JP2018160710A - Vehicle controller - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a control device for a vehicle capable of reliably determining a state of a sub communication module. SOLUTION: In a vehicle control device having a main control unit 12 and a sub control unit 22 connected to an in-vehicle network such as a CAN, when it is determined that a main communication module 14-1 is out of order, a main control is performed. The unit 12 determines whether or not a certain time has elapsed (step ST02), and after the certain time has elapsed, the main control unit 12 supplies control data to the in-vehicle device on the in-vehicle network (for example, the operation of the in-vehicle device). Degenerate data) transmission method (step ST05 (ST23) or ST07) is determined. [Selection diagram] Fig. 2

Description

  The present invention relates to a control device (vehicle control device) used for a vehicle such as an automobile, for example, and relates to a redundant control device including a main control unit and a sub control unit.

  For example, Patent Document 1 discloses a control device for a drive device, and the control device includes a main system microcomputer and a sub system microcomputer, and an AD (Analog-to-Digital) conversion module and a CAN (Controller Area Network) module are redundant. It has become. Specifically, in the control device of Patent Document 1, output calculation software for calculating input data is stored only in the main microcomputer. When the main system CAN module is abnormal and the sub system CAN module is normal, the main system microcomputer uses the sub system CAN input data stored in DPRAM (Dual Port RAM), and the sub system CAN module Communication can be performed.

  The sub-system microcomputer (CPU of the sub-system drive unit (ATCU) control device) of Patent Document 1 always stores the status (normal or abnormal) of the sub-system CAN module and the sub-system CAN input data (input value) in the DPRAM. Can write.

JP 2006-055832 A

  In Patent Document 1, when the state of the main CAN module and the state of the sub CAN module change simultaneously from normal to abnormal, for example, the main microcomputer attempts communication / execution in the sub CAN module. In other words, it takes time for the abnormality of the sub system CAN module to be written to the DPRAM. Therefore, before the writing, the main microcomputer refers to the DPRAM without considering the time lag, and the sub system CAN module is normal. Is mistakenly determined.

  Further, in Patent Document 1, fail processing is executed when the state of the main CAN module changes from normal to abnormal and the sub CAN module is abnormal. In other words, control continuity cannot be maintained when both CAN modules are abnormal.

  One object of the present invention is to provide a vehicle control device that can reliably determine the state of a sub-communication module such as a sub-system CAN module. Another object of the present invention is to provide a vehicle control device capable of continuing transmission of control data to an in-vehicle device on an in-vehicle network even in a situation where both communication modules fail. Other objects of the present invention will become apparent to those skilled in the art by referring to the aspects and best embodiments exemplified below and the accompanying drawings.

  In the following, in order to easily understand the outline of the present invention, embodiments according to the present invention will be exemplified.

In the first aspect, a vehicle control device having a main control unit and a sub-control unit connected to an in-vehicle network,
A first main communication module capable of executing communication on the in-vehicle network on a first bus;
A first sub-communication module capable of executing communication on the in-vehicle network on the first bus;
With
When it is determined that the first main communication module has failed, the main control unit determines whether or not a first predetermined time has elapsed,
After the first predetermined time has elapsed, the main control unit determines a control data transmission method to the in-vehicle device on the in-vehicle network.

  In the first aspect, the transmission of the control data to the in-vehicle device on the in-vehicle network (for example, CAN) is not performed immediately when it is determined that the first main communication module has failed. In other words, in the first aspect, when it is determined that the first main communication module has failed, it is determined whether or not the first fixed time has elapsed, and then the first sub-communication It can be determined whether to perform transmission on the module or to perform transmission on another communication module. Therefore, in the first aspect, the state of the first sub communication module can be reliably determined.

In a second aspect dependent on the first aspect,
The first sub-communication module has not failed within a first period from the time when it is determined that the first main communication module has failed to the time when the first predetermined time has elapsed. When it is determined, the transmission method of the control data to the in-vehicle device may be realized by transmission in the first sub communication module instead of transmission in the first main communication module. .

  In the second aspect, the first sub-communication module is used by using the first period from the time when it is determined that the first main communication module has failed to the time when the first fixed time has elapsed. After reliably determining that is normal, transmission by the first sub-communication module is executed, and transmission of control data to the in-vehicle device on the in-vehicle network can be realized. In other words, in the second aspect, unless the first sub-communication module is not faulty within the first period, the first sub-communication module is assumed to be faulty and transmission is performed in the first sub-communication module. Is not executed.

In a third aspect subordinate to the second aspect, the vehicle control device includes:
A second main communication module capable of executing communication on a route different from the in-vehicle network;
A second sub-communication module capable of executing communication on the different path;
May further comprise
The sub-control unit may periodically determine whether or not the first sub-communication module has failed,
When the sub-control unit determines that the first sub-communication module has not failed, the second sub-communication module may transmit non-failure data to the second main communication module. ,
When the second main communication module receives the non-failure data, the main control unit may determine that the second main communication module has not failed.

  In the third aspect, the sub-control unit can periodically determine whether the first sub-communication module has failed or not, and the determination result can be transmitted to the main control unit through a different route (for example, SPI).

In a fourth aspect subordinate to any one of the first to third aspects, the vehicle control device is configured to execute communication on the in-vehicle network on another bus different from the first bus. A communication module,
When it is determined that the first sub-communication module has failed within the first period, the transmission method of the control data to the in-vehicle device is the first main communication module. Instead of transmission, it may be realized by transmission in the other main communication module.

  In the fourth aspect, the in-vehicle network is composed of a plurality of buses (including the first bus), and when it is determined that the first main communication module is out of order, a first fixed time has elapsed. It can be determined whether or not to perform transmission in another communication module that can use another bus based on the failure of the first sub-communication module. Therefore, in the fourth aspect, even when both the first main communication module and the first sub communication module fail, transmission of control data to the in-vehicle device on the in-vehicle network can be continued. .

In a fifth aspect subordinate to the fourth aspect,
When the transmission of the control data to the in-vehicle device on the in-vehicle network is executed by the other main communication module instead of the first main communication module, the control data indicates the operation of the in-vehicle device. It may be degenerate data to be degenerated.

  In the fifth aspect, when both the first main communication module and the first sub communication module fail, the main control unit can transmit the degenerate data to the in-vehicle device using another main communication module. Therefore, in the fifth aspect, the main control unit can continue transmission of control data (dynamic degeneration data) necessary to degenerate the operation of the in-vehicle device.

In a sixth aspect subordinate to any one of the first to fifth aspects,
When it is determined that the first main communication module has not failed and it is determined that the first sub-communication module has failed, the main control unit determines that the second predetermined time has elapsed. You may decide whether or not
When it is determined again that the first main communication module has not failed after the second predetermined time has elapsed, the transmission of degenerate data for degenerating the operation of the in-vehicle device is performed in the first main communication module. It may be executed by a communication module.

  In the sixth aspect, when it is determined that the first sub-communication module has failed, it is determined whether or not the second predetermined time has elapsed, and then the first main communication module It can be determined whether to perform transmission or to perform transmission in another communication module. Therefore, in the sixth aspect, the first sub-communication module is determined using the second period, for example, from the time when it is determined that the first sub-communication module has failed to the time when the second predetermined time has elapsed. After reliably determining that the main communication module is normal, transmission by the first main communication module is executed, and transmission of degenerate data to the in-vehicle device on the in-vehicle network can be realized.

In a seventh aspect dependent on the fourth aspect or on the fifth or sixth aspect dependent on the fourth aspect,
When it is determined that the first main communication module has not failed and it is determined that the first sub-communication module has failed, the main control unit determines that the second predetermined time has elapsed. You may decide whether or not
When it is determined that the first main communication module has failed during the second predetermined time, the transmission of degenerate data for degenerating the operation of the in-vehicle device is transmitted by the other main communication module. May be executed.

  In the seventh aspect, after it is determined that the first sub-communication module has failed, it is determined that the first main communication module has failed during the second fixed time. , It may be decided to perform transmission on other communication modules available on other buses. Therefore, in the seventh aspect, even when both the first main communication module and the first sub communication module fail, transmission of control data to the in-vehicle device on the in-vehicle network can be continued. .

  Those skilled in the art will readily understand that the illustrated embodiments according to the present invention can be further modified without departing from the spirit of the present invention.

The structural example of the control apparatus for vehicles according to this invention is shown. The flowchart figure which shows the operation example of the main control apparatus which transmits degenerate data is shown. The flowchart figure which shows the operation example of the sub control apparatus which transmits degeneration data is shown.

  The best mode described below is used to easily understand the present invention. Accordingly, those skilled in the art should note that the present invention is not unduly limited by the embodiments described below.

  FIG. 1 shows a configuration example of a vehicle control device according to the present invention. Although not shown in FIG. 1, a vehicle such as an automobile typically includes many ECUs (Electronic Control Units), and these ECUs are connected to an in-vehicle network such as a CAN. Moreover, those ECUs can control various actuators (not shown) to realize vehicle travel. The vehicle control device shown in FIG. 1 is one of those ECUs or a general ECU that supervises these ECUs. The vehicle control device is, for example, a 2-wire differential voltage type CAN communication. The main control unit 12 and the sub-control unit 22 are connected to a CAN (in a broad sense, an in-vehicle network). Each of the main control unit 12 and the sub control unit 22 typically includes a calculation unit such as a CPU.

  In FIG. 1, the main control unit 12 executes communication on the CAN by a first main communication module 14-1 (vehicle network module) such as a CAN communication module, for example. In a broad sense, control data can be transmitted to an in-vehicle device. On the other hand, the sub-control unit 22 does not transmit control data to the ECU on the in-vehicle network as a normal operation. When the main control unit 12 or the main-side CAN communication module fails, the sub-control unit 22 determines the first sub-communication module 24-1 (specifically, the sub-side CAN communication as an exception or emergency operation). Module) can transmit control data to the ECU on the in-vehicle network. The main-side and sub-side CAN communication modules thus made redundant are provided in the vehicle control device.

  Specifically, the vehicle control device of FIG. 1 includes a main control device 10 and a sub control device 20, and each of the main control device 10 and the sub control device 20 includes, for example, a CAN such as an SPI (Serial Peripheral Interface). Has an SPI communication module capable of executing communication (main-sub communication) on different paths. The second main communication module 16 (specifically, the main-side SPI communication module) determines whether the first main communication module 14 (main-side CAN communication module) has failed / not failed, etc. 26 (specifically, the SPI communication module on the sub-side). Similarly, the second sub-communication module 26 (specifically, the sub-side SPI communication module) determines the failure / non-failure of the first sub-communication module 24 (sub-side CAN communication module) as the first This can be transmitted to the main communication module 16 (specifically, the SPI communication module on the main side).

  The CAN in FIG. 1 includes, for example, three buses (BUS1, BUS2, and BUS3), and the first main communication module 14-1 and the first sub communication module 24-1 perform communication on the first bus. Executable on bus BUS1. The main control device 10 and the sub control device 20 have other communication modules (14-2, 14-3, 24-2 and 24-3), and other main communication modules 14-2, 14-3 and others. The sub-communication modules 24-2 and 24-3 can execute communication on the CAN on other buses (the second bus BUS2 and the third bus BUS3) different from the first bus BUS1. Depending on the type of vehicle, the CAN may include two buses (BUS1 and BUS2 or BUS3) or four or more buses (BUS1, BUS2, BUS3 and BUS not shown).

  2 and 3 show examples of operations of the main control device 10 (main-side first CAN communication module) and the sub-control device 20 (sub-side first CAN communication module) that transmit degenerate data, respectively. A flowchart figure is shown. For example, the first main communication module 14-1 (the first CAN communication module on the main side) in FIG. 1 performs, for example, a first ECU (in a broad sense) on the first bus BUS1 as a normal operation. On the other hand, the first sub communication module 24-1 (the first CAN communication module on the sub side) transmits the control data to the in-vehicle device (not shown in FIG. 2), for example, as the first operation. The control data is not transmitted to, for example, the first ECU on the bus BUS1. Only when the sub-first first CAN communication module does not fail when the main first CAN communication module fails (steps ST01, ST03, ST04, ST05 in FIG. 2 and steps ST21, 22 in FIG. 3). The first CAN communication module on the sub-side can transmit control data (specifically, degenerate data in step ST23 in FIG. 3) to the first ECU as an exception or emergency operation.

  The first ECU is also connected to, for example, the second bus BUS2, and other main communication modules 14-2 (main side) are connected to the second ECU on the second bus BUS2, for example, as a normal operation. The second CAN communication module) transmits control data (not shown in FIG. 2). When the first CAN communication module on the main side fails and the first CAN communication module on the sub side also fails (see steps ST03 and ST06 in FIG. 2), for example, the second CAN communication module on the main side Alternatively, as an urgent operation, control data (specifically, degenerate data in step ST07 in FIG. 2) can be transmitted to the first ECU.

  Note that the first ECU may be connected to, for example, the third bus BUS3. For example, the third ECU on the third bus BUS3 has other main communication modules 14-3 as a normal operation. Control data is transmitted by the (main-side third CAN communication module) (not shown in FIG. 2). When the first ECU is connected to the third BUS 3, in step ST07 of FIG. 2, for example, the third CAN communication module on the main side transmits degenerate data to the first ECU as an exception or emergency operation. May be.

  In step ST01 of FIG. 2, the main control unit 12 of the main control device 10 determines whether or not the main CAN communication module corresponding to the first main communication module 14-1 has failed, for example. . The main control unit 12 includes, for example, a CAN controller, the CAN communication module is, for example, a CAN transceiver, and the CAN controller can detect or diagnose a failure of the CAN transceiver. Here, the CAN controller cannot distinguish between the failure of the CAN transceiver and the failure of the first bus BUS1, in other words, the failure of the CAN transceiver includes the failure of the first bus BUS1. The main control unit 12 can determine whether, for example, the second and third CAN communication modules on the main side are out of order. In FIG. 2, for example, the second, third, etc. on the main side. It is assumed that other CAN communication modules (and other buses such as the second bus BUS2 and the third bus BUS3) have not failed.

  When it is determined that, for example, the first CAN communication module on the main side is out of order, the main control unit 12 can determine whether or not a certain time (first certain time) has passed ( (See step ST02 in FIG. 2). For example, the main control unit 12 determines the transmission method of the degenerate data to, for example, the first ECU on the first bus BUS1 during a certain time (first certain time). It can be determined by notification from the sub-side whether, for example, the first CAN communication module on the sub-side corresponding to the first sub-communication module 24-1 has failed (see step ST03 in FIG. 2).

  In step ST03 of FIG. 2, specifically, the main control unit 12 can determine whether or not failure data representing a failure of, for example, the first CAN communication module on the sub-side exists. More specifically, the main control unit 12 can determine whether, for example, an SPI communication module on the main side corresponding to the second main communication module 16 has received a notification of failure data. In step ST21 of FIG. 3, the sub control unit 22 of the sub control device 20 determines whether or not, for example, the first CAN communication module on the sub side corresponding to the first sub communication module 24-1 has failed. be able to. When, for example, the first CAN communication module on the sub side fails, the sub control unit 22 can transmit or notify the failure data using, for example, the SPI communication module on the sub side corresponding to the second sub communication module 26. (See step ST24 in FIG. 3).

  Preferably, the sub control unit 22 can periodically determine whether, for example, the first CAN communication module on the sub side is out of order. When the sub-control unit 22 determines that the first CAN communication module has not failed, before or after executing step ST22 in FIG. 3, the sub-side SPI communication module The non-failure of the first CAN communication module can be transmitted to the main SPI communication module (not shown in FIG. 3). In step ST03 of FIG. 2, the main control unit 12 preferably executes steps ST04 and ST05 when the SPI communication module on the main side receives notification of non-failure data of, for example, the first CAN communication module on the sub side. To do. On the other hand, when the main-side SPI communication module receives notification of failure data of, for example, the first CAN communication module on the sub-side, the main control unit 12 executes steps ST06 and ST07.

  Since the main control unit 12 executes step ST02 of FIG. 2, for example, the transmission of the degenerate data in step ST07 is performed immediately when it is determined that the first CAN communication module on the main side has failed, for example. Not executed. In other words, in the vehicle control device of FIG. 1, when it is determined that the first CAN communication module on the main side has failed, it is determined whether or not a certain time (first certain time) has elapsed. Judgment (step ST02), and then whether to perform transmission in another CAN communication module on the main side (step ST07), or whether to perform transmission in the first CAN communication module on the sub side (FIG. 3 step ST23) can be determined.

  For example, within a period (first period) from when it is determined that the first CAN communication module on the main side is out of order until a certain time (first certain time) has elapsed, For example, when it is determined that the first CAN communication module has not failed, preferably, for example, when it is determined that the first CAN communication module on the sub-side has not failed by receiving non-failure data, Since the first CAN communication module on the main side has failed alone (step ST04 in FIG. 2), the SPI communication module on the main side has failed (specifically, for example, the first CAN communication module on the main side). , A degeneration operation instruction) can be transmitted to the sub-SPI communication module (step ST05 in FIG. 2).

  Here, the fixed time (first fixed time) is the normal detection time required for generating the failure data or non-failure data in the sub-control device 20 and the transmission data (failure data or non-failure data) in the sub-control device 20. ) To the reception of received data (failed data or non-failed data) at the main control device 10, for example, a certain time (first certain time) is a normal detection time. It is set by adding the time added with the maximum allowable time and the time added with the maximum allowable time to the normal notification time.

  The fixed time (first fixed time) is typically a fixed time, but the main control unit 12 sets or resets the fixed time to, for example, zero according to reception of failure data or non-failure data. Accordingly, a certain time (first certain time) that is a dynamic time may be generated. In other words, the main control unit 12 typically determines the degenerate data transmission method after a fixed time has elapsed, but the degenerate data transmission method is based on the failure of the first CAN communication module on the main side, for example. The determination may be made immediately after it is determined that the failure has occurred, and upon receipt of the failure data.

  In step ST21 of FIG. 3, when the sub-side, for example, the first CAN communication module has not failed, the sub-control device 20 is the sub-side SPI communication module, and the main-side, for example, the first CAN communication module has failed. It can be determined whether or not (specifically, the degeneration operation instruction in step ST05 in FIG. 2) has been received (step ST22 in FIG. 3). Accordingly, the sub control device 20 immediately activates the first CAN communication module, for example, on the sub side in response to the reception of the degeneration operation instruction, and the degeneration data to, for example, the first ECU on the first bus BUS1, for example. Can be executed (step ST23).

  By the way, when the main control device 10 in FIG. 1 controls or supervises a plurality of ECUs (including the first ECU) on the CAN, the role of the main control device 10 is large. As an example, when the main control device 10 realizes automatic driving of a vehicle while controlling, for example, a plurality of ECUs, the sub-control device 20 is configured in accordance with a failure of, for example, the first CAN communication module on the main side. For example, it is possible to shift from automatic traveling to exception or emergency automatic traveling such as avoidance automatic traveling (including automatic traveling stop). In other words, when, for example, the first CAN communication module on the main side is out of order, the sub-control device 20 can transmit, for example, degenerate data that causes a plurality of ECUs to degenerate their operations.

  For example, when transmitting degeneration data to the first ECU, the sub-control unit 22 calculates, in real time, a degeneration operation control output value necessary for, for example, exception or emergency automatic travel, and includes the degeneration operation control output. Transmission data (dynamic degeneration data) is transmitted from, for example, the first CAN communication module on the sub side (see step ST23 in FIG. 3). Thereby, for example, an exception of the vehicle or an emergency automatic traveling is realized.

  In step ST03 of FIG. 2, when the first CAN communication module on the main side fails and the first CAN communication module on the sub side also fails, for example, the first bus BUS1 is broken (step The main control unit 12 calculates, in real time, a degeneration operation control output value necessary for, for example, exceptional or emergency automatic travel, and transmits transmission data (dynamic degeneration data) including the degeneration operation control output. Transmission is performed from, for example, the second CAN communication module on the main side (see step ST07). Thereby, for example, an exception of the vehicle or an emergency automatic traveling is realized.

  It should be noted that when the first bus BUS1 breaks down or is disconnected, even if both CAN transceivers are not actually broken down, for example, the failure of the first CAN communication module on the main side and the sub Both failures of one CAN communication module are detected or diagnosed. In other words, when both failures are determined, the main control unit 12 can estimate the failure of the first bus BUS1. Accordingly, when executing step ST07, in other words, when the first bus BUS1 fails in step ST06, the main control unit 12 determines that other ECUs other than the first ECU on the first bus BUS1 (for example, the first bus BUS1). It is possible to determine whether or not the second ECU, the third ECU, and the like are also connected to other buses (for example, the second BUS2, the third BUS3, etc.) other than the first bus BUS1. Thereafter, the degenerate data is transmitted to the other ECUs connected to the other buses via the other buses. In other words, when executing step ST07, the main control unit 12 can transmit as much or optimum degenerate data as possible.

  In step ST04 in FIG. 2, since the failure of only the first CAN communication module on the main side, for example, is determined, both failures are not determined, and one of the failures is determined. In other words, since it is determined that, for example, the first CAN communication module on the sub side is not faulty, the first bus BUS1 is not faulty. Therefore, in step ST04 using the diagnosis result of the main CAN controller and the sub CAN controller, the main control unit 12 determines the failure of the first bus BUS1 and the failure of the main CAN transceiver. And can determine that the main-side CAN transceiver has failed.

  In step ST01 in FIG. 2, when it is determined that the main side, for example, the first CAN communication module is not faulty, the main control unit 12 determines whether the sub side, for example, the first CAN communication module is faulty. Judgment (see step ST08). In step ST08, the main control unit 12 can execute step ST09 in response to reception of failure data of, for example, the first CAN communication module on the sub-side in step ST24 of FIG. In step ST09, the failure of only the first CAN communication module on the sub side, for example, is determined, but the main control unit 12 is to reliably determine the non-failure of, for example, the first CAN communication module on the main side. It can be determined whether or not a certain time (second certain time) has elapsed.

  For example, within a period (second period) from the time when it is determined that the first CAN communication module on the sub side has failed to the time when a certain time (second certain time) has passed, For example, when it is determined again that the first CAN communication module has not failed (step ST11), the main control unit 12 transmits the degenerate data to, for example, the first ECU on the first bus BUS1, for example. It can be executed (step ST12).

  Here, the fixed time (second fixed time) is based on a normal detection time required for generating failure data or non-failure data in the main control device 10, for example, the fixed time (second fixed time) is: It is set by the time obtained by adding the maximum allowable time to the normal detection time.

  The fixed time (second fixed time) is typically a fixed time, but the main control unit 12 sets the fixed time to, for example, zero according to the generation of failure data or non-failure data on the main side. Alternatively, a fixed time (second fixed time) that is a dynamic time may be generated by resetting. In other words, the main control unit 12 typically determines the degenerate data transmission method after a fixed time has elapsed, but the degenerate data transmission method is based on the failure of the first CAN communication module on the sub-side, for example. It may be determined immediately after it is determined that the failure has occurred, depending on the generation of the failure data on the main side.

  For example, within a period (second period) from the time when it is determined that the first CAN communication module on the sub side has failed to the time when a certain time (second certain time) has passed, For example, when it is determined that the first CAN communication module has failed, the main control unit 12 can execute step ST07.

  The sub-control unit 22 can periodically determine whether, for example, the first CAN communication module on the sub-side is out of order, and the main control unit 12 also has, for example, the first CAN communication module on the main-side. Whether or not a failure has occurred can be periodically determined. As an example, both may determine failure or non-failure of the CAN communication module simultaneously or synchronously.

  The present invention is not limited to the above-described exemplary embodiments, and those skilled in the art will be able to easily modify the above-described exemplary embodiments to the extent included in the claims. .

  DESCRIPTION OF SYMBOLS 10 ... Main control apparatus, 12 ... Main control part, 14-1, 14-2, 14-3 ... 1st main communication module (for example, CAN communication module), 16 ... 2nd Main communication module (e.g., SPI communication module), 20 ... sub-control device, 22 ... sub-control unit, 24-1, 24-2, 24-3 ... first sub-communication module (e.g., CAN communication) Module), 26... Second sub-communication module (for example, SPI communication module).

Claims (7)

A vehicle control device having a main control unit and a sub control unit connected to an in-vehicle network,
A first main communication module capable of executing communication on the in-vehicle network on a first bus;
A first sub-communication module capable of executing communication on the in-vehicle network on the first bus;
With
When it is determined that the first main communication module has failed, the main control unit determines whether or not a first predetermined time has elapsed,
The main control unit determines a transmission method of control data to an in-vehicle device on the in-vehicle network after the first predetermined time has elapsed.   The first sub-communication module has not failed within a first period from the time when it is determined that the first main communication module has failed to the time when the first predetermined time has elapsed. When it is determined that the transmission method of the control data to the in-vehicle device is realized by transmission in the first sub communication module instead of transmission in the first main communication module. The vehicle control device according to claim 1, characterized in that: A second main communication module capable of executing communication on a route different from the in-vehicle network;
A second sub-communication module capable of executing communication on the different path;
Further comprising
The sub control unit periodically determines whether or not the first sub communication module has failed,
When the sub-control unit determines that the first sub-communication module has not failed, the second sub-communication module transmits non-failure data to the second main communication module;
The said main control part determines that the said 2nd main communication module has not failed when the said 2nd main communication module receives the said non-failure data, The Claim 2 characterized by the above-mentioned. Vehicle control device. And further comprising another main communication module capable of executing communication on the in-vehicle network on another bus different from the first bus,
When it is determined that the first sub-communication module has failed within the first period, the transmission method of the control data to the in-vehicle device is the first main communication module. The vehicle control device according to any one of claims 1 to 3, wherein the vehicle control device is realized by transmission in the other main communication module instead of transmission.   When the transmission of the control data to the in-vehicle device on the in-vehicle network is executed by the other main communication module instead of the first main communication module, the control data indicates the operation of the in-vehicle device. The vehicle control device according to claim 4, wherein the data is degenerate data to be degenerated. When it is determined that the first main communication module has not failed and it is determined that the first sub-communication module has failed, the main control unit determines that the second predetermined time has elapsed. To determine whether or not
When it is determined again that the first main communication module has not failed after the second predetermined time has elapsed, the transmission of degenerate data for degenerating the operation of the in-vehicle device is performed in the first main communication module. The vehicle control device according to claim 1, wherein the vehicle control device is executed by a communication module. When it is determined that the first main communication module has not failed and it is determined that the first sub-communication module has failed, the main control unit determines that the second predetermined time has elapsed. To determine whether or not
When it is determined that the first main communication module has failed during the second predetermined time, the transmission of degenerate data for degenerating the operation of the in-vehicle device is transmitted by the other main communication module. The vehicle control device according to claim 4 or claim 5 or 6 dependent on claim 4, wherein the control device is executed.

Images