JP2001022708A - Network system for vehicle - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the number of auxiliary slave ECUs by providing an auxiliary slave control device for performing the same control processing in place of a slave control device when the slave control device is not normally functioning and making the number of auxiliary slave control devices smaller than the number of slave control devices. SOLUTION: Slave ECUs 1b-1d as slave control devices are connected through a communication network 5 to a main ECU 1a as a main control device, an operating state parameter is transmitted to the main ECU 1a, and operating equipment is controlled on the basis of a control variable calculated by the main ECU 1a. Auxiliary slave ECUs 1e are provided as auxiliary slave control devices for performing the same control processing when the individual slave ECUs 1b-1d are not normally functioning, and the number of auxiliary slave ECUs 1e is less than the number of slave ECUs 1b-1d.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a vehicle network system in which a plurality of control devices are connected by a communication line.

[0002]

2. Description of the Related Art In recent years, electronic control devices have been mounted on vehicles, and the electronic control devices are used for engine control, transmission control, brake control, and the like. In addition, using a system in which a plurality of electronic control devices independently perform individual control, a plurality of electronic control devices are connected by a communication line to form a network, and control is performed while exchanging information with each other. System, and, moreover,
A system for centrally managing control data of a plurality of electronic control devices has been proposed.

FIG. 10 is a diagram showing a system configuration of a conventional vehicular network system disclosed in Japanese Patent Application Laid-Open No. 4-114203. In FIG. 10, reference numeral 101 denotes a plurality of driving state parameter detecting means for detecting driving state parameters of the vehicle, 102 denotes a plurality of slave ECUs (dependent control devices), 103 denotes a plurality of driving devices mounted on the vehicle,
104 is a main ECU (main control device), and 105 is a communication line. Slave ECU 102 and main ECU 10
4 is connected by a communication line 105 to form a network.

The slave ECU 102 transmits, via a communication line, the parameters (for example, the intake air amount, the throttle opening, the wheel speed, etc.) obtained by the operating state parameter detecting means 101 or data internally processed based on these parameters. In addition to transmitting the data to the main ECU 104 and controlling the plurality of driving devices 103 mounted on the vehicle based on the data transmitted from the main ECU 104 via the communication line 105. The main ECU 104 calculates control data based on various data sent from the plurality of slave ECUs 102 and transmits the control data to the slave ECU 102.

[0005]

However, in such a vehicle network system in which a plurality of electronic control units perform control while exchanging information with each other, one of a plurality of slave ECUs does not operate normally. In this case, the processing capacity of the other slave ECUs and the main ECU is limited, and the processing capacity of the entire system is reduced.
In order to solve such a reduction in processing capacity, a spare slave ECU having the same function is provided for each slave ECU.
(Not shown), there is a system configuration that ensures the processing capability of the vehicle network system by using the spare slave ECU when each slave ECU does not operate normally. However, in such a system configuration, as many spare slave ECs as the number of slave ECUs are provided.
Since it is necessary to provide the U, there is a problem that the space occupied in the vehicle increases and the cost increases.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and does not require a space for installing spare slave ECUs in the vehicle by the number of slave ECUs. It is an object of the present invention to provide a vehicle network system capable of securing the processing capability of the system even when each slave ECU does not operate normally without increasing the cost.

[0007]

SUMMARY OF THE INVENTION A vehicle network system according to the present invention comprises a driving state parameter detecting means for detecting a parameter representing a driving state of a vehicle, and an electronically controlled driving system for electronically controlling the driving of the vehicle. Equipment, a main control device that calculates a control amount for controlling the operation device based on the operation state parameter, and connected to the main control device via a communication network, and transmits the operation state parameter to the main control device, A slave control device that controls the driving equipment based on the control amount calculated by the main control device, and a spare device that performs the same control processing in place of the slave control device when the slave control device is not operating normally. And a slave controller, wherein the number of spare slave controllers is smaller than the number of slave controllers.

[0008] Further, the present invention is characterized in that there is only one auxiliary dependent control device.

A switching means for switching the transmission path of the operating state parameter and the control amount from the slave control device to the standby slave control device when any of the slave control devices does not operate normally. It is further characterized by being provided.

The main control unit stores and holds the same control program as the control program stored and held in the subordinate control unit. When the subordinate control unit does not operate normally, the main control unit stores and stores the same program. The same control program is stored and held in the auxiliary slave control device, and the standby slave control device performs the same processing as the slave control device that has stopped operating normally.

Further, the auxiliary slave control device stores and holds the same program as the control program stored and held in the slave control device. When the slave control device does not operate normally, the standby slave control device stores the same program. Using the same control program as the control program stored and held in the subordinate control device that has stopped operating normally among the control programs that have been stopped, and performs the same processing as the subordinate control device that has stopped operating normally. I do.

Further, after the main control device determines that one of the slave control devices does not operate normally,
Determining means for determining again whether or not the slave control device operates normally; and when the determining means determines that the slave control device has returned to normal operation, a preliminary slave control device is provided. The control of the driving equipment by the control device is stopped, and the subordinate control device that has returned controls the driving equipment.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 is a diagram showing a configuration of a vehicle network system according to an embodiment of the present invention, FIG. 2 is a flowchart showing control processing contents of a main control device, FIG. 3 is a flowchart showing control processing contents of a subordinate control device, FIG. 4 is a flowchart showing the control processing content of the backup slave control device, and FIG. 5 is a flowchart showing the control processing content of the switching circuit.

In FIG. 1, reference numerals 1a to 1e denote a group of computers mounted on a vehicle. These computers are composed of a main ECU 1a as a main control unit, slave ECUs 1b to 1d as subordinate control units, and auxiliary subordinate control units. A spare slave ECU 1e as a device is provided, and these devices are connected by a communication line 5 as a communication network to form a network. The slave ECUs 1b to 1d are an engine control device 1b, a transmission control device 1c, and a brake control device 1d, respectively.
1b to 1d are exemplarily shown, and may further include another slave ECU.

As shown in FIG. 1, the main ECU 1a
The main CPU 10a, the ROM 11a, the RAM 12a, and the communication LSI 13 are connected to each other. Also, the slave ECUs 1b, 1c, 1d
Are the slave CPUs 10b, 10c, 10c, respectively.
d, ROM 11b, 11c, 11d, RAM 12b, 1
2c, 12d, input interfaces 14a, 14b,
14c, output interfaces 15a, 15b, 15c
And a communication LSI 13. Spare slave ECU
1e is a spare slave CPU 10e, a spare slave RO
M11e, spare slave RAM 12e, input interfaces 14d, 14e, 14f, output interfaces 15d, 15e, 15f, and communication LSI 13.

The input interface 14a of the slave ECU 1b is connected to sensors as parameter detecting means such as a crank angle sensor 17, an intake air amount sensor 18, and the like, and the output interface 15a is connected to an output interface 15a.
Actuators such as an injector 19 and an ignition coil 20 are connected via a switching circuit 16a.

An input interface 14b of the slave ECU 1c includes a vehicle speed sensor 21, an accelerator switch 2
2. Sensors and switches such as a neutral switch 23 are connected, and actuators such as an automatic transmission actuator 24 are connected to an output interface 15b via a switching circuit 16b.

The input interface 14c of the slave ECU 1d includes a wheel speed sensor 25, a brake switch 2
6 are connected to sensors and switches, and actuators such as an ABS brake actuator 27 are connected to the output interface 15c by the switching circuit 1.
6c.

The crank angle sensor 17, the intake air amount sensor 18, the vehicle speed sensor 21, the accelerator switch 22,
The neutral switch 23, the wheel speed sensor 25, and the brake switch 26 function as operating state parameter detecting means. In addition, the injector 19, the ignition coil 2
0, the automatic transmission actuator 24 and the ABS brake actuator 27 function as driving equipment.

The input interface 14d of the spare slave ECU 1e is connected to sensors such as a crank angle sensor 17, an intake air amount sensor 18 and the like as parameter detecting means. The output interface 15d is connected to an injector 19 and an ignition. Actuators such as the coil 20 are connected via the switching circuit 16a. A control line 30d is connected between the output interface 15d of the spare slave ECU 1e and the switching circuit 16a.

The input interface 14e includes:
Sensors and switches such as a vehicle speed sensor 21, an accelerator switch 22, and a neutral switch 23 are connected, and actuators such as an automatic transmission actuator 24 are connected to an output port of an output interface 15e via a switching circuit 16b. Have been. A control line 30e is connected between the output interface 15e of the spare slave ECU 1e and the switching circuit 16b.

The input interface 14f includes:
Sensors and switches such as a wheel speed sensor 25 and a brake switch 26 are connected, and actuators such as an ABS brake actuator 27 are connected to the output interface 15f via a switching circuit 16c. A control line 30f is connected between the output interface 15f of the spare slave ECU 1e and the switching circuit 16c.

The ROM 11a connected to the main CPU 10a of the main ECU 1a stores not only various calculation programs such as calculation of fuel injection amount and calculation of ignition timing but also the same programs as those stored in the slave ECUs 1b to 1d. I have. The slave ECUs 1b to 1d are provided with the calculation of operating state parameters and the main ECU 1
Control programs for performing engine control, transmission control, and brake control based on the calculation result of a are stored, respectively.

The spare slave ECU 1e has a main CP
According to the program for executing the program transmitted from U and the information transmitted from the main CPU 10a,
A program for selectively using any one of the input interfaces 14d to 14f and any one of the output interfaces 15d to 15f paired with the input interface, and connected to the output interface selected by the program A spare slave ECU 1e for any of the switching circuits 16a to 16c in place of the malfunctioning slave ECU through one of the control lines 30d to 30f.
And a program for notifying the user of the use.

The switching circuits 16a to 16c control various devices (1) based on a command transmitted from the standby slave ECU 1e.
9, 20, 24 and 27)
The circuit configuration switches from control signals from the slave ECUs 1b to 1d to control signals from the spare slave ECU 1e.

Next, the operation of the main ECU will be described with reference to FIG. In step S1a, the main CPU 10
“a” requests each of the slave CPUs 10 b to 10 d via the communication LSI 13 for data such as various parameters required for calculation, engine speed, intake air amount, and the like.

In the following step S2a, the main CP
U10a determines whether or not data has been transmitted from slave ECUs 1b to 1d. When the data is transmitted within the predetermined time, in step S3a, the slave E
Based on various parameters received from CUs 1b to 1d,
Calculate the fuel injection pulse width, ignition timing, etc. Further, in the subsequent step S4a, the data calculated in step S3a is transmitted to each of the slave CPUs 10b to 10d via the communication LSI 13. When step S4a ends, the flow returns, and the processing is repeated from step S1a.

On the other hand, in step S2a, the main C
When the PU 10a determines that data has not been transmitted from any of the slave ECUs, the flow proceeds to step S5a. In step S5a, step S1
It is determined whether a predetermined time has elapsed (timeout) after the request from the main CPU 10a in a. If it is determined that the predetermined time has not elapsed, the flow returns to step S2a again.

On the other hand, if it is determined in step S5a that the predetermined time has elapsed (timeout), it is determined that there is no response from any of the slave ECUs 1b to 1d, and the flow proceeds to step S6a. . In step S6a, information identifying the slave ECU that has not responded is transmitted to the spare slave ECU 1e. Further, in the following step S7a, the same program as the program stored in the ROM of the slave ECU that has not responded is transmitted to the spare slave ECU 1e. In addition,
The order of step S6a and step S7a may be reversed.

Next, in step S8a, the main C
The PU 10a regards the spare slave ECU 1e that substitutes for the slave ECU that has determined that there is no response as the slave ECU. When step S8a ends, the flow returns, and the process is repeated from step S1a again.

In such a process, steps S3a and S4a are performed on the slave ECU responding in step S2a.
Steps 5a to S6a to S8a are performed on the slave ECU that has not responded in a.

Next, the operation of the slave ECU will be described with reference to FIG. In FIG. 3, first, in step S1b, operating condition parameters are obtained based on output signals from various sensors. Next, in step S2b, the slave C
The PUs 10b to 10d transmit the operating state parameters obtained in step S1b to the main CPU 10a via the communication LSI 13 in response to a request from the main ECU 1a.

Then, in step S3b, various data calculated by the main CPU 10a are received. In the following step S4b, various actuators (such as the automatic transmission actuator 24 and the ABS brake actuator 27) are controlled at a predetermined timing based on control data such as the reception data, the fuel injection amount, and the ignition timing. When step S4b ends, the flow returns, and the process of step S1b is performed again.

Next, the operation of the spare slave ECU will be described with reference to FIG. In step S1c, the spare slave C
The PU 10e checks whether a data transmission request has been made from the main CPU 10a. Main CPU
Until there is a data transmission request from 10a, the presence or absence of a data transmission request is checked at predetermined intervals.

If a transmission request has been received from the main CPU 10a, the flow proceeds to step S2c, where the program transmitted from the main CPU 10a is stored in the spare slave ROM 11e. In the following step S3c, the slave ECU that has not responded (one of 1b to 1d)
Is selected only for the input interface and output interface (I / O) for the device controlled by the slave ECU that did not respond.

Further, the flow proceeds to step S4c,
A switching circuit (16a-1) connected to a device (19, 20, 24 or 27) controlled by a slave ECU (1b-1d) that has not responded
6c), a switching command signal for switching the circuit is transmitted. The processing in steps S5c to S8c is the same as the processing in steps S1b to S4b.

Next, the operation of the switching circuit will be described with reference to FIG. The switching circuits 16a, 16b, and 16c perform step S
In 1d, it is determined whether a switching command signal has been received from the spare slave ECU 1e. If it is determined that the switching command signal has been received, the flow proceeds to step S2d, in which control is performed to supply various devices (any device of 19, 20, 24, and 27 connected to the slave ECU that does not operate normally). The signal supply source is switched to the spare slave ECU 1e.

As described above, according to the vehicular network system according to the first embodiment of the present invention, even when one of the slave ECUs does not operate normally, the same as the slave ECU that does not operate normally is used. Is loaded into the spare slave ECU, and the same processing is performed by substituting the spare slave ECU for the slave ECU.
U and any slave EC
Even when U does not operate normally, the processing capability of the system can be ensured. That is, according to the first embodiment of the present invention, the space occupied by the vehicular network system in the vehicle can be reduced, and the number of spare slave ECUs can be reduced. It is possible to provide a vehicle network system that can ensure the function as a vehicle network system even when the vehicle network system does not operate.

In the first embodiment, one spare slave ECU 1 is provided for three slave ECUs 1b to 1d.
e, the number of spare slave ECUs is limited to the number of slave ECUs.
, For example, three slave ECs
The present invention can be implemented in the same manner even in a configuration including two spare slave ECUs for U, and the same effect can be obtained.

Embodiment 2 In the first embodiment, as shown in FIG. 1, various calculation programs such as calculation of a fuel injection amount and calculation of an ignition timing, and programs identical to programs stored in slave ECUs 1b to 1d are stored in ROM 11a of main ECU 1a. I had memorized. Also,
In the first embodiment, the slave ECUs 1b to 1d are provided with an operation state parameter calculation program and a main EC.
Control programs such as engine control, transmission control, and brake control based on the calculation result by U1a are stored respectively.

The spare slave ECU 1e according to the first embodiment has a specific input interface and a specific output interface (14d and 15d, according to the information transmitted from the main CPU and the program executing the program transmitted from the main CPU). 14e and 15e, any of 14f and 15f) and a switching circuit (16a to 16e).
c), a program for notifying the use of the spare slave ECU 1e is stored.

On the other hand, the configuration of the vehicle network system according to the second embodiment of the present invention is similar to the configuration of the first embodiment shown in FIG.
Instead of storing a program having the same function as the program stored in the slave ECUs 1b to 1d in the ROM 11a of the auxiliary slave RO 1a of the auxiliary slave ECU 1e,
M11e includes a program having the same function as the program stored in the slave ECUs 1b to 1d, and a main CPU 1
0a, and a program for determining which of the same programs as the ECUs 1b to 1d are to be selectively executed, and any of an input interface and an output interface (in accordance with the information transmitted from the main CPU 10a). 14d and 15d, 14e and 15e, any of 14f and 15f), and a switching circuit (16a to 1d).
6c) is stored to notify the use of the spare slave ECU 1e. The slave ECUs 1b to 1d and the switching circuits 16a to 16d
16c performs the same operation as in the first embodiment.

FIG. 6 is a flowchart showing the operation of the main ECU. Steps S1e to S6e are the same as steps S1a to S6a in FIG. Further, the processing in step S7e is the same as step S8a in FIG. 2 in the first embodiment. In other words, the processing content shown in the flowchart of FIG. 6 is the same as the processing content of S7a in FIG. 2, but the description thereof is omitted here.

FIG. 7 is a flowchart showing the operation of the spare slave ECU according to the second embodiment of the present invention. Steps S1f and S3f to S8f are the same as steps S1c and S3c to S8c in FIG. 4 in the first embodiment. In FIG. 7, when the data reception is confirmed in step S1f, the flow proceeds to step S2f, and the ROM of the slave ECU that has stopped operating is determined based on the information transmitted from the main CPU 10a that specifies the slave ECU that has stopped operating normally. Is selected from the spare slave ROM 11e.

In the following step S3f, a control signal for transmitting a control signal to a device controlled by the slave ECU that has not responded is based on information identifying the slave ECU (any one of 1b to 1d) that has not responded. Input and output interfaces (14d and 1
5d, 14e and 15e, any of 14e and 15f). When step S3f ends,
Step S identical to steps S4c to S8c shown in FIG.
Processing of 4f to S8f is performed.

As described above, according to the second embodiment of the present invention,
As in the vehicle network system according to the first embodiment, by providing the auxiliary slave device having less than the number of slave ECUs, the function as the vehicle network system is secured even when the slave ECU does not operate normally. Not only can the cost of the entire system be reduced, but also the main EC
Since it is not necessary to download the program from U to the spare slave ECU, the time required for the spare slave ECU to become usable as the slave ECU after the slave ECU stops operating normally is reduced compared to the first embodiment. Time can be reduced.

Embodiment 3 The configuration of the vehicle network system according to Embodiment 3 of the present invention is the same as that of Embodiment 1 shown in FIG.
ROM 11a connected to the main CPU 10a of
After it is determined that one of the slave ECUs 1b to 1d has stopped operating normally, a program for determining again whether or not the slave ECU operates normally is stored and held. Such a program is executed in step S9g described below, and in step S9g, the main ECU 1a functions as a determination unit. Further, the slave ECU according to the third embodiment of the present invention performs the same operation as that of the first embodiment.

FIG. 8 is a flowchart showing the operation of the main ECU according to Embodiment 3 of the present invention. FIG.
, Steps S2g to S8g are steps for performing the same processing corresponding to steps S2a to S8a shown in FIG. 2 of the first embodiment. In step S1g, the main ECU 1a requests data such as operating state parameters from all the subordinate control devices. That is, at this time, data such as operating state parameters are requested not only from the normally operating slave ECUs but also from the slave ECUs that have once stopped operating normally.

In the following step S2g, the slave E
It is determined whether data has been received from the CU. When it is determined that the data has not been received, the flow proceeds to step S5g, and thereafter, the processing of steps S6g to S8g having the same contents as steps S6a to S8a in the first embodiment is performed.

On the other hand, if it is determined in step S2g that data has been received, the flow proceeds to step S9g.
Proceed to In step S9g, the slave ECU that has once determined that the data transmission source has
Is determined. If it is determined in step S9g that the slave ECU that is the data transmission source is once determined to have failed to operate normally, it is determined that the function of the slave ECU has returned to normal. Proceeds to step S10g.

In step S10g, the spare slave EC
Slave E that once stopped operating normally for U1e
Information for notifying that the CU is to be treated as a normal slave ECU again is transmitted. In the following step S11g, the spare slave ECU 1e is stopped assuming that it is regarded as a slave ECU, and thereafter, data is not transmitted to the spare control device 1e until one of the slave ECUs does not operate normally next time. I will.

On the other hand, if it is determined in step S9g that the data transmission source is not the slave ECU that once stopped operating normally, the flow proceeds to step S3g, and the flow proceeds to step S3a and step S4a in the first embodiment. The processing in steps S3g and S4g having the same contents as described above is performed.

FIG. 9 is a flowchart showing the operation of the spare slave ECU according to the third embodiment of the present invention. 9, steps S1h to S8h are processes having the same contents as steps S1c to S8c in FIG. 4 of the first embodiment. Here, as an example, the slave ECU 1
The case where b does not operate normally will now be described.

When steps S1h to S3h are completed and the flow proceeds to step S4h, the transmission circuit of various signals such as a control signal is switched in order to use the spare slave ECU 1e in place of the slave ECU 1b that has stopped operating normally. To this end, a switching request signal is transmitted to the switching circuit 16a. In a succeeding step S9h, it is determined whether or not the spare slave ECU 1e receives a signal indicating the return of the slave ECU 1b that has not been operating normally from the main ECU 1a.

If it is determined that a signal indicating the return of the slave ECU 1b has been received, the flow proceeds to step S10h.
The switching request signal is transmitted to the switching circuit 16b so that the control signal of the restored slave ECU 1b is supplied to the connected devices (19, 20). When the process in step S10h ends, the flow returns, and the process is repeated from step S1h.

On the other hand, if it is determined in step S9h that the spare slave ECU 1e has not received from the main ECU 1a a signal indicating the return of the slave ECU 1b that was not operating normally, the flow proceeds to step S9h.
5h, and thereafter, step S in the first embodiment is performed.
Steps S5h to S8h having the same contents as steps 5c to S8c are performed.

FIG. 5 is a flowchart showing the operation of the switching circuit. In FIG. 5, the operation in step S1d is the same as in the first embodiment. In step S2d, the slave ECU 1 that has returned from the standby slave ECU 1e to the supply source of the control signal to be transmitted to the various devices (19, 20)
Switch to b.

As described above, in the vehicle network system according to the third embodiment of the present invention, in addition to the effects of the first embodiment, the slave ECU 1b that has stopped operating once can be used again. Also, if any slave E
If the CU stops operating, the slave ECU 1b
Of the spare slave ECU 1e, which is no longer used due to the return of the slave ECU, does not operate normally.
b can be used in place of b. Therefore, according to the vehicular network system according to Embodiment 3 of the present invention, similarly to Embodiments 1 and 2, the spare slave EC
With a system configuration in which the number of U is smaller than the number of slave ECUs, the processing capability of the system can be ensured even when one of the slave ECUs does not operate normally, and the cost of the entire system can be reduced. In addition to the above, when the slave ECU 1b that has stopped operating once returns, it can be used again, so that it is possible to provide a vehicular network system with higher processing capability. In the third embodiment,
The case where the slave ECU 1b does not operate normally has been described as an example. However, the same processing can be performed when the slave ECU 1c or 1d does not operate normally.

[0059]

According to the present invention, there is provided a vehicle network system comprising: a driving state parameter detecting means for detecting a parameter representing a driving state of a vehicle; an electronically controlled driving device for electronically controlling the driving of the vehicle; A main control device that calculates a control amount for controlling the driving equipment based on the state parameter, and is connected to the main control device via a communication network to transmit the operation state parameter to the main control device, and the main control device Based on the calculated control amount, a slave control device that controls the driving equipment, and a standby slave control device that performs the same control processing in place of the slave control device when the slave control device is not operating normally. And the number of the auxiliary slave control devices is smaller than the number of the slave control devices, so that the vehicle network system occupies in the vehicle. Since the pace can be reduced and the number of spare slave ECUs can be reduced, a vehicle network system that can secure the function as a vehicle network system at low cost even when the slave ECU does not operate normally can be provided. Can be provided.

Further, since there is only one auxiliary dependent control device, a vehicle network system can be provided in which the cost of the system is reduced and the occupied space is reduced.

Further, when one of the slave control devices does not operate normally, a switching means for switching the transmission path of the operating state parameter and the control amount from the slave control device to the standby slave control device is provided. Since the system is further provided, it is possible to provide a vehicular network system in which the functions of the system are ensured more reliably.

The main control unit stores and holds the same program as the control program stored in the subordinate control unit. When the subordinate control unit does not operate normally, the main control unit stores and stores the same program. The same control program is stored and held in the auxiliary slave controller, and the standby slave controller performs the same processing as the slave controller that has stopped operating normally. Provided is a vehicle network system capable of securing a function as a system even in a case where any one of the slave control devices does not operate normally in a system configuration in which the number of auxiliary slave control devices is smaller than that of the devices. Can be.

The backup slave controller stores and holds the same program as the control program stored in the slave controller. When the slave controller does not operate normally, the standby slave controller holds the same program. Using the same control program as the control program stored and held in the subordinate control device that has stopped operating normally among the control programs that have been stopped, and performs the same processing as the subordinate control device that has stopped operating normally. Therefore, in a system configuration in which the number of backup slave controllers is smaller than that of slave controllers, even if any slave controller does not operate normally, a vehicle network that can secure the function of the system. A system can be provided. Further, when any of the subordinate control devices does not operate normally, by using a program stored and held in the standby subordinate control device, the auxiliary subordinate control device is replaced with a subordinate control device that does not operate normally. Therefore, it is possible to provide a vehicular network system in which the operation time in an emergency is reduced.

Further, after determining that one of the subordinate control devices has stopped operating normally, the main control device
Determining means for determining again whether or not the slave control device operates normally; and when the determining means determines that the slave control device has returned to normal operation, a preliminary slave control device is provided. Since the control of the driving device by the control device is stopped and the restored subordinate control device controls the driving device, the vehicle network system with higher processing capability can be provided.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a vehicle network system according to Embodiment 1 of the present invention.

FIG. 2 is a flowchart showing control processing contents of a main control device according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing control processing contents of a dependent control device according to Embodiment 1 of the present invention.

FIG. 4 is a flowchart showing control processing contents of a standby dependent control device according to the first embodiment of the present invention.

FIG. 5 is a flowchart showing control processing contents of a switching circuit according to the first embodiment of the present invention.

FIG. 6 shows a main EC according to Embodiment 2 of the present invention;
6 is a flowchart showing the operation of U.

FIG. 7 is a flowchart showing an operation of a spare slave ECU according to Embodiment 2 of the present invention.

FIG. 8 shows a main EC according to Embodiment 3 of the present invention.
6 is a flowchart showing the operation of U.

FIG. 9 is a flowchart showing an operation of a spare slave ECU according to Embodiment 3 of the present invention.

FIG. 10 is a diagram showing a system configuration of a conventional vehicular network system disclosed in Japanese Patent Application Laid-Open No. 4-114203.

[Explanation of symbols]

1a Main ECU (main control device, determination means), 1b,
1c, 1d Slave ECU (dependent control device), 1e
Spare slave ECU (preliminary slave controller), 5 communication lines (communication network), 17 crank angle sensor (operating state parameter detecting means), 18 intake air amount sensor (operating state parameter detecting means), 19 injector (operating equipment), Reference Signs List 20 ignition coil (operating equipment), 21 vehicle speed sensor (operating state parameter detecting means), 22 accelerator switch (operating state parameter detecting main d), 23 neutral switch (operating state parameter detecting means), 2
4 automatic transmission actuator (operating equipment), 25 wheel speed sensor (operating state parameter detecting means), 26 brake switch (operating state parameter detecting means), 27
ABS brake actuator (driving equipment).

Claims (6)

[Claims] An operating state parameter detecting means for detecting a parameter indicating an operating state of a vehicle, an electronically controlled operating device for electronically controlling the operation of the vehicle, and the operating device based on the operating state parameter. A main control device that calculates a control amount for controlling, a control amount that is connected to the main control device via a communication network, transmits an operation state parameter to the main control device, and that is calculated by the main control device. A slave controller that controls the operating device, and a standby slave controller that performs the same control process in place of the slave controller when the slave controller is not operating normally. And the number of the auxiliary slave controllers is
A network system for a vehicle, wherein the number is smaller than the number of the dependent control devices. 2. The vehicular network system according to claim 1, wherein the number of the auxiliary slave control devices is only one. 3. When any one of the slave control devices does not operate normally, a transmission path of the operating state parameter and the control amount is switched from the slave control device to the standby slave control device. The vehicle network system according to claim 1, further comprising a switching unit. 4. The main control device stores the same program as the control program stored and held in the subordinate control device, and stores the same program in the subordinate control device when the subordinate control device does not operate normally. The same control program as the stored control program is stored and held in the spare slave control device, and the spare slave control device performs the same processing as the slave control device that has stopped operating normally. The vehicle network system according to any one of claims 1 to 3. 5. The auxiliary slave control device stores the same program as a control program stored and held in the slave control device, and when the slave control device does not operate normally, the standby slave control device. Using the same control program as the control program stored and held in the subordinate control device that has not normally operated out of the control programs stored and held in the same process as the subordinate control device that has stopped operating normally The vehicular network system according to any one of claims 1 to 3, wherein the network system is performed. 6. The main control device, after determining that one of the slave control devices does not operate normally, determines a determination unit for determining again whether the slave control device operates normally. When the determination unit determines that the slave control device has returned to normal operation, the control of the operating device by the standby slave control device is stopped, and the restored slave control device is restored. The vehicle network system according to any one of claims 1 to 5, wherein the control unit controls the driving device.