JP2024018633A - vehicle control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform fail-safe processing depending on the state of a slave node.

SOLUTION: If a power supply voltage does not fall below a first threshold, a slave node 7 notifies a master node 2 that the voltage is in a normal state. If the power supply voltage falls below the first threshold but does not fall below a second threshold, the slave node 7 notifies the master node 2 of a voltage drop state. The slave node 7 becomes unable to communicate with the master node 2 when the power supply voltage is below the second threshold. The master node 2 instructs the slave node 7 to perform fail-safe processing for safely controlling an on-vehicle device 60, based on the notification of the state of the slave node 7 and whether communication with the slave node 7 is possible.

SELECTED DRAWING: Figure 6

COPYRIGHT: (C)2024,JPO&INPIT

Description

The technology disclosed herein relates to a vehicle control system.

Some vehicle control systems that control in-vehicle devices installed in a vehicle employ a master-slave system. For example, Patent Document 1 discloses a master-slave type vehicle interior lighting system. In this vehicle interior lighting system, each of the plurality of slave ECUs performs multiplex communication with a master ECU mounted on the vehicle, and controls the light source according to instructions from the master ECU.

JP2021-136220A

In the above-mentioned vehicle control system, it is required to perform fail-safe processing according to the state of the slave node so that in-vehicle devices can be safely controlled even when the voltage of the slave node drops. However, Patent Document 1 does not disclose or suggest performing fail-safe processing depending on the state of the slave node.

The technology disclosed herein has been developed in view of this point, and its purpose is to provide a vehicle control system that can perform fail-safe processing depending on the status of slave nodes. .

The technology disclosed herein relates to a vehicle control system that controls in-vehicle devices installed in a vehicle, and this vehicle control system includes:
a slave node that is connected to the in-vehicle device and a power source mounted on the vehicle, generates an operation signal based on a power supply voltage supplied from the power source, and outputs the operation signal to the in-vehicle device;
a master node that controls the slave node by communicating with the slave node via a communication network,
The slave node is
If the power supply voltage supplied to the slave node does not fall below a first threshold, notifying the master node that the slave node is in a normal voltage state;
Notifying the master node that the slave node is in a voltage drop state when the power supply voltage supplied to the slave node falls below a first threshold but does not fall below a second threshold lower than the first threshold. ,
configured such that communication with the master node is disabled when the power supply voltage supplied to the slave node is below the second threshold;
The master node instructs the slave node to perform fail-safe processing to safely control the in-vehicle device based on notification of the state of the slave node and whether communication with the slave node is possible.

In the above configuration, the state of the slave node can be estimated (recognized) based on the notification of the state of the slave node and whether communication with the slave node is possible. Thereby, fail-safe processing can be performed depending on the status of the slave node.

Note that in the vehicle control system,
The slave node is
It may be configured such that the configuration can be changed,
The configuration of the slave node may be set to a configuration having a predetermined function by the configuration data transmitted from the master node,
When the power supply voltage supplied to the slave node falls below the second threshold, the configuration of the slave node may be reset to an unset state.

In the above configuration, when communication between the master node and the slave node is impossible, it is possible to stop outputting operation signals from the slave node to the in-vehicle device by setting the configuration of the slave node to an unset state. can. Thereby, when communication between the master node and the slave node is impossible (when fail-safe processing cannot be performed at the slave node), the in-vehicle device can be stopped.

Further, in the vehicle control system,
When the slave node returns to a state in which the power supply voltage supplied to the slave node does not fall below the second threshold, the slave node may notify the master node that the configuration of the slave node has not been set,
When the master node is notified that the configuration of the slave node has not been set, the master node may transmit the configuration data to the slave node.

In the above configuration, when the power supply voltage supplied to the slave node returns to a state where it does not fall below the second threshold, the configuration of the slave node is set to a configuration having a predetermined function using the configuration data transmitted from the master node. can do. This allows communication between the master node and slave nodes.

Further, in the vehicle control system,
When the configuration of the slave node is completed using the configuration data transmitted from the master node, the slave node may notify the master node that the configuration of the slave node is completed.

In the above configuration, by notifying the master node that the configuration of the slave node has been completed, the master node can confirm that communication with the slave node is now possible. This allows communication between the master node and slave nodes to be restarted.

Further, in the vehicle control system,
When instructing the slave node to perform the fail-safe process, the master node performs a failure diagnosis process to diagnose whether or not there is a failure in the slave node, and lights up an indicator mounted on the vehicle. At least one of the indicator lighting processing may be performed.

In the above configuration, by performing a failure diagnosis process, it is possible to diagnose whether or not the slave node is out of order. Further, by performing the indicator lighting process, it is possible to notify the user of the vehicle that the power supply voltage supplied to the slave node is decreasing.

In addition, in vehicle control systems,
The slave node may detect a voltage value of an operation signal output to the in-vehicle device and transmit voltage information indicating the voltage value of the operation signal to the master node,
The master node may instruct the slave node to perform the fail-safe process when the voltage value indicated in the voltage information transmitted from the slave node is abnormal.

With the above configuration, when the voltage value of the operation signal output to the in-vehicle device is abnormal, the slave node can be caused to perform fail-safe processing. Thereby, the in-vehicle device can be safely controlled.

According to the technology disclosed herein, fail-safe processing can be performed depending on the state of the slave node.

FIG. 1 is a block diagram showing a configuration example of a vehicle control system. FIG. 2 is a conceptual diagram showing an example of functional distribution between a master node and slave nodes. FIG. 2 is a block diagram showing a configuration example of a master node. FIG. 2 is a block diagram showing a configuration example of a slave node. FIG. 2 is a circuit block diagram showing an example of the configuration of a driver group. 1 is a block diagram showing an example of the configuration of main parts of a vehicle control system. FIG. FIG. 3 is a state transition diagram showing the state transition of a slave node. It is a flowchart for explaining the first state transition process. It is a flowchart for explaining a 2nd state transition process. It is a flowchart for explaining a 3rd state transition process. It is a flowchart for explaining the 4th state transition processing. FIG. 3 is a diagram for explaining an example of failsafe processing. FIG. 3 is a block diagram showing a configuration example of main parts of a vehicle control system according to a second modification of the embodiment.

Hereinafter, embodiments will be described in detail with reference to the drawings. It should be noted that the same or corresponding parts in the figures are given the same reference numerals, and the description thereof will not be repeated.

Note that in this disclosure, some or all of the configurations indicated by the terms "system," "unit," "module," and "node" may be an application specific integrated circuit (ASIC) or a programmable logic array (Programmable logic array). It can be realized by a dedicated circuit such as array (PLA). Moreover, some or all of the above may be realized by a processor circuit that executes computer-readable instructions (eg, a program) to perform a specific function by performing predetermined processing steps.

Furthermore, in the following description, an "in-vehicle device" refers to a device mounted on a vehicle. The in-vehicle device includes at least one of a sensor and a component to be operated (for example, a motor, an LED, etc.).

(Embodiment)
FIG. 1 shows an example of the configuration of a vehicle control system according to an embodiment. As shown in FIG. 1, the vehicle control system 1 is mounted on a vehicle CA, and has a configuration in which a master node 2 and a plurality of slave units are connected via an on-vehicle communication network.

In the example of FIG. 1, the plurality of slave units include a combination switch unit 4, left and right side mirror units 5, a steering switch unit 6, a cluster switch unit 31, an overhead console unit 32, a left and right seat heater unit 33, and a left and right side mirror unit 5. A door latch unit 34 is illustrated. Each slave unit is equipped with a slave node 7 (see FIG. 4) having a common configuration. For convenience of explanation, the side mirror unit 5, the door latch unit 34, and the seat heater unit 33 are given the same reference numerals on the left and right sides, respectively.

Each of the master node 2 and a plurality of slave units (in this example, the combination switch unit 4, the steering switch unit 6, the cluster switch unit 31, the right side mirror unit 5, the right seat heater unit 33, and the right door latch unit 34) The slave nodes 7 provided in are connected to a bus through a communication line B1. In addition, a slave node provided in each of the master node 2 and a plurality of other slave units (in this example, the overhead console unit 32, the left side mirror unit 5, the left seat heater unit 33, and the left door latch unit 34) 7 is bus-connected via communication line B2. In the following description, the communication lines B1 and B2 will be collectively referred to as "communication line B." Communication line B constitutes a communication network.

The communication line B is, for example, a communication line compliant with CXPI (Clock Extension Peripheral Interface). CXPI is an example of an event-based communication protocol. Note that the communication method is not limited to CXPI, and may be any other communication method (whether wired or wireless). Further, the number of communication lines used in the communication network is not particularly limited. Further, a HUB (not shown), an ECU (not shown), etc. for communication relay may be provided in the middle of the communication line.

[Functional distribution between master node and slave node]
FIG. 2 is a conceptual diagram showing an example of the distribution of functions between the master node 2 and the slave nodes 7 with respect to the behavior of the vehicle CA. In FIG. 2, the operation process of the vehicle CA is divided into "recognition process Iz", "judgment process Pz", and "operation process Oz", and each process is subdivided. The functions 20 distributed to the master node 2 are surrounded by broken lines, and the functions 30 distributed to the slave nodes 7 are surrounded by solid lines.

In the following, an example will be described in which a change in weather occurs from clear skies to rainy weather (hereinafter simply referred to as "weather change") regarding the processing executed in each of the recognition step Iz, judgment step Pz, and operation step Oz. I will also explain.

[Cognitive process]
In the recognition step Iz, information acquired by the sensor is recognized based on the output signal of the sensor mounted on the in-vehicle device. In this disclosure, the term "sensor" refers to sensors that measure and detect various physical quantities such as temperature, voltage, and current, as well as switches that accept various operations, cameras that capture images inside and outside the vehicle, and sensors that measure and detect various physical quantities such as temperature, voltage, and current. The concept is used to include radar that recognizes targets, etc., devices that output mechanical and electrical conversion signals, etc. The sensor acquires vehicle behavior information, occupant operation information, occupant status information, external environment information, information on the current flowing through the actuator, information on the voltage applied to the actuator, failure status information, and the like. Below, these will be collectively referred to as "detection information."

The recognition step Iz includes steps Iz2 and Iz3 executed in the slave node 7 and steps Iz4 and Iz5 executed in the master node 2. Note that although an example in which the in-vehicle device is installed within the slave node 7 will be described below, the in-vehicle device may be provided outside the slave node 7.

First, in step Iz1, some detection information is detected by a sensor mounted on an in-vehicle device. In the above-mentioned example of "weather change", detection information (for example, adhesion of raindrops, change in amount of light received, etc.) is detected by a raindrop sensor and a light receiving sensor (not shown) as sensors.

In the next step Iz2, the slave node 7 receives the output of the sensor via a port P, which will be described later. The output of the above-mentioned sensor includes, for example, a detection signal of the sensor, a physical quantity detected by the sensor such as current, voltage, and temperature, a mechanical-electrical conversion signal, and the like.

In the next step Iz3, the slave node 7 performs signal processing and data processing on the sensor output, and transmits the signal obtained by these processing to the master node 2 as a detection signal. The detection signal transmitted from the slave node 7 to the master node 2 is a signal compliant with CXPI.

Note that the signal processing is, for example, a process of dividing information output from a sensor into "superior information" and "unnecessary information" and extracting only significant information. An example of the signal processing includes filtering processing such as a chattering filter. The data conversion process is, for example, a process of processing discretized information into information suitable for continuous processing. An example of data conversion processing is a process of obtaining a continuous signal by performing moving average processing on discrete data when performing continuous processing such as PID control in subsequent information processing.

That is, in steps Iz2 and Iz3, the slave node 7 converts the output of the sensor into a predetermined signal format without recognizing or determining the specific content of the input information (detection information), and sends it to the master node as a detection signal. Send to 2.

In the next step Iz4, the master node 2 receives the detection signal transmitted from the slave node 7. In the next step Iz5 (information processing), the master node 2 recognizes the specific content of the detection information input from the sensor to the slave node 7 based on the change over time of the detection signal and connection data described later. do. In the above-mentioned example of "weather change," information processing generates cognitive information such as, "The intensity of light passing through the windshield has fallen below a predetermined value, making it dark outside the vehicle, and it is raining." is obtained. Note that in the following, information recognized in the recognition process will be referred to as "recognition information."

[Judgment process]
In the judgment step Pz, the actions and responses of the vehicle CA are determined based on the cognitive information recognized in the recognition step Iz. Processes Pz1 to Pz4, which are components of the judgment process Pz, are executed in the master node 2.

Specifically, in step Pz1, master node 2 determines the purpose of the behavior of vehicle CA based on the recognition information recognized in recognition step Iz. In the above-mentioned example of "weather change", for example, the objective is determined to be "behaving in a manner appropriate to the case where the environment outside the vehicle becomes dark and rain begins to fall."

In the next step Pz2, the master node 2 sets an action plan to achieve the objective determined in step Pz1. At this time, action plans including alternative measures are listed. For example, an action list listing action plans is generated. In the example of "weather change" mentioned above, the action plan corresponding to "behavior when the environment outside the vehicle is dark and rainy" includes "operating the wipers" and "turning on the auto light function of the vehicle CA". , "Limit the upper limit speed of vehicle CA."

In the next step Pz3, the master node 2 determines which action to actually execute from among the actions listed in the action plan. For example, the master node 2 selects an action to be actually executed from the action list. In the above-mentioned example of "weather change", for example, the actions "operate the wipers" and "turn on the auto light function of the vehicle" are selected as the actions to be executed.

In the next step Pz4, the master node 2 selects a means (corresponding means) for realizing the action determined in step Pz3. In the example of "weather change" mentioned above, for example, in response to the actions "operate the wipers" and "turn on the auto light function of the vehicle", the wiper unit (not shown) and the headlight unit (not shown) are activated. (omitted) and a tail light unit (not shown) are selected.

[Operating process]
The operation process Oz includes processes Oz1 and Oz2 executed in the master node 2 and processes Oz3 to Oz5 executed in the slave node 7.

First, in step Oz1, the master node 2 determines the operation target and its operation amount for realizing the action and response determined in the judgment step Pz. Here, the operation target broadly includes objects that are operated to realize an action or response, and includes, for example, a lighting device and an actuator. Lighting devices include various LEDs and light bulbs used in headlamps, indicators, turn lamps, and the like. The actuator includes body-related devices such as wipers and mirror drive motors, and power-related devices used in engines, brakes, and the like.

In the above-mentioned example of "weather change", for example, as the operation contents of the wiper unit, turning on the windshield wiper, and the operation speed and operation interval of the wiper are determined. Further, as the operation details of the headlight unit and taillight unit, turning on the headlight and taillight and the illuminance thereof are determined.

In the next step Oz2, the master node 2 (1) identifies the port P to which the operation target is connected (hereinafter referred to as "operation port P") based on the connection data, and (2) determines the output of the operation port P. A command code for commanding the contents is generated, and (3) a process of transmitting an operation command signal containing the command code to the slave node provided with the operation port P is executed. In the above-mentioned example of "weather change", for example, the master node 2 transmits an instruction code (operation instruction signal) that instructs the output content of the operation port P to which the wiper is connected to the wiper unit (not shown), A command code indicating the output content of the operation port P connected to the headlight is sent to the headlight unit (not shown), and a command code indicating the output content of the operation port P connected to the taillight is sent to the taillight unit (not shown). (omitted). Note that the operation command signal transmitted from the master node 2 to the slave node 7 is a signal compliant with CXPI.

Each slave node 7 receives the instruction code transmitted from the master node 2, and outputs an operation signal based on the instruction code from the operation port P based on the instruction code.

Specifically, the slave node 7 generates a signal to be output from the operation port P based on the instruction code through protocol conversion of the instruction code and/or reference to a designated register (step Oz3). Then, an operation signal is output from the operation port P specified by the instruction code to the on-vehicle device (specifically, the device to be operated included in the on-vehicle device) (step Oz4). As a result, (1) the wiper unit drives the wiper, (2) the headlight unit lights the headlight, and (3) the taillight unit lights the taillight.

Next, the configurations of the master node 2 and slave units will be described in detail with reference to FIGS. 3 and 4.

[Master node]
FIG. 3 shows an example of the configuration of the master node 2. As shown in FIG. 3, the master node 2 includes a communication module 21, a recognition module 22, a judgment module 23, an operation module 24, and a memory 25.

The master node 2 includes, for example, one or more electronic control units (ECUs). The electronic control unit may be configured using a single IC (Integrated Circuit) or may be configured using a plurality of ICs. Additionally, an IC may include a single core or die, or multiple cooperating cores or dies.

The communication module 21 has a function of receiving signals from each slave node 7 and transmitting signals to each slave node 7 via the communication line B.

The memory 25 stores configuration data (hereinafter referred to as "master configuration data") corresponding to each slave node 7.

The master configuration data includes initial configuration data set in each slave node 7 and connection data. In other words, the master node 2 holds the initial configuration data set in each slave node 7. The connection data is data indicating the connection relationship between each port P of the slave node 7 and the device port of the in-vehicle device. In other words, the connection data is data indicating which function of the device port of the in-vehicle device is connected to each port P of the slave node 7.

Note that the memory 25 may be an internal memory built into an IC constituting the ECU, or an external memory externally attached to the IC. Furthermore, the memory may store, for example, a program for operating the CPU installed in the IC, or may store information such as processing results by the CPU.

The recognition module 22 executes the recognition processing of steps Iz4 and Iz5 of the above-mentioned recognition steps Iz. Specifically, the recognition module 22 connects the in-vehicle device (specifically, the in-vehicle device) based on the connection data stored in the memory and the detection signal received from the slave node (e.g., a change in the detection signal over time). performs recognition processing to recognize the detection information acquired by the included sensors). Note that the detection signal indicates which port of the slave node 7 inputs what kind of sensor output. The connection data indicates which in-vehicle device is connected to which port of the slave node 7.

In this example, the recognition module 22 includes a decoding module 221 and an informationization module 222. The decode module 221 decodes the detection signal received from the slave node 7. The informatization module 222 performs the informatization process in step Iz5 described above.

The judgment module 23 executes the judgment process of the above-mentioned judgment process Pz (specifically, processes Pz1 to Pz4). Specifically, the determination module 23 determines the behavior of the vehicle CA based on the cognitive information recognized in the cognitive processing by the cognitive module 22.

In this example, the judgment module 23 includes a purpose determining module 231 that executes the aforementioned process Pz1, an action planning module 232 that executes the aforementioned process Pz2, an action determining module 233 that executes the aforementioned process Pz3, and the aforementioned and a correspondence determination module 234 that executes step Pz4.

The operation module 24 executes processes Oz1 and Oz2 of the operation process Oz. Specifically, the operation module 24 identifies an in-vehicle device that corresponds to the behavior of the vehicle determined in the determination process, and operates the identified in-vehicle device (specifically, a device to be operated included in the in-vehicle device). An instruction code for instructing the operation of is generated and transmitted to the slave node 7 to which the specified in-vehicle device is connected.

In this example, the operation module 24 includes an operation determination module 241 that executes the aforementioned step Oz1, and an instruction generation module 242 that executes the aforementioned step Oz2.

[Slave unit]
FIG. 4 shows a configuration example of a combination switch unit and a right side mirror unit 5 (hereinafter referred to as "right side mirror unit 5") among the slave units illustrated in FIG. 1.

As shown in FIG. 4, the combination switch unit 4 and the right side mirror unit 5 are each provided with a common slave node 7. Each slave node 7 is provided with 12 ports P for connecting in-vehicle devices.

In this example, the combination switch unit 4 includes a wiper switch 41 for operating a wiper at ports P1 to P4, a light switch 42 for operating a light for ports P5 to P9, and a turn switch 43 for operating a turn light for ports P10 and P11. are connected to each other. P12 is a reserved port. The wiper switch 41, the light switch 42, and the turn switch 43 are examples of in-vehicle devices that include only sensors.

Similarly, in the right side mirror unit 5, ports P1 and P2 have turn light LEDs 51 (hereinafter referred to as "turn LEDs 51"), ports P3 to P6 have indicator LEDs 52, and ports P7 to P12 have mirror storage LEDs. Motors 53 are connected respectively. The turn LED 51, the LED 52, and the motor 53 are examples of in-vehicle devices that include both a sensor and a device to be operated.

[Slave node]
Each slave node 7 includes a communication module 71, a register 72, a selector 73, and a driver group 74.

The communication module 71 is connected to the communication module 21 of the master node 2 via the communication line B, and is configured to perform bidirectional communication in accordance with CXPI. The communication module 71 includes, for example, an input/output circuit connected to the communication line B, an encoder that generates a signal output from the input/output circuit, a decoder that converts a signal output from the input/output circuit, and the like. Note that as for the specific circuit configuration of the communication module 71, a previously known configuration can be applied, so detailed explanation thereof will be omitted here.

The driver group 74 includes a plurality of driver units 740 (not shown in FIG. 4) connected one-to-one to a plurality of ports P. For example, if the slave node 7 is provided with 12 ports P, the driver group 74 is provided with 12 driver units 740.

The driver unit 740 is an IO circuit that can be used as an input port or an output port depending on external settings. As the driver unit 740, for example, a conventionally known general purpose input/output circuit (GPIO: General Purpose Input/Output) can be applied.

[Driver unit]
FIG. 5 shows a configuration example of the driver unit 740. As shown in FIG. 5, the driver unit 740 includes an output circuit 743 connected to port P, and a driver circuit 741 that drives the output circuit 743 based on a set value of an output register 742. The setting value of the output register 742 can be rewritten by a setting signal input from the OUT terminal.

The driver unit 740 includes an input circuit 745 that receives input to port P, and a receiver circuit 746 that converts the input received by the input circuit 745 into a detection signal. Receiver circuit 746 includes an AD converter 747 and a comparator 748. When the attribute of port P is analog input, AD converter 747 converts the input of port P from analog to digital and outputs it from the AI terminal. When the attribute of port P is digital input, comparator 748 outputs the input of port P as a digital signal from the DI terminal.

The driver unit 740 is capable of changing the settings of each component based on a configuration signal. For example, the driver unit 740 can change the filter constant of the digital filter of the receiver circuit 746 based on the configuration signal.

The selector 73 selects which terminal is to be enabled among the terminals (OUT terminal, AI terminal, DI terminal) of each driver unit 740 based on the attribute information of each port P recorded in the register 72. Has a function.

When the AI terminal is enabled, an analog input signal is input from port P. In this case, the analog input signal is converted into a digital signal by the input circuit 745 and the AD converter 747, output from the AI terminal, and written to the register 72 via the selector 73.

When the DI terminal is enabled, a digital input signal is input from port P. In this case, the digital input signal is output from the DI terminal via input circuit 745 and comparator 748 and written to register 72 via selector 73.

When the OUT terminal is enabled, output setting data based on the instruction code is reflected in the output register 742 of the driver circuit 741. The driver circuit 741 drives the output circuit 743 to output from port P an operation signal (either a digital signal, an analog signal, or a PWM signal) based on the output setting data of the output register 742.

Here, the output setting data is generated, for example, based on the instruction code received from the master node 2 using a logic circuit (not shown) in the selector 73 or using the value of the register 72. In other words, the output setting based on the instruction code is made to the output register 742 of the driver circuit 741 connected to port P based on the instruction code. Then, the output circuit 743 outputs an operation signal based on the instruction code via the port P based on the output setting data. The instruction code is, for example, a code that includes identification data of the port P to which the operation target is connected, and output settings of each port P linked to the identification data.

Note that as for the specific circuit configuration of the selector, a conventionally known configuration can be used, so detailed explanation thereof will be omitted here.

The register 72 stores configuration data (hereinafter referred to as "slave configuration data") set for each slave node 7. The configuration data includes attribute data of each port P.

The slave configuration data is, for example, (1) attribute data of each port P, (2) filter constant of the port P whose attribute is input (hereinafter simply referred to as "input port P"), (3) input port P. and (4) output setting data for a port P whose attribute is output (hereinafter simply referred to as "output port P").

In this disclosure, initial setting information of slave configuration data is referred to as "initial configuration data." The initial configuration data may be transmitted from the master node 2 to the slave nodes 7 at a predetermined timing (for example, when the power is turned on), or may be set in each slave node 7 in advance.

[Main parts of vehicle control system]
Next, with reference to FIG. 6, main parts of the vehicle control system 1 of the embodiment will be described. The vehicle control system 1 controls an on-vehicle device 60 mounted on a vehicle. The vehicle control system 1 includes a slave node 7 and a master node 2.

The slave node 7 is connected to an on-vehicle device 60 and a power source 8 mounted on the vehicle. For example, the in-vehicle device 60 is a seat heater. The power supply 8 is a DC power supply that supplies a DC power supply voltage. For example, the power source 8 is a battery mounted on a vehicle. Note that the illustration of the power supply 8 is omitted in FIGS. 1 and 4.

The slave node 7 generates an operation signal based on the power supply voltage supplied from the power supply 8, and outputs the operation signal to the in-vehicle device 60 (specifically, the device to be operated included in the in-vehicle device 60).

The master node 2 controls the slave node 7 by communicating with the slave node via a communication network (communication line B in this example).

[Slave node configuration]
As shown in FIG. 6, slave node 7 includes slave IC 75, timer 76, and voltage detection circuit 80. Note that in FIG. 4, illustration of the timer 76 and voltage detection circuit 80 is omitted.

<Slave IC>
The slave IC 75 communicates with the master node 2 via the communication network. The slave IC 75 controls the operation of the slave node 7 by controlling each part of the slave node 7. In this example, slave IC 75 includes communication module 71 shown in FIG. 4, register 72, selector 73, and driver group 74. The slave IC 75 is an example of a slave control section provided in the slave node 7.

The slave IC 75 operates in response to various commands transmitted from the master node 2. Further, the slave IC 75 receives information output from the on-vehicle device 60 (specifically, a sensor included in the on-vehicle device 60) and information obtained in each part of the slave node 7. The slave IC 75 transmits various information to the master node 2.

<Voltage detection circuit>
Voltage detection circuit 80 detects the voltage value of the power supply voltage supplied from power supply 8 to slave node 7 . The voltage detection circuit 80 is an example of a voltage detection section that detects the power supply voltage supplied to the slave node 7.

<Timer>
The timer 76 measures time. For example, timer 76 includes an oscillator that operates at a constant frequency, such as a crystal oscillator, and a counter that counts clocks from the oscillator. The timer 76 is used to measure elapsed time.

[Slave node status]
Next, the state of slave node 7 will be described with reference to FIG. 7. The states of the slave node 7 include a "normal voltage state", a "low voltage state", and a "non-communication state".

<Normal voltage condition>
The voltage normal state is a state in which the power supply voltage supplied to the slave node 7 is normal. In the normal voltage state, the power supply voltage VB supplied to the slave node 7 does not fall below the first threshold Vth1. In the normal voltage state, the slave node 7 operates normally, and the communication between the master node 2 and the slave node 7 also occurs normally.

<Voltage drop state>
The voltage drop state is a state in which the power supply voltage supplied to the slave node 7 is lower than the voltage normal state. In the voltage drop state, the power supply voltage VB supplied to the slave node 7 falls below the first threshold Vth1, but does not fall below the second threshold Vth2, which is lower than the first threshold Vth1. In the voltage drop state, the operation of the slave node 7 becomes unstable, but communication between the master node 2 and the slave node 7 is possible.

<Communication unavailable state>
The communication disabled state is a state in which the power supply voltage supplied to the slave node 7 is lower than the voltage drop state, and communication between the master node 2 and the slave node 7 is disabled. In the communication disabled state, the power supply voltage VB supplied to the slave node 7 is lower than the second threshold Vth2.

<State transition>
As shown in FIG. 7, when the power supply voltage VB supplied to slave node 7 changes, the state of slave node 7 can change. For example, when the state of the slave node 7 is "voltage normal state" and the power supply voltage VB becomes "below the first threshold value Vth1 but not below the second threshold value Vth2", the state of the slave node 7 becomes "voltage normal state". Transition from "normal state" to "voltage drop state".

[Slave node configuration]
The slave node 7 is configured such that its configuration can be changed. Specifically, the configuration data (initial configuration data) transmitted from the master node 2 sets the configuration of the slave node 7 to a configuration (initial configuration) having a predetermined function. Examples of the predetermined functions include a function that allows communication with the master node 2, a function that performs an operation in response to a command transmitted from the master node 2 (for example, generation of an operation signal), and a function that allows the state of the slave node 7 to be Examples include functions that can be checked.

[First state transition processing]
Next, with reference to FIG. 8, the first state transition process of the vehicle control system 1 will be described. The first state transition process is performed when the power supply voltage supplied to the slave node 7 changes from "a state in which it does not fall below the first threshold" to "a state in which it falls below the first threshold but does not fall below the second threshold."

First, in step S11, when the power supply voltage supplied to the slave node 7 becomes "below the first threshold value but not below the second threshold value", the slave node 7 (more specifically, the slave IC 75) Status information indicating that the state is in a degraded state is transmitted to the master node 2.

Next, in step S12, the master node 2 receives the status information transmitted from the slave node 7. Then, the master node 2 refers to the status information received in step S12 and confirms that the slave node 7 is in a voltage drop state.

Next, in step S13, the master node 2 determines whether the slave node 7 is a "slave node 7 that requires fail-safe processing". If the slave node 7 requires fail-safe processing, the process of step S14 is performed; otherwise, the process ends. Note that the slave node 7 that needs to perform fail-safe processing is specified in advance. The master node 2 stores which slave node 7 is the "slave node 7 that needs to perform fail-safe processing."

Next, in step S14, the master node 2 transmits a command (failsafe command) to the slave node instructing to perform failsafe processing for safely controlling the in-vehicle device 60. Next, in step S15, the slave node 7 receives the failsafe command transmitted from the master node 2. Next, in step S16, the slave node 7 performs failsafe processing in response to the failsafe command. Failsafe processing will be explained in detail later.

[Second state transition processing]
Next, with reference to FIG. 9, the second state transition process of the vehicle control system 1 will be described. The second state transition process is performed when the power supply voltage supplied to the slave node 7 changes from "a state below the first threshold but not below the second threshold" to "a state where it does not fall below the first threshold."

First, in step S21, the slave node 7 (specifically, the slave IC 75) determines that the slave node 7 is in a normal voltage state when the power supply voltage supplied to the slave node 7 becomes "not lower than the first threshold". The status information shown is notified to the master node 2.

Next, in step S22, the master node 2 receives the status information transmitted from the slave node 7. Then, the master node 2 refers to the status information received in step S22 and confirms that the slave node 7 is in a normal voltage state.

Next, in step S23, the master node 2 determines whether the slave node 7 is "the slave node 7 currently executing failsafe processing". If the slave node 7 is executing fail-safe processing, the process of step S24 is performed; otherwise, the process ends. Note that the master node 2 stores which slave node 7 is the "slave node 7 currently executing failsafe processing."

Next, in step S24, the master node 2 transmits a command (failsafe cancellation command) to the slave node to instruct the termination of failsafe processing. Next, in step S25, the slave node 7 receives the failsafe cancellation command transmitted from the master node 2. Next, in step S26, the slave node 7 ends the failsafe process in response to the failsafe release command. After that, the slave node 7 performs an operation (eg, generates an operation signal) in accordance with the command from the master node 2.

[Third state transition processing]
Next, with reference to FIG. 10, the third state transition process of the vehicle control system 1 will be described. In the third state transition process, the power supply voltage supplied to the slave node 7 changes from "a state in which it does not fall below the first threshold" or "a state in which it falls below the first threshold but does not fall below the second threshold" to a state in which it falls below the second threshold. ”.

First, in step S31, the slave node 7 (more specifically, the slave IC 75) resets the configuration of the slave node 7 to an unset state when the power supply voltage supplied to the slave node 7 becomes "below the second threshold". do. This results in a state in which the slave node 7 cannot output an operation signal to the in-vehicle device 60. Furthermore, the slave node 7 becomes unable to communicate with the master node.

Next, in step S32, the master node 2 transmits a request to the slave node 7 to request transmission of status information indicating the status of the slave node 7. This request is sent repeatedly on a regular basis.

When the slave node 7 is in a communication-disabled state, the slave node 7 cannot respond to a request sent from the master node 2 and cannot send status information to the master node 2. Note that when the state of the slave node 7 is a normal voltage state (or a voltage drop state), the slave node 7 responds to the request sent from the master node 2 so that the state of the slave node 7 is a normal voltage state (or a voltage drop state). status information indicating that the master node is in a voltage drop state) is transmitted to the master node 2.

Next, in step S33, the master node 2 confirms that the slave node 7 has not responded to the request transmitted in step S32. For example, when the elapsed time from the time when the request was sent reaches a predetermined waiting time, the master node 2 determines that the slave node 7 is not responding to the request. Then, the master node 2 estimates (recognizes) that the slave node 7 is in a communication-disabled state.

Note that if the slave node 7 is in a communication disabled state, the slave node 7 cannot respond to the failsafe command. Therefore, when the slave node 7 is in a communication disabled state, the master node 2 does not send the failsafe command to the slave node 7. However, the master node 2 continues to periodically send requests to the slave node 7 that is estimated (recognized) to be in a communication-disabled state.

[Fourth state transition processing]
Next, with reference to FIG. 11, the fourth state transition process of the vehicle control system 1 will be described. The fourth state transition process is a state in which the power supply voltage supplied to the slave node 7 changes from "below the second threshold" to "not below the first threshold" or "below the first threshold but not below the second threshold". ”.

First, in step S41, the slave node 7 (more specifically, the slave IC 75) detects that the configuration of the slave node 7 has not been set when the power supply voltage supplied to the slave node 7 returns to a state where it does not fall below the second threshold. It becomes possible to notify the master node 2.

Next, in step S42, the master node 2 transmits a request to the slave node 7 to request transmission of status information indicating the status of the slave node 7. This request is sent repeatedly on a regular basis.

Next, in step S43, the slave node 7 receives the request sent from the master node 2. Then, in step S44, the slave node 7 transmits state information indicating that the configuration of the slave node 7 is in an unset state to the master node 2 in response to the request received in step S43.

Next, in step S45, the master node 2 receives the status information transmitted from the slave node 7. Next, in step S46, the slave node 7 refers to the state information received in step S45 and confirms that the state of the slave node 7 is "the configuration of the slave node 7 is not set". Then, the master node 2 transmits configuration data (initial configuration data) to the slave node 7.

Next, in step S47, the slave node 7 receives the configuration data transmitted from the master node 2. Next, in step S48, the slave node 7 uses the configuration data (initial configuration data) transmitted from the master node 2 to set the configuration of the slave node 7. As a result, the configuration of the slave node 7 is set to a configuration (initial configuration) having a predetermined function.

Next, in step S49, when the configuration of the slave node 7 is completed, the slave node 7 transmits configuration completion information indicating that the configuration of the slave node 7 is completed to the master node 2.

Next, in step S50, the master node 2 receives the configuration completion information transmitted from the slave node 7. Then, in step S51, the master node 2 refers to the configuration completion information received in step S48 and confirms that the configuration of the slave node 7 has been completed.

Note that after the configuration completion notification information is transmitted from the slave node 7 to the master node 2, one of the first state transition process and the second state transition process is performed depending on the power supply voltage supplied to the slave node 7. Specifically, when the power supply voltage supplied to the slave node 7 is "below the first threshold but not below the second threshold", the first state transition process is performed and the power supply voltage supplied to the slave node 7 is "below the first threshold but not below the second threshold". The second state transition process is performed when the power supply voltage is "in a state where it does not fall below the first threshold value."

[Failsafe processing]
Failsafe processing is processing for safely controlling in-vehicle devices. As described above, the slave node 7 performs the fail-safe process in response to the fail-safe command (command instructing to perform the fail-safe process) transmitted from the master node 2.

For example, the failsafe command includes failsafe information indicating the contents of the failsafe process specified by the master node 2 (what kind of operation the slave node 7 will perform in the failsafe process). The slave node 7 performs the operation indicated in the failsafe information.

Alternatively, the slave node 7 may store a plurality of processing patterns, each of which indicates the content of different failsafe processing. In this case, the master node 2 stores what kind of processing pattern is stored in which slave node 7. The failsafe command includes processing pattern information indicating a processing pattern specified by the master node 2 (which processing pattern is to be performed by the slave node 7). The slave node 7 performs the operation according to the processing pattern indicated in the processing pattern information.

Note that the master node 2 stores which slave node 7 is the "slave node 7 that needs to perform fail-safe processing." Furthermore, the master node 2 stores the details of the fail-safe process to be performed in each slave node 7 that needs to perform the fail-safe process.

The master node 2 also remembers which slave node 7 is the "slave node 7 currently executing failsafe processing." For example, when the master node 2 transmits a failsafe command to the slave node 7, the master node 2 stores the slave node 7 as a "slave node 7 currently executing failsafe processing."

FIG. 12 shows an example of failsafe processing performed in the slave node 7. In the example of FIG. 12, the operation when the slave node 7 is in a "non-communication state" and the operation when the slave node 7 returns from the "non-communication state" to a "normal voltage state" or a "low voltage state" but the slave node 7 The operation when the configuration is not set is also included in the example of fail-safe processing. The meanings of the terms shown in FIG. 12 are as follows.

“Power supply method” indicates a method for supplying power supply voltage from power supply 8 to slave node 7 . The “Hot Start method (constant power supply)” indicates a method in which power supply voltage is constantly supplied from the power supply 8 to the slave node 7. "Cold Start method (scene-specific power supply)" indicates a method in which the supply of power supply voltage from the power supply 8 to the slave node 7 may be stopped (for example, ignition power supply).

“Power supply” indicates the state of supply of power supply voltage from the power supply 8 to the slave node 7. “Loss” and “OFF” indicate a state in which the power supply voltage is not supplied from the power supply 8 to the slave node 7. “Electricity” indicates a state in which the power supply voltage is being supplied from the power supply 8 to the slave node 7.

“Initial configuration” indicates whether or not initial configuration settings have been completed in the slave node 7. “Not yet” indicates that the initial configuration settings have not been completed in the slave node 7. “Completed” indicates a state in which the initial configuration settings have been completed in the slave node 7.

“Communication bus” indicates the status of the slave node 7 with respect to the communication bus (communication network). “Sleep” indicates that the slave node 7 is in a sleep state (power saving state). "Wakeup" indicates that the slave node 7 is not in a sleep state.

“Reception state” indicates the reception state of the slave node 7 with respect to communication from the master node 2. “Not received” indicates a state in which the slave node 7 has not received the command from the master node 2. "Communication error" indicates a state in which the duration of the unreceived state exceeds a predetermined error time. “Receiving” indicates a state in which the slave node 7 is receiving a command from the master node 2.

"Slave node operation" is the operation of the slave node 7 corresponding to the combination of the above-mentioned "power supply method", "power supply", "initial configuration", "communication bus", and "reception status" (operation in fail-safe processing). shows.

"all off" indicates that the output of the operation signal from the slave node 7 to the in-vehicle device 60 is stopped (the signal level of the operation signal is maintained at zero, which is the off value). “Hold previous value” indicates that the signal level of the operation signal from the slave node 7 to the in-vehicle device 60 is held at the previous value. “Master node instruction” indicates that the master node 2 operates in accordance with a command transmitted from the master node 2.

The "failsafe value" indicates that the signal level of the operation signal from the slave node 7 to the in-vehicle device 60 is maintained at a predetermined failsafe value. The failsafe value is set to any one of an "on value", "off value (zero)", and "previous value". Note that the state "the signal level of the operation signal is maintained at the on value" indicates the state "the output of the operation signal having a predetermined signal level is continued". The state of "maintaining the signal level of the operation signal at an off value" indicates the state of "the output of the operation signal is stopped".

For example, in the fifth row of the correspondence table shown in FIG. The state of power supply voltage to master node 7 is "Loss (power supply voltage is being supplied)", the state of slave node 7 to the communication bus is "Wakeup", and the state of slave node 7 to communication bus is "Wakeup", and slave node 7 to communication bus This indicates that when the reception state of the node 7 is "communication error", the slave node 7 performs the operation of "maintaining the signal level of the operation signal to the in-vehicle device 60 at a fail-safe value".

[Effects of embodiment]
As described above, in the vehicle control system 1 of the embodiment, the slave node 7 masters that the slave node 7 is in a normal voltage state when the power supply voltage supplied to the slave node 7 does not fall below the first threshold. Notify node 2. Furthermore, when the power supply voltage supplied to the slave node 7 falls below the first threshold but does not fall below the second threshold, the slave node 7 notifies the master node 2 that the slave node 7 is in a voltage drop state. Further, the slave node 7 becomes unable to communicate with the master node 2 when the power supply voltage supplied to the slave node 7 is less than the second threshold. The master node 2 instructs the slave node 7 to perform fail-safe processing to safely control the in-vehicle device 60 based on the notification of the state of the slave node 7 and whether communication with the slave node 7 is possible.

In the above configuration, the state of the slave node 7 can be estimated (recognized) based on the notification of the state of the slave node 7 and whether communication with the slave node 7 is possible. Thereby, fail-safe processing can be performed depending on the state of the slave node 7.

Further, in the vehicle control system 1 of the embodiment, the slave node 7 is configured to be able to change the configuration. Using the configuration data transmitted from the master node 2, the configuration of the slave node 7 is set to a configuration having a predetermined function. Furthermore, when the power supply voltage supplied to the slave node 7 falls below the second threshold, the slave node 7 resets the configuration of the slave node 7 to an unset state and stops outputting the operation signal to the in-vehicle device 60. .

In the above configuration, when communication between the master node 2 and the slave node 7 is impossible, by setting the configuration of the slave node 7 to an unset state, the operation signal is output from the slave node 7 to the in-vehicle device 60. can be stopped. Thereby, when communication between master node 2 and slave node 7 is impossible (when fail-safe processing cannot be performed in slave node 7), in-vehicle device 60 can be stopped.

Further, in the vehicle control system 1 of the embodiment, when the slave node 7 returns to a state in which the power supply voltage supplied to the slave node 7 does not fall below the second threshold value, the slave node 7 detects that the configuration of the slave node 7 is not set yet. Notify node 2. When the master node 2 is notified that the configuration of the slave node 7 has not been set, it transmits the configuration data to the slave node 7.

In the above configuration, when the power supply voltage supplied to the slave node 7 returns to a state where it does not fall below the second threshold, the configuration data transmitted from the master node 2 changes the configuration of the slave node 7 to a configuration having a predetermined function. Can be set to . Thereby, communication between the master node 2 and slave node 7 can be made possible.

Further, in the vehicle control system 1 of the embodiment, when the configuration setting of the slave node 7 is completed based on the configuration data transmitted from the master node 2, the slave node 7 informs the master that the configuration setting of the slave node 7 is completed. Notify node 2.

In the above configuration, by notifying the master node 2 that the configuration settings of the slave node 7 have been completed, the master node 2 can confirm that communication with the slave node 7 is now possible. . Thereby, communication between the master node 2 and slave node 7 can be restarted.

(Modification 1 of embodiment)
The vehicle control system 1 of the first modification of the embodiment performs a failure diagnosis process and an indicator lighting process in addition to the processes of the vehicle control system 1 of the embodiment.

In the vehicle control system 1 of the first modification of the embodiment, the master node 2 performs at least one of the failure diagnosis process and the indicator lighting process when instructing the slave node 7 to perform the failsafe process. The failure diagnosis process is a process for diagnosing the presence or absence of a failure in the slave node 7. The indicator lighting process is a process for lighting an indicator (not shown) mounted on the vehicle.

[Effects of modification 1 of the embodiment]
In the vehicle control system 1 of the first modification of the embodiment, by performing a failure diagnosis process, it is possible to diagnose whether or not the slave node 7 is out of order. Further, by performing the indicator lighting process, it is possible to notify the user of the vehicle that the power supply voltage supplied to the slave node 7 is decreasing.

(Modification 2 of embodiment)
The vehicle control system 1 of the second modification of the embodiment performs processing based on the voltage value of the operation signal in addition to the processing of the vehicle control system 1 of the embodiment.

In the vehicle control system 1 of the second modification of the embodiment, the slave node 7 detects the voltage value of the operation signal output to the in-vehicle device 60, and transmits voltage information indicating the voltage value of the operation signal to the master node 2. . The master node 2 instructs the slave node 7 to perform fail-safe processing when the voltage value indicated in the voltage information transmitted from the slave node 7 is abnormal.

As shown in FIG. 13, in the second modification of the embodiment, slave node 7 includes an output voltage detection circuit 81 in addition to the configuration of slave node 7 shown in FIG.

The output voltage detection circuit 81 detects the voltage value of the operation signal output from the slave IC 75 to the in-vehicle device 60 (specifically, the device to be operated included in the in-vehicle device 60). Slave IC 75 transmits voltage information indicating the voltage value detected by output voltage detection circuit 81 to master node 2 . The output voltage detection circuit 81 is an example of an output voltage detection section that detects the voltage value of the operation signal output to the in-vehicle device 60.

The master node 2 determines whether the voltage value (voltage value of the operation signal) indicated in the voltage information transmitted from the slave node 7 exceeds a predetermined output abnormality threshold. When the voltage value indicated in the voltage information exceeds the output abnormality threshold, the master node 2 estimates (recognizes) that the voltage value indicated in the voltage information is abnormal and instructs to perform fail-safe processing. A command (failsafe command) is sent to the slave node 7.

[Effects of modification 2 of the embodiment]
In the vehicle control system 1 of the second modification of the embodiment, when the voltage value of the operation signal output to the vehicle-mounted device 60 is abnormal, the slave node 7 can be caused to perform fail-safe processing. Thereby, the in-vehicle device 60 can be safely controlled.

In the vehicle control system 1 of the second modification of the embodiment, the master node 2 determines whether the voltage value (voltage value of the operation signal) indicated in the voltage information transmitted from the slave node 7 is within a predetermined normal range. It may be determined whether or not. In this case, if the voltage value shown in the voltage information is not within the normal range, the master node 2 estimates (recognizes) that the voltage value shown in the voltage information is abnormal, and sends a failsafe command to the slave node. It may be sent to 7.

(Other embodiments)
In the above description, the master node 2 may decide whether to instruct the slave node 7 to perform fail-safe processing, depending on the frequency of state transitions of the slave node 7. For example, the master node 2 counts the number of state transitions of each slave node 7, and performs fail-safe processing ( For example, an instruction may be given to perform a fail-safe process of stopping the output of the operation signal to the in-vehicle device 60.

In addition, in the above explanation, the slave node 7 that does not need to perform fail-safe processing sends state information to the master node 2 indicating that the slave node 7 is in a "normal voltage state" or a "low voltage state". It may be configured not to transmit. Such settings can be realized by the initial configuration of the slave node 7.

Furthermore, in the above description, the voltage detection circuit 80 that directly detects the power supply voltage was used as an example of the voltage detection unit that detects the power supply voltage supplied to the slave node 7, but the present invention is not limited to this. For example, the voltage detection section may indirectly detect the power supply voltage supplied to the slave node 7. Specifically, the voltage detection unit may derive (estimate) the power supply voltage supplied to the slave node 7 based on a physical quantity that is correlated with the power supply voltage supplied to the slave node 7 . Note that the same applies to the output voltage detection section that detects the voltage value of the operation signal output to the in-vehicle device 60.

Furthermore, the above embodiments may be combined as appropriate. The above embodiments are essentially preferred examples and are not intended to limit the scope of the technology disclosed herein, its applications, or its uses.

As explained above, the technology disclosed herein is useful as a vehicle control system.

1 Vehicle control system 2 Master node 7 Slave node 8 Power supply 60 In-vehicle device 75 Slave IC
80 Voltage detection circuit (voltage detection section)
81 Output voltage detection circuit (output voltage detection section)

Claims (6)

A vehicle control system that controls an in-vehicle device installed in a vehicle,
a slave node that is connected to the in-vehicle device and a power source mounted on the vehicle, generates an operation signal based on a power supply voltage supplied from the power source, and outputs the operation signal to the in-vehicle device;
a master node that controls the slave node by communicating with the slave node via a communication network,
The slave node is
If the power supply voltage supplied to the slave node does not fall below a first threshold, notifying the master node that the slave node is in a normal voltage state;
Notifying the master node that the slave node is in a voltage drop state when the power supply voltage supplied to the slave node falls below a first threshold but does not fall below a second threshold lower than the first threshold. ,
configured such that communication with the master node is disabled when the power supply voltage supplied to the slave node is below the second threshold;
The master node instructs the slave node to perform fail-safe processing to safely control the in-vehicle device based on notification of the state of the slave node and whether communication with the slave node is possible. control system. The vehicle control system according to claim 1,
The slave node is
It is configured so that the configuration can be changed,
The configuration of the slave node is set to a configuration having a predetermined function by the configuration data transmitted from the master node,
A vehicle control system that resets the configuration of the slave node to an unset state when the power supply voltage supplied to the slave node falls below the second threshold. The vehicle control system according to claim 2,
When the slave node returns to a state in which the power supply voltage supplied to the slave node does not fall below the second threshold, the slave node notifies the master node that the configuration of the slave node has not been set;
A vehicle control system in which the master node transmits the configuration data to the slave node when notified that the configuration of the slave node is unset. The vehicle control system according to claim 3,
When the slave node completes the configuration setting of the slave node based on the configuration data transmitted from the master node, the slave node notifies the master node that the configuration setting of the slave node is completed. The vehicle control system according to claim 1,
When instructing the slave node to perform the fail-safe process, the master node performs a failure diagnosis process to diagnose whether or not there is a failure in the slave node, and lights up an indicator mounted on the vehicle. A vehicle control system that performs at least one of indicator lighting processing for. The vehicle control system according to any one of claims 1 to 5,
The slave node detects a voltage value of an operation signal output to the in-vehicle device, and transmits voltage information indicating the voltage value of the operation signal to the master node,
The master node is a vehicle control system that instructs the slave node to perform the fail-safe process when the voltage value indicated in the voltage information transmitted from the slave node is abnormal.