Vehicle control device, vehicle control method, and storage medium storing vehicle control program

Abstract

A vehicle control device, a vehicle control method, and a storage medium storing a vehicle control program. In a device having a plurality of microcomputers, even when an abnormality occurs in a microcomputer that can communicate directly with the outside of the device, the abnormality is notified to the outside. The vehicle control device includes a first microcomputer that can communicate with the outside, and a second microcomputer that cannot communicate directly with the outside and can communicate with the first microcomputer. A first CAN transceiver and a second CAN transceiver receive control signals from the outside. The first microcomputer controls the operation of the first relay based on the control signal and outputs the control signal to the second microcomputer. When the state of the first relay corresponding to the control signal is different from the state indicated by the first relay, the second microcomputer controls the operation of the first CAN transceiver and the second CAN transceiver in a manner that stops the operation.

Description

Technical Field

[0001] The present disclosure relates to a vehicle control device, a vehicle control method, and a storage medium storing a vehicle control program. Background Art

[0002] Japanese Patent Application Laid-Open No. 2018-020678 discloses an electronic control device capable of efficiently detecting faults in a control microcomputer. Japanese Patent Application Laid-Open No. 2018-020678 discloses that, when multiple control microcomputers receive the same data from a CAN communication bus, one microcomputer monitors whether the communication data output to the CAN communication bus by the other microcomputers is normal, thereby efficiently detecting faults in the other microcomputers (see, for example, paragraph

[0009] of Japanese Patent Application Laid-Open No. 2018-020678).

[0003] However, as disclosed in Japanese Patent Application Laid-Open No. 2018-020678, when multiple microcomputers are present in one device, an abnormality may occur in one of the multiple microcomputers. When an abnormality occurs in a microcomputer included in the device, its status needs to be notified to the outside of the device.

[0004] In this regard, in Japanese Patent Application Laid-Open No. 2018-020678, a plurality of microcomputers are connected to CAN transceivers as communication units. Therefore, when an abnormality occurs in another microcomputer, the microcomputer in the device can notify the outside world of the abnormality via the CAN transceiver connected to it.

[0005] On the other hand, unlike the structure described in Japanese Patent Application Laid-Open No. 2018-020678, some microcomputers within a device may be unable to communicate directly with the outside world. In this case, it is conceivable that if an abnormality occurs in a microcomputer capable of direct communication with the outside world, the abnormality cannot be reported to the outside world. This is because the microcomputer capable of direct communication with the outside world itself is in an abnormal state, and the microcomputer incapable of direct communication with the outside world cannot report the abnormality to the outside world.

[0006] Therefore, the technology disclosed in the above-mentioned Japanese Patent Application Publication No. 2018-020678 has the following problem: in a device having multiple microcomputers, when an abnormality occurs in a microcomputer that can directly communicate with the outside of the device, the abnormality cannot be notified to the outside. Summary of the Invention

[0007] In view of the above facts, in a device including a plurality of microcomputers, even when an abnormality occurs in a microcomputer capable of directly communicating with the outside of the device, the present disclosure notifies the outside of the abnormality.

[0008] The first form of the vehicle control device includes: a communication unit; a first microcomputer, which can communicate with the outside via the above-mentioned communication unit; and a second microcomputer, which cannot communicate directly with the outside and can communicate with the above-mentioned first microcomputer, wherein the above-mentioned communication unit receives a control signal from the outside, the above-mentioned first microcomputer controls the action of the controlled object based on the above-mentioned control signal received through the above-mentioned communication unit, and outputs the above-mentioned control signal to the above-mentioned second microcomputer, and when the state of the above-mentioned controlled object corresponding to the above-mentioned control signal is different from the state represented by the above-mentioned controlled object, the above-mentioned second microcomputer controls in a manner to stop the action of the above-mentioned communication unit.

[0009] According to the first form of the vehicle control device, the communication unit receives a control signal from the outside. In addition, the first microcomputer controls the operation of the control object based on the control signal received through the communication unit, and outputs the control signal to the second microcomputer. When the state of the control object corresponding to the control signal is different from the state represented by the control object, the second microcomputer controls the operation of the communication unit. Thus, in a vehicle control device having a plurality of microcomputers, even when an abnormality occurs in the first microcomputer that can directly communicate with the outside of the vehicle control device, the abnormality can be notified to the outside. Specifically, when the state of the control object represented by the control signal output from the first microcomputer is different from the actual state of the control object, the second microcomputer controls the operation of the communication unit. Thus, the vehicle control device cannot communicate with external devices, and the external devices can detect that the vehicle control device is not responding, thereby being able to detect that an abnormality has occurred in the vehicle control device.

[0010] The control object in the vehicle control device of the second embodiment is a relay located between the first power supply and the second power supply. By providing the relay between the first power supply and the second power supply, power supply switching can be performed.

[0011] In the third aspect of the vehicle control device, the first microcomputer controls the relay to be in an OFF state in response to the control signal, and outputs the control signal to the second microcomputer. The second microcomputer obtains the state indicated by the relay and, if the state indicated by the control signal differs from the state indicated by the relay, controls the communication unit to stop operating. Thus, if the relay state indicated by the control signal differs from the actual relay state, the communication unit stops operating, and an abnormality occurring in the vehicle control device can be notified externally.

[0012] In the fourth aspect of the vehicle control device, the first microcomputer controls the relay to be in the off state in response to the control signal, and outputs the control signal to the second microcomputer. The second microcomputer obtains the state indicated by the relay and, if the relay indicates the off state and the control signal indicates the same state as the relay, outputs an interlock signal for maintaining the off state of the relay. Thus, when the relay state indicated by the control signal is the same as the actual relay state, the relay state can be interlocked.

[0013] When the relay is controlled to be in the OFF state, the first microcomputer of the vehicle control device of the fifth embodiment controls the relay to be in the OFF state when the voltage value on the first power supply side of the relay becomes equal to or greater than a predetermined value. This enables smooth power switching.

[0014] The sixth form of the vehicle control method is a vehicle control method performed by a vehicle control device, the vehicle control device comprising: a communication unit; a first microcomputer capable of communicating with the outside via the communication unit; and a second microcomputer that is unable to communicate directly with the outside and is capable of communicating with the first microcomputer, wherein the communication unit receives a control signal from the outside, the first microcomputer controls the action of the controlled object based on the control signal received through the communication unit, and outputs the control signal to the second microcomputer, and when the state of the controlled object corresponding to the control signal is different from the state represented by the controlled object, the second microcomputer controls the action of the communication unit in a manner that stops the action of the communication unit.

[0015] The seventh form is a storage medium storing a vehicle control program for execution by a second microcomputer of a vehicle control device, wherein the vehicle control device comprises: a communication unit; a first microcomputer capable of communicating with the outside via the communication unit; and a second microcomputer that cannot communicate directly with the outside and can communicate with the first microcomputer, wherein the vehicle control program is used to perform the following processing: the communication unit receives a control signal from the outside, the first microcomputer controls the action of the controlled object based on the control signal received through the communication unit, and outputs the control signal to the second microcomputer, and when the state of the controlled object corresponding to the control signal is different from the state represented by the controlled object, the second microcomputer stops the action of the communication unit.

[0016] As described above, the present disclosure provides an effect that, in a device including a plurality of microcomputers, even when an abnormality occurs in a microcomputer capable of directly communicating with the outside of the device, the abnormality can be notified to the outside. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a schematic block diagram of a vehicle control system according to an embodiment.

[0018] Figure 2 A diagram for explaining the flow of electric current.

[0019] Figure 3 A diagram for explaining the flow of electric current.

[0020] Figure 4 This is a diagram showing a configuration example of a computer of each device according to the embodiment.

[0021] Figure 5 This is an example of processing performed by the vehicle control device.

[0022] Figure 6 This is an example of processing performed by the vehicle control device.

[0023] Figure 7 This is an example of an electronic circuit surrounding the first relay.

[0024] Figure 8 This is an example of processing performed by the vehicle control device.

[0025] Figure 9 This is an example of processing performed by the vehicle control device.

[0026] Figure 10A diagram for explaining the flow of current due to a parasitic diode. DETAILED DESCRIPTION

[0027] (Vehicle Control System)

[0028] Figure 1 1 is a block diagram showing an example of the functional configuration of the vehicle control system 10 according to the embodiment. Figure 1 As shown, the vehicle control system 10 includes a primary system 20, a vehicle control device 30, a secondary system 40, and an automatic driving control ECU (Electronic Control Unit) 50. The vehicle control system 10 is mounted on a vehicle. The vehicle control device 30 is an ECU.

[0029] like Figure 1 As shown, the primary system 20 includes a first power supply 22, a first converter 24, and a primary system component 26. The first converter 24 is, for example, a DC-DC converter for an HV (Hybrid vehicle).

[0030] The vehicle control device 30 includes a second converter 32-1, a first relay 32-2, and a second relay 32-3. The second converter 32-1 is a bidirectional DC / DC converter. Furthermore, the vehicle control device 30 includes a first microcomputer 34-1 (hereinafter simply referred to as the first microcomputer 34-1), a second microcomputer 34-2 (hereinafter simply referred to as the second microcomputer 34-2), a first CAN (Controller Area Network) transceiver 34-3, and a second CAN transceiver 34-4. The data communicated in the first CAN transceiver 34-3 and the data communicated in the second CAN transceiver 34-4 are identical. The first CAN transceiver 34-3 and the second CAN transceiver 34-4 are examples of communication units.

[0031] Furthermore, there are no communication lines between the second microcomputer 34-2 and the first and second CAN transceivers 34-3 and 34-4. Therefore, the second microcomputer 34-2 cannot directly communicate with the outside world via the first or second CAN transceivers 34-3 and 34-4. On the other hand, the second microcomputer 34-2 is configured to control the operation of the first or second CAN transceiver 34-3 and 34-4. For example, the second microcomputer 34-2 can stop the operation of each transceiver (e.g., switch it to standby mode) by performing STB (Set Top Box) control on each transceiver.

[0032] The vehicle control device 30 of the vehicle control system 10 of this embodiment switches the power supply when switching from normal driving to automatic driving. Note that normal driving is manual driving performed by a vehicle occupant.

[0033] exist Figure 2 and Figure 3 2 is a diagram for explaining the flow of current. Figure 2 The current flows when the vehicle is in a normal driving state. Figure 2 As shown, first relay 32-2 is in the on state, and second relay 32-3 is in the off state. In this case, power is supplied from first power supply 22 and first converter 24 to primary system component 26, and current I1 flows into primary system component 26. Furthermore, power is supplied from first power supply 22 and first converter 24 to secondary system component 44, and current I2 flows into secondary system component 44. Furthermore, current flows from first power supply 22 and first converter 24 to second power supply 42 via second converter 32-1, thereby charging second power supply 42.

[0034] on the other hand, Figure 3 is the current flow when the vehicle is in the automatic driving state. Figure 3 As shown, first relay 32-2 is in the OFF state, and second relay 32-3 is in the ON state. In this case, power is supplied from first power supply 22 and first converter 24 to primary system component 26, and current I3 flows into primary system component 26. Furthermore, power is supplied from first power supply 22 and first converter 24 to secondary system component 44, and currents I4 and I6 flow into secondary system component 44 via second converter 32-1. Furthermore, current I5 flows from first power supply 22 and first converter 24 to second power supply 42 via second converter 32-1, thereby charging second power supply 42.

[0035] Furthermore, in the vehicle control system 10, the primary system 20 and the secondary system 40 are connected via the second converter 32-1 so that the primary system 20 can be disconnected when an abnormality occurs on the primary system 20 side. When the primary system 20 and the secondary system 40 are disconnected, power is not supplied from the primary system 20 to the secondary system 40. In this case, Figure 3 As shown, the second relay 32-3 is in the on state, so power is supplied from the second power supply 42 to the secondary system component 44. Such power supply switching processing can also be achieved by the technology disclosed in Japanese Patent Application Laid-Open No. 2019-146305, for example.

[0036] Furthermore, the first microcomputer 34-1 and the second microcomputer 34-2 in the vehicle control device 30 perform the aforementioned power supply control. The first microcomputer 34-1 and the second microcomputer 34-2 receive signals from various components within the vehicle control device 30. Furthermore, the first microcomputer 34-1 and the second microcomputer 34-2 output control signals for controlling various components within the vehicle control device 30.

[0037] Furthermore, in the vehicle control device 30, the control of the first relay 32-2 is made redundant by two microcomputers, a first microcomputer 34-1 and a second microcomputer 34-2. Specifically, as will be described later, the first microcomputer 34-1 controls the on / off state of the first relay 32-2, while the second microcomputer 34-2 implements interlocking of the first relay 32-2.

[0038] Here, as Figure 1 As shown, the first microcomputer 34-1 is connected to a first CAN transceiver 34-3 and a second CAN transceiver 34-4, and can directly communicate with the outside of the vehicle control device 30 via the first CAN transceiver 34-3 and the second CAN transceiver 34-4. In addition, the first CAN transceiver 34-3 is connected to the local CAN, and the second CAN transceiver 34-4 is connected to the global CAN.

[0039] On the other hand, the second microcomputer 34-2 cannot communicate directly with the outside. The second microcomputer 34-2 is connected to the first microcomputer 34-1 so as to be communicable, and communicates with the outside via the first microcomputer 34-1.

[0040] For example, consider the case where an abnormality occurs in first microcomputer 34-1. In this case, control of first relay 32-2 is made redundant by first microcomputer 34-1 and second microcomputer 34-2. Therefore, second microcomputer 34-2 cannot control first relay 32-2 in place of first microcomputer 34-1. Furthermore, in this case, second microcomputer 34-2 cannot directly communicate with the outside world, and therefore cannot notify the external ECU of the abnormality in first microcomputer 34-1. If second microcomputer 34-2 is configured to enable direct communication with the outside world, the cost of constructing vehicle control device 30 increases.

[0041] Therefore, when a control signal is sent from the automatic driving control ECU 50, the second microcomputer 34-2 of the vehicle control system 10 of this embodiment controls the first CAN transceiver 34-3 and the second CAN transceiver 34-4 to stop operating when the state of the first relay 32-2 indicated by the control signal is different from the actual state of the first relay 32-2 that is controlled to operate according to the control signal.

[0042] As a result, the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4 ceases, rendering the vehicle control device 30 unable to communicate with external ECUs. External ECUs connected to the local CAN and global CAN can detect that the vehicle control device 30 is not responding, thereby detecting an abnormality in the vehicle control device 30. Thus, according to this embodiment, even if an abnormality occurs in a microcomputer capable of direct communication with the outside of the device within a device equipped with multiple microcomputers, this abnormality can be notified externally.

[0043] The first microcomputer 34 - 1 and the second microcomputer 34 - 2 are implemented by, for example, a semiconductor integrated circuit, and more specifically, by an application specific integrated circuit (ASIC).

[0044] In addition, the first microcomputer 34-1 and the second microcomputer 34-2 can also communicate with each other through Figure 4 The computer 60 shown in the figure is implemented. The computer 60 that implements the first microcomputer 34-1 and the second microcomputer 34-2 includes a central processing unit (CPU) 61, a memory 62 serving as a temporary storage area, and a nonvolatile storage unit 63. The computer also includes an input / output interface (I / F) 64 for connecting to input / output devices (not shown), and a read / write (R / W) unit 65 that controls the reading and writing of data from and to a recording medium 69. The computer also includes a network I / F 66 for connecting to a network such as the Internet. The CPU 61, memory 62, storage unit 63, I / O I / F 64, R / W unit 65, and network I / F 66 are interconnected via a bus 67.

[0045] The storage unit 63 can be implemented by a hard disk drive (HDD), a solid-state drive (SSD), a flash memory, or the like. The storage unit 63, serving as a storage medium, stores programs for enabling the computer to function. The CPU 61 reads the programs from the storage unit 63 and expands them in the memory 62, sequentially executing the steps of the programs.

[0046] Next, the operation of the vehicle control system 10 according to the embodiment will be described.

[0047] When the vehicle's operating state switches from the normal driving state to the automatic driving state, the automatic driving control ECU 50 outputs an automatic driving switching signal indicating the switch from the normal driving to the automatic driving state to the vehicle control device 30. Upon receiving the automatic driving switching signal, the first microcomputer 34-1 of the vehicle control device 30 executes Figure 5 The processing shown.

[0048] Furthermore, the first microcomputer 34-1 of the vehicle control device 30 receives control signals from the automatic driving control ECU 50 via the first CAN transceiver 34-3 and the second CAN transceiver 34-4. In this case, when the automatic driving switching signal is received via either the first CAN transceiver 34-3 or the second CAN transceiver 34-4, the first microcomputer 34-1 executes Figure 5 Furthermore, when the control signal received via the first CAN transceiver 34-3 contradicts the control signal received via the second CAN transceiver 34-4, the first microcomputer 34-1 outputs an abnormality notification signal indicating an abnormality to the external ECU.

[0049] In step S100 , the first microcomputer 34 - 1 outputs an automatic driving switching signal to the second microcomputer 34 - 2 .

[0050] In step S101 , the first microcomputer 34 - 1 outputs a control signal indicating voltage boost to the first converter 24 , thereby performing control so as to increase the voltage of the power supplied from the primary system 20 .

[0051] Furthermore, the voltage value on the primary system 20 side is lower than the voltage value on the secondary system 40 side. Therefore, when switching the power supply in a charged state, it is preferable to make the voltage supplied from the primary system 20 and the voltage on the secondary system 40 equal. Therefore, when controlling the first relay 32-2 to be in the off state, the first microcomputer 34-1 outputs a control signal indicating a voltage increase to the first converter 24, thereby controlling the power supply from the primary system 20 to increase in voltage.

[0052] In step S102, the first microcomputer 34-1 obtains the voltage value on the primary system 20 side. For example, the first microcomputer 34-1 obtains Figure 1 The voltage value of S1 on the primary system 20 side is shown. The voltage value of S1 on the primary system 20 side and the voltage value of S2 on the secondary system 40 side are different voltage values.

[0053] In step S104, the first microcomputer 34-1 determines whether the conditions for switching the power supply from the primary system 20 to the secondary system 40 are met. If the conditions for switching the power supply are met, the process proceeds to step S106. On the other hand, if the conditions for switching the power supply are not met, the process returns to step S102.

[0054] As a condition for power switching, the voltage value on the first power supply 22 side of the first relay 32-2 is set to be equal to or greater than a specified value. For example, the condition that the voltage value of S1 on the primary system 20 side is equal to or greater than a specified voltage (e.g., 14V) can be pre-set. This allows the voltage values ​​on the primary system 20 side to be aligned with the voltage values ​​on the secondary system 40 side, enabling smooth power switching. Furthermore, as a condition for power switching, the condition that a specified time (e.g., 4 seconds) has elapsed since the control signal to the first converter 24 was output can also be set.

[0055] In step S106, the first microcomputer 34-1 controls the operation of the first relay 32-2 as an example of a control object based on the automatic driving switching signal. In addition, the first microcomputer 34-1 controls the operation of the second relay 32-3 based on the automatic driving switching signal.

[0056] Specifically, in step S106, the first microcomputer 34-1 outputs a control signal to the first relay 32-2, thereby controlling the first relay 32-2 to be in an OFF state. In addition, the first microcomputer 34-1 outputs a control signal to the second relay 32-3, thereby controlling the second relay 32-3 to be in an ON state. Thus, power switching is performed, from Figure 2 The status shown is Figure 3 The status toggle shown.

[0057] In addition, upon receiving the automatic driving switching signal output from the first microcomputer 34-1, the second microcomputer 34-2 of the vehicle control device 30 executes Figure 6 The processing shown.

[0058] In step S200, the second microcomputer 34-2 Figure 5 In step S100, the automatic driving switching signal output from the first microcomputer 34-1 is obtained.

[0059] In step S202, the second microcomputer 34-2 updates the flag indicating whether the interlock of the first relay 32-2 is enabled or not, which is stored in a predetermined storage unit (not shown). Specifically, the second microcomputer 34-2 updates the flag indicating whether the interlock is enabled or not to "enabled".

[0060] When power switching is executed, it is preferable to interlock the first relay 32-2 in order to maintain the state. Therefore, when a predetermined condition is satisfied in a process described later, the second microcomputer 34-2 interlocks the first relay 32-2.

[0061] In step S204, the second microcomputer 34-2 obtains the intermediate voltage of the first relay 32-2 as an example of the state of the first relay 32-2 which is an example of the controlled object.

[0062] exist Figure 7 An example of an electronic circuit diagram around the first relay 32-2 is shown in FIG. Figure 7 As shown in FIG. 1 , the electronic circuit surrounding the first relay 32-2 is composed of transistors Tr1 and Tr2, a resistor R, and a diode D. Figure 7 As shown, the first relay 32-2 is composed of a transistor Tr 2-1 and transistor Tr 2-2 Configuration: The transistors Tr1 and Tr2 are MOSFETs (Metal-Oxide-Semiconductor Field Effect Transistors).

[0063] The second microcomputer 34-2 obtains Figure 7 The transistor Tr in the first relay 32-2 shown 2-1 With transistor Tr 2-2 The intermediate voltage T between them. In addition, Figure 7 OUT1 is an output terminal to the first microcomputer 34-1, and OUT2 is an output terminal to the second microcomputer 34-2. The second microcomputer 34-2 receives the intermediate voltage T output from OUT2.

[0064] In step S206, the second microcomputer 34-2 determines whether the conditions related to the first relay 32-2 are satisfied. If the conditions related to the first relay 32-2 are not satisfied, the process proceeds to step S208. On the other hand, if the conditions related to the first relay 32-2 are satisfied, the process proceeds to step S210.

[0065] As the condition related to the first relay 32-2, for example, the intermediate voltage T of the first relay 32-2 obtained in step S204 is equal to or lower than a predetermined voltage value (e.g., 3 V or lower) and this state lasts for a predetermined time (e.g., 24 ms or longer) is set.

[0066] When the automatic driving switch signal is issued from the automatic driving control ECU 50, Figure 5In step S106, first relay 32-2 is disconnected, and therefore intermediate voltage T is expected to be zero. However, even if the automatic driving switch signal is issued, if intermediate voltage T remains above a predetermined voltage value and remains in this state for a predetermined period of time, there is a high possibility that a malfunction has occurred in vehicle control device 30 itself. In particular, there is a high possibility that a malfunction has occurred in first microcomputer 34-1, which receives the automatic driving switch signal and controls the operation of first relay 32-2.

[0067] Therefore, as described above, when the state of the first relay 32-2 corresponding to the automatic driving switching signal is different from the state actually represented by the first relay 32-2, the second microcomputer 34-2 controls the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4 as an example of a communication unit so as to stop.

[0068] Specifically, in step S208, the second microcomputer 34-2 outputs a control signal for stopping the operations of the first CAN transceiver 34-3 and the second CAN transceiver 34-4.

[0069] Furthermore, the second microcomputer 34-2 checks whether an abnormality notification signal indicating an abnormality is output from the first microcomputer 34-1 to the external ECU when stopping the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4. If the abnormality notification signal indicating an abnormality is output from the first microcomputer 34-1 to the external ECU, the first microcomputer 34-1 itself recognizes the abnormality.

[0070] For example, after controlling the first relay 32-2 to be in the OFF state, the Figure 7 When the intermediate voltage T outputted by OUT1 shown in FIG. 1 is greater than a predetermined value, the first microcomputer 34-1 outputs an abnormality notification signal to the outside. In this case, since the abnormality of the vehicle control device 30 is notified to the external ECU, the second microcomputer 34-2 does not need to stop the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4.

[0071] Therefore, when the conditions related to the first relay 32-2 are not satisfied and the abnormality notification signal indicating the abnormality is not output from the first microcomputer 34-1 to the external ECU, the second microcomputer 34-2 outputs a control signal that stops the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4.

[0072] On the other hand, when the conditions related to first relay 32 - 2 are satisfied, the state indicated by the automatic driving switch signal is the same as the actual state of first relay 32 - 2 .

[0073] In this case, in step S210, the second microcomputer 34-2 outputs an interlock signal indicating interlock execution for continuing the OFF state of the first relay 32-2. The second microcomputer 34-2 also confirms that the flag indicating interlocking is "OK" and outputs the interlock signal.

[0074] Specifically, the second microcomputer 34-2 sends Figure 7 The control signal is output to IN2 shown in FIG. 1 , thereby performing interlocking so as to continue the OFF state of the first relay 32-2. Figure 7 IN1 shown receives a control signal output from the first microcomputer 34-1. If a signal is input to at least one of IN1 and IN2, an interlock is executed to maintain the OFF state of the first relay 32-2. Therefore, even if no control signal is input from the first microcomputer 34-1 to IN1, the OFF state of the first relay 32-2 remains.

[0075] In this way, if the state of first relay 32-2 indicated by the control signal output from first microcomputer 34-1 differs from the actual state of first relay 32-2, second microcomputer 34-2 controls the first CAN transceiver 34-3 and second CAN transceiver 34-4 to stop operating. This prevents vehicle control device 30 from communicating with external ECUs. External ECUs connected to the local CAN and global CAN can detect that vehicle control device 30 is not responding, thereby detecting an abnormality in vehicle control device 30. Furthermore, since second microcomputer 34-2 does not need to be connected to the local CAN and global CAN, the cost of constructing vehicle control device 30 can be reduced.

[0076] Furthermore, when the first microcomputer 34-1 controls the first relay 32-2, the second microcomputer 34-2 implements interlocking based on the intermediate voltage T representing the voltage between the two transistors constituting the first relay 32-2. Thus, the second microcomputer 34-2 can implement interlocking of the first relay 32-2 without receiving control information on the first relay 32-2 from the first microcomputer 34-1.

[0077] In addition, as mentioned above Figure 7 As shown, diodes are provided at IN1 and IN2 to separate the circuit for signal input from the first microcomputer 34-1 from the circuit for signal input from the second microcomputer 34-2. Therefore, even if a fault occurs, such as a ground fault, on the circuit side of the first microcomputer 34-1, the interlock signal from the second microcomputer 34-2 is input to IN2, and the state of the first relay 32-2 can be maintained.

[0078] Next, the operation of the vehicle control system 10 when switching from automatic driving to normal driving will be described.

[0079] When the vehicle's operating state switches from the automatic driving state to the normal driving state, the automatic driving control ECU 50 outputs a normal driving switching signal indicating the switch from the automatic driving state to the normal driving state to the vehicle control device 30. Upon receiving the normal driving switching signal, the vehicle control device 30 executes Figure 8 The processing shown.

[0080] In step S300, the first microcomputer 34-1 outputs a normal driving switching signal to the second microcomputer 34-2.

[0081] In step S301 , the first microcomputer 34 - 1 outputs a control signal indicating voltage boost to the first converter 24 , thereby performing control so as to increase the voltage of the power supplied from the primary system 20 .

[0082] In step S302, the first microcomputer 34-1 obtains the voltage value on the primary system 20 side. For example, the first microcomputer 34-1 obtains Figure 1 The voltage value of S1 on the primary system 20 side is shown.

[0083] In step S304, the first microcomputer 34-1 determines whether the conditions for switching the power supply from the primary system 20 to the secondary system 40 are met. If the conditions for switching the power supply are met, the process proceeds to step S306. On the other hand, if the conditions for switching the power supply are not met, the process returns to step S302.

[0084] As described above, the power switching condition can be set in advance to require that the voltage value of S1 on the primary system 20 side is a predetermined voltage (e.g., 14 V) or higher. Furthermore, the power switching condition can also be set to require that a predetermined time (e.g., 4 seconds) or longer has passed since the output of the control signal to the first converter 24.

[0085] In step S306, the first microcomputer 34-1 controls the operation of the first relay 32-2 as an example of a control object based on the normal driving switching signal. In addition, the first microcomputer 34-1 controls the operation of the second relay 32-3 based on the normal driving switching signal.

[0086] Specifically, in step S306, the first microcomputer 34-1 outputs a control signal to the first relay 32-2, thereby controlling the first relay 32-2 to be in the on state. In addition, the first microcomputer 34-1 outputs a control signal to the second relay 32-3, thereby controlling the second relay 32-3 to be in the off state. Thus, the power supply is switched from Figure 3 The status shown is Figure 2 The status toggle shown.

[0087] In addition, upon receiving the normal driving switching signal output from the first microcomputer 34-1, the second microcomputer 34-2 of the vehicle control device 30 executes Figure 9 The processing shown.

[0088] In step S400, the second microcomputer 34-2 obtains the Figure 8 The normal driving switching signal is output from the first microcomputer 34-1 in step S300.

[0089] In step S402, the second microcomputer 34-2 outputs an interlock release signal indicating that the interlock of the first relay 32-2 has been released.

[0090] In step S404, the second microcomputer 34-2 updates the flag indicating whether the interlock of the first relay 32-2 is enabled or not, which is stored in a predetermined storage unit (not shown). Specifically, the second microcomputer 34-2 updates the flag indicating whether the interlock is enabled or not to "no".

[0091] Here, the flag indicating whether or not interlocking is enabled will be described.

[0092] There are cases where the automatic driving control ECU 50 continuously issues an automatic driving switch signal and a normal driving switch signal. This state is called oscillation. For example, consider a situation where the normal driving switch signal and the automatic driving switch signal are continuously issued, and the vehicle control device 30 receives the automatic driving switch signal while the normal driving switch signal is being transmitted and the power supply is being switched based on the normal driving switch signal. In this case, the first microcomputer 34-1 may receive the automatic driving switch signal while executing power supply switching control from automatic driving to normal driving based on the normal driving switch signal, and the intermediate voltage T of the first relay may fall below a predetermined voltage. In this case, the second microcomputer 34-2 may interlock the first relay 32-2. Therefore, in this embodiment, a flag indicating whether the interlock is enabled or disabled is set. Upon receiving the automatic driving switch signal or the manual driving switch signal, the second microcomputer 34-2 immediately updates the flag indicating whether the interlock is enabled or disabled. Furthermore, when interlocking the first relay 32-2, the second microcomputer 34-2 refers to this flag and performs the interlock. This prevents the occurrence of such a situation.

[0093] In addition, as mentioned above Figure 7 As shown, the first relay 32-2 and the second relay 32-3 are formed of MOSFETs, and parasitic diodes are formed in the MOSFETs.

[0094] exist Figure 10 , which is a diagram for explaining the flow of current taking into account the parasitic diode. Figure 10 As shown, in the transistor Tr constituting the first relay 32-2 2-1 Tr 2-2 Parasitic diodes D1 and D2 are formed. In addition, the transistor Tr constituting the second relay 32-3 is also 2-3 Tr 2-4 Parasitic diodes D3 and D4 are formed.

[0095] Here, as Figure 10 As shown, when the power is switched, a transistor Tr in the first relay 32-2 2-2 Forming parasitic diode D2, even if transistor Tr 2-2 It is in the disconnected state, the current I 10 It also flows into the secondary system component 44. Figure 10 As shown, when the power is switched, a transistor Tr in the second relay 32-3 2-3 The parasitic diode D2 is formed, and even when the transistor Tr2-3 is off, the current I11 flows into the secondary system component 44. This can suppress the occurrence of instantaneous power interruption and enable power switching while continuing power supply.

[0096] As described above, the vehicle control system 10 according to the first embodiment includes a first CAN transceiver 34-3 and a second CAN transceiver 34-4 as examples of communication units, a first microcomputer 34-1 capable of communicating with the outside world via the first CAN transceiver 34-3 and the second CAN transceiver 34-4, and a second microcomputer 34-2 that cannot communicate directly with the outside world but can communicate with the first microcomputer 34-1. The first CAN transceiver 34-3 and the second CAN transceiver 34-4 receive control signals from the outside. The first microcomputer 34-1 controls the operation of the first relay 32-2, an example of a controlled object, based on the control signals and outputs the control signals to the second microcomputer 34-2. If the state of the first relay 32-2 corresponding to the control signal differs from the state indicated by the first relay 32-2, the second microcomputer 34-2 controls the operation of the first CAN transceiver 34-3 and the second CAN transceiver 34-4 to stop. Thus, in a device including a plurality of microcomputers, even if an abnormality occurs in a microcomputer capable of directly communicating with the outside of the device, the abnormality can be notified to the outside.

[0097] Specifically, if the state of first relay 32-2 indicated by the control signal output from first microcomputer 34-1 differs from the actual state of first relay 32-2, second microcomputer 34-2 controls the first CAN transceiver 34-3 and second CAN transceiver 34-4 to stop operating. This prevents vehicle control device 30 from communicating with external ECUs. External ECUs connected to the local CAN and global CAN can detect that vehicle control device 30 is unresponsive, thereby detecting an abnormality within vehicle control device 30. Furthermore, since second microcomputer 34-2 does not need to be connected to the local CAN and global CAN, the cost of constructing vehicle control device 30 can be reduced.

[0098] Furthermore, while the processing performed by each device in the above-described embodiment is described as being executed by hardware, software processing may also be performed by executing a program. Alternatively, processing may be a combination of software and hardware. In this case, the program stored in the ROM may be stored in various storage media and distributed.

[0099] Furthermore, the present disclosure is not limited to the above, and can of course be implemented with various modifications other than the above without departing from the gist of the present disclosure.

[0100] For example, in the above embodiment, the second microcomputer 34-2 obtains the transistor Tr constituting the first relay 32-2. 2-1 With transistor Tr 2-2 The case where the intermediate voltage T between is taken as the actual state of the first relay 32-2 is described as an example, but the present invention is not limited to this. For example, the second microcomputer 34-2 may obtain the transistor Tr constituting the first relay 32-2. 2-1 With transistor Tr 2-2 The actual state of the first relay 32 - 2 is determined based on the current value.

[0101] In the above embodiment, the vehicle control device 30 is described as receiving an automatic driving switch signal and a manual driving switch signal as an example, but the present invention is not limited thereto and the control signal may be any signal.

Claims

1. A vehicle control device comprising: Ministry of Communications; a first microcomputer capable of communicating with the outside via the communication unit; and The second microcomputer cannot communicate directly with the outside, but can communicate with the first microcomputer. in, The communication unit receives a control signal from the outside, The first microcomputer outputs a control signal to a relay, i.e., a control object, located between the first power supply and the second power supply based on the control signal received through the communication unit, in response to the control signal, so as to control the relay to be in an OFF state, and outputs the control signal to the second microcomputer. The second microcomputer obtains the state indicated by the relay from the relay. When the state of the relay corresponding to the control signal is different from the state indicated by the relay, the second microcomputer controls the communication unit by performing STB control, i.e., set-top box control, on the communication unit to stop the operation of the communication unit.

2. The vehicle control device according to claim 1, wherein: The second microcontroller outputs an interlock signal to the relay for continuing the OFF state of the relay when the state indicated by the relay is the OFF state and the state indicated by the control signal is the same as the state indicated by the relay.

3. The vehicle control device according to claim 1 or 2, wherein: When the relay is controlled to be in the OFF state, the first microcomputer controls the relay to be in the OFF state when the voltage value on the first power supply side of the relay becomes equal to or greater than a predetermined value.

4. A vehicle control method, the method being executed by a vehicle control device, the vehicle control device comprising: Ministry of Communications; a first microcomputer capable of communicating with the outside via the communication unit; and The second microcomputer cannot communicate directly with the outside, but can communicate with the first microcomputer. in, The communication unit receives a control signal from the outside, The first microcomputer outputs a control signal to a relay, i.e., a control object, located between the first power supply and the second power supply based on the control signal received through the communication unit, in response to the control signal, so as to control the relay to be in an OFF state, and outputs the control signal to the second microcomputer. The second microcomputer obtains the state indicated by the relay from the relay. When the state of the relay corresponding to the control signal is different from the state indicated by the relay, the second microcomputer controls the communication unit by performing STB control, i.e., set-top box control, on the communication unit to stop the operation of the communication unit.

5. A recording medium recording a vehicle control program to be executed by a second microcomputer of a vehicle control device, the vehicle control device comprising: Ministry of Communications; a first microcomputer capable of communicating with the outside via the communication unit; and The second microcomputer cannot communicate directly with the outside, but can communicate with the first microcomputer. in, The vehicle control program is used to perform the following processing: The communication unit receives a control signal from the outside, The first microcomputer outputs a control signal to a relay, i.e., a control object, located between the first power supply and the second power supply based on the control signal received through the communication unit, in response to the control signal, so as to control the relay to be in an OFF state, and outputs the control signal to the second microcomputer. The second microcomputer obtains the state indicated by the relay from the relay. When the state of the relay corresponding to the control signal is different from the state indicated by the relay, the second microcomputer controls the communication unit by performing STB control, i.e., set-top box control, on the communication unit to stop the operation of the communication unit.

Images