In-vehicle system and power supply control method

Abstract

To suppress restriction or stop of a function executed by an on-vehicle apparatus.SOLUTION: An on-vehicle system mounted on a vehicle includes a first on-vehicle device and a second on-vehicle device that control a switch for switching power supply to a specific on-vehicle device in the vehicle, in which the first on-vehicle device outputs a first on control signal that is a control signal for turning on the switch to the switch, the second on-vehicle device outputs a second on control signal that is a control signal for turning on the switch to the switch, and the switch is turned on under an OR condition of the first on control signal and the second on control signal.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle system and a power supply control method. [Background technology]

[0002] Conventionally, technologies for controlling a switch that switches on and off the supply of power to an in-vehicle device have been developed. For example, Patent Document 1 (JP 2011-195101 A) discloses the following control device. That is, the control device is connected to a relay switch to which one or more loads are connected, and receives as input an instruction signal instructing the load to be turned on or off and a status signal corresponding to the status of the load. The control device controls the relay switch based on the input signals and includes a plurality of control units that output control signals for controlling the on / off of the relay switch. The instruction signal and status signal, a forced-off signal instructing the relay switch to be forcibly turned off, and a signal indicating the on / off status of the relay switch are input to one of the plurality of control units, and some or all of the signals input to the one control unit and the control signal output by the one control unit are input to the other control units. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-195101 Summary of the Invention [Problem to be solved by the invention]

[0004] For example, if an abnormality occurs in the device that controls the switch, the power supply to the in-vehicle device may be stopped, which may limit or stop the functions performed by the in-vehicle device.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle system and a power supply control method that can suppress the restriction or suspension of functions executed by in-vehicle equipment. [Means for solving the problem]

[0006] The in-vehicle system of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a first in-vehicle device and a second in-vehicle device that control a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, wherein the first in-vehicle device outputs a first on control signal to the switch for turning on the switch, and the second in-vehicle device outputs a second on control signal to the switch for turning on the switch, and the switch turns on under an OR condition of the first on control signal and the second on control signal.

[0007] One aspect of the present disclosure can be realized not only as an in-vehicle system equipped with such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the in-vehicle system. [Effects of the Invention]

[0008] According to the present disclosure, it is possible to suppress the restriction or suspension of functions executed by in-vehicle devices. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of an in-vehicle system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating in detail a partial configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining the on-control of each switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 5] FIG. 5 is a diagram illustrating an example of the configuration of a management device according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram for explaining the on-control of each switch by the management device according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram illustrating the control of turning off the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 9] FIG. 9 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 10] FIG. 10 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 11] FIG. 11 is a flowchart defining another example of the operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 12] FIG. 12 is a flowchart illustrating an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch. [Figure 13] FIG. 13 is a flowchart defining an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch. [Figure 14] FIG. 14 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 15] FIG. 15 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 16] FIG. 16 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 17]FIG. 17 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a first in-vehicle device and a second in-vehicle device that control a switch that switches on or off the supply of power to a specific in-vehicle device in the vehicle, wherein the first in-vehicle device outputs a first on control signal to the switch for turning on the switch, and the second in-vehicle device outputs a second on control signal to the switch for turning on the switch, and the switch is turned on under an OR condition of the first on control signal and the second on control signal.

[0011] With this configuration, even if an abnormality occurs in one of the first and second in-vehicle devices that control the switch, the switch can be turned on by a control signal output from the other device. In other words, the control for turning on the switch is made redundant, reducing the possibility of power supply to a specific in-vehicle device being stopped. Therefore, it is possible to prevent the restriction or stop of functions executed by the in-vehicle devices.

[0012] (2) In (1) above, the first in-vehicle device may output a first off control signal to the switch to turn off the switch, and the second in-vehicle device may output a second off control signal to the switch to turn off the switch, and the first off condition, which is the condition under which the first in-vehicle device outputs the first off control signal, may be different from the second off condition, which is the condition under which the second in-vehicle device outputs the second off control signal.

[0013] With this configuration, even if one of the first and second in-vehicle devices mistakenly determines that the conditions for turning off the switch have been met, the switch can continue to be turned on by the control signal output from the other device.Therefore, by making the control for turning on the switch redundant, the possibility of power supply to a specific in-vehicle device being stopped can be reduced.

[0014] (3) In the above (2), the first off condition may include a condition regarding the state of the specific in-vehicle device, and the second off condition may not include a condition regarding the state of the specific in-vehicle device.

[0015] With this configuration, for example, when a failure occurs in a particular in-vehicle device, it is possible to prevent both the first in-vehicle device and the second in-vehicle device from erroneously outputting an OFF control signal to the switch.

[0016] (4) In the above (3), the specific in-vehicle device may be an in-vehicle device that executes a function related to the running of the vehicle.

[0017] With this configuration, when a certain in-vehicle device is performing a function related to the vehicle's operation, it is possible to prevent the switch from being turned off by an off control signal output from both the first in-vehicle device and the second in-vehicle device, thereby preventing the power supply to the in-vehicle device from being stopped.

[0018] (5) In any of (1) to (4) above, the first on condition, which is the condition under which the first in-vehicle device outputs the first on control signal, may be different from the second on condition, which is the condition under which the second in-vehicle device outputs the second on control signal.

[0019] With this configuration, a control signal for turning on the switch can be output under a wider variety of conditions, so that the switch can be turned on more reliably.

[0020] (6) In any of (1) to (5) above, the in-vehicle system may further include a third in-vehicle device that controls a parking brake of the vehicle, and the third in-vehicle device may transition the parking brake from an on state to an off state when the first in-vehicle device outputs the first on control signal, the second in-vehicle device outputs the second on control signal, and a predetermined operation is performed in the vehicle.

[0021] With this configuration, when the vehicle's parking brake is transitioned from the on state to the off state, i.e., when the vehicle starts moving, the first on control signal or the second on control signal can be used to complete the transition of the switch to the on state.Therefore, by making the control for turning on the switch redundant, it is possible to reduce the possibility of power supply to specific on-board equipment, such as on-board equipment that performs necessary functions, being stopped while the vehicle is moving.

[0022] (7) In any of (1) to (6) above, the specific vehicle equipment may be a driving-related device that is a vehicle equipment that executes a function related to the driving of the vehicle, and the driving-related device may start executing the function when the vehicle is in a state where it can start driving and the state of the switch is in an on state by the first on control signal or the second on control signal.

[0023] With this configuration, functions of driving-related equipment such as on-board equipment that controls the vehicle's steering and on-board equipment that controls the vehicle's brakes can be executed before the parking brake is released, thereby preventing delays in the start of execution of these functions.

[0024] (8) In (7) above, the vehicle may be provided with a plurality of the driving-related devices, and some of the driving-related devices may start executing the function when the vehicle is in a state where it can start driving, the switch is in an on state by the first on control signal or the second on control signal, and the parking brake of the vehicle is in an off state.

[0025] For example, in some driving-related devices, the conditions for executing a function of the driving-related device may further include that the parking brake be in an off state. With the above-described configuration, the function can be executed more reliably.

[0026] (9) In (7) or (8) above, the first in-vehicle device may transmit to the driving-related equipment a driving end notification indicating that the vehicle is in a state to end driving or a request notification to request that execution of the function be stopped before outputting a first off control signal to the switch to turn off the switch, and the driving-related equipment may perform pre-processing to stop execution of the function before the power supply to the driving-related equipment is stopped when the driving end notification or the request notification is received from the first in-vehicle device and the second in-vehicle device outputs a second off control signal to turn off the switch.

[0027] With this configuration, preparations for stopping execution of a function related to vehicle driving can be made at an appropriate timing, for example, when the vehicle is stopped or parked, etc. Furthermore, by setting the condition for the driving-related device to make such preparations as receiving a driving end notification or request notification from the first in-vehicle device and outputting a second off control signal from the second in-vehicle device, it is possible to prevent the driving-related device from erroneously making such preparations, for example, when an abnormality occurs in one of the first and second in-vehicle devices while the vehicle is driving.

[0028] (10) In the above (9), the first vehicle-mounted device may output the first off control signal to the switch when the second vehicle-mounted device outputs the second off control signal and the driving-related equipment has performed the pre-processing.

[0029] With this configuration, when preparations are complete to stop the execution of a function related to the vehicle's driving, the switch state can be transitioned to the off state, thereby preventing the power supply to the vehicle equipment that executes that function from being stopped at an unintended time.

[0030] (11) In the above (9) or (10), the first in-vehicle device may include an OR circuit that outputs a signal indicating the logical sum of the first off control signal and the second off control signal to the switch, the second in-vehicle device may transmit the second off control signal to the first in-vehicle device, the first in-vehicle device may, when receiving the second off control signal from the second in-vehicle device, transmit a reception notification to the second in-vehicle device indicating that the second off control signal has been received, the second in-vehicle device may, when receiving the reception notification from the first in-vehicle device, transmit a completion notification to the driving-related equipment indicating that transmission of the second off control signal has been completed, and the driving-related equipment may perform the pre-processing when receiving the request notification from the first in-vehicle device and the completion notification from the second in-vehicle device.

[0031] In this way, by setting the receipt of a request notification and a completion notification from the first in-vehicle device and the second in-vehicle device, respectively, as a condition for the driving-related device to prepare to stop executing a function, the control for making the preparation can be made redundant, and therefore, if an abnormality occurs in one of the first in-vehicle device and the second in-vehicle device while the vehicle is traveling, it can be more reliably prevented that the driving-related device will erroneously make the preparation. Furthermore, if the completion notification does not arrive from the second in-vehicle device, it can be determined that a failure, such as a break in the signal line for outputting an OFF control signal from the second in-vehicle device to the first in-vehicle device, has occurred.

[0032] (12) In any of (7) to (11) above, the in-vehicle system may further include a third in-vehicle device that is an in-vehicle device that controls a parking brake of the vehicle, and the first in-vehicle device may include an OR circuit that outputs a signal indicating the logical sum of the first on-control signal and the second on-control signal to the switch, and the first in-vehicle device may transmit to the second in-vehicle device and the third in-vehicle device a driving start notification indicating that the vehicle is in a state where it can start driving, or an equipment status notification indicating that the driving-related equipment is in operation, and when the second in-vehicle device receives the driving start notification or the equipment status notification from the first in-vehicle device, it may transmit the second on-control signal to the first in-vehicle device, and the first in-vehicle device When the second on-vehicle device receives the second on-control signal from the second on-vehicle device, it may transmit a reception notification to the second on-vehicle device indicating that the second on-control signal has been received; when the second on-vehicle device receives the reception notification from the first on-vehicle device, it may transmit an on-execution notification to the third on-vehicle device indicating that on-control of the switch will be executed using the second on-control signal; and when the parking brake is in an on-state, the third on-vehicle device may transition the parking brake from the on-state to the off-state when it receives the driving start notification or the equipment status notification from the first on-vehicle device and the on-execution notification from the second on-vehicle device and an operation to turn off the parking brake is performed in the vehicle.

[0033] In this way, by configuring the condition for transitioning the parking brake from an ON state to an OFF state by receiving a driving start notification or an equipment status notification from the first in-vehicle device, receiving an ON execution notification from the second in-vehicle device, and setting the operation of turning off the parking brake in the vehicle as a condition for transitioning the parking brake from an ON state to an OFF state, the OFF control of the parking brake can be made redundant, so that if an abnormality occurs in one of the first in-vehicle device or the second in-vehicle device, the device controlling the parking brake can be prevented from erroneously performing the OFF control. Furthermore, if the ON execution notification does not arrive from the second in-vehicle device, it can be determined that a failure, such as a break in the signal line for outputting the ON control signal from the second in-vehicle device to the first in-vehicle device, has occurred.

[0034] (13) A power supply control method according to an embodiment of the present disclosure is a power supply control method in an in-vehicle system mounted on a vehicle, the in-vehicle system including a first in-vehicle device and a second in-vehicle device, the first in-vehicle device being an in-vehicle device that controls a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, the first in-vehicle device outputting a first on control signal to the switch for turning on the switch, the second in-vehicle device outputting a second on control signal to the switch for turning on the switch, and the switch turning on under an OR condition of the first on control signal and the second on control signal.

[0035] With this method, even if an abnormality occurs in one of the first and second in-vehicle devices that control the switch, the switch can be turned on by a control signal output from the other device. In other words, the control for turning on the switch is made redundant, thereby reducing the possibility of power supply to a specific in-vehicle device being stopped. Therefore, it is possible to prevent the restriction or stop of functions executed by the in-vehicle devices.

[0036] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0037] [In-vehicle system] Fig. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to Fig. 1, the in-vehicle system 301 includes an in-vehicle relay device 101, an in-vehicle device group including a plurality of in-vehicle devices 201, and a power supply unit 51. The in-vehicle system 301 is mounted on a vehicle 1. The in-vehicle relay device 101 is an example of a first in-vehicle device.

[0038] The in-vehicle devices 201 include an in-vehicle ECU (Electronic Control Unit), an OTA (Over The Air) master, a sensor, an actuator, a motor, a navigation device, a human-machine interface, and a camera. The in-vehicle ECUs include an autonomous driving ECU, an engine ECU, a body ECU, a verification ECU, a steering ECU, a parking brake ECU, and a TCU (Telematics Communication Unit).

[0039] The in-vehicle relay device 101 and the plurality of in-vehicle devices 201 constitute an in-vehicle network 401. The plurality of in-vehicle devices 201 are connected to the in-vehicle relay device 101 via a CAN bus 2 that conforms to the CAN (Controller Area Network) standard, for example.

[0040] 1, the in-vehicle system 301 includes in-vehicle devices 201A, 201B, 201C, 201D, 201E, 201F, 201G, and 201H that are in-vehicle devices 201. In addition, in the example shown in FIG. 1, CAN buses 2A, 2B, 2C, and 2D are provided as the CAN bus 2.

[0041] The in-vehicle devices 201A and 201B are connected to the in-vehicle relay device 101 via a CAN bus 2A. The in-vehicle devices 201C and 201D are connected to the in-vehicle relay device 101 via a CAN bus 2B. The in-vehicle devices 201E and 201F are connected to the in-vehicle relay device 101 via a CAN bus 2C. The in-vehicle devices 201G and 201H are connected to the in-vehicle relay device 101 via a CAN bus 2D.

[0042] The vehicle-mounted relay device 101 performs a relay process for relaying frames transmitted and received between the vehicle-mounted devices 201 .

[0043] For example, each in-vehicle device 201 transmits a CAN frame including various information (described later) such as information for assisting the autonomous driving performed by the vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, to another in-vehicle device 201 or the in-vehicle repeater 101. The in-vehicle repeater 101 relays a CAN frame received from a certain in-vehicle device 201 to another in-vehicle device 201. The in-vehicle repeater 101 also creates a CAN frame including the above-mentioned various information and the CAN-ID, and transmits the created CAN frame to the destination in-vehicle device 201.

[0044] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 2 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 2 are provided.

[0045] In addition, the vehicle-mounted relay device 101 and the vehicle-mounted equipment 201 may be configured to communicate in accordance with communication protocols such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark), instead of or in addition to communication in accordance with the CAN standard.

[0046] The vehicle-mounted relay device 101 and each vehicle-mounted device 201 communicate with each other to provide various services to the vehicle 1.

[0047] Specifically, the in-vehicle network 401 performs services related to the driving of the vehicle 1, a service for updating various software used in the in-vehicle network 401 via OTA, a service for contactlessly charging the battery 71 installed in the vehicle 1, a service for detecting malfunctions in the vehicle 1, and a service for remotely operating the vehicle 1.

[0048] [Power supply section] The power supply unit 51 supplies power to the vehicle 1. The power supply unit 51 includes a first power supply 61 and a second power supply 62. When a service is being executed, both the first power supply 61 and the second power supply 62 supply power to each device in the in-vehicle system 301. When the execution of the service is stopped, the second power supply 62 supplies power to each device in the in-vehicle system 301.

[0049] The first power supply 61 is connected to the in-vehicle repeater 101 via a power supply line 3. The second power supply 62 is connected to the in-vehicle repeater 101 via a power supply line 4. Each in-vehicle device 201 is connected to the in-vehicle repeater 101 via a power supply line 5. The power supply line 3 and the power supply line 5 are connected within the in-vehicle repeater 101. The power supply line 4 and the power supply line 5 are connected within the in-vehicle repeater 101.

[0050] The power supply unit 51 is not limited to a configuration including two power supplies, that is, the first power supply 61 and the second power supply 62, but may be a configuration including one power supply.

[0051] 1, power lines 5A, 5B, 5C, and 5D are provided as the power line 5. The in-vehicle devices 201A and 201B are connected to the in-vehicle repeater 101 via the power line 5A. The in-vehicle devices 201C and 201D are connected to the in-vehicle repeater 101 via the power line 5B. The in-vehicle devices 201E and 201F are connected to the in-vehicle repeater 101 via the power line 5C. The in-vehicle devices 201G and 201H are connected to the in-vehicle repeater 101 via the power line 5D.

[0052] For example, the first power supply 61 includes a battery 71 and a DC / DC converter 72. The battery 71 is a high-voltage battery such as a lithium-ion battery. The DC / DC converter 72, for example, steps down a DC voltage Va of the battery 71 to generate a DC voltage Vb. The DC / DC converter 72 then outputs the DC voltage Vb to the power supply line 3.

[0053] The second power supply 62 includes, for example, a low-voltage battery having a lower voltage than the battery 71 of the first power supply 61 .

[0054] [Control switch] For example, the in-vehicle relay device 101 includes a control switch 91 that switches on / off the supply of power to a specific in-vehicle device 201 in the vehicle 1. The control switch 91 is, for example, a semiconductor switch. Note that, in FIG. 1, for ease of understanding, the control switch 91 is shown outside the in-vehicle relay device 101.

[0055] More specifically, for example, the control switch 91 switches on and off the supply of power to the in-vehicle devices 201 (hereinafter also referred to as "driving-related devices") that execute functions related to driving of the vehicle 1 (hereinafter also referred to as "driving-related functions"). Specifically, the driving-related devices include an EPS (Electric Power Steering) ECU, a steering ECU, an autonomous driving ECU, a foot brake ECU, an ABS (Anti-lock Braking System) ECU, and a parking brake ECU.

[0056] 1, a plurality of driving-related devices are provided in the vehicle 1. Specifically, the driving-related devices are in-vehicle devices 201F and 201H. The in-vehicle device 201F is a parking brake ECU, and the in-vehicle device 201H is an autonomous driving ECU.

[0057] Hereinafter, the in-vehicle device 201F and the in-vehicle device 201H will also be referred to as the parking brake ECU 201F and the autonomous driving ECU 201H, respectively. Here, an example will be described in which the control switch 91 switches between supplying and not supplying power to the autonomous driving ECU 201H. The parking brake ECU 201F is an example of a third in-vehicle device.

[0058] [Power switch] For example, the vehicle-mounted repeater 101 further includes a power switch 92. The power switch 92 is provided between the power supply unit 51 and the control switch 91. The power switch 92 is, for example, a semiconductor switch. Note that, in FIG. 1, for ease of understanding, the power switch 92 is shown outside the vehicle-mounted repeater 101.

[0059] In the example shown in FIG. 1, the vehicle-mounted relay device 101 includes the power switch 92, which is made up of power switches 92A and 92B.

[0060] The power switch 92A switches the connection state between the first power source 61 and the control switch 91. In this embodiment, for example, the power switch 92A is in the ON state when a service is being executed and is in the OFF state when the service is not being executed. The power switch 92B is always in the ON state.

[0061] [ON control signal] The in-vehicle relay device 101 outputs an ON control signal S11 for turning on the control switch 91 to the control switch 91. The in-vehicle device 201G outputs an ON control signal S21 for turning on the control switch 91 to the control switch 91 via the in-vehicle relay device 101. For example, each of the ON control signal S11 and the ON control signal S21 is a signal of a logical high level. The ON control signal S11 is an example of a first ON control signal, and the ON control signal S21 is an example of a second ON control signal.

[0062] In the following description, the in-vehicle device 201G is also referred to as a management device 201G. The management device 201G is, for example, a driving-related device. The management device 201G is an example of a second in-vehicle device.

[0063] Vehicle repeater 101 outputs an ON control signal S51 for turning on power switch 92A to power switch 92. Management device 201G outputs an ON control signal S61 for turning on power switch 92A to power switch 92A via vehicle repeater 101. For example, each of ON control signal S51 and ON control signal S61 is a logic high level signal.

[0064] Vehicle repeater 101 outputs an ON control signal S53 for turning on power switch 92B to power switch 92B. Management device 201G outputs an ON control signal S71 for turning on power switch 92B to power switch 92B via vehicle repeater 101. For example, each of ON control signal S53 and ON control signal S71 is a logic high level signal.

[0065] The power switch 92A is turned on under the OR condition of the ON control signal S51 and the ON control signal S61. The power switch 92B is turned on under the OR condition of the ON control signal S53 and the ON control signal S71. The ON control of each power switch 92 will be described in detail later.

[0066] Furthermore, the vehicle-mounted relay device 101 outputs a reset signal, which will be described later, to the management device 201G, and the management device 201G outputs the reset signal to the vehicle-mounted relay device 101.

[0067] For example, management device 201G is connected to in-vehicle relay device 101 via multiple signal lines 6. Hereinafter, each of the multiple signal lines 6 for transmitting various control signals output from management device 201G will also be referred to as signal line 6a. Also, each of the multiple signal lines 6 for transmitting a reset signal will also be referred to as signal line 6b. Note that management device 201G is not limited to a configuration in which it is connected to in-vehicle relay device 101 via multiple signal lines 6a, and it may also be configured in which it is connected to in-vehicle relay device 101 via a single signal line 6a.

[0068] 1, the in-vehicle devices 201A, 201B, 201C, and 201D are a body ECU, an occupant sensor, a buckle sensor, and a door opening / closing sensor, respectively. Hereinafter, the in-vehicle devices 201A, 201B, 201C, and 201D are also referred to as the body ECU 201A, the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D.

[0069] [Occupant sensor] For example, the occupant sensor 201B is a sensor that detects whether the driver is seated in the driver's seat of the vehicle 1 or whether the driver is leaving the driver's seat.

[0070] More specifically, for example, the occupant sensor 201B is a pressure sensor that measures the pressure P applied to the seat surface of the driver's seat. The occupant sensor 201B measures the pressure P, for example, periodically.

[0071] Then, the occupant sensor 201B detects whether or not a driver is seated in the driver's seat based on the measurement result of the pressure P, and performs a detection process D1 in which sensor information C1 indicating the detection result is transmitted to the body ECU 201A.

[0072] Specifically, for example, when the measurement value is equal to or greater than a predetermined threshold value Th1, the occupant sensor 201B transmits to the body ECU 201A sensor information C1 indicating that the driver is seated in the driver's seat, including the measurement time ta of the measurement value.

[0073] On the other hand, for example, when the measurement value is less than the threshold value Th1, the occupant sensor 201B transmits to the body ECU 201A sensor information C1 indicating that the driver has left the driver's seat, together with the measurement time ta of the measurement value.

[0074] The occupant sensor 201B is not limited to a pressure sensor, and may be a camera that takes an image of the driver's seat.

[0075] [Buckle sensor] The buckle sensor 201C is provided on the buckle of the driver's seat of the vehicle 1. The buckle sensor 201C periodically detects the state of the seat belt in the driver's seat and performs a detection process D2 in which sensor information C2 indicating the detection result and the detection time tb is transmitted to the body ECU 201A. For example, the buckle sensor 201C performs the detection process D2 at the same timing as the detection process D1 by the occupant sensor 201B.

[0076] Specifically, for example, when the tongue of the seat belt is engaged with the buckle, the buckle sensor 201C transmits, to the body ECU 201A, sensor information C2 indicating that the seat belt is in the locked state as a detection result.

[0077] On the other hand, for example, when the tongue of the seat belt is not engaged with the buckle, the buckle sensor 201C transmits sensor information C2 indicating that the state of the seat belt is unlocked as a detection result to the body ECU 201A.

[0078] [Door open / close sensor] The door opening / closing sensor 201D periodically detects the state of the door at the driver's seat, and performs a detection process D3 in which sensor information C3 indicating the detection result and the detection time tc is transmitted to the body ECU 201A. For example, the door opening / closing sensor 201D performs the detection process D3 at the same timing as the detection process D1 by the occupant sensor 201B.

[0079] [Body ECU] The body ECU 201A outputs control signals to drive body-related devices such as door lock mechanisms, wipers, and power windows. Specifically, for example, the body ECU 201A receives sensor information from each of the occupant sensor 201B, the buckle sensor 201C, and the door open / close sensor 201D, and outputs control signals based on the received sensor information to the body-related devices.

[0080] Furthermore, the body ECU 201A creates a CAN frame (hereinafter also referred to as "frame F") including the sensor information C1, sensor information C2, and sensor information C3 received from the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D, respectively.

[0081] As described above, the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D transmit the sensor information C1, the sensor information C2, and the sensor information C3, respectively, to the body ECU 201A, for example, periodically.

[0082] When the body ECU 201A receives sensor information C1, sensor information C2, and sensor information C3 from the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D, respectively, it stores the received sensor information C1, sensor information C2, and sensor information C3 in a memory unit not shown.

[0083] For example, when the processing timing Ta for creating a frame F arrives, the body ECU 201A acquires, from the storage unit, the sensor information C1, C2, and C3 accumulated during the period from the previous processing timing Ta to the current processing timing Ta, and creates a frame F including the acquired sensor information C1, C2, and C3. Then, the body ECU 201A transmits the created frame F to the in-vehicle relay device 101.

[0084] Furthermore, the body ECU 201A performs a switch monitoring process to monitor the state of the brake pedal switch or the engine switch. Then, the body ECU 201A transmits switch monitoring information indicating the monitoring results of the switch monitoring process to the in-vehicle relay device 101. The body ECU 201A performs the switch monitoring process and transmits the switch monitoring information, for example, periodically.

[0085] [Verification ECU] 1, the in-vehicle device 201E is a verification ECU, and will hereinafter also be referred to as the verification ECU 201E.

[0086] For example, the verification ECU 201E is connected to an electronic key sensor (not shown) that can measure radio waves output from the electronic key. The electronic key sensor transmits the measurement results and key information indicating identification information (hereinafter also referred to as "key ID") contained in the radio waves to the verification ECU 201E. The key ID is an ID unique to each electronic key.

[0087] The storage unit of the verification ECU 201E stores the key ID. When the verification ECU 201E receives key information from the electronic key sensor, if the measurement result indicated by the received key information satisfies a predetermined condition and the key ID indicated by the key information matches the key ID stored in the storage unit, the verification ECU 201E transmits key verification information to the in-vehicle relay device 101, indicating that the electronic key is present near the vehicle 1 and the key IDs match.

[0088] [Parking brake ECU] The parking brake ECU 201F controls, for example, the parking brake of the vehicle 1. When activated, the parking brake ECU 201F broadcasts parking brake information indicating the state of the parking brake to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0089] [In-vehicle relay device] FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle relay device 101 includes a relay unit 11, a processing unit 12, and a memory unit 13. The processing unit 12 includes a determination unit 21, a signal generation unit 22, a logic circuit unit 23, a notification unit 24, a monitoring unit 25, an abnormality processing unit 26, and a transition processing unit 27. One or both of the relay unit 11 and the processing unit 12 are realized, for example, by a processing circuit including one or more processors. The memory unit 13 is, for example, a non-volatile memory included in the processing circuit. The abnormality processing unit 26 is an example of a control unit, an example of a warning unit, and an example of a reset processing unit.

[0090] (Relay section) The relay unit 11 receives a CAN frame transmitted from a certain in-vehicle device 201. Then, the relay unit 11 checks whether the received CAN frame is a CAN frame that the in-vehicle relay device 101 of its own should receive.

[0091] The storage unit 13 stores, for example, a reception list L1 that indicates the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list L1 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0092] When the relay unit 11 receives a CAN frame, it refers to the reception list in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0093] For example, if the CAN-ID included in the received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0094] On the other hand, the relay unit 11 performs relay processing, for example, when the CAN-ID included in the received CAN frame is registered in the reception list L1 and the destination of the CAN frame is the in-vehicle device 201. Also, the relay unit 11 outputs the CAN frame to the processing unit 12, for example, when the CAN-ID included in the received CAN frame is registered in the reception list L1 and the destination of the CAN frame is its own in-vehicle relay device 101.

[0095] Specifically, for example, the storage unit 13 stores a routing table indicating the correspondence between the CAN-ID, the device to which the CAN frame is to be transmitted, and the CAN bus 2 to which the device to which the CAN frame is to be transmitted (hereinafter also referred to as the "destination bus"). The routing table is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0096] For example, if the CAN-ID contained in the CAN frame received from the in-vehicle device 201 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0097] When the relay unit 11 confirms that the destination device of the received CAN frame is the in-vehicle device 201, it refers to the routing table to identify the destination bus corresponding to the destination device, and then outputs the received CAN frame to the identified destination bus.

[0098] On the other hand, when the relay unit 11 confirms that the device to which the received CAN frame is to be transmitted is its own in-vehicle relay unit 101 , it outputs the CAN frame to the processing unit 12 .

[0099] (Judgment Department) For example, the determination unit 21 performs a determination process to determine the state of the vehicle 1. More specifically, for example, the determination unit 21 performs a determination process J1 to determine whether or not the vehicle 1 is in a state in which it can start traveling (hereinafter also referred to as a "traveling start state").

[0100] For example, when the verification of the electronic key by the verification ECU 201E is completed and the monitoring result indicated by the switch monitoring information B satisfies a predetermined condition, the determination unit 21 determines that the vehicle 1 is in a traveling start state.

[0101] More specifically, when the determination unit 21 receives key verification information from the verification ECU 201E via the relay unit 11, the determination unit 21 checks the monitoring results indicated by the switch monitoring information (hereinafter also referred to as "switch monitoring information B") received from the body ECU 201A via the relay unit 11 within a predetermined time period after receiving the key verification information. If the switch monitoring information B indicates that the brake switch or the engine switch is in the on state, the determination unit 21 determines that the vehicle 1 is in the running start state.

[0102] For example, when the determination unit 21 determines that the state of the vehicle 1 is a running start state, the determination unit 21 periodically broadcasts a running start notification indicating that the state of the vehicle 1 is a running start state to each in-vehicle device 201 via the relay unit 11. In addition, the determination unit 21 outputs the running start notification to the signal generation unit 22.

[0103] On the other hand, if the switch monitoring information B indicates that key matching information has not arrived from the matching ECU 201E, or that the brake switch or engine switch is in the off state, the judgment unit 21 judges that the vehicle 1 is not in the running start state.

[0104] [On-control of each switch by the vehicle-mounted relay device 101] 3 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 2 and FIG. 3, a signal generating unit 22 in the in-vehicle relay device 101 generates an ON control signal S11 based on the state of the vehicle 1 determined by the determining unit 21.

[0105] More specifically, for example, when the signal generating unit 22 receives a running start notification from the determining unit 21, that is, when the determining unit 21 determines that the state of the vehicle 1 is a running start state, the signal generating unit 22 generates an ON control signal S11. Then, the signal generating unit 22 outputs the generated ON control signal S11 to the logic circuit unit 23.

[0106] The logic circuit unit 23 receives an ON control signal S11 from the signal generating unit 22. The logic circuit unit 23 also receives an ON control signal S21 from outside the vehicle relay device 101, that is, from the management device 201G, via the signal line 6a.

[0107] For example, the logic circuit unit 23 includes OR gates 81, 82, and 83. The OR gate 81 outputs a gate signal S1 indicating the logical sum of the ON control signal S11 generated by the signal generating unit 22 and the ON control signal S21 received by the logic circuit unit 23 to the control switch 91. The OR gate 81 is an example of an OR circuit.

[0108] The OR gate 82 outputs a gate signal S3 indicating the logical sum of the ON control signal S51 and the ON control signal S61 to the power switch 92A. The OR gate 83 outputs a gate signal S5 indicating the logical sum of the ON control signal S53 and the ON control signal S71 to the power switch 92B.

[0109] FIG. 4 is a diagram for explaining the on-control of each switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0110] 3 and 4, when at least one of on control signal S51 and on control signal S61 is input to OR gate 82, a gate signal S3 of a logic high level is output from OR gate 82 to power switch 92A. When at least one of on control signal S53 and on control signal S71 is input to OR gate 83, a gate signal S5 of a logic high level is output from OR gate 83 to power switch 92B. In the example shown in FIG. 4, on control signals S51 and S53 are input to OR gates 82 and 83, respectively.

[0111] The power switch 92A turns on when it receives a gate signal S3 of a logic high level from the OR gate 82, and the power switch 92B turns on when it receives a gate signal S5 of a logic high level from the OR gate 83. This causes the connection state between the first power supply 61 and the control switch 91 and the connection state between the second power supply 62 and the control switch 91 to transition from an off state to an on state.

[0112] As described above, in this embodiment, the power switch 92B is always in the on state. That is, the power switch 92B remains in the on state even when the microcomputer mounted on the in-vehicle relay device 101 is in the sleep state. In order to maintain the power switch 92B in the on state, for example, an on-holding unit (not shown) is provided between the signal generating unit 22 and the OR gate 83 in the in-vehicle relay device 101. This makes it possible to reduce the dark current flowing through the power supply unit 51 when the ignition power of the vehicle 1 is in the off state.

[0113] In order to keep the power switch 92B in the on state, the power switch 92B may be a normally-on switch.

[0114] When at least one of the ON control signal S11 and the ON control signal S21 is input to the OR gate 81, the gate signal S1 at a logic high level is output from the OR gate 81 to the control switch 91. In the example shown in FIG.

[0115] The control switch 91 turns on when it receives a gate signal S1 of a logic high level from the OR gate 81. As a result, power from the power supply unit 51 is supplied to the automatic driving ECU 201H.

[0116] [Startup completion notification] Referring again to Figure 1, for example, when the state of the vehicle 1 is in a driving start state and the state of the control switch 91 is in an on state by the on control signal S11 or the on control signal S21, the automatic driving ECU 201H starts executing a driving-related function, specifically an automatic driving function.

[0117] More specifically, for example, when the control switch 91 is turned on while the vehicle 1 is in a traveling start state, the autonomous driving ECU 201H is activated. Then, the autonomous driving ECU 201H starts executing the autonomous driving function. Furthermore, when activated, the autonomous driving ECU 201H transmits an activation completion notification to the in-vehicle relay device 101, indicating that the autonomous driving ECU 201H has been activated.

[0118] The autonomous driving ECU 201H may be configured to start executing the autonomous driving function when the vehicle 1 is in a traveling start state, the control switch 91 is in an on state, and the parking brake is in an off state. In this case, when the control switch 91 is in an on state and the parking brake state indicated by the brake information received from the parking brake ECU 201F is in an off state, the autonomous driving ECU 201H is started up and starts executing the autonomous driving function.

[0119] [Device status notification] Referring again to Figure 2, in the vehicle relay device 101, when the notification unit 24 receives a startup completion notification from the autonomous driving ECU 201H via the relay unit 11, it periodically broadcasts an equipment status notification indicating that the autonomous driving ECU 201H is operating to each vehicle device 201 via the relay unit 11.

[0120] [Managed equipment] FIG. 5 is a diagram illustrating an example of the configuration of a management device according to an embodiment of the present disclosure. Referring to FIG. 5, management device 201G includes a communication unit 31, a processing unit 32, and a storage unit 33. Processing unit 32 includes a determination unit 41, a signal generation unit 42, a notification unit 43, a monitoring unit 44, an abnormality processing unit 45, and a transition processing unit 46. One or both of communication unit 31 and processing unit 32 are implemented, for example, by a processing circuit including one or more processors. Storage unit 33 is, for example, a non-volatile memory included in the processing circuit. Abnormality processing unit 45 is an example of a control unit, an example of a warning unit, and an example of a reset processing unit.

[0121] For example, the storage unit 33 stores a reception list L2 that indicates CAN-IDs included in CAN frames that should be received by the management device 201G. The reception list L2 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0122] When the communication unit 31 receives a CAN frame from the in-vehicle relay device 101 or another in-vehicle device 201 other than the management device 201G, the communication unit 31 reads out the reception list L2 in the storage unit 33. Then, by referring to the reception list L2, the communication unit 31 checks whether the CAN-ID included in the received CAN frame is registered in the reception list L2.

[0123] If the CAN-ID included in the received CAN frame is registered in the reception list L2, the communication unit 31 outputs the CAN frame to the processing unit 32. On the other hand, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the communication unit 31 discards the CAN frame.

[0124] The determination unit 41 determines the state of the vehicle 1. Specifically, for example, the determination unit 41 determines that the state of the vehicle 1 is a running start state by receiving a running start notification from the in-vehicle relay device 101 via the communication unit 31. Then, the determination unit 41 outputs the received running start notification to the signal generation unit 42.

[0125] The determination unit 41 further determines the state of the autonomous driving ECU 201H. Specifically, for example, when the determination unit 41 receives an equipment state notification from the in-vehicle relay device 101 via the communication unit 31, the determination unit 41 determines that the autonomous driving ECU 201H is operating. Then, the determination unit 41 outputs the received equipment state notification to the signal generation unit 42.

[0126] (Generation and output of ON control signals S21, S61, S71) For example, the second ON condition under which management device 201G outputs ON control signal S21 is different from the first ON condition under which in-vehicle relay device 101 outputs ON control signal S11. As described above, in-vehicle relay device 101 generates ON control signal S11 when it determines that the state of vehicle 1 is the traveling start state. On the other hand, in response to receiving a device state notification from in-vehicle relay device 101, management device 201G generates ON control signals S21, S61, and S71.

[0127] Specifically, for example, in the management device 201G, when the signal generating section 42 receives a device state notification from the determining section 41, it generates the ON control signals S21, S61, and S71.

[0128] Then, the signal generating unit 42 outputs the generated ON control signals S21, S61, and S71 to the in-vehicle repeater 101. For example, the signal generating unit 42 outputs the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at the same timing. Note that the signal generating unit 42 may output some of the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at a timing different from that of the other ON control signals.

[0129] Specifically, for example, when the signal generating unit 42 generates the ON control signal S21, it transmits the generated ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6a.

[0130] Furthermore, for example, when the signal generating unit 42 generates the ON control signals S61 and S71, it transmits the generated ON control signals S61 and S71 to the vehicle-mounted relay device 101 via the signal line 6a.

[0131] [Controlling the on-state of each switch using management device 201G] 6 is a diagram illustrating the on-control of each switch by a management device according to an embodiment of the present disclosure. Fig. 6 shows a case where control switch 91, power switch 92A, and power switch 92B are turned on by on control signal S21, on control signal S61, and on control signal S71 generated by management device 201G, respectively.

[0132] (Power switch 92 ON control) 6, logic circuit unit 23 in in-vehicle relay device 101 receives ON control signals S61 and S71 from management device 201G via signal line 6a shown in FIG. 2. OR gate 82 in logic circuit unit 23 outputs gate signal S3 of a logic high level to power switch 92A. OR gate 83 in logic circuit unit 23 outputs gate signal S5 of a logic high level to power switch 92B.

[0133] Power switch 92A is turned on when it receives gate signal S3 of a logic high level from OR gate 82, and power switch 92B is turned on when it receives gate signal S5 of a logic high level from OR gate 83.

[0134] Furthermore, when logic circuit unit 23 receives ON control signals S61, S71 from managed device 201G, logic circuit unit 23 outputs to notification unit 24 a switch ON notification N22 indicating that ON control signals S61, S71 have been received.

[0135] When the notification unit 24 receives the switch-on notification N22 from the logic circuit unit 23, it transmits the switch-on notification N22 to the management device 201G via the relay unit 11.

[0136] (Turning on the control switch 91) Furthermore, logic circuit unit 23 receives an ON control signal S21 from management device 201G via signal line 6a. Then, OR gate 81 in logic circuit unit 23 outputs gate signal S1 of a logic high level to control switch 91. OR gate 81 is an example of an OR circuit.

[0137] Control switch 91 turns on when it receives gate signal S1 of a logic high level from OR gate 81.

[0138] (Switch-on notification N21, N22) Furthermore, when logic circuit unit 23 receives the ON control signal S21 from managed device 201G, it outputs a switch-on notification N21 indicating that the ON control signal S21 has been received from managed device 201G to notification unit 24. Switch-on notification N21 is an example of a reception notification.

[0139] When the notification unit 24 receives the switch-on notification N21 from the logic circuit unit 23, it transmits the switch-on notification N21 to the management device 201G via the relay unit 11.

[0140] Furthermore, when logic circuit unit 23 receives ON control signals S61, S71 from managed device 201G via signal line 6a, it outputs to notification unit 24 a switch ON notification N22 indicating that ON control signals S61, S71 have been received from managed device 201G.

[0141] When the notification unit 24 receives the switch-on notification N22 from the logic circuit unit 23, it transmits the switch-on notification N22 to the management device 201G via the relay unit 11.

[0142] [On pending notification] Referring again to Figure 5, in the management device 201G, the notification unit 43 broadcasts an on-uncertainty notification, via the communication unit 31, to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201G, indicating that the execution of the on control of the control switch 91 by the on control signal S21, the on control of the power switch 92A by the on control signal S61, and the on control of the power switch 92B by the on control signal S71 is unconfirmed.

[0143] Specifically, the notification unit 43 broadcasts the on-unconfirmed notification to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically, until it receives the switch-on notification N21 from the in-vehicle relay device 101 via the communication unit 31.

[0144] [On completion notification] Furthermore, when the notification unit 43 receives the switch-on notification N21 from the in-vehicle relay device 101 via the communication unit 31, the notification unit 43 broadcasts an on-completion notification indicating that on control of the control switch 91 using the on control signal S21 is being executed, i.e., that the execution of the on-control in the in-vehicle relay device 101 has been confirmed, to each of the other in-vehicle devices 201 other than its own management device 201G and the in-vehicle relay device 101 via the communication unit 31. The on-completion notification is an example of an on-execution notification.

[0145] [Parking brake off control] Referring again to Figure 1, for example, when the parking brake is in the on state, the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101, receives an on completion notification from the management device 201G, and performs an operation Q1 to turn the parking brake off in the vehicle 1, and performs a parking brake release process to transition the parking brake from the on state to the off state.

[0146] More specifically, for example, the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification or a device status notification from the in-vehicle relay device 101, receives an ON completion notification from the management device 201G, and the driver of the vehicle 1 performs an operation Q1 of moving the shift lever to a position other than "parking." Below, an example will be described in which the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification and an ON completion notification from the in-vehicle relay device 101 and the management device 201G, respectively, and the driver performs the operation Q1. The operation Q1 is, for example, an operation in which the driver of the vehicle 1 moves the shift lever to a position other than "parking."

[0147] Specifically, for example, a shift lever sensor (not shown) is connected to the parking brake ECU 201F. The shift lever sensor periodically detects the position of the shift lever and performs detection processing D4, in which sensor information C4 indicating the detection result is transmitted to the parking brake ECU 201F.

[0148] When the parking brake ECU 201F receives the sensor information C4 from the shift lever sensor, the parking brake ECU 201F stores the received sensor information C4 in a storage unit.

[0149] For example, when the parking brake ECU 201F receives a driving start notification from the in-vehicle relay device 101, the parking brake ECU 201F acquires, from the storage unit, the sensor information C4 received during a period from the reception of the driving start notification until a predetermined time has elapsed.

[0150] When the sensor information C4 acquired from the storage unit indicates a shift lever position other than "parking" as the detection result and the parking brake ECU 201F receives an ON completion notification from the management device 201G, the parking brake ECU 201F outputs an OFF control signal S32 to the parking brake to transition the parking brake to an OFF state. This transitions the parking brake from an ON state to an OFF state.

[0151] [Parking brake on control] For example, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state when it receives an ON completion notification from the management device 201G and a predetermined operation Q2 is performed in the vehicle 1. For example, the operation Q2 is an operation in which the driver moves the shift lever to the "parking" position.

[0152] More specifically, for example, after receiving an ON completion notification from the management device 201G, if the sensor information C4 received from the shift lever sensor indicates "parking" as the detection result, the parking brake ECU 201F outputs an ON control signal S31 to the parking brake to transition the parking brake to an ON state. As a result, the parking brake transitions from an OFF state to an ON state.

[0153] Then, the parking brake ECU 201F broadcasts to the other in-vehicle devices 201 and the in-vehicle relay device 101 a brake-on notification indicating that the on control signal S31 has been output to the parking brake.

[0154] In addition, the parking brake ECU 201F is not limited to being configured to transition the parking brake from the off state to the on state when it receives an on completion notification from the management device 201G and operation Q2 is performed in the vehicle 1, but may also be configured to transition the parking brake from the off state to the on state when another operation is performed in the vehicle 1 instead of operation Q2.

[0155] In this case, for example, when the parking brake ECU 201F receives an ON completion notification from the management device 201G and at least two or more of the following operations are performed in the vehicle 1: operation Q3 in which the driver leaves the driver's seat; operation Q4 in which the driver unlocks the seat belt; and operation Q5 in which the driver unlocks the driver's door, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state.

[0156] [In-vehicle relay device] (Judgment Department) 2 again, in the in-vehicle relay device 101, the determination unit 21 performs a determination process J2 to determine whether the vehicle 1 is in a state where it has finished traveling (hereinafter also referred to as a "traveling end state"). More specifically, for example, when the determination unit 21 receives a brake-on notification from the parking brake ECU 201F and operations Q3, Q4, and Q5 are performed in the vehicle 1, the determination unit 21 determines that the state of the vehicle 1 is in the traveling end state.

[0157] Specifically, for example, when the judgment unit 21 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11, it checks whether the sensor information C1, C2, and C3 contained in frame F (hereinafter also referred to as "frame F1") received from the body ECU 201A via the relay unit 11 within a predetermined time period after receiving the brake-on notification satisfy predetermined conditions.

[0158] For example, if frame F1 contains sensor information C1 indicating that the driver has left the seat, sensor information C2 indicating that the seat belt is in an unlocked state, and sensor information C3 indicating that the driver's door is in an open state, the judgment unit 21 determines that the state of vehicle 1 is in an end-of-travel state.

[0159] Then, the determination unit 21 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each in-vehicle device 201 via the relay unit 11. The determination unit 21 also outputs the driving end notification to the signal generation unit 22.

[0160] In addition, the judgment unit 21 may be configured to judge that the state of vehicle 1 is in the end-of-travel state when it receives a brake-on notification from the parking brake ECU 201F and any two of operations Q3, Q4, and Q5 are performed in vehicle 1.

[0161] [Off transition request] For example, the in-vehicle relay device 101 transmits an OFF transition request to the automatic driving ECU 201H to request that the execution of the driving-related function be stopped. The OFF transition request is an example of a request notification.

[0162] More specifically, for example, in the in-vehicle relay device 101, when the signal generating unit 22 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11 and also receives a driving end notification from the judgment unit 21, it broadcasts an off transition request to each in-vehicle device 201 via the relay unit 11 before generating the off control signal S12.

[0163] [Stop preparation completion notification] Referring again to Figure 1, for example, when the autonomous driving ECU 201H receives a driving end notification or an off transition request from the vehicle relay device 101 and the management device 201G outputs an off control signal S22 described later, it performs pre-processing to stop the execution of the autonomous driving function before the power supply to the autonomous driving ECU 201H is stopped.

[0164] More specifically, for example, when the autonomous driving ECU 201H receives a driving end notification or an off transition request from the vehicle relay device 101 and also receives an off completion notification (described later) from the management device 201G, it performs predetermined pre-processing in preparation for stopping the execution of the autonomous driving function.

[0165] Specifically, for example, the autonomous driving ECU 201H includes a volatile memory that stores data indicating the processing content during execution of the autonomous driving function, and a non-volatile memory that is used in preprocessing.

[0166] When the autonomous driving ECU 201H receives a driving end notification from the vehicle relay device 101 and an off completion notification from the management device 201G, it performs a preprocessing process to back up the data stored in the volatile memory to the non-volatile memory.

[0167] Furthermore, for example, an actuator (not shown) is connected to the automatic driving ECU 201H. The automatic driving ECU 201H drives the actuator while the automatic driving function is being executed.

[0168] When the autonomous driving ECU 201H receives the driving end notification from the in-vehicle relay device 101 and the power-off completion notification from the management device 201G, it performs a process of stopping the operation of the actuator as pre-processing.

[0169] Then, when the automatic driving ECU 201H completes preparations to stop the execution of the automatic driving function, it transmits a stop preparation completion notification to the in-vehicle relay device 101.

[0170] [OFF control signal S22] 3 and 5 again, for example, management device 201G outputs an OFF control signal S22 to control switch 91 to turn off control switch 91. For example, OFF control signal S22 is a signal at a logical low level. ON control signal S21 and OFF control signal S22 are output exclusively. OFF control signal S22 is an example of a second OFF control signal.

[0171] For example, the condition under which vehicle relay device 101 outputs off control signal S12 (hereinafter also referred to as the "first off condition") is different from the condition under which management device 201G outputs off control signal S22 (hereinafter also referred to as the "second off condition").

[0172] More specifically, for example, the first OFF condition includes a condition related to the state of the automatic driving ECU 201H, and the second OFF condition does not include a condition related to the state of the automatic driving ECU 201H.

[0173] Specifically, for example, when the in-vehicle relay device 101 receives a stop preparation completion notification from the autonomous driving ECU 201H, it outputs an OFF control signal S12.

[0174] For example, in the management device 201G, when the signal generating unit 42 receives a brake-on notification from the parking brake ECU 201F via the communication unit 31 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 31, it decides to output an off control signal S22.

[0175] Then, the signal generating unit 42 generates an OFF control signal S22 and outputs the generated OFF control signal S22 to the vehicle-mounted relay device 101.

[0176] Specifically, for example, the signal generating unit 42 transmits the generated OFF control signal S22 to the vehicle-mounted relay device 101 via the signal line 6a.

[0177] [Switch off notification N12] Referring again to Figures 2 and 3, in the vehicle relay device 101, when the logic circuit unit 23 receives an off control signal S22 from the management device 201G via the signal line 6a, it outputs a switch off notification N12 to the notification unit 24 indicating that the off control signal S22 has been received.

[0178] When the notification unit 24 receives the switch-off notification N12 from the logic circuit unit 23, it transmits the switch-off notification N12 to the management device 201G via the relay unit 11.

[0179] [Notification of unconfirmed off] Referring again to Figure 5, in the management device 201G, the notification unit 43 broadcasts an off-uncertainty notification, indicating that the off control of the control switch 91 by the off control signal S22 is undetermined, via the communication unit 31 to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201G.

[0180] Specifically, during the period from when the notification unit 43 outputs the off control signal S22 to the vehicle-mounted relay device 101 to when it receives the switch-off notification N12 from the vehicle-mounted relay device 101 via the communication unit 31, the notification unit 43 broadcasts an off-unconfirmed notification to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101, for example, periodically.

[0181] [Off completion notification] After outputting the off control signal S22 to the vehicle relay device 101, the notification unit 43, when it receives a switch off notification N12 from the vehicle relay device 101, sends an off completion notification to the autonomous driving ECU 201H indicating that the transmission of the off control signal S22 has been completed.

[0182] Specifically, when the notification unit 43 receives a switch-off notification N12 from the in-vehicle relay device 101 via the communication unit 31, the notification unit 43 broadcasts an off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201G via the communication unit 31. The notification unit 43 broadcasts the off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101, for example, periodically.

[0183] [Controlling each switch to off] (Generation and output of the off control signal S12) 2 and 3 again, for example, the vehicle-mounted relay device 101 outputs an OFF control signal S12 for turning off the control switch 91 to the control switch 91. The OFF control signal S12 is an example of a first OFF control signal.

[0184] More specifically, for example, when the management device 201G outputs an off control signal S22 and the autonomous driving ECU 201H performs preprocessing to stop the execution of the autonomous driving function, the vehicle relay device 101 outputs an off control signal S12 to the control switch 91.

[0185] Specifically, for example, in the in-vehicle relay device 101, the signal generating unit 22 generates an OFF control signal S12 when it receives a stop preparation completion notification from the autonomous driving ECU 201H via the relay unit 11. For example, the OFF control signal S12 is a signal at a logical low level.

[0186] Then, the signal generating unit 22 outputs the generated OFF control signal S12 to the logic circuit unit 23. The ON control signal S11 and the OFF control signal S12 are output exclusively.

[0187] (Turning off the control switch 91) FIG. 7 is a diagram for explaining the control of turning off the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0188] Referring to Figure 7, for example, in the in-vehicle relay device 101, when the signal generation unit 22 receives a preparation completion notification from the autonomous driving ECU 201H via the relay unit 11, it outputs the generated off control signal S12 to the logic circuit unit 23.

[0189] Logic circuit unit 23 outputs gate signal S2 of a logic low level to control switch 91 when it receives OFF control signal S12 from signal generating unit 22 and OFF control signal S22 from management device 201G.

[0190] Specifically, when both the OFF control signal S12 and the OFF control signal S22 are input to the OR gate 81, the gate signal S2 at a logic low level is output from the OR gate 81 to the control switch 91.

[0191] The control switch 91 turns off when it receives the gate signal S2 of a logical low level from the OR gate 81. This stops the supply of power to the automatic driving ECU 201H.

[0192] In addition to the control switch 91 that switches on / off the supply of power to the autonomous driving ECU 201H, the in-vehicle relay device 101 may be configured to include another control switch that switches on / off the supply of power to the management device 201G. In this case, the in-vehicle relay device 101 and the management device 201G switch on and off the other switch in the same way as the control switch 91 described above is switched on and off.

[0193] (Generation and output of the OFF control signal S52) 2 and 3 again, for example, in the vehicle-mounted relay device 101, the signal generating unit 22 generates an OFF control signal S52 for turning off the power switch 92A.

[0194] More specifically, for example, the signal generating unit 22 generates the OFF control signal S52 when execution of various services is stopped in the in-vehicle network 401. For example, the OFF control signal S52 is a signal at a logic low level.

[0195] Specifically, for example, when the signal generating unit 22 receives a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 via the communication unit 31, the signal generating unit 22 determines that the execution of various services in the in-vehicle network 401 has stopped. In this case, the signal generating unit 22 generates an OFF control signal. Note that the signal generating unit 22 may be configured to determine that the execution of various services has stopped when the signal generating unit 22 receives a stop preparation completion notification from an in-vehicle ECU that controls the DC / DC converter 72 in the power supply unit 51.

[0196] Then, the signal generating unit 22 outputs the generated OFF control signal S52 to the logic circuit unit 23. The ON control signal S51 and the OFF control signal S52 are output exclusively.

[0197] (Generation and output of OFF control signals S62 and S72) 3 and 5 again, for example, in management device 201G, signal generation unit 42 generates off control signal S62 for turning off power switch 92A and off control signal S72 for turning off power switch 92B. For example, off control signals S62 and S72 are signals at a logical low level.

[0198] More specifically, for example, when the signal generating unit 42 receives a brake-on notification from the parking brake ECU 201F via the communication unit 31 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 31, it decides to output off control signals S62, S72.

[0199] Then, the signal generating unit 42 generates OFF control signals S62, S72 and transmits the generated OFF control signals S62, S72 to the in-vehicle relay device 101 via the signal line 6a. The ON control signal S61 and the OFF control signal S62 are output exclusively. The ON control signal S71 and the OFF control signal S72 are output exclusively.

[0200] (Switch off notification N11) Referring again to Figure 7, in the vehicle-mounted relay device 101, when the logic circuit unit 23 receives the off control signals S62, S72 from the management device 201G via the signal line 6a, it outputs a switch off notification N11 to the notification unit 24 indicating that the off control signals S62, S72 have been received from the management device 201G.

[0201] When the notification unit 24 receives the switch-off notification N11 from the logic circuit unit 23, it transmits the switch-off notification N11 to the management device 201G via the relay unit 11.

[0202] (Power switch 92A turned off) Referring again to Figure 7, in the vehicle relay device 101, when the logic circuit unit 23 receives an off control signal S52 from the signal generating unit 22 and an off control signal S62 from the management device 201G, it outputs a gate signal S4 of a logical low level to the power switch 92A.

[0203] Specifically, for example, when both the OFF control signal S52 and the OFF control signal S62 are input to the OR gate 82, the gate signal S4 at a logic low level is output from the OR gate 82 to the power switch 92A.

[0204] Power switch 92A is turned off when it receives gate signal S4 of a logic low level from OR gate 82.

[0205] [Monitoring by the vehicle-mounted relay device 101] 1, 2 and 5 again, for example, when the state of management device 201G is normal, signal generation unit 42 in management device 201G outputs a status signal of logic high level to signal line 6. Also, for example, when the state of management device 201G is abnormal, signal generation unit 42 outputs a status signal of logic low level to signal line 6.

[0206] For example, the monitoring unit 25 in the vehicle-mounted relay device 101 performs a monitoring process E1 for monitoring the state of the management device 201G.

[0207] More specifically, for example, when the monitoring unit 25 receives a status signal of a logical high level from the management device 201G via the signal line 6, it determines that the status of the management device 201G is normal.

[0208] On the other hand, for example, when monitoring unit 25 receives a status signal of a logical low level from managed device 201G via signal line 6, it determines that an abnormality has occurred in managed device 201G. Then, monitoring unit 25 outputs abnormality detection information M1 indicating that an abnormality has occurred in managed device 201G to abnormality processing unit 26. Note that monitoring unit 25 may be configured to monitor the status of managed device 201G using a watchdog timer instead of the status signal transmitted from managed device 201G.

[0209] (Warning information output) For example, when the monitoring unit 25 determines that an abnormality has occurred in the managed device 201G, the abnormality processing unit 26 performs warning processing K1 to output warning information.

[0210] More specifically, for example, when the abnormality processing unit 26 receives abnormality detection information M1 from the monitoring unit 25, it transmits the abnormality detection information M1 as warning information to in-vehicle equipment 201 (hereinafter also referred to as "display equipment") such as a navigation device and a meter in the in-vehicle network 401 via the relay unit 11.

[0211] For example, when the display device receives the abnormality detection information M1 from the in-vehicle relay device 101, the display device performs notification processing based on the received abnormality detection information M1. Specifically, for example, the display device displays the content indicated by the abnormality detection information M1 on its own display unit. Note that the abnormality processing unit 26 may be configured to notify the passengers of the vehicle 1 of the content indicated by the abnormality detection information M1 by a method other than displaying it on the display device, for example, by voice.

[0212] (Reset signal output) Furthermore, for example, when the monitoring unit 25 determines that an abnormality has occurred in the managed device 201G, the abnormality processing unit 26 performs reset processing R1 to reset the managed device 201G.

[0213] More specifically, when abnormality processing section 26 receives abnormality detection information M1 from monitoring section 25, it outputs a reset signal to signal line 6b to reset the microcomputer mounted on management device 201G, for example.

[0214] When the management device 201G receives a reset signal from the vehicle-mounted relay device 101 via the signal line 6b, it resets the microcomputer mounted therein.

[0215] (Keep the parking brake on) For example, the abnormality processing unit 26 performs parking brake ON control G1 to maintain the parking brake in the ON state when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts traveling. More specifically, for example, when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts traveling, the abnormality processing unit 26 notifies the parking brake ECU 201F that the parking brake should be maintained in the ON state.

[0216] Specifically, for example, when the abnormality processing unit 26 receives abnormality detection information M1 from the monitoring unit 25 before receiving a driving start notification from the judgment unit 21, the abnormality processing unit 26 transmits a brake request notification indicating that the parking brake should be maintained in the on state to the parking brake ECU 201F shown in Figure 1 via the relay unit 11.

[0217] The parking brake ECU 201F maintains the parking brake in the ON state when receiving the brake request notification from the in-vehicle relay device 101. This makes it possible to prevent the vehicle 1 from starting to move when an abnormality occurs in the management device 201G.

[0218] (Transition to evacuation driving mode) For example, when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G while the vehicle 1 is traveling, the transition processing unit 27 performs transition processing A1 to transition a specific in-vehicle device 201 to an operation mode for driving the vehicle 1 to an evacuation mode (hereinafter also referred to as an "evacuation mode"). Below, a case will be described in which the transition processing unit 27 transitions the autonomous driving ECU 201H to the evacuation mode.

[0219] For example, when abnormality processing unit 26 receives abnormality detection information M1 from monitoring unit 25, it notifies transition processing unit 27 that the abnormality detection information M1 has been received from monitoring unit 25.

[0220] When the transition processing unit 27 receives the above notification from the abnormality processing unit 26, it transitions the autonomous driving ECU 201H to the evacuation traveling mode.

[0221] For example, the evacuation driving mode includes a guidance mode that guides the vehicle 1 to a safe place such as a road shoulder. Note that the evacuation driving mode may include other modes in addition to or instead of the guidance mode, such as a mode that restricts driving-related functions of the vehicle 1 such as the engine output value, a mode that notifies the driver of the vehicle 1 of the occurrence of an abnormality, and a mode that drives the vehicle 1 with the hazard lights turned on.

[0222] For example, the memory unit 13 stores the CAN-ID stored in the CAN frame that its own in-vehicle relay device 101 transmits to the autonomous driving ECU 201H. When the transition processing unit 27 receives the above notification from the abnormality processing unit 26, it creates a CAN frame (hereinafter also referred to as a "transition request frame") that includes the CAN-ID of the autonomous driving ECU 201H stored in the memory unit 13 and an evacuation request notification W indicating a request to transition to the evacuation traveling mode.

[0223] Then, the transition processing unit 27 transmits the created transition request frame to the autonomous driving ECU 201H via the relay unit 11.

[0224] When the autonomous driving ECU 201H receives a transition request frame from the in-vehicle relay device 101, it transitions to the evacuation travel mode in accordance with the evacuation request notification W included in the received transition request frame. Specifically, for example, the autonomous driving ECU 201H guides its own vehicle 1 to the shoulder of the road by autonomous driving in accordance with the evacuation request notification W.

[0225] It should be noted that the transition processing unit 27 is not limited to a configuration that transitions the autonomous driving ECU 201H to the evacuation traveling mode in transition processing A1, but may also be configured to transmit information indicating that the vehicle 1 should transition to the evacuation traveling mode to a display device in the in-vehicle network 401 via the relay unit 11. In this case, when the display device receives the information from the in-vehicle relay device 101, it displays the content indicated by the information on its own display unit.

[0226] [Monitoring using management device 201G] For example, when the state of the in-vehicle repeater 101 is normal, the signal generating unit 22 in the in-vehicle repeater 101 outputs a status signal of a logic high level to the signal line 6. Also, for example, when the state of the in-vehicle repeater 101 is abnormal, the signal generating unit 22 outputs a status signal of a logic low level to the signal line 6.

[0227] For example, the monitoring unit 44 in the management device 201G performs a monitoring process E2 for monitoring the state of the vehicle-mounted relay device 101.

[0228] More specifically, for example, when the monitoring unit 44 receives a state signal of a logical high level from the in-vehicle repeater 101 via the signal line 6, it determines that the in-vehicle repeater 101 is in a normal state.

[0229] On the other hand, for example, when the monitoring unit 44 receives a status signal of a logical low level from the in-vehicle repeater 101 via the signal line 6, it determines that the in-vehicle repeater 101 is in an abnormal state. Then, the monitoring unit 44 outputs abnormality detection information M2 indicating that an abnormality has occurred in the in-vehicle repeater 101 to the abnormality processing unit 45. Note that the monitoring unit 44 may be configured to monitor the status of the in-vehicle repeater 101 using a watchdog timer instead of the status signal transmitted from the in-vehicle repeater 101.

[0230] (Warning information output) For example, when the monitoring unit 44 determines that an abnormality has occurred in the vehicle-mounted relay device 101, the abnormality processing unit 45 performs a warning process K2 to output warning information.

[0231] More specifically, for example, when the abnormality processing unit 45 receives the abnormality detection information M2 from the monitoring unit 44, it transmits the abnormality detection information M2 as warning information to the display device in the in-vehicle network 401 via the communication unit 31.

[0232] For example, when the display device receives the abnormality detection information M2 from the in-vehicle relay device 101, the display device performs notification processing based on the received abnormality detection information M2. Specifically, for example, the display device displays the content indicated by the abnormality detection information M2 on its own display unit. Note that the abnormality processing unit 45 may be configured to notify the passengers of the vehicle 1 of the content indicated by the abnormality detection information M2 by a method other than displaying it on the display device, for example, by voice.

[0233] (Reset signal output) Furthermore, for example, when the monitoring unit 44 determines that an abnormality has occurred in the vehicle-mounted relay device 101, the abnormality processing unit 45 performs a reset process R2 to reset the vehicle-mounted relay device 101.

[0234] More specifically, when the abnormality processing unit 45 receives the abnormality detection information from the monitoring unit 44, it outputs a reset signal to reset the microcomputer mounted on the vehicle relay device 101, for example, to the signal line 6b.

[0235] When the vehicle-mounted relay device 101 receives the reset signal from the management device 201G via the signal line 6b, the vehicle-mounted relay device 101 resets the microcomputer mounted therein to the initial state. Then, the management device 201G re-executes the program of the microcomputer stored in the storage unit 13.

[0236] (Keep the parking brake on) For example, the abnormality processing unit 45 performs parking brake ON control G2 to maintain the parking brake in the ON state when the monitoring unit 44 determines that an abnormality has occurred in the in-vehicle relay device 101 before the vehicle 1 starts traveling. More specifically, for example, when the monitoring unit 44 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts traveling, the abnormality processing unit 45 notifies the parking brake ECU 201F that the parking brake should be maintained in the ON state.

[0237] Specifically, for example, when the abnormality processing unit 45 receives abnormality detection information M2 from the monitoring unit 44 before receiving a driving start notification from the vehicle relay device 101 via the communication unit 31, the abnormality processing unit 45 transmits a brake request notification indicating that the parking brake should be maintained in an on state to the parking brake ECU 201F shown in Figure 1 via the communication unit 31.

[0238] When the parking brake ECU 201F receives a brake request notification from the management device 201G, the parking brake ECU 201F maintains the parking brake in the ON state. This prevents the vehicle 1 from starting to move when an abnormality occurs in the in-vehicle relay device 101.

[0239] (Transition to evacuation driving mode) For example, when the monitoring unit 44 determines that an abnormality has occurred in the in-vehicle relay device 101 while the vehicle 1 is traveling, the transition processing unit 46 performs transition processing A2 to transition the autonomous driving ECU 201H to an evacuation traveling mode.

[0240] For example, when the abnormality processing unit 45 receives abnormality detection information M2 from the monitoring unit 44 after receiving a driving start notification from the vehicle relay device 101 via the communication unit 31, it notifies the transition processing unit 46 that it has received the abnormality detection information M2 from the monitoring unit 44.

[0241] When the transition processing unit 46 receives the above notification from the abnormality processing unit 45, it transitions the autonomous driving ECU 201H to the evacuation traveling mode.

[0242] For example, the storage unit 33 further stores the CAN-ID of the autonomous driving ECU 201H. When the transition processing unit 46 receives the above notification from the abnormality processing unit 45, it creates the above transition request frame, which is a CAN frame including the CAN-ID of the autonomous driving ECU 201H stored in the storage unit 33 and the evacuation request notification W. Then, the transition processing unit 46 transmits the created transition request frame to the autonomous driving ECU 201H via the communication unit 31.

[0243] When the autonomous driving ECU 201H receives a transition request frame from the in-vehicle relay device 101, it transitions to the evacuation travel mode in accordance with the evacuation request notification W included in the received transition request frame. Specifically, for example, the autonomous driving ECU 201H guides its own vehicle 1 to the shoulder of the road by autonomous driving in accordance with the evacuation request notification W.

[0244] Note that, in transition process A2, transition processing unit 46 is not limited to a configuration that transitions autonomous driving ECU 201H to the evacuation traveling mode, but may also be configured to transmit information indicating that vehicle 1 should transition to the evacuation traveling mode to a display device in in-vehicle network 401 via communication unit 31. In this case, when the display device receives the information from management device 201G, it displays content indicating the information on its own display unit.

[0245] [Operation flow] Next, the flow of operations of each device in the in-vehicle system 301 according to the embodiment of the present disclosure will be described with reference to the drawings.

[0246] 8, 9, and 10 are flowcharts showing an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. These flowcharts show the operation when the power switch 92 and the control switch 91 are turned on by the on-control signal S51 and the on-control signal S11, respectively, generated in the in-vehicle relay device 101.

[0247] 8, 9, and 10, first, the vehicle-mounted relay device 101 performs a monitoring process E1 for monitoring the management device 201G while in an activated state (step ST101).

[0248] Next, the in-vehicle relay device 101 waits for reception of key verification information from the verification ECU 201E (NO in step ST102).

[0249] Next, when the in-vehicle relay device 101 receives the key verification information from the verification ECU 201E (YES in step ST102), it waits for the reception of switch monitoring information from the body ECU 201A (NO in step ST103).

[0250] Then, when the in-vehicle relay device 101 receives switch monitoring information B from the body ECU 201A within a predetermined time after receiving the key verification information from the verification ECU 201E (YES in step ST103), it uses the received switch monitoring information B to determine whether the state of the vehicle 1 is in a running start state (step ST104).

[0251] Then, if the switch monitoring information B received from the body ECU 201A indicates that the brake pedal switch or the engine switch is in the off state, the vehicle relay device 101 determines that the vehicle 1 is not in the start state (NO in step ST104), and determines whether an abnormality has occurred in the management device 201G (step ST105).

[0252] Next, if the vehicle relay device 101 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts driving (YES in step ST105), it transmits abnormality detection information M1 indicating that an abnormality has occurred in the management device 201G to the parking brake ECU 201F (step ST106).

[0253] Next, the vehicle-mounted relay device 101 performs a warning process K1 to output the abnormality detection information M1 as warning information (step ST107).

[0254] Next, the vehicle-mounted relay device 101 performs a reset process R1 to reset the management device 201G. For example, as described above, the vehicle-mounted relay device 101 outputs a reset signal to the signal line 6b to reset the microcomputer mounted in the management device 201G (step ST108).

[0255] On the other hand, if the vehicle relay device 101 determines that no abnormality has occurred in the management device 201G before the vehicle 1 starts driving (NO in step ST105), it waits to receive new key verification information from the verification ECU 201E (NO in step ST103).

[0256] Furthermore, if the switch monitoring information B received from the body ECU 201A indicates that the brake pedal switch or the engine switch is in the on state (YES in step ST104), the vehicle relay device 101 determines that the vehicle 1 is in the driving start state and broadcasts a driving start notification to each vehicle equipment 201 (step ST109).

[0257] Next, the signal generating unit 22 in the in-vehicle relay device 101 generates an ON control signal S51 for turning on the power switch 92A and an ON control signal S11 for turning on the control switch 91 (step ST110). Note that steps ST109 and ST110 may be executed in reverse order or in parallel.

[0258] Next, the in-vehicle repeater 101 turns on the power switch 92A. For example, as described above, in the in-vehicle repeater 101, the signal generating unit 22 outputs the generated on-control signals S51 and S53 to the logic circuit unit 23. Then, the OR gate 82 in the logic circuit unit 23 outputs the gate signal S3 at a logic high level to the power switch 92A (step ST111).

[0259] Next, the in-vehicle relay device 101 turns on the control switch 91. For example, as described above, the signal generating unit 22 outputs the generated ON control signal S11 to the logic circuit unit 23. Then, the OR gate 81 in the logic circuit unit 23 outputs a gate signal S1 of a logical high level to the control switch 91 (step ST112). This starts the supply of power to the autonomous driving ECU 201H.

[0260] Next, the in-vehicle relay device 101 waits for reception of a start-up completion notification from the autonomous driving ECU 201H (NO in step ST113).

[0261] Then, when the in-vehicle relay device 101 receives the start-up completion notification from the autonomous driving ECU 201H (YES in step ST113), it broadcasts an equipment status notification indicating that the autonomous driving ECU 201H is operating to each in-vehicle device 201 (step ST114).

[0262] Next, the vehicle-mounted relay device 101 waits for reception of the ON control signals S21, S61, and S71 from the management device 201G (NO in step ST115).

[0263] Then, when the vehicle-mounted relay device 101 receives the on control signals S21, S61, and S71 from the management device 201G (YES in step ST115), it transmits a switch-on notification N21 indicating that the on control signal S21 has been received, and a switch-on notification N22 indicating that the on control signals S61 and S71 have been received, to the management device 201G (step ST116), and determines whether an abnormality has occurred in the management device 201G (step ST117).

[0264] If the vehicle relay device 101 determines that no abnormality has occurred in the management device 201G (NO in step ST117), it waits to receive a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201A (NO in step ST118).

[0265] Next, when the vehicle relay device 101 receives a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201A (YES in step ST118), it determines whether the state of the vehicle 1 is in an end-of-travel state based on the sensor information C1, C2, and C3 contained in the received sensor monitoring information (step ST119).

[0266] Then, when the vehicle relay device 101 determines that the state of the vehicle 1 is the traveling end state (YES in step ST119), it broadcasts a traveling end notification to each of the vehicle-mounted devices 201 (step ST120).

[0267] Furthermore, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 to request the suspension of the execution of the driving-related functions (step ST121).

[0268] Next, the vehicle-mounted relay device 101 waits to receive, from the management device 201G, an OFF control signal S22 for turning off the control switch 91 and OFF control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (NO in step ST122).

[0269] Then, when the vehicle-mounted relay device 101 receives the off control signals S22, S62, and S72 from the management device 201G (YES in step ST122), it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201G (step ST123).

[0270] Next, after transmitting the switch-off notifications N11 and N12 to the management device 201G, the in-vehicle relay device 101 waits for reception of a stop preparation completion notification from the autonomous driving ECU 201H (NO in step ST124).

[0271] Then, in the vehicle relay device 101, when the signal generation unit 22 receives a notification that stop preparation is complete from the autonomous driving ECU 201H (YES in step ST124), it generates an off control signal S12 for turning off the control switch 91 and outputs it to the logic circuit unit 23 (step ST125).

[0272] Next, the in-vehicle repeater 101 turns off the control switch 91. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 23 inputs both the off control signal S12 and the off control signal S22 to the OR gate 81. Then, the OR gate 81 outputs the gate signal S1 at a logic low level to the control switch 91 (step ST126).

[0273] Next, when the in-vehicle relay device 101 turns off the control switch 91, it waits for a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 (NO in step ST127).

[0274] Then, in the vehicle relay device 101, when the signal generating unit 22 receives a notification that stop preparation is complete from all vehicle ECUs in the vehicle network 401 (YES in step ST127), it generates an off control signal S52 for turning off the power switch 92A and outputs it to the logic circuit unit 23 (step ST128).

[0275] Next, the in-vehicle repeater 101 turns off the power switch 92A. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 23 inputs both the off control signal S52 and the off control signal S62 to the OR gate 81. Then, the OR gate 82 outputs the gate signal S4 of a logic low level to the power switch 92A (step ST129).

[0276] On the other hand, when the vehicle relay device 101 determines that the vehicle 1 is not in the traveling end state (NO in step ST119), it checks again whether or not an abnormality has occurred in the management device 201G (step ST117).

[0277] Furthermore, if the in-vehicle relay device 101 determines that an abnormality has occurred in the management device 201G after power supply to the autonomous driving ECU 201H has started (YES in step ST117), the in-vehicle relay device 101 performs transition processing A1 to transition the autonomous driving ECU 201H to the evacuation traveling mode. For example, as described above, the in-vehicle relay device 101 transmits a transition request frame to the autonomous driving ECU 201H (step ST130).

[0278] Next, the vehicle-mounted relay device 101 performs a warning process K1 to output, as warning information, abnormality detection information M1 indicating that an abnormality has occurred in the management device 201G (step ST131).

[0279] Next, the vehicle-mounted relay device 101 performs a reset process R1 to reset the management device 201G (step ST132). Note that steps ST130, ST131, and ST132 may be executed in a reverse order or in parallel.

[0280] 11 is a flowchart showing another example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. FIG. 11 shows the operation when the power switch 92A, the power switch 92B, and the control switch 91 are turned on by the ON control signal S61, the ON control signal S71, and the ON control signal S21, respectively, generated in the management device 201G.

[0281] 11, first, in-vehicle relay device 101 receives ON control signals S61 and S71 for turning on power switches 92A and 92B, respectively, from management device 201G via signal line 6a, and turns on power switches 92A and 92B. For example, as described above, in in-vehicle relay device 101, logic circuit unit 23 receives ON control signals S61 and S71 from management device 201G via signal line 6a. OR gate 82 in logic circuit unit 23 outputs gate signal S3 of a logic high level to power switch 92A. Furthermore, OR gate 83 in logic circuit unit 23 outputs gate signal S5 of a logic high level to power switch 92B (step ST201).

[0282] Next, the vehicle-mounted relay device 101 transmits to the management device 201G a switch-on notification N22 indicating that the on-control signals S61 and S71 have been received from the management device 201G (step ST202).

[0283] Next, the vehicle-mounted relay device 101 receives an ON control signal S21 for turning on the control switch 91 from the management device 201G via the signal line 6a, and turns on the control switch 91. For example, as described above, the logic circuit unit 23 receives the ON control signal S21 from the management device 201G via the signal line 6a. Then, the OR gate 81 in the logic circuit unit 23 outputs a gate signal S1 of a logic high level to the control switch 91 (step ST203).

[0284] Next, the vehicle-mounted relay device 101 transmits to the management device 201G a switch-on notification N21 indicating that the on-control signal S21 has been received from the management device 201G (step ST204).

[0285] 12 and 13 are flowcharts defining an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch.

[0286] 12 and 13, first, the management device 201G performs a monitoring process E2 of monitoring the state of the vehicle-mounted relay device 101 while it is activated (step ST301).

[0287] Next, the management device 201G determines whether or not the state of the vehicle 1 is the traveling start state. For example, as described above, the management device 201G determines whether or not the state of the vehicle 1 is the traveling start state by checking whether or not a traveling start notification has been received from the in-vehicle relay device 101 (step ST302).

[0288] If the management device 201G determines that the vehicle 1 is not in the traveling start state (NO in step ST302), it determines whether or not an abnormality has occurred in the vehicle-mounted relay device 101 (step ST303).

[0289] Next, if the management device 201G determines that an abnormality has occurred in the vehicle-mounted relay device 101 before the vehicle 1 starts moving (YES in step ST303), it performs warning processing K2 to output abnormality detection information M2 indicating that an abnormality has occurred in the vehicle-mounted relay device 101 as warning information (step ST304).

[0290] Next, the management device 201G transmits a brake request notification indicating that the parking brake should be maintained in the ON state to the parking brake ECU 201F (step ST305).

[0291] Next, management device 201G performs reset processing R2 to reset in-vehicle relay device 101. For example, as described above, management device 201G outputs a reset signal to signal line 6b to reset the microcomputer mounted in in-vehicle relay device 101 (step ST306). Note that steps ST304, ST305, and ST306 may be executed in a reversed order or in parallel.

[0292] On the other hand, if the management device 201G determines that no abnormality has occurred in the vehicle relay device 101 before the vehicle 1 starts moving (NO in step ST303), it again determines whether the state of the vehicle 1 is in the moving start state (step ST302).

[0293] Furthermore, when the management device 201G determines that the vehicle 1 is in a traveling start state (YES in step ST302), the management device 201G waits for reception of a device state notification from the vehicle-mounted relay device 101 (NO in step ST307).

[0294] Then, when the management device 201G receives a device status notification from the vehicle-mounted relay device 101 (YES in step ST307), it generates ON control signals S61 and S71 for turning on the power switches 92A and 92B, respectively, and transmits the ON control signals S61 and S71 to the vehicle-mounted relay device 101 via the signal line 6a (step ST308).

[0295] Next, the management device 201G generates an ON control signal S21 for turning on the control switch 91, and transmits the ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6a (step ST309).

[0296] Next, the management device 201G waits for reception of the switch-on notifications N21 and N22 from the vehicle-mounted relay device 101 (NO in step ST310).

[0297] Then, when the management device 201G receives switch-on notifications N21 and N22 from the vehicle-mounted relay device 101 (YES in step ST310), it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST311).

[0298] Next, after transmitting the ON control signal S21 to the vehicle-mounted relay device 101, the management device 201G determines whether or not an abnormality has occurred in the vehicle-mounted relay device 101 (step ST312).

[0299] Then, if the management device 201G determines that no abnormality has occurred in the vehicle relay device 101 (NO in step ST312), it waits to receive a brake-on notification from the parking brake ECU 201F and a driving end notification from the vehicle relay device 101 (NO in step ST313 and NO in step ST314).

[0300] Next, when the management device 201G receives a brake-on notification and a driving end notification from the parking brake ECU 201F and the vehicle-mounted relay device 101, respectively (YES in step ST313 and YES in step ST314), it generates off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively, and transmits them to the vehicle-mounted relay device 101 via signal line 6a (step ST315).

[0301] Furthermore, management device 201G generates an OFF control signal S22 for turning off control switch 91 and transmits it to in-vehicle relay device 101 (step ST316).

[0302] Next, the management device 201G waits for reception of switch-off notifications N11 and N12 from the vehicle-mounted relay device 101 (NO in step ST317).

[0303] Then, when the management device 201G receives the switch-off notification N11, N12 from the vehicle-mounted relay device 101 (YES in step ST317), it broadcasts an off-completion notification indicating that the transmission of the off control signal S22 has been completed to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST318).

[0304] On the other hand, if the management device 201G determines that an abnormality has occurred in the in-vehicle relay device 101 after transmitting the ON control signal S21 (YES in step ST312), it performs transition processing A2 to transition the autonomous driving ECU 201H to the evacuation traveling mode. For example, as described above, the management device 201G transmits a transition request frame to the autonomous driving ECU 201H (step ST319).

[0305] Next, the management device 201G performs a warning process K2 to output abnormality detection information M2 indicating that an abnormality has occurred in the vehicle-mounted relay device 101 (step ST320).

[0306] Next, the management device 201G performs a reset process R2 to reset the vehicle-mounted relay device 101 (step ST321). Note that step ST319, step ST320, and step ST321 may be executed in a reversed order or may be executed in parallel.

[0307] 14 and 15 are diagrams illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0308] 14 and 15, first, the management device 201G broadcasts a turn-off completion notification indicating that the turn-off control signal S22 has been transmitted to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST401).

[0309] Furthermore, the verification ECU 201E transmits the key verification information to the in-vehicle relay device 101 (step ST402).

[0310] Furthermore, the body ECU 201A transmits switch monitoring information indicating the monitoring results of the states of the brake pedal switch and the engine switch to the in-vehicle relay device 101 (step ST403).

[0311] Next, when the in-vehicle relay device 101 receives the key verification information and the switch monitoring information from the verification ECU 201E and the body ECU 201A, respectively, it performs a determination process J1 to determine whether the state of the vehicle 1 is in a traveling start state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling start state (step ST404).

[0312] Next, the vehicle relay device 101 broadcasts a travel start notification indicating that the state of the vehicle 1 is a travel start state to each of the vehicle-mounted devices 201 (step ST405).

[0313] Next, the vehicle-mounted repeater 101 generates an ON control signal S11 for turning on the control switch 91. The vehicle-mounted repeater 101 also generates an ON control signal S51 for turning on the power switch 92A (step ST406).

[0314] Next, the in-vehicle relay device 101 turns on the power switches 92A and 92B using the OR gate 82 as described above. Also, the in-vehicle relay device 101 turns on the control switch 91 using the OR gate 81 as described above. This starts the supply of power to the autonomous driving ECU 201H (step ST407).

[0315] Next, the autonomous driving ECU 201H starts up (step ST408), and transmits a start-up completion notification indicating that the autonomous driving ECU 201H has started up to the in-vehicle relay device 101 (step ST409).

[0316] Next, the automatic driving ECU 201H starts executing the automatic driving function (step ST410). Note that step ST409 and step ST410 may be executed in reverse order, or may be executed in parallel.

[0317] Furthermore, when the in-vehicle relay device 101 receives the start-up completion notification from the autonomous driving ECU 201H, it broadcasts to each in-vehicle device 201 a device state notification indicating that the autonomous driving ECU 201H is operating (step ST411).

[0318] In addition, management device 201G receives a device status notification from vehicle-mounted relay device 101 and generates ON control signals S61 and S71 for turning on power switches 92A and 92B, respectively, and ON control signal S21 for turning on control switch 91 (step ST412).

[0319] Next, the management device 201G transmits the generated ON control signals S61, S71, S21 to the vehicle-mounted relay device 101 via the signal line 6a (step ST413).

[0320] Next, the management device 201G broadcasts an on-unconfirmed notification to each of the other in-vehicle devices 201 and the in-vehicle relay device 101, indicating that the on control of the control switch 91 by the on control signal S21, the on control of the power switch 92A by the on control signal S61, and the on control of the power switch 92B by the on control signal S71 have not been completed (step ST414).

[0321] Next, when the vehicle-mounted relay device 101 receives the ON control signal S21 from the management device 201G, the vehicle-mounted relay device 101 transmits a switch-on notification N21 indicating that the ON control signal S21 has been received to the management device 201G (step ST415).

[0322] Furthermore, when the vehicle-mounted relay device 101 receives the ON control signals S61, S71 from the management device 201G, it transmits a switch-on notification N22 indicating that the ON control signals S61, S71 have been received to the management device 201G (step ST416).

[0323] Next, when the management device 201G receives the switch-on notification N21 from the in-vehicle relay device 101, it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST417).

[0324] Next, when the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101 and an on completion notification from the management device 201G, it performs a parking brake release process to transition the parking brake from the on state to the off state (step ST418).

[0325] 16 and 17 are diagrams illustrating another example of the processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0326] 16 and 17, first, the management device 201G broadcasts an ON completion notification indicating that ON control of the control switch 91 has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST501).

[0327] In addition, the body ECU 201A transmits to the vehicle relay device 101 a frame F including sensor information C1, sensor information C2, and sensor information C3, which respectively indicate the detection results of the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D while the vehicle 1 is traveling (step ST502).

[0328] The parking brake ECU 201F also determines whether to transition the parking brake from the OFF state to the ON state. Here, it is assumed that the parking brake ECU 201F has received an ON completion notification from the management device 201G and has determined to transition the parking brake from the OFF state to the ON state because the operation Q1 has been performed in the vehicle 1 (step ST503).

[0329] Next, the parking brake ECU 201F broadcasts a brake-on notification indicating that the parking brake has been switched to the on state to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST504).

[0330] Furthermore, the in-vehicle relay device 101 receives a frame F and a brake-on notification from the body ECU 201A and the parking brake ECU 201F, respectively, and performs a determination process J2 to determine whether the state of the vehicle 1 is in a traveling end state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling end state (step ST505).

[0331] Next, the vehicle-mounted relay device 101 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each of the vehicle-mounted devices 201 (step ST506).

[0332] Furthermore, when receiving the brake-on notification from the parking brake ECU 201F, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 before generating the OFF control signal S12 (step ST507).

[0333] Next, when the management device 201G receives a parking brake on notification from the parking brake ECU 201F and a driving end notification or an off transition request from the vehicle relay device 101, it generates an off control signal S22 for turning off the control switch 91, and off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (step ST508).

[0334] Next, the management device 201G broadcasts an OFF unconfirmed notification indicating that the OFF control of the control switch 91 by the OFF control signal S22 is unconfirmed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST509).

[0335] Next, the management device 201G transmits the generated OFF control signals S22, S62, and S72 to the vehicle-mounted relay device 101 via the signal line 6a (step ST510).

[0336] Next, when the vehicle-mounted relay device 101 receives the off control signals S22, S62, and S72 from the management device 201G, it transmits to the management device 201G a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received (step ST511).

[0337] Next, when the management device 201G receives the switch-off notifications N11 and N12 from the vehicle-mounted relay device 101, it broadcasts an off-completion notification indicating that the off-control signals S22, S62, and S72 have been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST512).

[0338] Next, when the autonomous driving ECU 201H receives a driving end notification or an OFF transition request from the in-vehicle relay device 101 and an OFF completion notification from the management device 201G, it performs pre-processing to stop the execution of the autonomous driving function. For example, as described above, the autonomous driving ECU 201H performs predetermined pre-processing in preparation for stopping the execution of the autonomous driving function (step ST513).

[0339] Next, the autonomous driving ECU 201H transmits a stop preparation completion notification indicating that preparation for stopping the execution of the autonomous driving function has been completed to the in-vehicle relay device 101 (step ST514).

[0340] Next, when the in-vehicle relay device 101 receives the stop preparation completion notification from the autonomous driving ECU 201H, it generates the OFF control signal S12 (step ST515).

[0341] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S12, it turns off the control switch 91 using the OR gate 81 as described above (step ST516).

[0342] Next, the in-vehicle relay device 101 checks whether or not the execution of various services has been stopped in the in-vehicle network 401. For example, as described above, when the in-vehicle relay device 101 receives a notification that the preparation for stopping has been completed from all the in-vehicle ECUs in the in-vehicle network 401, the in-vehicle relay device 101 determines that the execution of various services has been stopped (step ST517).

[0343] Next, when the in-vehicle relay device 101 confirms that the execution of various services has been stopped, it generates an OFF control signal S52 (step ST518).

[0344] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S52, it turns off the power switch 92A using the OR gate 82 as described above (step ST519).

[0345] In the in-vehicle system 301 according to the embodiment of the present disclosure, the control switch 91 and the power switches 92A and 92B are configured to be provided in the in-vehicle relay device 101, but this is not limited to this. Some or all of the control switch 91 and the power switches 92A and 92B may be configured to be provided outside the in-vehicle relay device 101.

[0346] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the logic circuit unit 23 is configured to include an OR gate 81, but this is not limited thereto. The logic circuit unit 23 may be configured to include a NAND gate instead of the OR gate 81. In this case, the signal generating unit 22 in the in-vehicle relay device 101 and the signal generating unit 42 in the management device 201G generate an ON control signal S11 and an ON control signal S21 at a logical low level, respectively. When at least one of the ON control signal S11 and the ON control signal S21 is input to the NAND gate, a gate signal at a logical high level is output from the NAND gate to the control switch 91. In other words, even when the logic circuit unit 23 includes a NAND gate, the control switch 91 turns on under the OR condition of the ON control signal S11 and the ON control signal S21.

[0347] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the first off condition under which the in-vehicle relay device 101 turns off the control switch 91 is different from the second off condition under which the management device 201G turns off the control switch 91, but this is not limited to this. The first off condition may be the same as the second off condition.

[0348] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the second off condition includes a condition related to the state of the parking brake of the vehicle 1, and the first off condition does not include a condition related to the state of the parking brake, but this is not limited to this. The second off condition may include a condition different from the condition related to the state of the parking brake, and the first off condition may not include the other condition.

[0349] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the first ON condition under which the in-vehicle relay device 101 turns on the control switch 91 is different from the second ON condition under which the management device 201G turns on the control switch 91, but this is not limited to this. The first ON condition may be the same as the second ON condition. In this case, when the state of the vehicle 1 is in a traveling start state, i.e., when the management device 201G receives a traveling start notification from the in-vehicle relay device 101, the management device 201G generates and outputs the ON control signal S21.

[0350] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the parking brake ECU 201F is configured to transition the parking brake from the ON state to the OFF state when the in-vehicle relay device 101 outputs the ON control signal S11, the management device 201G outputs the ON control signal S21, and the operation Q1 is performed in the vehicle 1, but this is not limited to this. The parking brake ECU 201F may also be configured to transition the parking brake from the ON state to the OFF state when other conditions are met.

[0351] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the control switch 91 is configured to switch on / off the supply of power to the driving-related equipment, but this is not limited to this. The control switch 91 may also be configured to switch on / off the supply of power to other in-vehicle equipment 201 that is different from the driving-related equipment.

[0352] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the autonomous driving ECU 201H is configured to start executing the autonomous driving function when the vehicle 1 is in a driving start state and the control switch 91 is turned on by the ON control signal S11 or the ON control signal S21, but this is not limited to this. The autonomous driving ECU 201H may also be configured to start executing the autonomous driving function when other conditions are met.

[0353] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the autonomous driving ECU 201H is configured to perform preprocessing to stop the execution of the autonomous driving function when it receives a driving end notification or an OFF transition request notification from the in-vehicle relay device 101 and the management device 201G outputs the OFF control signal S22, but this is not limited to this. The autonomous driving ECU 201H may be configured not to perform preprocessing when it is permitted not to perform processing such as saving data stored in volatile memory to non-volatile memory.

[0354] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the off control signal S22 when the management device 201G generates the off control signal S22 and the autonomous driving ECU 201H has performed preprocessing, but this is not limited to this. The in-vehicle relay device 101 may also be configured to generate the off control signal S12 when the management device 201G generates the off control signal S22, regardless of whether the autonomous driving ECU 201H has performed preprocessing.

[0355] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate an ON control signal S51 for turning on the power switch 92 when it determines that the state of the vehicle 1 is a traveling start state, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S51 when it determines that the driver has gotten into the vehicle 1, specifically when it determines that the driver has performed an operation to unlock the door at the driver's seat, or when it determines that the driver has sat in the driver's seat.

[0356] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0357] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the programs read from the one or more memories, or according to logic circuits pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separate processors may execute each of the processes in cooperation with each other. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium. [Explanation of symbols]

[0358] 1 vehicle 2, 2A, 2B, 2C, 2D CAN bus 5,5A,5B,5C,5D power wire 6,6a,6b signal lines 11 Relay Section 12,32 Processing section 13,33 Storage part 21,41 Judgment section 22,42 Signal generation unit 23 Logic Circuit Section 24,43 Notification Department 25,44 Monitoring Department 26,45 Abnormality processing section 27,46 Transition processing section 31 Communications Department 51 Power supply section 61 1st power supply 62 2nd power supply 71 Battery 72 DC / DC converters 81, 82, 83 OR gate 91 Control Switch 92, 92A, 92B Power switch 101 Vehicle relay device 201 Automotive equipment 301 In-Vehicle Systems 401 In-Vehicle Network

Claims

1. An in-vehicle system mounted on a vehicle, a first in-vehicle device and a second in-vehicle device that control a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle; the first in-vehicle device outputs a first on-control signal to the switch for turning on the switch; the second in-vehicle device outputs a second on-control signal to the switch for turning on the switch; The switch is turned on in response to an OR condition of the first on control signal and the second on control signal.

2. the first in-vehicle device outputs a first off control signal to the switch for turning off the switch; the second in-vehicle device outputs a second off control signal to the switch for turning off the switch; 2. The in-vehicle system according to claim 1, wherein a first off condition, which is a condition under which the first in-vehicle device outputs the first off control signal, is different from a second off condition, which is a condition under which the second in-vehicle device outputs the second off control signal.

3. the first off condition includes a condition related to a state of the specific in-vehicle device, The in-vehicle system according to claim 2 , wherein the second off condition does not include a condition relating to a state of the specific in-vehicle device.

4. The in-vehicle system according to claim 3 , wherein the specific in-vehicle device is an in-vehicle device that executes a function related to the running of the vehicle.

5. 3. The in-vehicle system according to claim 1, wherein a first on condition, which is a condition under which the first in-vehicle device outputs the first on control signal, is different from a second on condition, which is a condition under which the second in-vehicle device outputs the second on control signal.

6. The in-vehicle system further comprises: a third in-vehicle device that controls a parking brake of the vehicle; 3. The in-vehicle system according to claim 1, wherein the third in-vehicle device transitions the parking brake from an on state to an off state when the first in-vehicle device outputs the first on control signal, the second in-vehicle device outputs the second on control signal, and a predetermined operation is performed in the vehicle.

7. the specific in-vehicle device is a driving-related device that is an in-vehicle device that executes a function related to driving of the vehicle, 3. The in-vehicle system according to claim 1, wherein the driving-related device starts executing the function when the vehicle is in a state where it can start driving and the switch is in an on state by the first on control signal or the second on control signal.

8. The vehicle is provided with a plurality of the driving-related devices, 8. The in-vehicle system according to claim 7, wherein some of the driving-related devices among the plurality of driving-related devices start executing the function when the vehicle is in a state where the vehicle can start driving, the state of the switch is turned on by the first on control signal or the second on control signal, and the state of the parking brake of the vehicle is in an off state.

9. the first in-vehicle device transmits, to the driving-related device, a driving end notification indicating that the vehicle is in a state of ending driving or a request notification for requesting that execution of the function be stopped, before outputting a first off control signal to the switch for turning off the switch; 8. The in-vehicle system according to claim 7, wherein when the driving-related equipment receives the driving end notification or the request notification from the first in-vehicle device and the second in-vehicle device outputs a second off control signal for turning off the switch, the driving-related equipment performs pre-processing to stop the execution of the function before the power supply to the driving-related equipment is stopped.

10. 10. The in-vehicle system according to claim 9, wherein the first in-vehicle device outputs the first off control signal to the switch when the second in-vehicle device outputs the second off control signal and the driving-related equipment has performed the pre-processing.

11. the first in-vehicle device includes an OR circuit that outputs a signal indicating a logical sum of the first off control signal and the second off control signal to the switch; the second in-vehicle device transmits the second off control signal to the first in-vehicle device; when the first in-vehicle device receives the second off-control signal from the second in-vehicle device, the first in-vehicle device transmits a reception notification indicating that the second off-control signal has been received to the second in-vehicle device; When the second in-vehicle device receives the reception notification from the first in-vehicle device, the second in-vehicle device transmits a completion notification indicating that transmission of the second off-control signal has been completed to the driving-related device; The in-vehicle system according to claim 9 , wherein the driving-related device performs the pre-processing when the driving-related device receives the request notification from the first in-vehicle device and the completion notification from the second in-vehicle device.

12. The in-vehicle system further comprises: a third in-vehicle device that is an in-vehicle device that controls a parking brake of the vehicle; the first in-vehicle device includes an OR circuit that outputs a signal indicating a logical sum of the first ON control signal and the second ON control signal to the switch; the first in-vehicle device transmits to the second in-vehicle device and the third in-vehicle device a driving start notification indicating that the vehicle is in a state where it can start driving, or a device status notification indicating that the driving-related device is in operation; the second in-vehicle device transmits the second ON control signal to the first in-vehicle device when receiving the driving start notification or the device state notification from the first in-vehicle device; when the first in-vehicle device receives the second ON control signal from the second in-vehicle device, the first in-vehicle device transmits a reception notification indicating that the second ON control signal has been received to the second in-vehicle device; when the second in-vehicle device receives the reception notification from the first in-vehicle device, the second in-vehicle device transmits to the third in-vehicle device an ON execution notification indicating that ON control of the switch using the second ON control signal will be executed; 8. The in-vehicle system according to claim 7, wherein, when the parking brake is in an on state, the third in-vehicle device receives the driving start notification or the equipment status notification from the first in-vehicle device, receives the on execution notification from the second in-vehicle device, and when an operation to turn off the parking brake is performed in the vehicle, transitions the parking brake from the on state to the off state.

13. A power supply control method for an in-vehicle system mounted on a vehicle, the in-vehicle system including a first in-vehicle device and a second in-vehicle device, the first in-vehicle device and the second in-vehicle device being in-vehicle devices that control a switch for switching on / off power supply to a specific in-vehicle device in the vehicle, the first in-vehicle device outputs a first on-control signal to the switch for turning on the switch; the second in-vehicle device outputs a second on-control signal to the switch for turning on the switch; A power supply control method including a step of turning on the switch in response to an OR condition of the first on control signal and the second on control signal.

Images