Vehicle Control System

Abstract

To perform fail-safe processing depending on the state of a slave node.SOLUTION: If a power supply voltage does not fall below a first threshold, a slave node 7 notifies a master node 2 that the voltage is in a normal state. If the power supply voltage falls below the first threshold but does not fall below a second threshold, the slave node 7 notifies the master node 2 of a voltage drop state. The slave node 7 becomes unable to communicate with the master node 2 when the power supply voltage is below the second threshold. The master node 2 instructs the slave node 7 to perform fail-safe processing for safely controlling an on-vehicle device 60, based on the notification of the state of the slave node 7 and whether communication with the slave node 7 is possible.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The technology disclosed herein relates to a vehicle control system. [Background technology]

[0002] There are vehicle control systems that employ a master-slave system for controlling on-board devices installed in a vehicle. For example, Patent Document 1 discloses a master-slave vehicle interior lighting system. In this vehicle interior lighting system, each of multiple slave ECUs performs multiplex communication with a master ECU installed in the vehicle and controls a light source according to instructions from the master ECU. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-136220 Summary of the Invention [Problem to be solved by the invention]

[0004] In the vehicle control system described above, it is required to perform fail-safe processing according to the state of the slave node so that the in-vehicle device can be safely controlled even when the voltage of the slave node drops. However, Patent Document 1 does not disclose or suggest performing fail-safe processing according to the state of the slave node.

[0005] The technology disclosed herein has been made in consideration of the above points, and its purpose is to provide a vehicle control system that is capable of performing fail-safe processing depending on the state of the slave node. [Means for solving the problem]

[0006] The technology disclosed herein relates to a vehicle control system that controls an in-vehicle device mounted on a vehicle, and the vehicle control system includes: a slave node connected to the in-vehicle device and a power supply mounted in the vehicle, generating an operation signal based on a power supply voltage supplied from the power supply, and outputting the operation signal to the in-vehicle device; a master node that controls the slave nodes by communicating with the slave nodes via a communication network; The slave node notifying the master node that the slave node is in a normal voltage state when the power supply voltage supplied to the slave node does not fall below a first threshold; notifying the master node that the slave node is in a voltage drop state when the power supply voltage supplied to the slave node falls below a first threshold but does not fall below a second threshold that is lower than the first threshold; When the power supply voltage supplied to the slave node falls below the second threshold, communication with the master node is disabled; The master node instructs the slave node to perform fail-safe processing for safely controlling the in-vehicle device based on notification of the state of the slave node and whether communication with the slave node is possible.

[0007] In the above configuration, the state of the slave node can be estimated (recognized) based on the notification of the slave node state and whether communication with the slave node is possible. This allows fail-safe processing to be performed according to the state of the slave node.

[0008] In the vehicle control system, The slave node The configuration may be configured to be changeable, The configuration of the slave node may be set to a configuration having a predetermined function by the configuration data transmitted from the master node, When the power supply voltage supplied to the slave node falls below the second threshold, the configuration of the slave node may be reset to an unconfigured state.

[0009] In the above configuration, when communication between the master node and the slave node is impossible, the slave node's configuration is set to an unconfigured state, thereby stopping the output of an operation signal from the slave node to the in-vehicle device. This allows the in-vehicle device to be stopped when communication between the master node and the slave node is impossible (when the slave node cannot perform fail-safe processing).

[0010] Further, in the vehicle control system, When the power supply voltage supplied to the slave node returns to a state where it is not lower than the second threshold, the slave node may notify the master node that a configuration of the slave node has not been set, When the master node is notified that the configuration of the slave node has not been set, the master node may transmit the configuration data to the slave node.

[0011] In the above configuration, when the power supply voltage supplied to the slave node returns to a state where it does not fall below the second threshold, the configuration data transmitted from the master node can be used to set the configuration of the slave node to a configuration having a predetermined function, thereby enabling communication between the master node and the slave node.

[0012] Further, in the vehicle control system, When the configuration of the slave node is completed using the configuration data transmitted from the master node, the slave node may notify the master node that the configuration of the slave node has been completed.

[0013] In the above configuration, the master node is notified that the configuration of the slave node has been completed, and the master node can confirm that communication with the slave node is now possible. This allows communication between the master node and the slave node to resume.

[0014] Further, in the vehicle control system, When the master node instructs the slave node to perform the fail-safe processing, the master node may perform at least one of a fault diagnosis process to diagnose whether or not there is a fault in the slave node, and an indicator lighting process to light an indicator mounted on the vehicle.

[0015] In the above configuration, by performing the fault diagnosis process, it is possible to diagnose whether or not the slave node has a fault. Also, by performing the indicator lighting process, it is possible to notify the vehicle user that the power supply voltage supplied to the slave node has dropped.

[0016] In addition, in the vehicle control system, The slave node may detect a voltage value of an operation signal output to the in-vehicle device, and transmit voltage information indicating the voltage value of the operation signal to the master node. The master node may instruct the slave node to perform the fail-safe processing when a voltage value indicated in the voltage information transmitted from the slave node is abnormal.

[0017] In the above configuration, if the voltage value of the operation signal output to the in-vehicle device is abnormal, the slave node can be made to perform fail-safe processing, thereby enabling the in-vehicle device to be controlled safely. [Effects of the Invention]

[0018] According to the technology disclosed herein, fail-safe processing can be performed according to the state of the slave node. [Brief explanation of the drawings]

[0019] [Figure 1] FIG. 1 is a block diagram illustrating an example of the configuration of a vehicle control system. [Figure 2]FIG. 1 is a conceptual diagram showing an example of functional distribution between a master node and a slave node. [Figure 3] FIG. 2 is a block diagram illustrating a configuration example of a master node. [Figure 4] FIG. 2 is a block diagram showing a configuration example of a slave node. [Figure 5] FIG. 2 is a circuit block diagram showing an example of the configuration of a driver group. [Figure 6] 1 is a block diagram showing an example of the configuration of a main part of a vehicle control system; [Figure 7] FIG. 10 is a state transition diagram showing the transition of the state of a slave node. [Figure 8] 10 is a flowchart illustrating a first state transition process. [Figure 9] 10 is a flowchart illustrating a second state transition process. [Figure 10] 10 is a flowchart illustrating a third state transition process. [Figure 11] 10 is a flowchart illustrating a fourth state transition process. [Figure 12] FIG. 10 is a diagram illustrating an example of a fail-safe process. [Figure 13] FIG. 10 is a block diagram showing a configuration example of a main part of a vehicle control system according to a second modified example of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0020] Hereinafter, the embodiments will be described in detail with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference numerals and their description will not be repeated.

[0021] In this disclosure, some or all of the components indicated by the terms "system," "unit," "module," and "node" may be realized by dedicated circuits such as application specific integrated circuits (ASICs) or programmable logic arrays (PLAs). Also, some or all of the above may be realized by processor circuits that execute computer-readable instructions (e.g., programs) to perform predetermined processing steps and thereby perform specific functions.

[0022] In the following description, an "in-vehicle device" refers to a device mounted on a vehicle. The in-vehicle device has at least one of a sensor and a component to be operated (for example, a motor, an LED, etc.).

[0023] (Embodiment) Fig. 1 shows an example of the configuration of a vehicle control system according to an embodiment. As shown in Fig. 1, the vehicle control system 1 is mounted on a vehicle CA, and is configured such that a master node 2 and multiple slave units are connected via an in-vehicle communication network.

[0024] In the example of Figure 1, the multiple slave units are exemplified by a combination switch unit 4, left and right side mirror units 5, a steering switch unit 6, a cluster switch unit 31, an overhead console unit 32, left and right seat heater units 33, and left and right door latch units 34. Each slave unit is equipped with a slave node 7 (see Figure 4) that has a common configuration. For ease of explanation, the left and right side mirror units 5, door latch units 34, and seat heater units 33 are each assigned the same reference numerals.

[0025] The master node 2 and the slave nodes 7 provided in each of the multiple slave units (in this example, the combination switch unit 4, steering switch unit 6, cluster switch unit 31, right side mirror unit 5, right seat heater unit 33, and right door latch unit 34) are bus-connected by a communication line B1. Furthermore, the master node 2 and the slave nodes 7 provided in each of the other multiple slave units (in this example, the overhead console unit 32, left side mirror unit 5, left seat heater unit 33, and left door latch unit 34) are bus-connected by a communication line B2. In the following explanation, the communication lines B1 and B2 will be collectively referred to as "communication line B." The communication line B constitutes a communication network.

[0026] The communication line B is, for example, a communication line conforming to CXPI (Clock Extension Peripheral Interface). CXPI is an example of an event-based communication protocol. The communication method is not limited to CXPI, and other communication methods (whether wired or wireless) may be used. The number of communication lines used in the communication network is not particularly limited. A communication relay HUB (not shown) or ECU (not shown) may be provided along the communication line.

[0027] [Functional distribution between master node and slave node] Figure 2 is a conceptual diagram showing an example of the allocation of functions between the master node 2 and the slave node 7 in response to the actions of the vehicle CA. In Figure 2, the operational process of the vehicle CA is divided into a "recognition process Iz," a "judgment process Pz," and an "operation process Oz," and each process is subdivided. Functions 20 allocated to the master node 2 are surrounded by dashed lines, and functions 30 allocated to the slave node 7 are surrounded by solid lines.

[0028] Below, the processing executed in each of the recognition process Iz, judgment process Pz, and operation process Oz will be explained using an example in which the weather changes from sunny to rainy (hereinafter simply referred to as "weather change").

[0029] [Cognitive process] In the recognition process Iz, information acquired by the sensor is recognized based on the output signal of the sensor mounted on the on-vehicle device. In this disclosure, the term "sensor" is used to include not only sensors that measure and detect various physical quantities such as temperature, voltage, and current, but also switches that accept various operations, cameras that capture images of the interior and exterior of the vehicle, radar that recognizes targets outside the vehicle, and devices that output mechanical-electrical conversion signals. The sensors acquire vehicle behavior information, occupant operation information, occupant status information, external environment information, information on the current flowing through the actuator, information on the voltage applied to the actuator, fault status information, and the like. Hereinafter, these will be collectively referred to as "detection information."

[0030] The recognition process Iz includes processes Iz2 and Iz3 executed in the slave node 7 and processes Iz4 and Iz5 executed in the master node 2. Note that, although an example in which the in-vehicle device is implemented in the slave node 7 will be described below, the in-vehicle device may also be provided outside the slave node 7.

[0031] First, in step Iz1, some kind of detection information is detected by a sensor mounted on the in-vehicle device. In the example of "weather change" mentioned above, the detection information (e.g., the adhesion of raindrops, a change in the amount of received light, etc.) is detected by a raindrop sensor and a light receiving sensor (not shown).

[0032] In the next step Iz2, the slave node 7 receives the output of the sensor via a port P, which will be described later. The output of the sensor includes, for example, a detection signal of the sensor, physical quantities such as current, voltage, and temperature detected by the sensor, and a mechanical-electrical conversion signal.

[0033] In the next step Iz3, the slave node 7 performs signal processing and data processing on the sensor output, and transmits the signal obtained by these processes as a detection signal to the master node 2. The detection signal transmitted from the slave node 7 to the master node 2 is a signal conforming to CXPI.

[0034] Signal processing is, for example, a process of separating information output from a sensor into "significant information" and "insignificant information" and extracting only the significant information. An example of signal processing is a filtering process such as a chattering filter. Data processing is, for example, a process of converting discrete information into information suitable for continuous processing. An example of data processing is a process of obtaining a continuous signal by performing moving average processing on discrete data when performing continuous processing such as PID control in the subsequent data processing.

[0035] That is, in steps Iz2 and Iz3, the slave node 7 converts the output of the sensor into a predetermined signal format and transmits it to the master node 2 as a detection signal without recognizing or determining the specific content of the input information (detection information).

[0036] In the next step Iz4, the master node 2 receives the detection signal transmitted from the slave node 7. In the next step Iz5 (information processing), the master node 2 recognizes the specific content of the detection information input from the sensor to the slave node 7 based on the change over time of the detection signal and the connection data described below. In the example of "weather change" mentioned above, the information processing provides recognition information such as "the light intensity transmitted through the windshield has fallen below a predetermined value, making it dark outside the car, and it has started to rain." Note that, hereinafter, the information recognized in the recognition step will be referred to as "recognition information."

[0037] [Judgment process] In the determination process Pz, the behavior and response of the vehicle CA are determined based on the recognition information recognized in the recognition process Iz. Processes Pz1 to Pz4, which are components of the determination process Pz, are executed by the master node 2.

[0038] Specifically, in step Pz1, the master node 2 determines the behavioral purpose of the vehicle CA based on the recognition information recognized in the recognition step Iz. In the example of "weather change" mentioned above, the purpose determined is, for example, "to behave appropriately when it becomes dark outside the vehicle and starts to rain."

[0039] In the next step Pz2, the master node 2 sets an action plan to achieve the objective determined in step Pz1. At this time, action plans including alternative measures are listed. For example, an action list listing action plans is generated. In the example of "weather change" mentioned above, the action plan corresponding to "behavior when the outside environment is dark and it is raining" includes action plans such as "operate the wipers," "turn on the automatic headlight function of the vehicle CA," and "limit the upper speed limit of the vehicle CA."

[0040] In the next step Pz3, the master node 2 determines which of the actions listed in the action plan will actually be executed. For example, the master node 2 selects an action to actually be executed from the action list. In the example of "weather change" mentioned above, for example, the actions "turn on the wipers" and "turn on the vehicle's automatic headlight function" are selected as the actions to be executed.

[0041] In the next step Pz4, the master node 2 selects a means (a response means) for realizing the action determined in step Pz3. In the example of "weather change" mentioned above, for example, a wiper unit (not shown), a headlight unit (not shown), and a taillight unit (not shown) are selected for the actions "turn on the wipers" and "turn on the vehicle's automatic light function."

[0042] [Operating process] The operation process Oz includes processes Oz1 and Oz2 executed in the master node 2 and processes Oz3 to Oz5 executed in the slave node 7.

[0043] First, in step Oz1, the master node 2 determines an operation target and its operation amount for realizing the action or response determined in the judgment step Pz. Here, the operation target broadly includes objects that are operated to realize the action or response, and includes, for example, lighting devices and actuators. Lighting devices include various LEDs and bulbs used for headlights, indicators, turn signals, etc. Actuators include body-related devices such as wiper and mirror drive motors, and power-related devices used for the engine, brakes, etc.

[0044] In the example of "weather change" mentioned above, for example, the operation of the wiper unit may determine whether to turn on the windshield wipers and the operation speed and interval of the wipers, while the operation of the headlight unit and taillight unit may determine whether to turn on the headlights and taillights and their illuminance.

[0045] In the next step Oz2, the master node 2 executes the following processes: (1) identifies the port P (hereinafter referred to as "operation port P") to which the operation target is connected based on the connection data; (2) generates an instruction code instructing the output content of the operation port P; and (3) transmits an operation instruction signal including the instruction code to the slave node provided with the operation port P. In the example of "weather change" mentioned above, for example, the master node 2 transmits an instruction code (operation instruction signal) instructing the output content of the operation port P to which the wipers are connected to the wiper unit (not shown), transmits an instruction code indicating the output content of the operation port P to which the headlights are connected to the headlight unit (not shown), and transmits an instruction code indicating the output content of the operation port P to which the taillights are connected to the taillight unit (not shown). Note that the operation instruction signal transmitted from the master node 2 to the slave node 7 is a signal conforming to CXPI.

[0046] Each slave node 7 receives the command code transmitted from the master node 2, and outputs an operation signal based on the command code from an operation port P based on the command code.

[0047] Specifically, the slave node 7 generates a signal to be output from the operation port P based on the instruction code after converting the protocol of the instruction code and / or referring to a specified register (step Oz3). Then, it outputs an operation signal from the operation port P specified by the instruction code to an in-vehicle device (specifically, a device to be operated that is included in the in-vehicle device) (step Oz4). As a result, (1) the wiper unit drives the wipers, (2) the headlight unit turns on the headlights, and (3) the taillight unit turns on the taillights.

[0048] Next, the configurations of the master node 2 and the slave units will be described in detail with reference to FIGS.

[0049] [Master node] 3 shows an example of the configuration of the master node 2. As shown in FIG. 3, the master node 2 includes a communication module 21, a recognition module 22, a determination module 23, an operation module 24, and a memory 25.

[0050] The master node 2 is configured, for example, by one or more electronic control units (ECUs). The electronic control unit may be configured using a single integrated circuit (IC) or multiple ICs. Furthermore, the IC may include a single core or die, or multiple cooperating cores or dies.

[0051] The communication module 21 has the function of receiving signals from each slave node 7 via the communication line B and transmitting signals to each slave node 7.

[0052] The memory 25 stores configuration data corresponding to each slave node 7 (hereinafter referred to as "master configuration data").

[0053] The master configuration data includes initial configuration data set in each slave node 7 and connection data. In other words, the master node 2 holds the initial configuration data set in each slave node 7. The connection data is data indicating the connection relationship between each port P of the slave node 7 and the device port of the in-vehicle device. In other words, the connection data is data indicating what function the device port of the in-vehicle device is connected to each port P of the slave node 7.

[0054] The memory 25 may be an internal memory built into the IC constituting the ECU, or an external memory attached to the IC. The memory may store, for example, a program for operating a CPU mounted on the IC, or information such as the processing results of the CPU.

[0055] The recognition module 22 executes the recognition process of steps Iz4 and Iz5 of the above-mentioned recognition process Iz. Specifically, the recognition module 22 executes the recognition process to recognize the detection information acquired by the on-board device (specifically, the sensor included in the on-board device) based on the connection data stored in the memory and the detection signal (e.g., a change over time in the detection signal) received from the slave node. The detection signal indicates what kind of sensor output is input to which port of the slave node 7. The connection data indicates which on-board device is connected to which port of the slave node 7.

[0056] In this example, the recognition module 22 includes a decoding module 221 and an information module 222. The decoding module 221 performs decoding processing of the detection signal received from the slave node 7. The information module 222 performs the information processing of the above-mentioned step Iz5.

[0057] The determination module 23 executes the determination processing of the above-mentioned determination process Pz (specifically, processes Pz1 to Pz4). Specifically, the determination module 23 determines the behavior of the vehicle CA based on the recognition information recognized in the recognition process by the recognition module 22.

[0058] In this example, the judgment module 23 includes a goal determination module 231 that executes the aforementioned process Pz1, an action planning module 232 that executes the aforementioned process Pz2, an action determination module 233 that executes the aforementioned process Pz3, and a response determination module 234 that executes the aforementioned process Pz4.

[0059] The operation module 24 executes the processes of steps Oz1 and Oz2 of the operation step Oz. Specifically, the operation module 24 identifies an in-vehicle device corresponding to the vehicle action determined in the determination process, generates a command code for commanding the operation of the identified in-vehicle device (specifically, a device to be operated that is included in the in-vehicle device), and transmits the command code to the slave node 7 to which the identified in-vehicle device is connected.

[0060] In this example, the operation module 24 includes an operation determination module 241 that executes the above-mentioned process Oz1, and an instruction generation module 242 that executes the above-mentioned process Oz2.

[0061] [Slave unit] FIG. 4 shows an example of the configuration of the combination switch unit and the right side mirror unit 5 (hereinafter referred to as "right side mirror unit 5") among the slave units shown in FIG.

[0062] 4, the combination switch unit 4 and the right side mirror unit 5 are each provided with a common slave node 7. Each slave node 7 is provided with 12 ports P for connecting in-vehicle devices.

[0063] In this example, in the combination switch unit 4, a wiper switch 41 that operates the wipers is connected to ports P1 to P4, a light switch 42 that operates the lights is connected to ports P5 to P9, and a turn switch 43 that operates the turn lights is connected to ports P10 and P11. P12 is a reserve port. The wiper switch 41, the light switch 42, and the turn switch 43 are examples of in-vehicle devices that include only sensors.

[0064] Similarly, in the right side mirror unit 5, a turn light LED 51 (hereinafter referred to as "turn LED 51") is connected to ports P1 and P2, an indicator LED 52 is connected to ports P3 to P6, and a mirror folding motor 53 is connected to ports P7 to P12. The turn LED 51, LED 52, and motor 53 are examples of in-vehicle devices that have both a sensor and a device to be operated.

[0065] [Slave node] Each slave node 7 includes a communication module 71, a register 72, a selector 73, and a group of drivers 74.

[0066] The communication module 71 is connected to the communication module 21 of the master node 2 via the communication line B, and is configured to enable two-way communication conforming to CXPI. The communication module 71 includes, for example, an input / output circuit connected to the communication line B, an encoder that generates a signal output from the input / output circuit, and a decoder that converts the signal output from the input / output circuit. Note that, since a conventionally known configuration can be applied to the specific circuit configuration of the communication module 71, a detailed description thereof will be omitted here.

[0067] The driver group 74 includes a plurality of driver units 740 (not shown in FIG. 4) connected one-to-one to a plurality of ports P. For example, if the slave node 7 is provided with 12 ports P, the driver group 74 includes 12 driver units 740.

[0068] The driver unit 740 is an IO circuit that can be used as an input port or an output port depending on external settings. As the driver unit 740, for example, a conventionally known general-purpose input / output circuit (GPIO: General Purpose Input / Output) can be applied.

[0069] [Driver unit] Fig. 5 shows an example configuration of the driver unit 740. As shown in Fig. 5, the driver unit 740 includes an output circuit 743 connected to a port P, and a driver circuit 741 that drives the output circuit 743 based on the setting value of an output register 742. The setting value of the output register 742 can be rewritten by a setting signal input from the OUT terminal.

[0070] The driver unit 740 includes an input circuit 745 that receives an input to port P, and a receiver circuit 746 that converts the input received by the input circuit 745 into a detection signal. The receiver circuit 746 includes an AD converter 747 and a comparator 748. If the attribute of port P is analog input, the AD converter 747 performs analog-to-digital conversion of the input to port P and outputs the result from the AI ​​terminal. If the attribute of port P is digital input, the comparator 748 outputs the input to port P as a digital signal from the DI terminal.

[0071] The driver unit 740 is configured to be able to change the settings of each component based on the configuration signal. For example, the driver unit 740 is configured to be able to change the filter constant of the digital filter of the receiver circuit 746 based on the configuration signal.

[0072] The selector 73 has the function of selecting which terminal of each driver unit 740 (OUT terminal, AI terminal, DI terminal) to enable based on the attribute information of each port P recorded in the register 72.

[0073] When the AI ​​terminal is enabled, an analog input signal is input from port P. In this case, the analog input signal is converted into a digital signal by input circuit 745 and AD converter 747, output from the AI ​​terminal, and written to register 72 via selector 73.

[0074] When the DI terminal is enabled, a digital input signal is input from the port P. In this case, the digital input signal is output from the DI terminal via the input circuit 745 and the comparator 748, and written to the register 72 via the selector 73.

[0075] When the OUT terminal is enabled, output setting data based on the instruction code is reflected in the output register 742 of the driver circuit 741. The driver circuit 741 drives the output circuit 743 to output an operation signal (either a digital signal, an analog signal, or a PWM signal) based on the output setting data of the output register 742 from the port P.

[0076] Here, the output setting data is generated, for example, based on a command code received from the master node 2, using a logic circuit (not shown) in the selector 73 or the value of the register 72. In other words, an output setting based on the command code is made in the output register 742 of the driver circuit 741 connected to the port P based on the command code. Then, the output circuit 743 outputs an operation signal based on the command code via the port P based on the output setting data. The command code is, for example, a code including identification data of the port P to which the operation target is connected and the output setting of each port P linked to the identification data.

[0077] As for the specific circuit configuration of the selector, a conventionally known configuration can be used, and therefore a detailed description thereof will be omitted here.

[0078] The register 72 stores configuration data (hereinafter referred to as "slave configuration data") set for each slave node 7. The configuration data includes attribute data of each port P.

[0079] The slave configuration data includes, for example, (1) attribute data of each port P, (2) filter constants of ports P whose attribute is input (hereinafter simply referred to as "input port P"), (3) WakeUp setting data based on input signals to the input port P, and (4) output setting data of ports P whose attribute is output (hereinafter simply referred to as "output port P").

[0080] In this disclosure, the initial setting information of the slave configuration data is referred to as “initial configuration data.” The initial configuration data may be transmitted from the master node 2 to the slave nodes 7 at a predetermined timing (for example, when the power is turned on), or may be set in each slave node 7 in advance.

[0081] [Key parts of the vehicle control system] Next, a main part of the vehicle control system 1 according to the embodiment will be described with reference to Fig. 6. The vehicle control system 1 controls an in-vehicle device 60 mounted on a vehicle. The vehicle control system 1 includes a slave node 7 and a master node 2.

[0082] The slave node 7 is connected to an in-vehicle device 60 and a power supply 8 mounted on the vehicle. For example, the in-vehicle device 60 is a seat heater. The power supply 8 is a DC power supply that supplies a DC power supply voltage. For example, the power supply 8 is a battery mounted on the vehicle. Note that the power supply 8 is not shown in FIGS. 1 and 4.

[0083] The slave node 7 generates an operation signal based on the power supply voltage supplied from the power supply 8, and outputs the operation signal to the in-vehicle device 60 (specifically, a device to be operated that is included in the in-vehicle device 60).

[0084] The master node 2 controls the slave nodes 7 by communicating with the slave nodes via a communication network (communication line B in this example).

[0085] [Slave node configuration] 6, the slave node 7 includes a slave IC 75, a timer 76, and a voltage detection circuit 80. Note that the timer 76 and the voltage detection circuit 80 are not shown in FIG.

[0086] <Slave IC> The slave IC 75 communicates with the master node 2 via the communication network. The slave IC 75 controls the operation of the slave node 7 by controlling each part of the slave node 7. In this example, the slave IC 75 includes the communication module 71, register 72, selector 73, and driver group 74 shown in FIG. 4. The slave IC 75 is an example of a slave control unit provided in the slave node 7.

[0087] The slave IC 75 operates in response to various commands transmitted from the master node 2. The slave IC 75 also receives information output from the in-vehicle device 60 (specifically, sensors included in the in-vehicle device 60) and information obtained by each part of the slave node 7. The slave IC 75 transmits various types of information to the master node 2.

[0088] <Voltage detection circuit> The voltage detection circuit 80 detects the voltage value of the power supply voltage supplied from the power supply 8 to the slave node 7. The voltage detection circuit 80 is an example of a voltage detection unit that detects the power supply voltage supplied to the slave node 7.

[0089] Timer The timer 76 measures time. For example, the timer 76 includes an oscillator that operates at a fixed frequency, such as a crystal oscillator, and a counter that counts clocks from the oscillator. The timer 76 is used to measure elapsed time, etc.

[0090] [Slave node status] Next, the states of the slave node 7 will be described with reference to Fig. 7. The states of the slave node 7 include a "normal voltage state," a "low voltage state," and a "communication disabled state."

[0091] <Normal voltage state> The normal voltage state is a state in which the power supply voltage supplied to the slave node 7 is normal. In the normal voltage state, the power supply voltage VB supplied to the slave node 7 does not fall below the first threshold Vth1. In the normal voltage state, the slave node 7 operates normally, and communication between the master node 2 and the slave node 7 also occurs normally.

[0092] <Voltage drop condition> The voltage drop state is a state in which the power supply voltage supplied to the slave node 7 is lower than in the normal voltage state. In the voltage drop state, the power supply voltage VB supplied to the slave node 7 falls below the first threshold Vth1 but does not fall below the second threshold Vth2, which is lower than the first threshold Vth1. In the voltage drop state, the operation of the slave node 7 becomes unstable, but communication between the master node 2 and the slave node 7 is possible.

[0093] <Communication unavailable> The communication-disabled state is a state in which the power supply voltage supplied to the slave node 7 is lower than that in the voltage drop state, making communication between the master node 2 and the slave node 7 impossible. In the communication-disabled state, the power supply voltage VB supplied to the slave node 7 falls below the second threshold Vth2.

[0094] <State transition> 7, when the power supply voltage VB supplied to the slave node 7 changes, the state of the slave node 7 may transition. For example, when the state of the slave node 7 is in the "normal voltage state," if the power supply voltage VB falls below the first threshold Vth1 but not below the second threshold Vth2, the state of the slave node 7 transitions from the "normal voltage state" to the "low voltage state."

[0095] [Slave node configuration] The slave node 7 is configured to be able to change its configuration. Specifically, the configuration of the slave node 7 is set to a configuration (initial configuration) having predetermined functions based on the configuration data (initial configuration data) transmitted from the master node 2. Examples of the predetermined functions include a function to communicate with the master node 2, a function to perform an operation (e.g., generate an operation signal) in response to a command transmitted from the master node 2, and a function to check the status of the slave node 7.

[0096] [First state transition process] Next, the first state transition process of the vehicle control system 1 will be described with reference to Fig. 8. The first state transition process is performed when the power supply voltage supplied to the slave node 7 changes from a "state in which it is not below the first threshold" to a "state in which it is below the first threshold but not below the second threshold."

[0097] First, in step S11, when the power supply voltage supplied to the slave node 7 falls below the first threshold but not below the second threshold, the slave node 7 (more specifically, the slave IC 75) transmits status information to the master node 2 indicating that the slave node 7 is in a voltage drop state.

[0098] Next, in step S12, the master node 2 receives the status information transmitted from the slave node 7. Then, the master node 2 refers to the status information received in step S12 and confirms that the slave node 7 is in a voltage drop state.

[0099] Next, in step S13, the master node 2 determines whether the slave node 7 is a "slave node 7 that needs to perform fail-safe processing." If it is a slave node 7 that needs to perform fail-safe processing, the process of step S14 is performed; if not, the process ends. Note that the slave node 7 that needs to perform fail-safe processing is specified in advance. The master node 2 stores which slave node 7 is a "slave node 7 that needs to perform fail-safe processing."

[0100] Next, in step S14, the master node 2 transmits a command (fail-safe command) to the slave node to instruct the slave node to perform fail-safe processing for safely controlling the in-vehicle device 60. Next, in step S15, the slave node 7 receives the fail-safe command transmitted from the master node 2. Next, in step S16, the slave node 7 performs fail-safe processing in response to the fail-safe command. The fail-safe processing will be described in detail later.

[0101] [Second state transition process] Next, the second state transition process of the vehicle control system 1 will be described with reference to Fig. 9. The second state transition process is performed when the power supply voltage supplied to the slave node 7 changes from a "state in which the power supply voltage is below the first threshold but not below the second threshold" to a "state in which the power supply voltage is not below the first threshold."

[0102] First, in step S21, when the power supply voltage supplied to the slave node 7 (more specifically, the slave IC 75) becomes "in a state where it does not fall below the first threshold," the slave node 7 notifies the master node 2 of status information indicating that the voltage of the slave node 7 is in a normal state.

[0103] Next, in step S22, the master node 2 receives the state information transmitted from the slave node 7. Then, the master node 2 refers to the state information received in step S22 and confirms that the voltage of the slave node 7 is in a normal state.

[0104] Next, in step S23, the master node 2 determines whether the slave node 7 is a "slave node 7 executing fail-safe processing." If it is a slave node 7 executing fail-safe processing, the process of step S24 is performed; if it is not, the process ends. The master node 2 stores which slave node 7 is a "slave node 7 executing fail-safe processing."

[0105] Next, in step S24, the master node 2 transmits a command (failsafe release command) to the slave node to instruct the slave node to end the failsafe processing. Next, in step S25, the slave node 7 receives the failsafe release command transmitted from the master node 2. Next, in step S26, the slave node 7 responds to the failsafe release command and ends the failsafe processing. Thereafter, the slave node 7 performs an operation (e.g., generates an operation signal) in accordance with the command from the master node 2.

[0106] [Third state transition processing] Next, the third state transition process of the vehicle control system 1 will be described with reference to Fig. 10. The third state transition process is performed when the power supply voltage supplied to the slave node 7 changes from a "state in which it is not below the first threshold value" or a "state in which it is below the first threshold value but not below the second threshold value" to a "state in which it is below the second threshold value."

[0107] First, in step S31, when the power supply voltage supplied to the slave node 7 falls below the second threshold, the slave node 7 (more specifically, the slave IC 75) resets the configuration of the slave node 7 to an unconfigured state. This causes the slave node 7 to enter a state in which it is unable to output an operation signal to the in-vehicle device 60. Furthermore, the slave node 7 is unable to communicate with the master node.

[0108] Next, in step S32, the master node 2 transmits a request to the slave node 7 to request transmission of state information indicating the state of the slave node 7. This request transmission is periodically repeated.

[0109] When the slave node 7 is in a communication unavailable state, the slave node 7 cannot respond to a request sent from the master node 2 and cannot send status information to the master node 2. When the slave node 7 is in a voltage normal state (or a voltage drop state), the slave node 7 sends status information indicating that the slave node 7 is in a voltage normal state (or a voltage drop state) to the master node 2 in response to a request sent from the master node 2.

[0110] Next, in step S33, the master node 2 confirms that the slave node 7 has not responded to the request sent in step S32. For example, when the time elapsed since the request was sent reaches a predetermined waiting time, the master node 2 determines that the slave node 7 has not responded to the request. Then, the master node 2 estimates (recognizes) that the slave node 7 is in a communication unavailable state.

[0111] If the slave node 7 is in a communication-disabled state, the slave node 7 cannot respond to the fail-safe command. Therefore, if the slave node 7 is in a communication-disabled state, the master node 2 does not send a fail-safe command to the slave node 7. However, the master node 2 continues to periodically send requests to the slave node 7 that is presumed (recognized) to be in a communication-disabled state.

[0112] [Fourth state transition process] Next, the fourth state transition process of the vehicle control system 1 will be described with reference to Fig. 11. The fourth state transition process is performed when the power supply voltage supplied to the slave node 7 changes from a "state below the second threshold" to a "state not below the first threshold" or a "state below the first threshold but not below the second threshold."

[0113] First, in step S41, when the power supply voltage supplied to the slave node 7 (more specifically, the slave IC 75) returns to a state where it does not fall below the second threshold, the slave node 7 is able to notify the master node 2 that the configuration of the slave node 7 has not been set.

[0114] Next, in step S42, the master node 2 transmits a request to the slave node 7 to request transmission of state information indicating the state of the slave node 7. This request transmission is repeated periodically.

[0115] Next, in step S43, the slave node 7 receives the request transmitted from the master node 2. Then, in step S44, in response to the request received in step S43, the slave node 7 transmits to the master node 2 state information indicating that the configuration of the slave node 7 is in an unset state.

[0116] Next, in step S45, the master node 2 receives the state information transmitted from the slave node 7. Next, in step S46, the slave node 7 refers to the state information received in step S45 and confirms that the state of the slave node 7 is "a state in which the configuration of the slave node 7 has not been set." Then, the master node 2 transmits configuration data (initial configuration data) to the slave node 7.

[0117] Next, in step S47, the slave node 7 receives the configuration data transmitted from the master node 2. Next, in step S48, the slave node 7 sets the configuration of the slave node 7 using the configuration data (initial configuration data) transmitted from the master node 2. As a result, the configuration of the slave node 7 is set to a configuration (initial configuration) having predetermined functions.

[0118] Next, in step S49, when the configuration of the slave node 7 is completed, the slave node 7 transmits configuration completion information indicating that the configuration of the slave node 7 is completed to the master node 2.

[0119] Next, in step S50, the master node 2 receives the configuration completion information transmitted from the slave node 7. Then, in step S51, the master node 2 refers to the configuration completion information received in step S48 and confirms that the configuration setting of the slave node 7 has been completed.

[0120] After the slave node 7 transmits the configuration completion notification information to the master node 2, one of the first state transition process and the second state transition process is performed depending on the power supply voltage supplied to the slave node 7. Specifically, when the power supply voltage supplied to the slave node 7 is in a state where it is "below the first threshold but not below the second threshold," the first state transition process is performed, and when the power supply voltage supplied to the slave node 7 is in a state where it is "not below the first threshold," the second state transition process is performed.

[0121] [Fail-safe processing] The fail-safe processing is a process for safely controlling the in-vehicle devices. As described above, the slave node 7 performs the fail-safe processing in response to the fail-safe command (a command instructing to perform the fail-safe processing) transmitted from the master node 2.

[0122] For example, the fail-safe command includes fail-safe information indicating the content of the fail-safe processing (what operation the slave node 7 will perform in the fail-safe processing) specified by the master node 2. The slave node 7 performs the operation indicated in the fail-safe information.

[0123] Alternatively, the slave node 7 may store multiple processing patterns, each indicating a different fail-safe processing content. In this case, the master node 2 stores which processing pattern is stored in which slave node 7. The fail-safe command includes processing pattern information indicating the processing pattern specified by the master node 2 (which processing pattern the slave node 7 should perform). The slave node 7 performs the operation of the processing pattern indicated in the processing pattern information.

[0124] The master node 2 stores information about which slave nodes 7 are "slave nodes 7 that need to perform fail-safe processing." Furthermore, the master node 2 stores, for each slave node 7 that needs to perform fail-safe processing, the contents of the fail-safe processing that should be performed by that slave node 7.

[0125] The master node 2 also stores which slave node 7 is the "slave node 7 currently executing fail-safe processing." For example, when the master node 2 sends a fail-safe command to a slave node 7, it stores the slave node 7 as the "slave node 7 currently executing fail-safe processing."

[0126] Figure 12 shows an example of fail-safe processing performed in the slave node 7. In the example of Figure 12, the example of fail-safe processing also includes the operation when the slave node 7 is in a "communication unavailable state" and the operation when the slave node 7 has returned from the "communication unavailable state" to a "normal voltage state" or a "low voltage state" but the configuration of the slave node 7 has not yet been set. The meanings of the terms shown in Figure 12 are as follows:

[0127] "Power supply method" refers to the method of supplying power voltage from the power supply 8 to the slave node 7. "Hot Start method (constant power supply)" refers to a method in which power voltage is constantly supplied from the power supply 8 to the slave node 7. "Cold Start method (scene-specific power supply)" refers to a method in which the supply of power voltage from the power supply 8 to the slave node 7 may be stopped (for example, ignition power supply).

[0128] "Power" indicates the state of supply of power voltage from the power supply 8 to the slave node 7. "Loss" and "OFF" indicate a state in which power voltage is not being supplied from the power supply 8 to the slave node 7. "Powered" indicates a state in which power voltage is being supplied from the power supply 8 to the slave node 7.

[0129] "Initial Config" indicates whether the initial configuration has been set in the slave node 7. "Not yet" indicates that the initial configuration has not been set in the slave node 7. "Complete" indicates that the initial configuration has been set in the slave node 7.

[0130] "Communication bus" indicates the state of the slave node 7 relative to the communication bus (communication network). "Sleep" indicates that the slave node 7 is in a sleep state (power saving state). "Wakeup" indicates that the slave node 7 is not in a sleep state.

[0131] "Reception state" indicates the reception state of the slave node 7 in response to communication from the master node 2. "Not received" indicates a state in which the slave node 7 has not received a command from the master node 2. "Communication error" indicates a state in which the duration of the non-received state exceeds a predetermined error time. "Received" indicates a state in which the slave node 7 is receiving a command from the master node 2.

[0132] "Slave node operation" indicates the operation of the slave node 7 (operation in fail-safe processing) corresponding to the combination of the above "power supply method", "power supply", "initial configuration", "communication bus", and "reception state".

[0133] "All off" indicates that the output of the operation signal from the slave node 7 to the in-vehicle device 60 is stopped (the signal level of the operation signal is maintained at zero, which is the off value). "Hold previous value" indicates that the signal level of the operation signal from the slave node 7 to the in-vehicle device 60 is maintained at the previous value. "Master node instruction" indicates that the operation is performed in accordance with the command sent from the master node 2.

[0134] The "fail-safe value" indicates that the signal level of the operation signal from the slave node 7 to the in-vehicle device 60 is maintained at a predetermined fail-safe value. The fail-safe value is set to one of the "on value," "off value (zero)," and "previous value." Note that the state of "maintaining the signal level of the operation signal at the on value" indicates a state of "continuing to output an operation signal having a predetermined signal level." The state of "maintaining the signal level of the operation signal at the off value" indicates a state of "stopping to output the operation signal."

[0135] For example, the example in the fifth row of the correspondence table shown in Figure 12 indicates that when the method of supplying power supply voltage from the power supply 8 to the slave node 7 is the "Hot Start method (constant power supply)", the supply status of power supply voltage from the power supply 8 to the slave node 7 is "Loss (state in which power supply voltage is being supplied)", the status of the slave node 7 with respect to the communication bus is "Wakeup", and the reception status of the slave node 7 with respect to communication from the master node 2 is "Communication error", the slave node 7 will perform the operation of "maintaining the signal level of the operation signal to the in-vehicle device 60 at a fail-safe value".

[0136] [Effects of the embodiment] As described above, in the vehicle control system 1 of the embodiment, the slave node 7 notifies the master node 2 that the slave node 7 is in a normal voltage state when the power supply voltage supplied to the slave node 7 does not fall below the first threshold. Furthermore, the slave node 7 notifies the master node 2 that the slave node 7 is in a low voltage state when the power supply voltage supplied to the slave node 7 falls below the first threshold but not below the second threshold. Furthermore, the slave node 7 becomes unable to communicate with the master node 2 when the power supply voltage supplied to the slave node 7 falls below the second threshold. The master node 2 instructs the slave node 7 to perform fail-safe processing to safely control the in-vehicle device 60, based on the notification of the state of the slave node 7 and whether communication with the slave node 7 is possible.

[0137] In the above configuration, the state of the slave node 7 can be estimated (recognized) based on notification of the state of the slave node 7 and whether communication with the slave node 7 is possible. This allows fail-safe processing to be performed according to the state of the slave node 7.

[0138] Furthermore, in the vehicle control system 1 of the embodiment, the slave node 7 is configured to be able to change its configuration. The configuration of the slave node 7 is set to a configuration having a predetermined function based on the configuration data transmitted from the master node 2. Furthermore, when the power supply voltage supplied to the slave node 7 falls below a second threshold, the slave node 7 resets the configuration of the slave node 7 to an unconfigured state and stops outputting an operation signal to the in-vehicle device 60.

[0139] In the above configuration, when communication between the master node 2 and the slave node 7 is impossible, the slave node 7's configuration is set to an unset state, thereby stopping the output of an operation signal from the slave node 7 to the in-vehicle device 60. This allows the in-vehicle device 60 to be stopped when communication between the master node 2 and the slave node 7 is impossible (when the slave node 7 cannot perform fail-safe processing).

[0140] Furthermore, in the vehicle control system 1 of the embodiment, when the power supply voltage supplied to the slave node 7 returns to a state where it does not fall below the second threshold, the slave node 7 notifies the master node 2 that the configuration of the slave node 7 has not been set. When the master node 2 is notified that the configuration of the slave node 7 has not been set, it transmits configuration data to the slave node 7.

[0141] In the above configuration, when the power supply voltage supplied to the slave node 7 returns to a state where it does not fall below the second threshold, the configuration of the slave node 7 can be set to a configuration having a predetermined function based on the configuration data transmitted from the master node 2. This enables communication between the master node 2 and the slave node 7.

[0142] In addition, in the vehicle control system 1 of the embodiment, when the configuration setting of the slave node 7 is completed using the configuration data transmitted from the master node 2, the slave node 7 notifies the master node 2 that the configuration setting of the slave node 7 has been completed.

[0143] In the above configuration, the master node 2 is notified that the configuration of the slave node 7 has been completed, and the master node 2 can confirm that communication with the slave node 7 is now possible. This allows communication between the master node 2 and the slave node 7 to resume.

[0144] (Modification 1 of the embodiment) The vehicle control system 1 of the first modified embodiment performs a fault diagnosis process and an indicator lighting process in addition to the processes of the vehicle control system 1 of the embodiment.

[0145] In the vehicle control system 1 of the first modified embodiment, when the master node 2 instructs the slave node 7 to perform fail-safe processing, the master node 2 performs at least one of a fault diagnosis process and an indicator lighting process. The fault diagnosis process is a process for diagnosing whether or not there is a fault in the slave node 7. The indicator lighting process is a process for lighting an indicator (not shown) mounted on the vehicle.

[0146] [Effects of Modification 1 of the Embodiment] In the vehicle control system 1 according to the first modification of the embodiment, by performing a fault diagnosis process, it is possible to diagnose whether or not the slave node 7 has a fault. Also, by performing an indicator lighting process, it is possible to notify the vehicle user that the power supply voltage supplied to the slave node 7 has dropped.

[0147] (Modification 2 of the embodiment) The vehicle control system 1 of the second modification of the embodiment performs processing based on the voltage value of the operation signal in addition to the processing of the vehicle control system 1 of the embodiment.

[0148] In the vehicle control system 1 according to the second modification of the embodiment, the slave node 7 detects the voltage value of an operation signal output to the in-vehicle device 60, and transmits voltage information indicating the voltage value of the operation signal to the master node 2. If the voltage value indicated in the voltage information transmitted from the slave node 7 is abnormal, the master node 2 instructs the slave node 7 to perform fail-safe processing.

[0149] As shown in FIG. 13, in the second modification of the embodiment, the slave node 7 includes an output voltage detection circuit 81 in addition to the configuration of the slave node 7 shown in FIG.

[0150] The output voltage detection circuit 81 detects the voltage value of an operation signal output from the slave IC 75 to the in-vehicle device 60 (specifically, a device included in the in-vehicle device 60 that is to be operated). The slave IC 75 transmits voltage information indicating the voltage value detected by the output voltage detection circuit 81 to the master node 2. The output voltage detection circuit 81 is an example of an output voltage detection unit that detects the voltage value of an operation signal output to the in-vehicle device 60.

[0151] The master node 2 determines whether the voltage value indicated in the voltage information transmitted from the slave node 7 (the voltage value of the operation signal) exceeds a predetermined output abnormality threshold. If the voltage value indicated in the voltage information exceeds the output abnormality threshold, the master node 2 estimates (recognizes) that the voltage value indicated in the voltage information is abnormal, and transmits a command (fail-safe command) to the slave node 7 instructing it to perform fail-safe processing.

[0152] [Effects of Modification 2 of the Embodiment] In the vehicle control system 1 according to the second modification of the embodiment, when the voltage value of the operation signal output to the in-vehicle device 60 is abnormal, the slave node 7 can be made to perform fail-safe processing. This allows the in-vehicle device 60 to be controlled safely.

[0153] In the vehicle control system 1 according to the second modification of the embodiment, the master node 2 may determine whether or not the voltage value indicated in the voltage information transmitted from the slave node 7 (the voltage value of the operation signal) is within a predetermined normal range. In this case, if the voltage value indicated in the voltage information is not within the normal range, the master node 2 may estimate (recognize) that the voltage value indicated in the voltage information is abnormal, and transmit a fail-safe command to the slave node 7.

[0154] (Other embodiments) In the above description, the master node 2 may determine whether to instruct the slave node 7 to perform fail-safe processing, depending on the frequency of state transitions of the slave node 7. For example, the master node 2 may count the number of state transitions of each slave node 7, and instruct the slave node 7 whose number of state transitions exceeds a predetermined abnormal number to perform fail-safe processing (for example, fail-safe processing that stops output of an operation signal to the in-vehicle device 60).

[0155] Furthermore, in the above description, a slave node 7 that does not need to perform fail-safe processing may be configured not to transmit state information indicating that the slave node 7 is in a "normal voltage state" or a "low voltage state" to the master node 2. Such a setting can be realized by the initial configuration of the slave node 7.

[0156] In the above description, the voltage detection circuit 80 that directly detects the power supply voltage has been exemplified as the voltage detection unit that detects the power supply voltage supplied to the slave node 7, but this is not limiting. For example, the voltage detection unit may indirectly detect the power supply voltage supplied to the slave node 7. Specifically, the voltage detection unit may derive (estimate) the power supply voltage supplied to the slave node 7 based on a physical quantity that is correlated with the power supply voltage supplied to the slave node 7. The same applies to the output voltage detection unit that detects the voltage value of the operation signal output to the in-vehicle device 60.

[0157] The above embodiments may be combined as appropriate. The above embodiments are essentially preferred examples and are not intended to limit the scope of the technology disclosed herein, its applications, or its uses. [Industrial Applicability]

[0158] As described above, the technology disclosed herein is useful as a vehicle control system. [Explanation of symbols]

[0159] 1. Vehicle control system 2 Master Node 7 Slave Nodes 8 Power supply 60 In-Vehicle Devices 75 slave ICs 80 Voltage detection circuit (voltage detection section) 81 Output voltage detection circuit (output voltage detection section)

Claims

1. A vehicle control system that controls an in-vehicle device mounted on a vehicle, a slave node connected to the in-vehicle device and a power supply mounted in the vehicle, generating an operation signal based on a power supply voltage supplied from the power supply, and outputting the operation signal to the in-vehicle device; a master node that controls the slave nodes by communicating with the slave nodes via a communication network; The slave node notifying the master node that the slave node is in a normal voltage state when the power supply voltage supplied to the slave node does not fall below a first threshold; notifying the master node that the slave node is in a voltage drop state when the power supply voltage supplied to the slave node falls below a first threshold but does not fall below a second threshold that is lower than the first threshold; When the power supply voltage supplied to the slave node falls below the second threshold, the slave node is configured to be unable to communicate with the master node; The master node instructs the slave node to perform fail-safe processing for safely controlling the in-vehicle device based on the notification of the state of the slave node and whether communication with the slave node is possible. Vehicle control system.

2. 2. The vehicle control system of claim 1, The slave node The configuration is changeable, The configuration of the slave node is set to a configuration having a predetermined function by the configuration data transmitted from the master node, When the power supply voltage supplied to the slave node falls below the second threshold, the configuration of the slave node is reset to an unconfigured state. Vehicle control system.

3. 3. The vehicle control system of claim 2, When the power supply voltage supplied to the slave node returns to a state where it is not lower than the second threshold, the slave node notifies the master node that the configuration of the slave node has not been set, When the master node is notified that the configuration of the slave node has not been set, the master node transmits the configuration data to the slave node. Vehicle control system.

4. 4. The vehicle control system of claim 3, When the configuration of the slave node is completed using the configuration data transmitted from the master node, the slave node notifies the master node that the configuration of the slave node has been completed. Vehicle control system.

5. 2. The vehicle control system of claim 1, When instructing the slave node to perform the fail-safe processing, the master node performs at least one of a failure diagnosis process for diagnosing whether or not there is a failure in the slave node and an indicator lighting process for lighting an indicator mounted on the vehicle. Vehicle control system.

6. In any one of claims 1 to 5, the vehicle control system the slave node detects a voltage value of an operation signal output to the in-vehicle device, and transmits voltage information indicating the voltage value of the operation signal to the master node; The master node instructs the slave node to perform the fail-safe process when a voltage value indicated in the voltage information transmitted from the slave node is abnormal. Vehicle control system.

Images