Vehicle control system

Abstract

To protect a slave node from an anomaly.SOLUTION: A first shut-off unit 76 enters, when a shut-off condition is satisfied, a shut-off state that shuts off a current path CP from a power supply 8 to an in-vehicle unit 60 via a slave node 7. A second shut-off unit 77 is arranged between the power supply 8 and the first shut-off unit 76 in the current path CP. The slave node 7 transmits, to a master node 2, state information indicating a state of the first shut-off unit 76 and current information indicating a current value of a current flowing in the current path CP. The master node 2 transmits, on the basis of the state information and the current information, a command for controlling the first shut-off unit 76 and the second shut-off unit 77 to the slave node 7.SELECTED DRAWING: Figure 6

Description

Technical Field

[0001] The technology disclosed herein relates to a vehicle control system.

Background Art

[0002] Some vehicle control systems for controlling in-vehicle devices mounted on a vehicle adopt a master-slave system. For example, Patent Document 1 discloses a master-slave type vehicle interior lighting system. In this system, each of a plurality of slave ECUs communicates with a master ECU mounted on the vehicle in a multi-way communication and controls a light source according to an instruction from the master ECU.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the vehicle control system as described above, it is required to protect slave nodes from abnormalities (such as overcurrent and overheating). However, Patent Document 1 neither discloses nor suggests protecting slave nodes from abnormalities.

[0005] The technology disclosed herein has been made in view of such points, and its object is to provide a vehicle control system capable of protecting slave nodes from abnormalities.

Means for Solving the Problems

[0006] The technology disclosed herein relates to a vehicle control system for controlling in-vehicle devices mounted on a vehicle, and this vehicle control system A slave node connected to the in-vehicle device and the power supply mounted on the vehicle, which generates an operation signal based on the power supply voltage supplied from the power supply and outputs the operation signal to the in-vehicle device, The system comprises a master node that controls the slave nodes by communicating with them via a communication network, The aforementioned slave node is A first interruption unit is provided in the current path for generating and outputting the aforementioned operation signal, which extends from the power supply through the slave node to the in-vehicle device, and enters an interruption state that interrupts the current path when predetermined interruption conditions are met. A second interruption unit is provided between the power supply and the first interruption unit in the current path, and is capable of being put into an interruption state that interrupts the current path. It includes a current detection unit that detects the current value of the current flowing through the current path, The slave node transmits to the master node status information indicating the state of the first interruption unit and current information indicating the current value detected by the current detection unit. The master node transmits commands to the slave node to control the first and second interruption units based on the state information and current information transmitted from the slave node.

[0007] In the above configuration, by providing a first interruption unit, the current path (the current path from the power supply through the slave node to the in-vehicle device) can be interrupted without waiting for instructions from the master node when the interruption condition is met. This protects the slave node from abnormalities (such as overcurrent or overheating) that require rapid interruption of the current path.

[0008] Furthermore, in the above configuration, by providing a second interruption unit together with the first interruption unit, even if the first interruption unit fails to enter an interrupted state due to a malfunction in the first interruption unit, the current path can be interrupted by entering an interrupted state with the second interruption unit. This ensures that the slave node is protected from malfunctions even if the first interruption unit fails to enter an interrupted state.

[0009] Furthermore, in the aforementioned vehicle control system, The master node may, when the state of the first block unit indicated in the state information is the blocked state, transmit a command to the slave node instructing it to put the first block unit into the blocked state and stop generating the operation signal.

[0010] In the above configuration, when the blocking condition is met and the first blocking unit enters a blocked state, the master node can instruct the slave node to put the first blocking unit into a blocked state. This allows the slave node to be in a state where it is processing in response to the instruction from the master node (a system-consistent state), and enables smoother control of the slave node by the master node thereafter.

[0011] Furthermore, in the vehicle control system, After the master node has transmitted a command to the slave node instructing the first interruption unit to be in the interrupted state, if the current value indicated in the current information transmitted from the slave node exceeds a predetermined current abnormality threshold, the master node may transmit a command to the slave node instructing the second interruption unit to be in the interrupted state.

[0012] In the above configuration, if the first interruption unit fails to enter an interrupted state due to a malfunction in the first interruption unit and current flows through the current path, the second interruption unit can be put into an interrupted state. This allows the slave node to be protected from malfunctions even if the first interruption unit fails to enter an interrupted state.

[0013] Furthermore, in the vehicle control system, The slave node has an abnormality detection unit that detects when the first block unit is in an abnormal state, and when the abnormality detection unit detects when the first block unit is in an abnormal state, it may transmit abnormality notification information indicating that the first block unit is in an abnormal state to the master node. The master node may send a command to the slave node to instruct the second blocking unit to enter the blocking state in response to the abnormality notification information sent from the slave node.

[0014] In the above configuration, when the first blocking unit is in an abnormal state, the second blocking unit can be put into the blocking state. Thereby, when the first blocking unit is in an abnormal state, the slave node can be protected from the abnormality.

[0015] Also, in the vehicle control system, The blocking condition may include a condition that the current value detected by the current detection unit exceeds a predetermined overcurrent threshold value.

[0016] In the above configuration, the slave node can be protected from overcurrent.

[0017] Also, in the vehicle control system, The slave node may have a temperature detection unit that detects the temperature of the first blocking unit, The blocking condition may include a condition that the temperature detected by the temperature detection unit exceeds a predetermined overheat threshold value.

[0018] In the above configuration, the slave node can be protected from overheating.

Effects of the Invention

[0019] According to the technology disclosed herein, the slave node can be protected from abnormalities.

Brief Description of the Drawings

[0020] [Figure 1] It is a block diagram showing a configuration example of a vehicle control system. [Figure 2] It is a conceptual diagram showing an example of the function distribution between the master node and the slave node. [Figure 3] It is a block diagram showing a configuration example of the master node. [Figure 4] This block shows an example configuration for a slave node. [Figure 5] This is a circuit block diagram showing an example configuration of the driver group. [Figure 6] This is a block diagram showing an example of the configuration of the main components of a vehicle control system. [Figure 7] This block shows an example of the IPD configuration. [Figure 8] This is a flowchart to explain the first protection process. [Figure 9] This is a flowchart to explain the second protection process. [Figure 10] This is a flowchart to explain the third protection process. [Modes for carrying out the invention]

[0021] The embodiments will be described in detail below with reference to the drawings. Note that the same or corresponding parts in the drawings are denoted by the same reference numerals, and their descriptions will not be repeated.

[0022] In this disclosure, some or all of the configurations referred to by the terms “system,” “unit,” “module,” and “node” may be implemented by dedicated circuits such as application-specific integrated circuits (ASICs) or programmable logic arrays (PLAs). Furthermore, some or all of the above may be implemented by processor circuits that execute computer-readable instructions (e.g., programs) and perform predetermined processing steps to execute specific functions.

[0023] Furthermore, in the following description, "in-vehicle device" refers to a device mounted on a vehicle. An in-vehicle device has at least one of a sensor and a component to be operated (e.g., a motor or an LED).

[0024] (Embodiment) Figure 1 shows an example of the configuration of a vehicle control system according to an embodiment. As shown in Figure 1, the vehicle control system 1 is mounted on a vehicle CA and has a configuration in which a master node 2 and a plurality of slave units are connected via an in-vehicle communication network.

[0025] In the example shown in Figure 1, multiple slave units are exemplified, including a combination switch unit 4, left and right side mirror units 5, a steering switch unit 6, a cluster switch unit 31, an overhead console unit 32, left and right seat heater units 33, and left and right door latch units 34. Each slave unit is equipped with a slave node 7 (see Figure 4) which has a common configuration. For the sake of explanation, the side mirror unit 5, door latch unit 34, and seat heater unit 33 are each given the same reference numerals for the left and right sides.

[0026] The master node 2 and the slave nodes 7 located on each of the multiple slave units (in this example, the combination switch unit 4, the steering switch unit 6, the cluster switch unit 31, the right side mirror unit 5, the right seat heater unit 33, and the right door latch unit 34) are bus-connected via communication line B1. Additionally, the slave nodes 7 located on each of the other multiple slave units (in this example, the overhead console unit 32, the left side mirror unit 5, the left seat heater unit 33, and the left door latch unit 34) are bus-connected via communication line B2. In the following description, communication lines B1 and B2 will be collectively referred to as "communication line B". Communication line B constitutes the communication network.

[0027] Communication line B is, for example, a communication line compliant with CXPI (Clock Extension Peripheral Interface). CXPI is an example of an event-type communication protocol. Note that the communication method is not limited to CXPI and may be other communication methods (whether wired or wireless). Also, there is no particular limit to the number of communication lines used in the communication network. Furthermore, communication relay hubs (not shown) and ECUs (not shown) may be provided in the middle of the communication lines.

[0028] [Functional distribution between master and slave nodes] Figure 2 is a conceptual diagram showing an example of the functional distribution between master node 2 and slave node 7 for the actions of a vehicle CA. In Figure 2, the operation process of the vehicle CA is divided into "cognition process Iz," "decision process Pz," and "operation process Oz," and each process is subdivided. The functions 20 distributed to master node 2 are enclosed by dashed lines, and the functions 30 distributed to slave node 7 are enclosed by solid lines.

[0029] In the following, we will explain the processes performed in each of the cognitive process Iz, the judgment process Pz, and the operation process Oz, using an example of a change in weather from sunny to rainy (hereinafter simply referred to as "weather change").

[0030] [Cognitive process] In recognition process Iz, information acquired by sensors is recognized based on the output signals of sensors mounted on the in-vehicle devices. In this disclosure, the term "sensor" is used to include not only sensors that measure and detect various physical quantities such as temperature, voltage, and current, but also switches that accept various operations, cameras that capture images inside and outside the vehicle, radar that recognizes targets outside the vehicle, and devices that output mechanical-electrical conversion signals. Sensors acquire information such as vehicle behavior information, occupant operation information, occupant status information, external environment information, current information flowing through actuators, voltage information applied to actuators, and fault status information. Hereinafter, these will be collectively referred to as "detection information".

[0031] The cognitive process Iz includes processes Iz2 and Iz3, which are performed on the slave node 7, and processes Iz4 and Iz5, which are performed on the master node 2. Note that the following description assumes that the in-vehicle device is implemented within the slave node 7; however, the in-vehicle device may be located outside the slave node 7.

[0032] First, in process Iz1, some kind of detection information is detected by sensors mounted on the in-vehicle device. In the aforementioned example of "weather changes," detection information (e.g., raindrop adhesion, change in the amount of light received, etc.) is detected by a raindrop sensor and a light receiving sensor (not shown) as sensors.

[0033] In the next step Iz2, the slave node 7 receives the sensor output via port P, which will be described later. The sensor output includes, for example, the sensor's detection signal, physical quantities such as current, voltage, and temperature detected by the sensor, and a mechanoelectric conversion signal.

[0034] In the next step Iz3, the slave node 7 performs signaling and data processing on the sensor output and transmits the resulting signal to the master node 2 as a detection signal. The detection signal transmitted from the slave node 7 to the master node 2 is a signal compliant with CXPI.

[0035] Signaling processing, for example, is the process of separating information output from a sensor into "important information" and "meaningless information," and extracting only the significant information. An example of signaling processing is filtering, such as a chattering filter. Data conversion processing, for example, is the process of processing discretized information into information suitable for continuous processing. An example of data conversion processing is the process of obtaining a continuous signal by applying a moving average to discrete data when performing continuous processing such as PID control in a subsequent information processing stage.

[0036] In other words, in processes Iz2 and Iz3, the slave node 7 converts the sensor output into a predetermined signal format and transmits it to the master node 2 as a detection signal, without recognizing or judging the specific content of the input information (detection information).

[0037] In the next step Iz4, the master node 2 receives a detection signal transmitted from the slave node 7. In the next step Iz5 (information processing), the master node 2 recognizes the specific content of the detection information input from the sensor to the slave node 7 based on the time-dependent change of the detection signal and the connection data described later. In the example of "weather change" mentioned above, the information processing provides recognition information such as, "The light intensity transmitted through the windshield has fallen below a predetermined value, making it dark outside the car, and it has started to rain." Hereafter, the information recognized in the recognition process will be referred to as "recognition information."

[0038] [Judgment process] In the decision-making process Pz, the actions and responses of the vehicle CA are determined based on the cognitive information recognized in the cognitive process Iz. Processes Pz1 to Pz4, which are components of the decision-making process Pz, are executed on master node 2.

[0039] Specifically, in process Pz1, master node 2 determines the objective of the vehicle CA's actions based on the cognitive information recognized in cognitive process Iz. In the aforementioned example of "weather changes," for example, the objective is determined to "act in a manner appropriate to the situation when the external environment becomes dark and it starts to rain."

[0040] In the next step, Pz2, the master node 2 sets an action plan to achieve the objective determined in step Pz1. At this time, the action plan includes alternative measures. For example, an action list is generated that lists the action plans. In the aforementioned example of "weather changes," the action plan corresponding to "behavior when the external environment is dark and it is raining" includes actions such as "activate the wipers," "turn on the vehicle CA's automatic light function," and "limit the vehicle CA's maximum speed."

[0041] In the next step, Pz3, Master Node 2 determines which actions to actually execute from among the actions listed in the action plan. For example, Master Node 2 selects the actions to be executed from the action list. In the aforementioned example of "weather change," for example, the actions "activate the wipers" and "turn on the vehicle's automatic headlight function" are selected as the actions to be executed.

[0042] In the next step Pz4, the master node 2 selects the means (corresponding means) to realize the action determined in step Pz3. In the aforementioned example of "weather change," for example, for the actions of "activating the wipers" and "turning on the vehicle's automatic light function," a wiper unit (not shown), a headlight unit (not shown), and a taillight unit (not shown) are selected.

[0043] [Operating process] The operation process Oz includes processes Oz1 and Oz2 performed on master node 2, and processes Oz3 to Oz5 performed on slave node 7.

[0044] First, in process Oz1, the master node 2 determines the object to be manipulated and the amount of manipulation required to realize the action or response determined in the decision process Pz. Here, the object to be manipulated broadly includes the object to be manipulated in order to realize the action or response, and includes, for example, lighting devices and actuators. Lighting devices include various LEDs and light bulbs used in headlights, indicators, turn signals, etc. Actuators include body system devices such as wipers and motors for driving mirrors, and power system devices used in engines, brakes, etc.

[0045] In the aforementioned example of "weather changes," for instance, the operation of the wiper unit determines whether to turn on the windshield wipers, as well as the operating speed and interval of those wipers. Similarly, the operation of the headlight unit and taillight unit determines whether to turn on the headlights and taillights, as well as their illumination level.

[0046] In the next step Oz2, the master node 2 performs the following processes: (1) identifies the port P to which the target to be operated is connected (hereinafter referred to as "operation port P") based on the connection data, (2) generates an instruction code that commands the output content of operation port P, and (3) sends an operation command signal containing that instruction code to the slave node where operation port P is located. In the aforementioned "weather change" example, for example, the master node 2 sends an instruction code (operation command signal) that commands the output content of operation port P to which the wiper is connected to the wiper to the wiper unit (not shown), an instruction code indicating the output content of operation port P to which the headlight is connected to the headlight unit (not shown), and an instruction code indicating the output content of operation port P to which the taillight is connected to the taillight unit (not shown). The operation command signals sent from the master node 2 to the slave node 7 are signals compliant with CXPI.

[0047] Each slave node 7 receives an instruction code transmitted from the master node 2 and outputs an operation signal based on that instruction code from the operation port P corresponding to that instruction code.

[0048] Specifically, the slave node 7 generates a signal to be output from the operation port P based on the instruction code, after protocol conversion of the instruction code and / or referencing a specified register (step Oz3). Then, it outputs an operation signal from the operation port P specified by the instruction code to the in-vehicle device (specifically, the device to be operated included in the in-vehicle device) (step Oz4). As a result, (1) the wiper unit drives the wipers, (2) the headlight unit turns on the headlights, and (3) the taillight unit turns on the taillights.

[0049] Next, the configuration of the master node 2 and the slave units will be described in detail with reference to Figures 3 and 4.

[0050] [Master Node] Figure 3 shows an example of the configuration of the master node 2. As shown in Figure 3, the master node 2 comprises a communication module 21, a recognition module 22, a decision module 23, an operation module 24, and a memory 25.

[0051] Master node 2 is composed of, for example, one or more electronic control units (ECUs). An electronic control unit may be composed of a single integrated circuit (IC) or multiple ICs. Furthermore, the IC may have a single core or die, or multiple cooperating cores or dies.

[0052] The communication module 21 has the function of receiving signals from each slave node 7 via the communication line B and transmitting signals to each slave node 7.

[0053] Memory 25 stores the configuration data (hereinafter referred to as "master configuration data") corresponding to each slave node 7.

[0054] The master configuration data includes the initial configuration data and connection data set for each slave node 7. In other words, master node 2 holds the initial configuration data set for each slave node 7. The connection data indicates the connection relationship between each port P of the slave node 7 and the device ports of the in-vehicle device. In other words, the connection data indicates which functional device ports of the in-vehicle device are connected to each port P of the slave node 7.

[0055] The memory 25 may be an internal memory built into the IC that constitutes the ECU, or it may be an external memory attached to the IC. In addition, the memory may store, for example, a program for operating the CPU mounted on the IC, or information such as the processing results of the CPU.

[0056] The cognitive module 22 executes cognitive processing steps Iz4 and Iz5 of the cognitive process Iz described above. Specifically, the cognitive module 22 performs cognitive processing to recognize detection information acquired by the in-vehicle device (specifically, the sensors included in the in-vehicle device) based on connection data stored in memory and detection signals received from the slave node (for example, changes in the detection signal over time). The detection signal indicates which sensor output was input to which port of the slave node 7. The connection data indicates which in-vehicle device is connected to which port of the slave node 7.

[0057] In this example, the cognitive module 22 includes a decoding module 221 and an information processing module 222. The decoding module 221 decodes the detection signal received from the slave node 7. The information processing module 222 performs the information processing described in step Iz5 above.

[0058] The decision module 23 executes the decision processing of the aforementioned decision process Pz (specifically, processes Pz1 to Pz4). Specifically, the decision module 23 determines the action of the vehicle CA based on the cognitive information recognized in the cognitive processing by the cognitive module 22.

[0059] In this example, the decision module 23 includes an objective decision module 231 that executes the aforementioned process Pz1, an action plan module 232 that executes the aforementioned process Pz2, an action decision module 233 that executes the aforementioned process Pz3, and a response decision module 234 that executes the aforementioned process Pz4.

[0060] The operation module 24 executes processes Oz1 and Oz2 of the operation process Oz. Specifically, the operation module 24 identifies an in-vehicle device corresponding to the vehicle action determined in the decision process, generates an instruction code to command the operation of the identified in-vehicle device (specifically, the device to be operated included in the in-vehicle device), and sends it to the slave node 7 to which the identified device is connected.

[0061] In this example, the operation module 24 includes an operation decision module 241 that executes the aforementioned process Oz1, and an instruction generation module 242 that executes the aforementioned process Oz2.

[0062] [Slave Unit] Figure 4 shows an example configuration of the combination switch unit and the right side mirror unit 5 (hereinafter referred to as "right side mirror unit 5") among the slave units exemplified in Figure 1.

[0063] As shown in Figure 4, the combination switch unit 4 and the right side mirror unit 5 are each provided with a common slave node 7. Each slave node 7 is provided with 12 ports P for connecting in-vehicle devices.

[0064] In this example, the combination switch unit 4 has wiper switches 41 connected to ports P1 to P4 for operating the wipers, light switches 42 connected to ports P5 to P9 for operating the lights, and turn switches 43 connected to ports P10 and P11 for operating the turn signals. P12 is a reserve port. The wiper switches 41, light switches 42, and turn switches 43 are examples of in-vehicle devices that include only sensors.

[0065] Similarly, in the right side mirror unit 5, LEDs 51 for the turn signal (hereinafter referred to as "turn LED 51") are connected to ports P1 and P2, LEDs 52 for indicators are connected to ports P3 to P6, and motors 53 for mirror retraction are connected to ports P7 to P12. The turn LED 51, LED 52, and motor 53 are examples of in-vehicle devices that have both sensors and devices to be operated.

[0066] [Slave node] Each slave node 7 is equipped with a communication module 71, a register 72, a selector 73, and a driver group 74.

[0067] The communication module 71 is connected to the communication module 21 of the master node 2 via communication line B and is configured to enable bidirectional communication compliant with CXPI. The communication module 71 includes, for example, an input / output circuit connected to communication line B, an encoder that generates signals to be output from the input / output circuit, and a decoder that converts signals to be output from the input / output circuit. As a previously known configuration can be applied to the specific circuit configuration of the communication module 71, a detailed explanation is omitted here.

[0068] The driver group 74 comprises multiple driver units 740 (not shown in Figure 4) connected one-to-one to multiple ports P. For example, if the slave node 7 is provided with 12 ports P, the driver group 74 will be provided with 12 driver units 740.

[0069] The driver unit 740 is an I / O circuit that can be used as an input port or an output port depending on external settings. For example, a conventionally known general-purpose input / output circuit (GPIO: General Purpose Input / Output) can be applied as the driver unit 740.

[0070] [Driver Unit] Figure 5 shows an example configuration of the driver unit 740. As shown in Figure 5, the driver unit 740 includes an output circuit 743 connected to port P and a driver circuit 741 that drives the output circuit 743 based on the setting value of the output register 742. The setting value of the output register 742 can be rewritten by a setting signal input from the OUT terminal.

[0071] The driver unit 740 includes an input circuit 745 that receives input to port P, and a receiver circuit 746 that converts the input received by the input circuit 745 into a detection signal. The receiver circuit 746 includes an AD converter 747 and a comparator 748. When the attribute of port P is analog input, the AD converter 747 converts the input of port P to analog-to-digital and outputs it from the AI ​​terminal. When the attribute of port P is digital input, the comparator 748 outputs the input of port P as a digital signal from the DI terminal.

[0072] The driver unit 740 allows the settings of each component to be changed based on the configuration signal. For example, the driver unit 740 allows the filter constants of the digital filter in the receiver circuit 746 to be changed based on the configuration signal.

[0073] The selector 73 has the function of selecting which of the terminals (OUT terminal, AI terminal, DI terminal) of each driver unit 740 to enable, based on the attribute information of each port P recorded in register 72.

[0074] When the AI ​​terminal is enabled, an analog input signal is input from port P. In this case, the analog input signal is converted to a digital signal by the input circuit 745 and the AD converter 747, output from the AI ​​terminal, and written to register 72 via selector 73.

[0075] When the DI terminal is enabled, a digital input signal is input from port P. In this case, the digital input signal is output from the DI terminal via input circuit 745 and comparator 748, and written to register 72 via selector 73.

[0076] When the OUT terminal is enabled, output setting data based on the instruction code is reflected in the output register 742 of the driver circuit 741. The driver circuit 741 drives the output circuit 743 to output an operation signal (either a digital signal, an analog signal, or a PWM signal) from port P based on the output setting data in the output register 742.

[0077] Here, the output setting data is generated, for example, based on the instruction code received from the master node 2, using the logic circuit (not shown) in the selector 73 or the value of register 72. In other words, the output setting based on the instruction code is set in the output register 742 of the driver circuit 741 connected to port P based on the instruction code. Then, the output circuit 743 outputs an operation signal based on the instruction code via port P based on that output setting data. The instruction code is, for example, a code that includes identification data of the port P to which the target of operation is connected, and the output setting for each port P associated with that identification data.

[0078] Regarding the specific circuit configuration of the selector, conventionally known configurations can be used, so a detailed explanation will be omitted here.

[0079] Register 72 stores the configuration data set for each slave node 7 (hereinafter referred to as "slave configuration data"). The configuration data includes attribute data for each port P.

[0080] The slave configuration data includes, for example, (1) attribute data for each port P, (2) filter constants for port P whose attribute is input (hereinafter simply referred to as "input port P"), (3) WakeUp setting data based on the input signal to input port P, and (4) output setting data for port P whose attribute is output (hereinafter simply referred to as "output port P").

[0081] In this disclosure, the initial configuration information for slave configuration data is referred to as "initial configuration data." The initial configuration data may be sent from master node 2 to slave node 7 at a predetermined time (for example, when power is turned on), or it may be pre-configured on each slave node 7.

[0082] [Key components of the vehicle control system] Next, with reference to Figure 6, the main components of the vehicle control system 1 of the embodiment will be described. The vehicle control system 1 controls the in-vehicle devices 60 mounted on the vehicle. The vehicle control system 1 comprises a slave node 7 and a master node 2.

[0083] The slave node 7 is connected to the in-vehicle device 60 and the power supply 8 installed in the vehicle. For example, the in-vehicle device 60 is a seat heater. The power supply 8 is a DC power supply that provides a DC power voltage. For example, the power supply 8 is a battery installed in the vehicle. Note that the power supply 8 is not shown in Figures 1 and 4.

[0084] The slave node 7 generates an operation signal based on the power supply voltage supplied from the power supply 8 and outputs the operation signal to the in-vehicle device 60 (specifically, the device to be operated included in the in-vehicle device 60).

[0085] Master node 2 controls slave node 7 by communicating with the slave node via the communication network (communication line B in this example).

[0086] [Slave node configuration] As shown in Figure 6, the slave node 7 includes a slave IC 75, an IPD (Intelligent Power Device) 76, and a power relay 77. Inside the IPD 76 are a current detection circuit 81, a temperature detection circuit 82, and the like. Note that the IPD 76 and power relay 77 are not shown in Figure 4.

[0087] <Slave Interchange> The slave IC 75 communicates with the master node 2 via the communication network. The slave IC 75 controls the operation of the slave node 7 by controlling various parts of the slave node 7. In this example, the slave IC 75 includes the communication module 71 shown in Figure 4, a register 72, a selector 73, and a driver group 74. The slave IC 75 is an example of a slave control unit provided in the slave node 7.

[0088] The slave IC 75 operates in response to various commands transmitted from the master node 2. In this example, the slave IC 75 controls the operation (state) of the IPD 76 by outputting a control signal to the IPD 76. The slave IC 75 also controls the operation (state) of the power relay 77 by outputting a control signal to the power relay 77.

[0089] Furthermore, the slave IC 75 receives information output from the in-vehicle device 60 (specifically, the sensors included in the in-vehicle device 60) and information obtained from various parts of the slave node 7. The slave IC 75 transmits various types of information to the master node 2.

[0090] <IPD> IPD76 is provided in the current path CP. The current path CP is a path for generating and outputting control signals, and is a current path from the power supply 8 through the slave node 7 to the in-vehicle device 60. Furthermore, when predetermined interruption conditions are met, IPD76 enters an interruption state that interrupts the current path CP. IPD76 is an example of a first interruption unit.

[0091] In this example, the IPD76 switches between an on state and an off state (switching operation) in response to a control signal output from the slave IC. Furthermore, when the shut-off condition is met and the IPD76 enters the shut-off state, it notifies the slave IC that the IPD76 is in the shut-off state.

[0092] In this example, the tripping condition includes the condition that the current value detected by the current detection circuit 81 (the current value of the current flowing through the current path CP), as described later, exceeds a predetermined overcurrent threshold. The IPD76 enters a tripped state when the current value of the current flowing through the current path CP exceeds the overcurrent threshold, and releases the tripped state when the current value of the current flowing through the current path CP no longer exceeds the overcurrent threshold.

[0093] <Power relay> The power relay 77 is installed in the current path CP between the power supply 8 and the IPD 76. The power relay 77 can be put into an interrupted state that interrupts the current path CP. The power relay 77 is an example of a second interruption unit.

[0094] <Current detection circuit> The current detection circuit 81 detects the current value of the current flowing through the current path CP. The current detection circuit 81 is an example of a current detection unit.

[0095] For example, the current detection circuit 81 may include a shunt resistor connected in series with the current path CP. The signal output from the current detection circuit 81 may be a signal indicating the voltage value obtained by the shunt resistor (a voltage value corresponding to the potential difference across the shunt resistor). It is possible to derive the current value of the current flowing through the current path CP based on the "voltage value obtained by the shunt resistor" and the "resistance value of the shunt resistor". Such a derivation may be performed in the control circuit 85 described later. The voltage value obtained by the shunt resistor is an example of information indicating the current value of the current flowing through the current path CP.

[0096] <Temperature detection circuit> The temperature detection circuit 82 detects the temperature of the IPD76. Examples of the IPD76 temperature include the temperature of the substrate (not shown) on which the IPD76 components are mounted, and the temperature inside the casing (not shown) that houses the IPD76 components. The temperature detection circuit 82 is an example of a temperature detection unit.

[0097] [IPD Configuration] Figure 7 shows an example configuration of the IPD76. In addition to the current detection circuit 81 and the temperature detection circuit 82, the IPD76 includes a switching element 80 and a control circuit 85.

[0098] <Switching elements> The switching element 80 is provided in the current path CP. The switching element 80 can be switched between an on state and an off state. For example, the switching element 80 is an insulated-gate field-effect transistor (MOSFET).

[0099] When the switching element 80 is turned ON, the current path CP becomes conductive and current flows through the current path CP. On the other hand, when the switching element 80 is turned OFF, the current path CP is blocked and no current flows through the current path CP. This switching between the ON and OFF states of the switching element 80 (switching operation) generates an operation signal to operate (drive) the in-vehicle device 60. Also, when the switching element 80 is fixed in the OFF state, the IPD76 is turned OFF.

[0100] <Control circuit> The control circuit 85 operates in response to the control signal output from the slave IC 75. The control circuit 85 controls the operation of the IPD76 by controlling each part of the IPD76.

[0101] In this example, the control circuit 85 controls the operation (state) of the switching element 80 by outputting a control signal to the switching element 80. Specifically, the control circuit 85 controls the switching operation of the switching element 80 in response to the control signal output from the slave IC.

[0102] The control circuit 85 receives information obtained from each part of the IPD76. In this example, the control circuit 85 acquires the current value detected by the current detection circuit 81 (the current value of the current flowing through the current path CP) and the temperature detected by the temperature detection circuit 82 (the temperature of the IPD76).

[0103] In this example, the control circuit 85 determines whether the current value detected by the current detection circuit 81 (the current value of the current flowing through the current path CP) exceeds the overcurrent threshold.

[0104] When the current value detected by the current detection circuit 81 exceeds the overcurrent threshold, the control circuit 85 fixes the switching element 80 in the off state and notifies the slave IC 75 that the IPD 76 is in the off state. As a result, the IPD 76 is turned off, and the slave IC is notified that the IPD 76 is in the off state.

[0105] On the other hand, when the current value detected by the current detection circuit 81 no longer exceeds the overcurrent threshold, the control circuit 85 releases the lock on the off state of the switching element 80 and notifies the slave IC 75 that the IPD 76 is not in an off state. As a result, the IPD 76 is released from its off state, and the slave IC is notified that the IPD 76 is not in an off state.

[0106] In this example, the control circuit 85 determines whether the temperature detected by the temperature detection circuit 82 (the temperature of the IPD76) exceeds a predetermined temperature anomaly threshold, and based on the determination result, notifies the slave IC 75 whether the IPD76 is experiencing a temperature anomaly. A temperature anomaly is an example of an abnormal state of the first shut-off unit. The control circuit 85 is an example of an anomaly detection unit that detects an abnormal state of the first shut-off unit. The temperature anomaly threshold may be set to a temperature lower than the overheat threshold, which will be described later.

[0107] Specifically, when the temperature detected by the temperature detection circuit 82 exceeds the temperature anomaly threshold, the control circuit 85 notifies the slave IC that the IPD76 is experiencing a temperature anomaly. On the other hand, when the temperature detected by the temperature detection circuit 82 no longer exceeds the temperature anomaly threshold, the control circuit 85 notifies the slave IC 75 that the IPD76 is no longer experiencing a temperature anomaly.

[0108] The control circuit 85 can be implemented using a dedicated circuit such as an application-specific integrated circuit (ASIC) or a programmable logic array (PLA). Alternatively, the control circuit 85 can be implemented using a processor circuit that executes computer-readable instructions (e.g., a program) and performs predetermined processing steps to execute a specific function.

[0109] [First protection process] Next, with reference to Figure 8, the first protection process of the vehicle control system 1 will be described. The first protection process is performed when the disconnection condition is met at the slave node 7 and the IPD76 enters a disconnected state.

[0110] First, in step S11, when the shut-off condition is met and the IPD76 enters a shut-off state, the slave node 7 (specifically the slave IC75) sends status information to the master node 2 indicating that the IPD76 is in a shut-off state. The status information is information indicating the state of the IPD76.

[0111] Next, in step S12, the master node 2 receives status information transmitted from the slave node 7. Then, in step S13, the master node 2 confirms that the IPD76 installed on the slave node 7 is in the blocked state by referring to the status information received in step S12. The master node 2 then sends a command (first block command) to the slave node 7 instructing it to block the IPD76 and stop generating the operation signal.

[0112] Next, in step S14, the slave node 7 receives the first shutdown command transmitted from the master node 2. Then, in step S15, the slave node 7 controls the IPD76 in response to the first shutdown command so that the IPD76 enters a shutdown state. If there is no shutdown abnormality (fault) in the IPD76, the IPD76 is already in a shutdown state due to the fulfillment of the shutdown conditions, and the IPD76 maintains the shutdown state in response to the control of the slave node 7.

[0113] [Second Protection Process] Next, with reference to Figure 9, the second protection process of the vehicle control system 1 will be described. The second protection process is performed after the first disconnection command (a command instructing the IPD76 to be put into a disconnected state) is transmitted from the master node 2 to the slave node 7. The second protection process is performed repeatedly at regular intervals.

[0114] First, in step S21, the master node 2 sends a request (current request) to the slave node 7 to request the transmission of current information indicating the current value of the current flowing through the current path CP. In step S22, the slave node 7 (specifically the slave IC 75) receives the current request sent from the master node 2. Then, in step S23, the slave node 7 transmits current information indicating the current value (the current value of the current flowing through the current path CP) detected by the current detection circuit 81 to the master node 2.

[0115] Next, in step S24, the master node 2 receives current information transmitted from the slave node 7. Then, in step S25, the master node 2 determines whether the current value indicated in the current information received in step S24 exceeds a predetermined current anomaly threshold. If the current value indicated in the current information exceeds the current anomaly threshold, the process in step S26 is performed; otherwise, the process ends.

[0116] In step S26, the master node 2 sends a command (second shutdown command) to the slave node 7 instructing it to shut down the power relay 77 and stop generating the operation signal. In step S27, the slave node 7 receives the second shutdown command sent from the master node 2. Then, in step S28, the slave node 7 controls the power relay 77 in response to the second shutdown command so that it shuts down.

[0117] [Third Protection Process] Next, with reference to Figure 10, the third protection process of the vehicle control system 1 will be described. The third protection process is performed repeatedly at regular intervals.

[0118] First, in step S31, the master node 2 sends a request (status request) to the slave node 7 to request the transmission of status information indicating the status of the IPD76. In step S32, the slave node 7 (specifically the slave IC75) receives the status request sent from the master node 2. Then, in step S33, the slave node 7 transmits the status information indicating the status of the IPD76 to the master node 2.

[0119] Next, in step S34, the master node 2 receives status information transmitted from the slave node 7. Then, in step S35, the master node 2 determines whether the status information received in step S34 is "an abnormality notification information indicating that the IPD76 is abnormal (temperature abnormality in this example)". If the status information is an abnormality notification information, the process in step S36 is performed; otherwise, the process is terminated.

[0120] In step S36, the master node 2 sends a command (second cutoff command) to the slave node 7 instructing it to turn off the power relay 77 and stop generating the operation signal. In step S37, the slave node 7 receives the second cutoff command sent from the master node 2. Then, in step S38, the slave node 7 controls the power relay 77 in response to the second cutoff command so that it turns off.

[0121] [Effects of the Embodiment] As described above, in the vehicle control system 1 of this embodiment, the slave node 7 has an IPD 76, a power relay 77, and a current detection circuit 81. The IPD 76 is installed in the current path CP and enters an interrupted state that interrupts the current path CP when the interruption condition is met. The power relay 77 is installed between the power supply 8 and the IPD 76 in the current path CP and can be put into an interrupted state that interrupts the current path CP. The current detection circuit 81 detects the current value of the current flowing through the current path CP. The slave node 7 transmits state information indicating the state of the IPD 76 and current information indicating the current value detected by the current detection circuit 81 to the master node 2. Based on the state information and current information transmitted from the slave node 7, the master node 2 transmits commands to the slave node 7 to control the IPD 76 and the power relay 77.

[0122] In the above configuration, by providing IPD76, the current path CP (the current path from the power supply 8 through the slave node 7 to the in-vehicle device 60) can be shut off without waiting for instructions from the master node 2 when the shutoff condition is met. This protects the slave node 7 from abnormalities (such as overcurrent or overheating) that require rapid shutdown of the current path CP.

[0123] Furthermore, by providing a power relay 77 together with the IPD76, even if the IPD76 does not enter a tripped state due to a malfunction in the IPD76, the current path can be interrupted by tripping the power relay 77. This protects the slave node 7 from malfunctions even if the IPD76 does not enter a tripped state.

[0124] Furthermore, in the vehicle control system 1 of this embodiment, the master node 2 sends a command to the slave node 7 instructing it to turn off the IPD76 and stop generating operation signals when the state of the IPD76 indicated in the status information is in a blocked state.

[0125] In the above configuration, when the blocking condition is met and IPD76 enters a blocked state, the master node 2 can instruct the slave node 7 to put IPD76 into a blocked state. This allows the slave node 7 to process the request in response to the instruction from the master node 2 (a system-consistent state), and enables smoother control of the slave node 7 by the master node 2 thereafter.

[0126] Furthermore, in the vehicle control system 1 of this embodiment, the master node 2 sends a command to the slave node 7 instructing it to turn off the IPD 76, and then, if the current value indicated in the current information sent from the slave node 7 exceeds the current abnormality threshold, it sends a command to the slave node 7 instructing it to turn off the power relay 77.

[0127] In the above configuration, if IPD76 malfunctions and current flows through the current path CP without the IPD76 being shut off, the power relay 77 can be shut off. This protects the slave node 7 from malfunctions even if the IPD76 does not shut off.

[0128] Furthermore, in the vehicle control system 1 of this embodiment, the slave node 7 has a control circuit 85 (an example of an abnormality detection unit) that detects that the IPD76 is overheating. When the control circuit 85 detects that the IPD76 is overheating, it transmits abnormality notification information indicating that the IPD76 is overheating to the master node 2. In response to the abnormality notification information transmitted from the slave node 7, the master node 2 transmits a command to the slave node 7 instructing it to put the power relay 77 into an off state.

[0129] In the above configuration, if IPD76 experiences a temperature anomaly, the power relay 77 can be shut off. This protects the slave node 7 from malfunction when IPD76 experiences a temperature anomaly.

[0130] Furthermore, in the vehicle control system 1 of this embodiment, the tripping condition includes the condition that the current value detected by the current detection circuit 81 exceeds the overcurrent threshold. With this configuration, the slave node 7 can be protected from overcurrent.

[0131] (Modified version of the embodiment) The modified vehicle control system 1 of the embodiment has different shut-off conditions than the vehicle control system 1 of the embodiment. The other configurations and processes of the modified vehicle control system 1 of the embodiment are the same as those of the vehicle control system 1 of the embodiment.

[0132] In the modified vehicle control system 1 of the embodiment, the shut-off condition includes the condition that the temperature detected by the temperature detection circuit 82 (i.e., the temperature of the IPD76) exceeds a predetermined overheat threshold. In the IPD76, the control circuit 85 determines whether the temperature detected by the temperature detection circuit 82 (the temperature of the IPD76) exceeds the overheat threshold. If the temperature of the IPD76 exceeds the overheat threshold, the control circuit 85 fixes the switching element 80 in the off state and notifies the slave IC 75 that the IPD76 is in a shut-off state. On the other hand, when the temperature of the IPD76 no longer exceeds the overheat threshold, the control circuit 85 releases the off state of the switching element 80 and notifies the slave IC 75 that the IPD76 is not in a shut-off state.

[0133] [Effects of modified embodiments] As described above, in the modified vehicle control system 1 of the embodiment, the shut-off condition includes the condition that the temperature detected by the temperature detection circuit 82 exceeds the overheat threshold. With the above configuration, the slave node 7 can be protected from overheating.

[0134] The tripping conditions may include both a first condition, where the current value detected by the current detection circuit 81 exceeds the overcurrent threshold, and a second condition, where the temperature detected by the temperature detection circuit 82 exceeds the overheat threshold. In this case, the IPD76 enters a tripped state when at least one of the first and second conditions is met, and releases the tripped state when neither the first nor the second condition is met. This configuration protects the slave node 7 from both overcurrent and overheating.

[0135] (Other embodiments) Furthermore, in the above explanation, the current detection circuit 81 provided inside the IPD76 was given as an example of a current detection unit that detects the current value of the current flowing through the current path CP, but it is not limited to this. For example, the current detection unit may be a current detection circuit provided between the IPD76 and the in-vehicle device 60 in the current path CP. Also, the current detection unit may directly detect the current value of the current flowing through the current path CP, or it may indirectly detect the current value of the current flowing through the current path CP. For example, the current detection unit may derive (estimate) the current value of the current flowing through the current path CP based on a physical quantity correlated with the current flowing through the current path CP.

[0136] Furthermore, the above embodiments may be combined as appropriate. The above embodiments are essentially preferred examples and are not intended to limit the scope of the technologies, applications, or uses disclosed herein. [Industrial applicability]

[0137] As explained above, the technology disclosed herein is useful as a vehicle control system. [Explanation of symbols]

[0138] 1. Vehicle control system 2 Master Nodes 7 slave nodes 8 Power supply 60 In-Car Devices 75 Slave ICs 76 IPD (First Blocker) 77 Power relay (second break-off section) 81 Current detection circuit (current detection unit) 82 Temperature detection circuit (temperature detection unit) 85 Control circuit (anomaly detection unit) CP current path

Claims

1. A vehicle control system for controlling an in-vehicle device mounted on a vehicle, A slave node connected to the in-vehicle device and the power supply mounted on the vehicle, which generates an operation signal based on the power supply voltage supplied from the power supply and outputs the operation signal to the in-vehicle device, The system comprises a master node that controls the slave nodes by communicating with them via a communication network, The aforementioned slave node is A first interruption unit is provided in the current path for generating and outputting the aforementioned operation signal, which extends from the power supply through the slave node to the in-vehicle device, and enters an interruption state that interrupts the current path when predetermined interruption conditions are met. A second interruption unit is provided between the power supply and the first interruption unit in the current path, and is capable of being put into an interruption state that interrupts the current path. It includes a current detection unit that detects the current value of the current flowing through the current path, The slave node transmits to the master node status information indicating the state of the first interruption unit and current information indicating the current value detected by the current detection unit. The master node transmits commands to the slave node to control the first and second interruption units based on the state information and current information transmitted from the slave node. The master node, when the state of the first cutoff unit indicated in the state information is the cutoff state, transmits a command to the slave node instructing it to set the first cutoff unit to the cutoff state and stop generating the operation signal. Vehicle control system.

2. In the vehicle control system according to claim 1, After the master node transmits a command to the slave node instructing the first interruption unit to be in the interrupted state, if the current value indicated in the current information transmitted from the slave node exceeds a predetermined current abnormality threshold, the master node transmits a command to the slave node instructing the second interruption unit to be in the interrupted state. Vehicle control system.

3. In the vehicle control system according to claim 1, The slave node has an abnormality detection unit that detects when the first block unit is in an abnormal state, and when the abnormality detection unit detects when the first block unit is in an abnormal state, it transmits abnormality notification information indicating that the first block unit is in an abnormal state to the master node. The master node, in response to abnormality notification information transmitted from the slave node, transmits a command to the slave node instructing the second block unit to be put into the block state. Vehicle control system.

4. In any one of claims 1 to 3, The aforementioned interruption condition includes the condition that the current value detected by the current detection unit exceeds a predetermined overcurrent threshold. Vehicle control system.

5. In any one of claims 1 to 3, The slave node has a temperature detection unit that detects the temperature of the first cutoff unit, The shut-off condition includes the condition that the temperature detected by the temperature detection unit exceeds a predetermined overheating threshold. Vehicle control system.

Images