdown is within the predetermined range (Tset1-α≦ΔTdown≦Tset1+β). For this reason, it is preferable to pre-select as the second ECU 200, among the multiple ECUs in the vehicle electronic control system, an ECU whose interval for performing a predetermined control process after turning off the IGNSW 45 is set to be sufficiently shorter than the expected set time Tset1.

[0132] In the second example of the vehicle electronic control system according to the second embodiment and the third embodiment, the first controller 160 does not perform a leak diagnosis if the stop time ΔTdown is not within a predetermined range (Tset1-α≦ΔTdown≦Tset1+β). However, if there is little change in the fuel condition after the set time Tset1, the first controller 160 may perform a leak diagnosis even if the stop time ΔTdown is not within the predetermined range as long as it is equal to or greater than the set time Tset1. In this case, it is necessary to select in advance as the second ECU 200 an ECU for which only one set time Tset2 or at least one of multiple set times Tset2 is longer than the set time Tset1.

[0133] In a second example of the vehicle electronic control system according to the third embodiment, when the second ECU 200 is activated based on the alarm signal ALM2, the following occurs: That is, the second controller 260 activates the third ECU 300, receives information about the elapsed time T3 measured by the timer 330, and determines whether to transmit a basic processing request signal to the first controller 160 based on the set time Tset2 and the elapsed time T3. Alternatively, when the first ECU 100 is activated by receiving the activation request signal, the following may occur: That is, the first controller 160 activates the third ECU 300, receives information about the elapsed time T3, and determines whether to perform the basic processing based on the set time Tset1 and the elapsed time T3.

[0134] In the second example of the vehicle electronic control system according to the third embodiment, when the second ECU 200 is activated based on the alarm signal ALM2, the second controller 260 transmits an activation request signal to the target ECUs including the first ECU 100. Alternatively, when the second ECU 200 is activated based on the alarm signal ALM2, the following may be performed: That is, the second controller 260 may activate the target ECUs (including the third ECU 300) other than the first ECU 100 to receive information on the elapsed time T3, and determine whether to transmit an activation request signal to the first ECU 100 based on the set time Tset2 and the elapsed time T3.

[0135] In the first to third embodiments, the second diagnostic method for diagnosing a fault in the RTC 130 may be employed only when the timing accuracy of the timer 230 of the second ECU 200 is ensured. For example, the second diagnostic method can be employed if, upon startup of the second controller 260, a specific time is measured using the timer inherent to the second controller 260 and the soak timer of the timer 230, and these two pieces of timing data do not diverge. In the third embodiment, the second diagnostic method can be employed if, upon turning off the IGNSW 45, the elapsed time is measured using the soak timers of the timer 230 and the timer 330, and these two pieces of timing data do not diverge. In the first and second embodiments, the above-described two pieces of timing data can be measured by either the first or second controller 160, 260, and in the third embodiment, they can be measured by either one of the first to third controllers 160, 260, and 360.

[0136] In the vehicle electronic control systems according to the first to third embodiments, after the SSOFF period ends, the first controller 160 is not in a shutdown state but is in a power supply voltage V REG1 However, the first controller 160 is assumed to lose its inherent timekeeping function even in the sleep state.

[0137] In the vehicle electronic control systems according to the first to third embodiments, the second controller 260 and the third controller 360 may be constantly supplied with a power supply voltage. As a result, the second ECU 200 may not have the timer unit 230 but may perform timekeeping using the timer function inherent to the second controller 260, and the third ECU 300 may not have the timer unit 330 but may perform timekeeping using the timer function inherent to the third controller 360.

[0138] In the first to third embodiments, if the ECM 14 is configured so as not to lose its timekeeping function when the IGNSW 45 is in the OFF state, the ECM 14 may perform the timekeeping function compensation process instead of the second ECU 200.

[0139] Furthermore, the technical ideas explained in the above embodiments and modifications based thereon can be used in appropriate combinations as long as no contradictions arise. [Explanation of symbols]

[0140] REFERENCE SIGNS LIST 1...internal combustion engine, 7...fuel injector, 19...fuel tank, 45...ignition switch, 100...first ECU, 130...RTC (first timing means), 200...second ECU, 230...timing unit (second timing means), 300...third ECU, 330...timing unit (third timing means), t off …off time, t on ...start time, ΔTdown...stop time, Tset1...set time (first set time), Tset2...set time (second set time), T3...elapsed time (elapsed time measured by the third timing means)

Claims

1. a first electronic control unit having a first timer capable of measuring an elapsed time after an ignition switch is turned off, and being activated to perform a first process when the elapsed time measured by the first timer reaches a first set time, the first process being a leak diagnosis process for diagnosing a leak of evaporated fuel in an evaporated fuel distribution system through which evaporated fuel flows from a fuel tank that stores fuel to be injected into a fuel injection valve of an internal combustion engine; a second electronic control unit that is communicably connected to the first electronic control unit and has a second timer that can measure the elapsed time; Equipped with An electronic control system for a vehicle, configured such that when a failure occurs in the first timing means, the second electronic control unit starts up based on the elapsed time measured by the second timing means and sends a startup request signal to the first electronic control unit requesting startup of the first electronic control unit, and the first electronic control unit disables the measurement of the elapsed time by the first timing means and performs the first processing on the condition that it has started up based on receiving the startup request signal.

2. 2. The electronic control system for a vehicle according to claim 1, wherein, when a failure occurs in the first timing means, the second electronic control unit receives information regarding the first set time from the first electronic control unit, and starts up when the elapsed time measured by the second timing means reaches the first set time, and transmits the start-up request signal to the first electronic control unit, and the first electronic control unit starts up upon receiving the start-up request signal and performs the first processing.

3. the second electronic control unit is configured to be activated when the elapsed time measured by the second timing means reaches a second set time, and to perform a second process of checking a remaining battery charge of the vehicle; 2. The electronic control system for a vehicle according to claim 1, wherein, in the event of a malfunction in the first timing means, the second electronic control unit transmits the startup request signal to the first electronic control unit when the elapsed time measured by the second timing means reaches the second set time and the second electronic control unit is started up, and when the first electronic control unit is started up in response to receiving the startup request signal, the first electronic control unit calculates the time from the turning off of the ignition switch to the startup of the first electronic control unit based on the timing data of the second timing means, and determines that the first processing should be performed when the time from the turning off of the ignition switch to the startup of the first electronic control unit is within a predetermined range including the first set time.

4. The electronic control system for a vehicle according to claim 3 , wherein a plurality of second set times can be set.

5. a third electronic control unit that is communicably connected to the second electronic control unit and has a third timer that is capable of measuring the elapsed time; 3. The electronic control system for a vehicle according to claim 2, wherein when the elapsed time measured by the second timing means reaches the first set time and the second electronic control unit is started, the second electronic control unit starts the third electronic control unit before sending the start-up request signal to the first electronic control unit, and when the absolute value of the difference between the elapsed time measured by the third timing means and the first set time is less than a predetermined value, the second electronic control unit determines that the start-up request signal should be sent to the first electronic control unit.

6. a third electronic control unit that is communicably connected to the second electronic control unit and has a third timer that is capable of measuring the elapsed time; 4. The electronic control system for a vehicle according to claim 3, wherein the second electronic control unit activates the third electronic control unit when the elapsed time measured by the second timing means reaches the second set time and is activated, and when the absolute value of the difference between the elapsed time measured by the third timing means and the second set time is less than a predetermined value, determines that the first processing should be performed and transmits the determination result to the first electronic control unit.

7. a third electronic control unit that is communicably connected to the first electronic control unit and has a third timer that is capable of measuring the elapsed time; 4. The electronic control system for a vehicle according to claim 3, wherein the first electronic control unit activates the third electronic control unit when activated by receiving the activation request signal, and determines that the first processing should be performed when the absolute value of the difference between the elapsed time measured by the third timing means and the second set time is less than a predetermined value.

8. a third electronic control unit that is communicably connected to the second electronic control unit and has a third timer that is capable of measuring the elapsed time; 4. The electronic control system for a vehicle according to claim 3, wherein when the elapsed time measured by the second timing means reaches the second set time and the second electronic control unit is started, the second electronic control unit starts the third electronic control unit before sending the start-up request signal to the first electronic control unit, and when the absolute value of the difference between the elapsed time measured by the third timing means and the second set time is less than a predetermined value, the second electronic control unit determines that the start-up request signal should be sent to the first electronic control unit.

9. An electronic control system for a vehicle as described in any one of claims 1 to 8, wherein the first set time is the time from when the ignition switch is turned off until the fuel temperature and pressure in the fuel tank stabilize to a degree that ensures the diagnostic accuracy of leak diagnosis.

10. a first electronic control unit having a first timer capable of measuring an elapsed time after an ignition switch is turned off, and being activated to perform a first process when the elapsed time measured by the first timer reaches a set time, the first process being a leak diagnosis process for diagnosing a leak of evaporated fuel in an evaporated fuel distribution system through which evaporated fuel flows from a fuel tank that stores fuel to be injected into a fuel injection valve of an internal combustion engine; a second electronic control unit that is communicably connected to the first electronic control unit and has a second timer that can measure the elapsed time; A control method for a vehicle electronic control system comprising: A control method for a vehicle electronic control system, wherein, when a failure occurs in the first timing means, the second electronic control unit starts up based on the elapsed time measured by the second timing means and sends a startup request signal to the first electronic control unit requesting startup of the first electronic control unit, and the first electronic control unit disables the measurement of the elapsed time by the first timing means and performs the first processing on the condition that it has started up based on receiving the startup request signal.

Images