Control device and control program

Abstract

To provide a control device and a control program capable of reliably performing door lock control when retreat traveling control is performed.SOLUTION: This control device comprises a controller that causes, when one of a main power source and a backup power source fails, vehicle retreat traveling control to be performed by the other normal power source. The controller executes door lock control including locking / unlocking of a vehicle in accordance with at least one of an indoor state and an outdoor state of the vehicle when the retreat traveling control is completed. The controller executes the door lock control when a charge remaining amount of the normal power source drops to or below a threshold value before the completion of the retreat traveling control.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The disclosed embodiments relate to a control device and a control program. [Background technology]

[0002] Conventionally, there is known a technique for performing evacuation travel control of a vehicle when an abnormality occurs in the vehicle, and for locking or unlocking the vehicle doors after the evacuation travel control is completed depending on the conditions inside and outside the vehicle (see, for example, Patent Documents 1 and 2). In Patent Document 1, door lock control including locking and unlocking of the doors is performed depending on the conditions inside the vehicle after the evacuation travel control is completed. In Patent Document 2, door lock control is performed depending on the conditions outside the vehicle after the evacuation travel control is completed.

[0003] Furthermore, in a vehicle equipped with a redundant power supply system including a main power supply and a backup power supply, if one power supply fails, the other normal power supply performs evacuation control. When the evacuation control is completed and the vehicle stops, the occupants, including the driver, may be in a panic. Therefore, to ensure the safety of the occupants, it is desirable to lock the doors depending on the situation outside the vehicle cabin. Furthermore, in the event of an emergency, such as a vehicle fire, it is desirable to unlock the doors because the occupants need to quickly exit the vehicle cabin after the evacuation control is completed. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2022-093098 [Patent Document 2] Japanese Patent Publication No. 2020-097850 Summary of the Invention [Problem to be solved by the invention]

[0005] However, if the remaining charge of the normal power source runs out before the evacuation travel control is completed, there is a risk that the door lock control will not be able to be performed.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a control device and a control program that can reliably perform door lock control when performing evacuation driving control. [Means for solving the problem]

[0007] To solve the above problems and achieve the object, a control device according to one aspect of the embodiment includes a controller that controls a vehicle to perform evacuation travel control using a normal power source when one of a main power source and a backup power source fails. When the evacuation travel control is completed, the controller executes door lock control, including locking and unlocking the doors of the vehicle, depending on at least one of conditions inside and outside the vehicle. When the remaining charge of the normal power source falls below a threshold before the evacuation travel control is completed, the controller executes the door lock control. [Effects of the Invention]

[0008] In one aspect of the embodiment, the controller is configured to execute door lock control if the remaining charge of the normal power source falls below a threshold before the evacuation travel control is completed. This makes it possible to execute door lock control before the remaining charge of the normal power source runs out if the remaining charge of the normal power source is about to run out before the evacuation travel control is completed. Therefore, the controller can reliably execute door lock control when executing evacuation travel control. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a control system according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 3]FIG. 3 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 5] FIG. 5 is an explanatory diagram illustrating an example of the operation of the power supply control device according to the embodiment. [Figure 6] FIG. 6 is a diagram for explaining the remaining charge of the power source when door lock control is performed. [Figure 7] FIG. 7 is a diagram for explaining the remaining charge of the power source when door lock control is performed. [Figure 8] FIG. 8 is a flowchart illustrating an example of processing executed by the controller of the power supply control device according to the embodiment. [Figure 9] FIG. 9 is a flowchart illustrating an example of processing executed by the controller of the power supply control device according to the embodiment. [Figure 10] FIG. 10 is a flowchart illustrating an example of processing executed by the controller of the automatic driving control device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of a control device and a control program will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiment. The control device according to the embodiment is installed in an electric vehicle with an automatic driving function, a hybrid vehicle, or an internal combustion engine vehicle.

[0011] [1. Control system configuration] Fig. 1 is an explanatory diagram showing an example of the configuration of a control system 100 according to an embodiment. As shown in Fig. 1, the control system 100 according to the embodiment includes a power supply control device 1, a main power supply 10, an automatic driving control device 60, a door control device 70, and a navigation device 80. The power supply control device 1 is an example of a control device.

[0012] When the power supply control device 1 is mounted on an engine vehicle, the main power supply 10 includes a generator 12 and a lead battery (hereinafter referred to as "PbB11"). The battery of the main power supply 10 may be any secondary battery other than PbB11.

[0013] The generator 12 is, for example, an alternator that converts the kinetic energy of a running vehicle into electricity to generate power. The generator 12 charges the PbB 11 and a backup power supply 20 (described later) with the generated power. The main power supply 10 also supplies power to multiple electrical loads mounted on the vehicle.

[0014] When the power supply control device 1 is mounted on an electric vehicle or a hybrid vehicle, the main power supply 10 includes a DC / DC converter (not shown, hereinafter referred to as "DCDC") and a PbB 11. In this case, the DCDC is connected to a generator 12 and a high-voltage battery (not shown) whose voltage is higher than that of the PbB 11, and steps down the voltage of the generator 12 and the high-voltage battery to supply power to multiple electrical loads. The high-voltage battery is, for example, a battery for driving the vehicle mounted on an electric vehicle or a hybrid vehicle.

[0015] The automatic driving control device 60 is electrically connected to the power supply control device 1 and the navigation device 80. The automatic driving control device 60 is capable of communicating information between the power supply control device 1 and the navigation device 80.

[0016] The automatic driving control device 60 includes a GPS (Global Positioning System) (not shown) and a controller 61. The controller 61 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various circuits.

[0017] The controller 61 may be configured in part or entirely with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0018] The controller 61 controls the automatic driving of the vehicle by having the CPU execute a program stored in the ROM using the RAM as a work area. The automatic driving control device 60 may be configured to acquire GPS vehicle position information, map information, etc. from the navigation device 80. The automatic driving control device 60 may be configured to acquire map information from an external server (not shown).

[0019] When the main power supply 10 fails, the controller 61 of the automatic driving control device 60 controls the vehicle to run safely using the backup power supply 20, which will be described later. When the backup power supply 20 fails, the controller 61 also controls the vehicle to run safely using the main power supply 10. A failure of the main power supply 10 includes a failure in the power supply system (first system 110, which will be described later) of the main power supply 10. A failure of the backup power supply 20 also includes a failure in the power supply system (second system 120, which will be described later) of the backup power supply 20.

[0020] The door control device 70 is electrically connected to the power supply control device 1. The door control device 70 is capable of communicating information with the power supply control device 1. The door control device 70 includes a controller 71. The controller 71 includes a microcomputer having a CPU, ROM, RAM, etc., and various circuits. Note that the controller 71 may be configured in part or in whole using hardware such as an ASIC or FPGA.

[0021] The controller 71 controls the vehicle door locks by having the CPU execute a program stored in the ROM using the RAM as a work area. For example, the controller 71 communicates with a key equipped with a wireless communication function, and locks or unlocks the vehicle doors in response to a signal received from the key or in response to the operation of a switch installed inside the vehicle. Furthermore, when a locking command to lock the doors is input from the power supply control device 1, the controller 71 locks the doors corresponding to the locking command. When an unlocking command to unlock the doors is input from the power supply control device 1, the controller 71 unlocks the doors corresponding to the unlocking command.

[0022] The navigation device 80 includes a GPS and a storage unit (neither of which is shown) that stores map information and the like. The navigation device 80 is a device that provides guidance on a driving route from the current location to a destination input by the user. The map information is map information that includes the route (road) on which the vehicle will travel. The map information also includes information on the type of road (for example, an ordinary road, an expressway, etc.) and the shape of the road (such as a slope). The navigation device 80 is electrically connected to the power supply control device 1. The navigation device 80 is capable of communicating information with the power supply control device 1.

[0023] The power supply control device 1 is a device that controls the power supply to multiple electrical loads installed in a vehicle. The power supply control device 1 is electrically connected to a main power supply 10, a first running load 101, a first general load 102, a second running load 103, and a second general load 104.

[0024] The first running load 101 includes an electrical load related to the vehicle running itself under autonomous driving. The first running load 101 includes, for example, an electric steering device, a shift-by-wire device, an electric accelerator device, an electric brake device, an on-board camera, various sensors, and radar. The first running load 101 also includes a minimum load required for evacuation running control in FOP (fail-safe control).

[0025] The second running load 103 has some or all of the functions for autonomous driving that the first running load 101 has. The second running load 103 includes the minimum loads required for evacuation driving control in the FOP, such as an electric steering device, a shift-by-wire device, an electric accelerator device, an electric brake device, an on-board camera, various sensors, and some or all of radar. The first running load 101 and the second running load 103 are controlled by the automatic driving control device 60 during autonomous driving to cause the vehicle to drive autonomously.

[0026] The above-mentioned in-vehicle cameras include exterior cameras and interior cameras. The exterior cameras are installed at appropriate positions on the vehicle and capture images of the outside of the vehicle cabin (exterior images). The exterior cameras capture images of the periphery of the vehicle, including the front and rear of the vehicle, as exterior images. The exterior cameras output the captured exterior images to the power supply control device 1 or the like. The interior cameras are installed at appropriate positions on the vehicle and capture images of the inside of the vehicle cabin (interior images). The interior images include, for example, images of the faces of the occupants, including the driver and passengers, and luggage loaded in the vehicle cabin. The interior cameras output the captured interior images to the power supply control device 1 or the like. The in-vehicle cameras are, for example, cameras equipped with a lens and an imaging element such as a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor), but are not limited to these.

[0027] The first general load 102 and the second general load 104 are loads that are not directly involved in the automatic driving control. The first general load 102 and the second general load 104 include a door lock unit, an air conditioner, an audio system, various lights, a security device, various sensors, etc. The door lock unit operates under the control of the door control device 70 and locks or unlocks the vehicle doors.

[0028] The various sensors of the first general load 102 and the second general load 104 include an emergency sensor that detects an emergency in the vehicle. The emergency sensor includes, for example, a fire sensor and a submersion sensor. The fire sensor detects that a fire has occurred in the vehicle and outputs a fire detection signal to the automatic driving control device 60, the power supply control device 1, etc. The submersion sensor detects that the vehicle has been submerged and outputs a submersion detection signal to the automatic driving control device 60, the power supply control device 1, etc. Note that the emergency sensor does not need to be configured to include both a fire sensor and a submersion sensor, and may be configured to include only one of the sensors. Furthermore, the emergency sensor is not limited to a fire sensor and a submersion sensor, and may include other types of sensors, such as a sensor that detects abnormal odors.

[0029] The first general load 102 and the second general load 104 may be the same type of load or different types of loads. For example, the second general load 104 may include a part of the first general load 102 (for example, only a door lock unit and an emergency sensor) in order to reduce power consumption during evacuation travel control using the backup power source 20.

[0030] The power supply control device 1 includes a backup power supply 20, a controller 3, a first system (first system line) 110, a second system (second system line) 120, an inter-system line 130, an inter-system switch 41, a battery switch 42, a first voltage sensor 51, and a second voltage sensor 52.

[0031] The backup power supply 20 is a backup power supply in the event that the main power supply 10 is unable to supply power. The backup power supply 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). Note that the battery of the backup power supply 20 may be any secondary battery other than the LiB21.

[0032] The first system 110 is a power supply line that supplies power from the main power supply 10 to a plurality of electrical loads. In other words, the power supply system of the main power supply 10 includes the main power supply 10 and the first system 110.

[0033] The second system 120 is a power supply line that supplies power from the backup power supply 20 to a plurality of electrical loads. In other words, the power supply system of the backup power supply 20 includes the backup power supply 20 and the second system 120. The inter-system line 130 is a connection line that electrically connects the first system 110 and the second system 120.

[0034] The inter-system switch 41 is a switch that can connect and disconnect the first system 110 and the second system 120. The inter-system switch 41 may be a DCDC. In this case, the DCDC connects the first system 110 and the second system 120 by operating. The DCDC disconnects the connection between the first system 110 and the second system 120 by stopping its operation. The inter-system switch 41 is an example of a connection device provided on the inter-system line 130.

[0035] In the following description, turning on the inter-system switch 41 means electrically connecting, or establishing conduction between, the first system 110 and the second system 120. Turning off the inter-system switch 41 means disconnecting, or interrupting the electrical connection between the first system 110 and the second system 120. The battery switch 42 is a switch that can connect and disconnect the backup power supply 20 and the second system 120.

[0036] The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110 and outputs the detection result to the controller 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120 and outputs the detection result to the controller 3.

[0037] The controller 3 includes a microcomputer having a CPU, ROM, RAM, etc., and various circuits. Note that the controller 3 may be configured partly or entirely with hardware such as an ASIC or FPGA.

[0038] The controller 3 controls the operations of the inter-system switch 41 and the battery switch 42 by the CPU executing a program stored in the ROM using the RAM as a work area.

[0039] The controller 3 also monitors the remaining charge of the backup power supply 20 and the main power supply 10. Specifically, the controller 3 acquires information indicating the remaining charge of the backup power supply 20 from the backup power supply 20. The information indicating the remaining charge of the backup power supply 20 is, for example, the SOC (State Of Charge) of the LiB 21. The controller 3 also acquires information indicating the remaining charge of the main power supply 10 from the main power supply 10. The information indicating the remaining charge of the main power supply 10 is, for example, the SOC of the PbB 11. When the SOC of the LiB 21 and PbB 11 is 100%, the remaining charge is at its maximum. When the SOC of the LiB 21 and PbB 11 is 0%, the remaining charge is zero.

[0040] The controller 3 is mounted on a vehicle having an automatic driving function, and performs FOP (fail-safe control) in the event of a failure of the main power supply 10, by supplying power from the backup power supply 20 to the second running load 103 and the second general load 104. In the FOP in the event of a failure of the main power supply 10, the controller 3 causes the automatic driving control device 60 to control the evacuation running of the vehicle using the backup power supply 20. In the FOP in the event of a failure of the backup power supply 20, the controller 3 also performs FOP in the event of a failure of the backup power supply 20, by supplying power from the main power supply 10 to the first running load 101 and the first general load 102. In the FOP in the event of a failure of the backup power supply 20, the controller 3 also causes the automatic driving control device 60 to control the evacuation running of the vehicle using the main power supply 10. In the event of evacuation running control, the controller 3 also locks and unlocks the vehicle doors via the door control device 70, which will be described later.

[0041] The controller 3 can also acquire roadway information, such as the road type (e.g., ordinary road, expressway, etc.) and road shape (e.g., slope) of the road on which the vehicle is traveling, from the navigation device 80. The controller 3 locks and unlocks the vehicle doors in accordance with the roadway information, which will be described later. The controller 3 may also acquire the roadway information from an external server (not shown).

[0042] [2. Example of power supply control device operation] Next, the operation of the power supply control device 1 according to the embodiment will be described with reference to Figures 2 to 5. Figures 2 to 5 are explanatory diagrams showing an example of the operation of the power supply control device 1 according to the embodiment.

[0043] [2-1. Normal operation] The controller 3 controls the inter-system switch 41 and the like as shown in FIG. 2 during normal automatic operation or manual operation when the ignition switch (IG) of the vehicle is turned on and the power supply systems of the main power supply 10 and the backup power supply 20 are not failing.

[0044] Specifically, the controller 3 turns on the system switch 41. The controller 3 turns off the battery switch 42. This allows the power supply control device 1 to supply power from the main power supply 10 to the first running load 101, the first general load 102, the second running load 103, and the second general load 104 while suppressing discharge of the LiB 21 during normal operation.

[0045] [2-2. Operation of the power supply control device when the power supply system fails] In the control system 100, a power supply system may fail. Examples of a power supply system failure include a ground fault 200 (see FIG. 3) in the first system 110 including the main power supply 10, and a ground fault 201 (see FIG. 3) in the second system 120 including the backup power supply 20.

[0046] In the power supply control device 1, if a ground fault 200 in the first system 110 or a ground fault 201 in the second system 120 occurs during normal operation, the voltages of the first system 110 and the second system 120 become lower than the normal voltages.

[0047] For this reason, when the voltage of the second system 120 detected by the second voltage sensor 52 (hereinafter referred to as "second system voltage V2") becomes equal to or lower than the ground fault threshold, the controller 3 provisionally determines that a failure has occurred in the power supply system. Then, as shown in FIG. 3, the controller 3 turns off the inter-system switch 41 and turns on the battery switch 42. Note that the controller 3 may provisionally determine that a failure has occurred in the power supply system, for example, when the voltage of the first system 110 detected by the first voltage sensor 51 (hereinafter referred to as "first system voltage V1") becomes equal to or lower than the ground fault threshold.

[0048] This disconnects the first system 110 from the second system 120. Then, if there is no ground fault in the first system 110, the power supply control device 1 becomes able to supply power from the main power supply 10. Also, if there is no ground fault in the second system 120, the power supply control device 1 becomes able to supply power from the backup power supply 20.

[0049] This provisional determination may be made by a hardware circuit including a comparator. In this case, the comparator compares the second system voltage V2 with a ground fault threshold. When the detected voltage falls below the ground fault threshold, the comparator outputs a fault detection signal indicating a provisional determination, thereby turning off the inter-system switch 41 and turning on the battery switch 42.

[0050] After provisionally determining that a failure has occurred in a power supply system, the controller 3 determines which system has the failure. Specifically, when the first system voltage V1 is below the ground fault threshold for a predetermined period of time or longer and the second system voltage V2 recovers to exceed the normal threshold for a predetermined period of time or longer, the controller 3 officially determines that a ground fault 200 has occurred in the first system 110, including the main power supply 10. Note that the normal threshold is set higher than the ground fault threshold, but they may be the same value. In this manner, when the main power supply 10 fails, the controller 3 performs FOP, which causes the backup power supply 20 to supply power to the loads. Specifically, as shown in FIG. 4 , the controller 3 keeps the inter-system switch 41 off and the battery switch 42 on, and supplies power from the backup power supply 20 to the second running load 103 and the second general load 104 via the second system 120.

[0051] If the controller 3 determines that the main power supply 10 has failed due to a ground fault 200 in the first system 110 or the like, it notifies the automatic operation control device 60 that the main power supply 10 has failed and that FOP using the backup power supply 20 has begun.

[0052] When the controller 61 of the automatic driving control device 60 is notified by the power supply control device 1 that FOP using the backup power supply 20 has started, the controller 61 starts evacuation driving control by automatic driving. Evacuation driving means driving the vehicle to a safe place and stopping it.

[0053] The controller 3 determines that there is a ground fault 201 in the second system 120 if the second system voltage V2 remains below the ground fault threshold even after a predetermined time has passed since the provisional determination, and the first system voltage V1 recovers to exceed the normal threshold for more than a predetermined time.

[0054] In this case, the controller 3 performs FOP, supplying power from the main power supply 10 to the first traveling load 101 and the first general load 102. Specifically, as shown in Fig. 5 , the controller 3 turns off the battery switch 42 while keeping the inter-system switch 41 off, and supplies power from the main power supply 10 to the first traveling load 101 and the first general load 102 via the first system 110.

[0055] If the controller 3 determines that the backup power supply 20 has failed, for example, due to a ground fault in the second system 120, it notifies the automatic operation control device 60 that the backup power supply 20 has failed and that FOP using the main power supply 10 has begun.

[0056] When the controller 61 of the automatic driving control device 60 is notified by the power supply control device 1 that FOP using the main power supply 10 has started, the controller 61 starts evacuation travel control using automatic driving.

[0057] If, after the provisional determination, the first system voltage V1 and the second system voltage V2 recover to exceed the normal threshold for a predetermined time or more, the controller 3 determines that the provisional determination result is incorrect. In other words, the controller 3 officially determines that there is no failure in the power supply system. Then, the controller 3 turns off the battery switch 42 and turns on the inter-system switch 41. This causes the power supply control device 1 to return to normal operation as shown in FIG. 2.

[0058] [3. Door lock control overview] Next, an overview of door lock control in the control system 100 according to the embodiment will be described. In this embodiment, the term "door lock control" is used to mean both locking and unlocking of vehicle doors, but is not limited thereto and may also mean either locking or unlocking of doors.

[0059] When the above-described evacuation traveling control is completed and the vehicle is stopped, the occupants, including the driver, may panic and carelessly get out of the vehicle. In this embodiment, door lock control is performed to lock the doors depending on the situation outside the vehicle cabin to ensure the safety of the occupants. In this embodiment, door lock control is performed to lock the doors depending on the situation inside the vehicle cabin in addition to or instead of the situation outside the vehicle cabin. Furthermore, in the event of an emergency such as a vehicle fire or submersion in water, the occupants need to quickly exit the vehicle cabin after the evacuation traveling control is completed. In this embodiment, door lock control is performed to unlock the doors to ensure the safety of the occupants. Details of the above-described door lock control will be described later using Figure 8 and subsequent figures.

[0060] Here, the state of the power supply (more specifically, the remaining charge of the power supply) when the door lock control is performed will be described with reference to Fig. 6 and Fig. 7. Fig. 6 and Fig. 7 are diagrams for explaining the remaining charge of the power supply when the door lock control is performed. Note that the description here takes as an example a case where the main power supply 10 has failed, the backup power supply 20 is a normal power supply, and the evacuation travel control is performed by the backup power supply 20.

[0061] 6, when the main power supply 10 fails at time T11, the controller 3 starts FOP and starts evacuation travel control using the backup power supply 20. In the evacuation travel control, the vehicle is driven to a safe place and stopped at the safe place (see time T12). This completes the evacuation travel control.

[0062] When the evacuation traveling control is initiated, the backup power source 20 supplies power to the second traveling load 103 and the second general load 104, and the SOC of the backup power source 20 gradually decreases. In the example of FIG. 6, at time T12 when the evacuation traveling control is completed, the SOC of the backup power source 20 is higher than the threshold value. The threshold value is set in advance to the lower limit of the SOC at which the controller 3 can operate the door lock unit via the door control device 70 and execute door lock control. The threshold value is not limited to this lower limit value and can be set to another value, for example, a value higher than the lower limit value.

[0063] When the evacuation travel control is completed (see time T12), the SOC of the backup power supply 20 is higher than the threshold value, so the controller 3 can execute door lock control depending on the conditions inside and outside the vehicle compartment.

[0064] 7, the SOC of backup power supply 20 may fall below the threshold value at time T23 when the evacuation traveling control is completed. In such a case, as shown by the imaginary line, controller 3 cannot execute door lock control because the SOC of backup power supply 20 is insufficient at time T23 when the evacuation traveling control is completed. Therefore, in the controller 3 according to this embodiment, after evacuation traveling control is started at time T21, if the SOC of backup power supply 20 falls below the threshold value before the evacuation traveling control is completed (see time T22), door lock control is executed.

[0065] In the above, an example is given in which the main power supply 10 fails, the backup power supply 20 is a normal power supply, and evacuation travel control is performed by the backup power supply 20, but the present invention is not limited to this. In other words, the above explanation also applies to a case in which the backup power supply 20 fails, the main power supply 10 is a normal power supply, and evacuation travel control is performed by the main power supply 10. In this case, the SOC in Figures 6 and 7 means the SOC of the main power supply 10.

[0066] In this way, the controller 3 according to this embodiment is configured to execute door lock control if the remaining charge of the normal power source falls below a threshold before the evacuation travel control is completed. This makes it possible to execute door lock control before the remaining charge of the normal power source runs out, even if the remaining charge of the normal power source runs out before the evacuation travel control is completed. Therefore, the controller 3 can reliably execute door lock control when executing the evacuation travel control.

[0067] [4. Processing performed by the controller of the power supply control device] Next, a process executed by the controller 3 of the power supply control device 1 according to the embodiment will be described with reference to Fig. 8 and Fig. 9. Fig. 8 and Fig. 9 are flowcharts showing an example of a process executed by the controller 3 of the power supply control device 1 according to the embodiment.

[0068] When the vehicle is started, the controller 3 turns on the inter-system switch 41 and turns off the battery switch 42, and then executes the process shown in Fig. 8. As shown in Fig. 8, the controller 3 provisionally determines whether a power supply failure has occurred (step S101). In other words, the controller 3 provisionally determines whether a failure has occurred in the power supply system.

[0069] The controller 3 provisionally determines that a failure has occurred in the power supply system when the second system voltage V2 is equal to or lower than the ground fault threshold, and determines that no failure has occurred in the power supply system when the second system voltage V2 is higher than the ground fault threshold.

[0070] If the controller 3 determines that a power supply failure has not occurred (step S101, No), it ends the process and restarts the process from step S101. If the controller 3 provisionally determines that a power supply failure has occurred (step S101, Yes), it turns off the inter-system switch 41 and turns on the battery switch 42 (step S102).

[0071] Thereafter, the controller 3 performs a final determination of a power supply failure (step S103). Specifically, after the provisional determination, if the first system voltage V1 is equal to or lower than the ground fault threshold for a predetermined time or longer and the second system voltage V2 exceeds the normal threshold for a predetermined time or longer, the controller 3 performs a final determination of a failure in the main power supply 10. In other words, the controller 3 performs a final determination of a failure in the first system 110, which is the power supply system of the main power supply 10.

[0072] If, after the provisional determination, the second system voltage V2 is equal to or lower than the ground fault threshold for a predetermined time or longer and the first system voltage V1 exceeds the normal threshold for a predetermined time or longer, the controller 3 makes a final determination that there is a failure in the backup power supply 20. In other words, the controller 3 makes a final determination that there is a failure in the second system 120, which is the power supply system of the backup power supply 20.

[0073] Furthermore, if the first system voltage V1 and the second system voltage V2 exceed the normal threshold for a predetermined time or longer after the provisional determination, the controller 3 determines that the provisional determination result is incorrect. In other words, the controller 3 officially determines that no power supply failure has occurred.

[0074] The controller 3 determines whether or not the result of this determination is a failure of the main power supply 10 (step S104). If the result of this determination is a failure of the main power supply 10 (step S104, Yes), the controller 3 starts FOP using the backup power supply 20 while keeping the inter-system switch 41 off and the battery switch 42 on (step S105), and proceeds to step S110. In step S105, the controller 3 notifies the automatic driving control device 60 that FOP using the backup power supply 20 has started, and the automatic driving control device 60 starts evacuation travel control using the backup power supply 20.

[0075] If the result of this determination is not a failure of the main power supply 10 (No in step S104), the controller 3 determines whether the result of this determination is a failure of the backup power supply 20 (step S106).

[0076] If the result of this determination is a failure of the backup power supply 20 (step S106, Yes), the controller 3 keeps the inter-system switch 41 off and turns off the battery switch 42 (step S107). Next, the controller 3 starts FOP using the main power supply 10 (step S108) and proceeds to step S115. In step S108, the controller 3 notifies the automatic driving control device 60 that FOP using the main power supply 10 has started, and the automatic driving control device 60 starts evacuation travel control using the main power supply 10.

[0077] Furthermore, if the result of this determination is that neither the main power supply 10 nor the backup power supply 20 has failed (step S106, No), the controller 3 turns off the battery switch 42 and turns on the inter-system switch 41 (step S109). In other words, if the controller 3 determines that there has been no power supply failure, it turns off the battery switch 42 and turns on the inter-system switch 41. This returns the battery switch 42 and the inter-system switch 41 to their original normal states. Then, the controller 3 ends the processing and starts the processing again from step S101.

[0078] When the evacuation travel control is started, the controller 3 determines whether the SOC of the normal power source (here, the remaining charge of the backup power source 20) is equal to or less than a threshold value (step S110). In other words, the controller 3 determines whether the SOC of the backup power source 20 has decreased due to the evacuation travel control or the like and has become equal to or less than a threshold value indicating the lower limit at which the door lock control can be executed.

[0079] If the controller 3 determines that the remaining charge of the backup power supply 20 is not equal to or less than the threshold (step S110, No), it skips the processing of steps S111 to S114, which will be described later. On the other hand, if the controller 3 determines that the remaining charge of the backup power supply 20 is equal to or less than the threshold (step S110, Yes), it determines whether or not at least one of the conditions inside and outside the vehicle indicates an emergency (step S111). For example, if a fire detection signal is input from a fire sensor, which is an emergency sensor, the controller 3 determines that a vehicle fire, which is an emergency, has occurred. Also, if a submergence detection signal is input from a submergence sensor, which is an emergency sensor, the controller 3 determines that a vehicle submergence, which is an emergency, has occurred.

[0080] When it is determined that an emergency situation has occurred (step S111, Yes), the controller 3 outputs an unlock instruction to unlock all the doors of the vehicle to the door control device 70 (step S112). As a result, the door control device 70 unlocks all the doors of the vehicle. In this way, the controller 3 unlocks all the doors of the vehicle when the remaining charge of the normal power source falls below the threshold before the evacuation travel control is completed and an emergency situation has occurred.

[0081] On the other hand, if it is determined that an emergency situation does not occur (step S111, No), the controller 3 executes a process of determining candidate doors to be locked (step S113). The candidate doors to be locked are doors that are candidates to be locked among the multiple doors in the vehicle.

[0082] Here, the process of determining a candidate locking door will be described with reference to Fig. 9. Fig. 9 is a flowchart showing an example of the process of determining a candidate locking door.

[0083] As shown in FIG. 9, the controller 3 determines whether the situation outside the vehicle cabin indicates that another vehicle is approaching (step S201). Specifically, the controller 3 detects whether or not there is another vehicle in the vicinity of the vehicle. More specifically, the controller 3 acquires an image of the exterior of the vehicle from an exterior camera. The controller 3 analyzes the acquired image of the exterior of the vehicle using any image analysis method, detects whether or not there is another vehicle in the vicinity from the analysis result, and if another vehicle is detected, determines whether or not the other vehicle is approaching the vehicle. Note that the other vehicle here includes a leading vehicle traveling in front of the vehicle and a trailing vehicle traveling behind the vehicle, but is not limited thereto and may include only one of the leading vehicle and the trailing vehicle.

[0084] When it is determined that another vehicle is approaching (step S201, Yes), the controller 3 determines the door on the left or right side of the vehicle that is on the side where the other vehicle is approaching as a candidate door to be locked (step S202). Specifically, when another vehicle is approaching from the rear right side or front right side of the vehicle, the controller 3 determines the right door of the vehicle as a candidate door to be locked. Furthermore, when another vehicle is approaching from the rear left side or front left side of the vehicle, the controller 3 determines the left door of the vehicle as a candidate door to be locked.

[0085] Although the above example illustrates the case where the door on the side where another vehicle is approaching is determined as a candidate door to be locked, the present invention is not limited thereto. That is, when it is determined that another vehicle is approaching, the controller 3 may determine all of the vehicle's doors as candidate doors to be locked. Furthermore, in the present embodiment, the process of determining candidate doors to be locked is performed in a situation where the SOC of the backup power source 20 falls below a threshold before the completion of the evacuation travel control and in a situation where the evacuation travel control is completed. However, the candidate doors to be locked may be different depending on the situation. For example, when the SOC of the backup power source 20 falls below a threshold before the completion of the evacuation travel control, the controller 3 determines the door on the side where another vehicle is approaching as a candidate door to be locked. However, this is not limited thereto, and all of the doors may be determined as candidate doors to be locked. Furthermore, when the evacuation travel control is completed, the controller 3 determines all of the doors as candidate doors to be locked. However, this is not limited thereto, and the controller 3 may determine the door on the side where another vehicle is approaching as a candidate door to be locked.

[0086] If it is determined that no other vehicle is approaching (No at step S201), the controller 3 skips the process at step S202.

[0087] Next, the controller 3 determines whether or not the situation inside the vehicle cabin is one in which an occupant is seated (step S203). Note that the occupant here is a child, but is not limited to this and may include an adult. Specifically, the controller 3 detects the presence or absence of an occupant in the vehicle cabin. More specifically, the controller 3 acquires an interior video from an in-vehicle camera. The controller 3 analyzes the acquired interior video using any video analysis method and detects the presence or absence of an occupant from the analysis result. If the detected occupant's face position, face size, etc. have child-like characteristics from the analysis result, the controller 3 determines that an occupant (child) is seated. Note that the controller 3 may also detect the presence or absence of an occupant using a seating sensor provided in the seat. That is, the controller 3 may determine that an occupant is seated when a signal indicating that an occupant is seated is output from the seating sensor.

[0088] When it is determined that an occupant is seated (step S203, Yes), the controller 3 determines the door where the occupant is seated among the multiple doors of the vehicle as a candidate door to be locked (step S204). Specifically, when an occupant (e.g., a child) is seated on the right side of the rear seat of the vehicle, the controller 3 determines the door on the right side of the rear seat as a candidate door to be locked.

[0089] Although the above example illustrates an example in which a door where an occupant is seated is determined as a candidate door to be locked, the present invention is not limited thereto. That is, when it is determined that an occupant is seated, the controller 3 may determine all of the vehicle's doors as candidate doors to be locked. Furthermore, as an example, in a situation in which the SOC of the backup power supply 20 becomes equal to or lower than a threshold before the completion of the evacuation travel control, the controller 3 determines at least the door where an occupant is seated as a candidate door to be locked. However, this is not limited thereto, and all of the doors may be candidate doors to be locked. Furthermore, in a situation in which the evacuation travel control is completed, the controller 3 determines the door where an occupant is seated as a candidate door to be locked. However, this is not limited thereto, and all of the doors may be candidate doors to be locked. Although the above example illustrates an example in which a candidate door to be locked is determined based on whether an occupant is seated. However, this is not limited thereto, and the controller 3 may determine, for example, a door (seat) where a pet such as a dog or a cat is present in addition to or instead of the occupant as a candidate door to be locked.

[0090] If it is determined that no passenger is seated (No at step S203), the controller 3 skips the process at step S204.

[0091] Next, the controller 3 determines whether the situation outside the vehicle cabin is an expressway (step S205). Specifically, when the travel route information acquired from the navigation device 80 includes information indicating that the road type of the travel route on which the vehicle is traveling is an expressway, the controller 3 determines that the situation outside the vehicle cabin is an expressway.

[0092] When it is determined that the situation outside the vehicle cabin is an expressway (step S205, Yes), the controller 3 determines the door on the lane side of the vehicle's left and right doors as a candidate door to be locked (step S206). Specifically, when there is a lane on the right side of the vehicle where other vehicles can travel, the controller 3 determines the door on the right side of the vehicle, which is on the lane side, as a candidate door to be locked. Furthermore, when there is a lane on the left side of the vehicle where other vehicles can travel, the controller 3 determines the door on the left side of the vehicle, which is on the lane side, as a candidate door to be locked.

[0093] Although the above example illustrates the case where the lane-side door is determined as a candidate door to be locked, the present invention is not limited thereto. That is, when it is determined that the situation outside the vehicle cabin is an expressway, the controller 3 may determine all of the vehicle's doors as candidate doors to be locked. Furthermore, as an example, in a situation where the SOC of the backup power supply 20 becomes equal to or lower than a threshold before the completion of the evacuation travel control, the controller 3 determines at least the lane-side door as a candidate door to be locked. However, this is not a limitation, and all of the doors may be candidate doors to be locked. Furthermore, in a situation where the evacuation travel control has been completed, the controller 3 determines the lane-side door as a candidate door to be locked. However, this is not a limitation, and all of the doors may be candidate doors to be locked.

[0094] If it is determined that the situation outside the vehicle is not an expressway (No at step S205), the controller 3 skips the process at step S206.

[0095] Next, the controller 3 determines whether the situation outside the vehicle cabin is a slope (step S207). Specifically, if the road information acquired from the navigation device 80 includes information indicating that the road shape of the road on which the vehicle is traveling is a slope, the controller 3 determines that the situation outside the vehicle cabin is a slope. A slope is a road that slopes in the longitudinal direction of the vehicle (i.e., a hill). The slope here refers to a relatively steep slope (steep slope) with an inclination angle in the longitudinal direction of the vehicle equal to or greater than a preset inclination angle threshold, but is not limited to this. Note that the controller 3 may also determine whether the situation outside the vehicle cabin is a slope based on the output of an inclination sensor that detects the inclination of the vehicle.

[0096] If the controller 3 determines that the situation outside the vehicle cabin is a slope (step S207, Yes), it determines all of the vehicle doors as locking door candidates (step S208). Note that, although the above example shows that all of the vehicle doors are determined as locking door candidates, the present invention is not limited to this. That is, if the controller 3 determines that the situation outside the vehicle cabin is a slope, it may determine some of the vehicle doors as locking door candidates. If the controller 3 determines that the situation outside the vehicle cabin is not a slope (step S207, No), it skips the processing of step S208.

[0097] Next, the controller 3 determines whether the situation inside the vehicle cabin is such that no occupants are in the vehicle and that luggage is loaded (step S209). In other words, the controller 3 determines whether the vehicle is a vehicle that transports luggage in an unmanned driving state. If the controller 3 determines that the situation inside the vehicle cabin is such that no occupants are in the vehicle and that luggage is loaded (step S209, Yes), it determines all the doors of the vehicle as candidates for doors to be locked (step S210). If the controller 3 determines that the situation inside the vehicle cabin is not such that no occupants are in the vehicle and that luggage is loaded (step S209, No), it skips the processing of step S210.

[0098] Returning to the explanation of Fig. 8, the controller 3 outputs a locking instruction for the candidate door to be locked determined by the processing of step S113 to the door control device 70 (step S114). As a result, the door control device 70 locks the door corresponding to the locking instruction. In this way, the controller 3 executes door lock control if the remaining charge of the normal power source falls below the threshold before the evacuation travel control is completed.

[0099] Next, the controller 3 determines whether the evacuation traveling control has been completed (step S115). The controller 3 acquires information from the automatic driving control device 60 that the evacuation traveling control has been completed.

[0100] If the controller 3 determines that the evacuation traveling control has not been completed (step S115, No), the controller 3 returns to the processing of step S110. If the controller 3 determines that the evacuation traveling control has been completed (step S115, Yes), the controller 3 determines whether at least one of the situation inside the vehicle compartment and the situation outside the vehicle compartment indicates an emergency situation (step S116). If the controller 3 determines that an emergency situation has occurred (step S116, Yes), the controller 3 outputs an unlock instruction to unlock all the doors of the vehicle to the door control device 70 (step S117). As a result, the door control device 70 unlocks all the doors of the vehicle. In this way, the controller 3 unlocks all the doors of the vehicle when an emergency situation has occurred after the evacuation traveling control has been completed.

[0101] On the other hand, if it is determined that an emergency situation does not occur (step S116, No), the controller 3 executes a process to determine candidate lock doors (step S118). The process of step S118 has been described in the description of the process of step S113, and therefore will not be described here.

[0102] The controller 3 outputs a locking instruction for the candidate door to be locked determined by the processing of step S118 to the door control device 70 (step S119). As a result, the door control device 70 locks the door corresponding to the locking instruction. In this way, after the evacuation traveling control is completed, the controller 3 executes door lock control in accordance with at least one of the conditions inside and outside the vehicle cabin.

[0103] In the above example, the process proceeds to step S115 after starting FOP using the main power supply 10 in step S108. This is because PbB11 of the main power supply 10 is charged with power generated by the generator 12 even during execution of evacuation travel control, and the SOC of PbB11 is unlikely to fall below the threshold, so steps S110 to S114 are skipped. However, this is not limiting, and as indicated by the dashed arrow in FIG. 8, the controller 3 may execute the process from step S110 onwards after starting FOP using the main power supply 10 in step S108. In this case, the process in step S110 determines whether the SOC of a normal power supply (here, the remaining charge of the main power supply 10 (PbB11)) is below the threshold.

[0104] Furthermore, if the SOC becomes equal to or lower than the threshold value during evacuation driving and no emergency has occurred, the controller 3 determines which doors to lock in accordance with the conditions inside and outside the vehicle in step S113. However, in step S113, all doors may be set as candidate doors to lock without considering the conditions inside and outside the vehicle. This is because even if candidate doors to lock are determined during evacuation driving, the conditions may change when the evacuation driving is completed.

[0105] [5. Processing performed by the controller of the automated driving device] Next, processing executed by the controller 61 of the automatic driving control device 60 according to the embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of processing executed by the controller 61 of the automatic driving control device 60 according to the embodiment. Fig. 10 shows evacuation travel processing executed by the controller 61 of the automatic driving control device 60 according to the embodiment.

[0106] When the controller 61 is notified by the power supply control device 1 that the power supply has failed and the FOP has started, the controller 61 starts evacuation travel control by automatic driving (step S301). Next, the controller 61 uses map information and GPS to determine whether the vehicle has stopped in a safe place (step S302). If the controller 61 determines that the vehicle has not stopped in a safe place (step S302, No), it repeats the processing of step S302.

[0107] On the other hand, if the controller 61 determines that the vehicle has stopped in a safe place (step S302, Yes), it notifies the controller 3 of the power supply control device 1 that the evacuation driving control has been completed, and ends the evacuation driving control (step S303).

[0108] As described above, the power supply control device (an example of a control device) 1 according to the embodiment includes a controller 3 that controls the vehicle's evacuation travel using the other normal power source when either the main power source 10 or the backup power source 20 fails. When the evacuation travel control is completed, the controller 3 executes door lock control, including locking and unlocking the vehicle doors, depending on at least one of the conditions inside and outside the vehicle. If the remaining charge of the normal power source falls below a threshold before the evacuation travel control is completed, the controller 3 executes door lock control.

[0109] In this way, the controller 3 executes door lock control if the remaining charge of the normal power source falls below the threshold before the evacuation travel control is completed. This makes it possible to execute door lock control before the remaining charge of the normal power source runs out if the remaining charge of the normal power source is about to run out before the evacuation travel control is completed. Therefore, the controller 3 can reliably execute door lock control when performing evacuation travel control.

[0110] Furthermore, after the completion of the evacuation travel control, if the situation outside the vehicle cabin indicates that another vehicle is approaching, the controller 3 locks one of the left and right doors of the vehicle on the side where the other vehicle is approaching. If the remaining charge of the normal power source falls below a threshold before the completion of the evacuation travel control, the controller 3 locks all doors of the vehicle. This ensures that the door on the side where the other vehicle is approaching is locked when the evacuation travel control is performed. Locking the doors in this way prevents occupants, including the driver, from panicking and carelessly getting out of the vehicle, thereby ensuring the safety of the occupants.

[0111] Furthermore, after the completion of the evacuation travel control, if the situation inside the vehicle cabin is one in which an occupant is seated, the controller 3 locks the door where the occupant is seated among the multiple doors of the vehicle. If the remaining charge of the normal power source falls below a threshold before the completion of the evacuation travel control, the controller 3 locks at least the door where the occupant is seated. This ensures that the door where the occupant is seated is locked when the evacuation travel control is performed. Locking the door in this way prevents the occupant from panicking and getting out of the vehicle, ensuring the safety of the occupants.

[0112] In addition, since the occupant is a child, the door where the child is seated can be reliably locked when the evacuation driving control is performed. By locking the door in this manner, the child is prevented from panicking and getting out of the vehicle, ensuring the safety of the child.

[0113] After the evacuation driving control is completed, if the situation outside the vehicle cabin is on a highway, the controller 3 locks the door on the highway lane side out of the left and right doors of the vehicle. If the remaining charge of the normal power source falls below a threshold before the evacuation driving control is completed, the controller 3 locks at least the door on the lane side. This ensures that the door on the highway lane side is locked when the evacuation driving control is performed. Locking the door in this way prevents occupants from panicking and getting out of the vehicle, ensuring the safety of the occupants.

[0114] Furthermore, after the completion of the evacuation travel control, if the situation outside the vehicle cabin is a slope, the controller 3 locks all of the vehicle's doors. If the remaining charge of the normal power source falls below a threshold before the completion of the evacuation travel control, the controller 3 locks all of the vehicle's doors. If the road is a slope, there is a risk that the occupant may fall if they step onto the slope. However, with the above configuration, all of the doors can be reliably locked when the evacuation travel control is performed. Locking the doors in this way makes it possible to prevent the occupant from stepping onto the slope and preventing the occupant from falling.

[0115] Furthermore, after the completion of the evacuation travel control, if the situation inside the vehicle is such that no occupants are in the vehicle and luggage is loaded, the controller 3 locks all of the vehicle doors. If the remaining charge of the normal power source falls below a threshold before the completion of the evacuation travel control, the controller 3 locks all of the vehicle doors. As a result, even if a vehicle transporting luggage in an unmanned state is stopped due to the completion of the evacuation travel control, all of the doors are securely locked, making it possible to prevent theft of luggage and the like.

[0116] Furthermore, after the completion of the evacuation travel control, if at least one of the conditions inside and outside the vehicle indicates an emergency, the controller 3 unlocks all of the vehicle doors. If the remaining charge of the normal power source falls below a threshold before the completion of the evacuation travel control, and if an emergency occurs inside or outside the vehicle, the controller 3 unlocks all of the vehicle doors. This ensures that all doors are unlocked when the evacuation travel control is performed. Unlocking the doors in this way allows occupants to exit the vehicle quickly, thereby ensuring the safety of the occupants.

[0117] In the above description, the controller 3 outputs locking and unlocking instructions to the door control device 70 to execute door lock control, but the present invention is not limited to this. For example, some or all of the functions of the controller 3 may be implemented in the controller 71 of the door control device 70. Specifically, when the evacuation travel control is completed, the controller 71 executes door lock control, including locking and unlocking the vehicle doors, in accordance with at least one of the conditions inside and outside the vehicle. In addition, the controller 71 acquires information on the remaining charge of the normal power source from the controller 3, and executes door lock control if the remaining charge of the normal power source falls below a threshold before the evacuation travel control is completed.

[0118] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0119] 1 Power supply control device 3 Controller 10 Main power supply 20 Backup power supply 60 Automatic driving control device 70 Door control device

Claims

1. A control device including a controller that controls a vehicle to evacuate using a normal power source when one of a main power source and a backup power source fails, The controller When the evacuation travel control is completed, a door lock control including locking and unlocking of the doors of the vehicle is executed in accordance with at least one of a situation inside the vehicle cabin and a situation outside the vehicle cabin; If the remaining charge of the normal power source becomes equal to or less than a threshold before the evacuation travel control is completed, the door lock control is executed. Control device.

2. The controller After the completion of the evacuation travel control, if the situation outside the vehicle compartment is a situation in which another vehicle is approaching, locking one of the left and right doors of the vehicle that is on the side where the other vehicle is approaching, If the remaining charge of the normal power source becomes equal to or less than the threshold before the evacuation travel control is completed, all doors of the vehicle are locked. The control device according to claim 1 .

3. The controller After the completion of the evacuation travel control, if the situation in the vehicle compartment is a situation in which an occupant is seated, locking the door in which the occupant is seated among a plurality of doors of the vehicle, If the remaining charge of the normal power source becomes equal to or less than the threshold before the evacuation travel control is completed, at least the door where the occupant is seated is locked. The control device according to claim 1 .

4. the occupant is a child; The control device according to claim 3 .

5. The controller After the completion of the evacuation travel control, if the situation outside the vehicle cabin is an expressway, locking one of the left and right doors of the vehicle that is on the lane side of the expressway, If the remaining charge of the normal power source becomes equal to or less than the threshold before the evacuation travel control is completed, at least the door on the lane side is locked. The control device according to claim 1 .

6. The controller After the completion of the evacuation travel control, if the situation outside the vehicle cabin is a slope, lock all doors of the vehicle; If the remaining charge of the normal power source becomes equal to or less than the threshold before the evacuation travel control is completed, all doors of the vehicle are locked. The control device according to claim 1 .

7. The controller After the completion of the evacuation travel control, if the situation inside the vehicle compartment is a situation where no occupants are in the vehicle and luggage is loaded, lock all doors of the vehicle, If the remaining charge of the normal power source becomes equal to or less than the threshold before the evacuation travel control is completed, all doors of the vehicle are locked. The control device according to claim 1 .

8. The controller After the completion of the evacuation travel control, if at least one of the situation inside the vehicle compartment and the situation outside the vehicle compartment indicates that an emergency has occurred, unlock all doors of the vehicle, If the remaining charge of the normal power source becomes equal to or less than the threshold value before the evacuation travel control is completed, and an emergency situation occurs inside or outside the vehicle, unlock all doors of the vehicle. The control device according to claim 1 .

9. When one of the main power supply and the backup power supply fails, the other normal power supply controls the vehicle's evacuation driving; When the evacuation travel control is completed, a door lock control including locking and unlocking of the doors of the vehicle is executed in accordance with at least one of a situation inside the vehicle cabin and a situation outside the vehicle cabin; When the remaining charge of the normal power source becomes equal to or less than a threshold before the evacuation travel control is completed, the door lock control is executed. A control program that causes a computer to execute the above.

Images