Vehicle-mounted power supply control system and switch control method

Abstract

It is possible to suppress the restriction or stop of the function executed by the in-vehicle device and to suppress the influence of the abnormality.SOLUTION: An in-vehicle power supply control system mounted on a vehicle, comprising: a plurality of first control switches; a signal generation unit configured to generate a first control signal for turning on each of the first control switches; and an input unit configured to receive a second control signal for turning on each of the first control switches from outside the in-vehicle power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generation unit and the second control signal received by the input unit, and the in-vehicle power supply control system further comprises: a plurality of first measurement units provided for each of the first control switches and configured to perform measurement relating to the first control switch; and a first control unit configured to turn off the corresponding first control switch regardless of the OR condition, based on a measurement result of the first measurement unit.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle power supply control system and a switch control method. [Background technology]

[0002] Conventionally, technologies for controlling a switch that switches on and off the supply of power to an in-vehicle device have been developed. For example, Patent Document 1 (JP 2011-195101 A) discloses the following control device. That is, the control device is connected to a relay switch to which one or more loads are connected, and receives as input an instruction signal instructing the load to be turned on or off and a status signal corresponding to the status of the load. The control device controls the relay switch based on the input signals and includes a plurality of control units that output control signals for controlling the on / off of the relay switch. The instruction signal and status signal, a forced-off signal instructing the relay switch to be forcibly turned off, and a signal indicating the on / off status of the relay switch are input to one of the plurality of control units, and some or all of the signals input to the one control unit and the control signal output by the one control unit are input to the other control units. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2011-195101 Summary of the Invention [Problem to be solved by the invention]

[0004] For example, if an abnormality occurs in the device that controls the switch, the power supply to the in-vehicle device may be stopped, which may limit or stop the functions performed by the in-vehicle device.

[0005] Furthermore, if an abnormality such as a short to power, a short to ground, or a break occurs in the on-board device, the power supply source to the on-board device, or the wire harness connected to the on-board device, it is necessary to quickly turn off the switch to suppress the effects of the abnormality.There is a need for technology that can suppress the restriction or suspension of functions executed by the on-board device and can suppress the effects of the abnormality when an abnormality occurs in the vehicle.

[0006] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle power supply control system and a switch control method that can suppress the restriction or suspension of functions executed by in-vehicle equipment and suppress the effects of abnormalities. [Means for solving the problem]

[0007] The automotive power supply control system of the present disclosure is an automotive power supply control system mounted on a vehicle, and includes a plurality of first control switches that switch on and off the supply of power to automotive equipment in the vehicle, a signal generation unit that generates a first control signal for turning on each of the first control switches, and an input unit that receives a second control signal for turning on each of the first control switches from outside the automotive power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generation unit and the second control signal received by the input unit, and the automotive power supply control system further includes a plurality of first measurement units provided for each of the first control switches that perform measurements related to the first control switches, and a first control unit that turns off the corresponding first control switch based on the measurement results of the first measurement units regardless of the OR condition.

[0008] One aspect of the present disclosure can be realized not only as an in-vehicle power supply control system including such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle power supply control system. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to suppress the restriction or suspension of functions executed by in-vehicle devices and to suppress the effects of abnormalities. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle power supply control system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating in detail a partial configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of the configuration of the first monitoring unit in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 5] FIG. 5 is a diagram illustrating in detail a partial configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram illustrating an example of the configuration of the third monitoring unit in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram for explaining the on-control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram for explaining the on-control of the power switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of a configuration of an in-vehicle device according to an embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram for explaining an example of the off control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram for explaining another example of the power switch OFF control by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 12] FIG. 12 is a diagram illustrating in detail a partial configuration of an in-vehicle relay device according to an embodiment of the present disclosure. [Figure 13]FIG. 13 is a diagram illustrating an example of the configuration of the second monitoring unit in the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 14] FIG. 14 is a diagram for explaining the on-control of the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 15] FIG. 15 is a diagram illustrating the off control of the second switch performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 16] FIG. 16 is a diagram for explaining another example of the control of turning off the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 17] FIG. 17 is a diagram for explaining another example of the control of turning off the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 18] FIG. 18 is a diagram for explaining another example of the power switch OFF control by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 19] FIG. 19 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 20] FIG. 20 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 21] FIG. 21 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 22] FIG. 22 is a flowchart defining another example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 23] FIG. 23 is a flowchart illustrating an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs measurement processing. [Figure 24] FIG. 24 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs measurement processing. [Figure 25]FIG. 25 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 26] FIG. 26 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 27] FIG. 27 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 28] FIG. 28 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0011] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle power supply control system according to an embodiment of the present disclosure is an in-vehicle power supply control system mounted on a vehicle, and includes a plurality of first control switches that switch on and off the supply of power to in-vehicle equipment in the vehicle, a signal generation unit that generates a first control signal for turning on each of the first control switches, and an input unit that receives a second control signal for turning on each of the first control switches from outside the in-vehicle power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generation unit and the second control signal received by the input unit, and the in-vehicle power supply control system further includes a plurality of first measurement units provided for each of the first control switches that perform measurements related to the first control switches, and a first control unit that turns off the corresponding first control switch based on the measurement results of the first measurement units, regardless of the OR condition.

[0012] In this way, by configuring the system to turn on the first control switch based on an OR condition of the generated first control signal and the second control signal input from outside the in-vehicle power supply control system, even if an abnormality occurs and the first control signal cannot be generated, the first control switch can be turned on by the second control signal. In other words, the control for turning on the first control switch is made redundant, and the possibility of power supply to a specific in-vehicle device being stopped can be reduced.

[0013] Furthermore, by configuring the first control switch to be turned off depending on the measurement result for the first control switch, regardless of the above OR condition, for example, if the measurement result indicates the occurrence of an abnormality, the first control switch corresponding to the measurement result can be forcibly turned off, thereby suppressing the effects of the abnormality.

[0014] (2) In the above (1), the in-vehicle power supply control system may further include a second control switch that is turned on and off by a third control signal and a fourth control signal generated by the signal generating unit, respectively; a second measuring unit that is provided corresponding to the second control switch and performs measurements related to the second control switch; and a second control unit that turns off the second control switch based on the measurement results of the second measuring unit, regardless of the third control signal and the fourth control signal.

[0015] With this configuration, if the measurement results for a second control switch different from the first control switch indicate the occurrence of an abnormality, the second control switch can be forcibly turned off. Therefore, in a configuration having multiple switches whose on and off conditions differ from one another, the effects of abnormalities can be reliably suppressed.

[0016] (3) In the above (1) or (2), the signal generating unit may generate the first control signal using a condition different from a condition under which the second control signal is generated.

[0017] With this configuration, the control for turning on the first control switch can be made redundant.

[0018] (4) In any of (1) to (3) above, the vehicle power supply control system may further include a judgment unit that judges the state of the vehicle, and the signal generation unit may generate the first control signal based on the state judged by the judgment unit, and the second control signal may be generated using a judgment criterion different from the judgment criterion for the state used by the signal generation unit to generate the first control signal.

[0019] With this configuration, the first control switch can be turned on in various vehicle states, so that power can be supplied to specific in-vehicle devices more reliably.

[0020] (5) In (4) above, the judgment criteria used to generate the second control signal may include judgment criteria regarding the state of the parking brake of the vehicle, and the judgment criteria used to generate the first control signal may not include judgment criteria regarding the state of the parking brake.

[0021] With this configuration, for example, a control signal for turning on the first control switch can be output from outside the in-vehicle device depending on whether the parking brake is on or not, i.e., whether the vehicle is stopped or parked, and power can be supplied to a specific in-vehicle device. Also, in the in-vehicle device, control for turning on the first control switch can be made redundant regardless of the state of the parking brake.

[0022] (6) In any of (1) to (5) above, the signal generating unit may further generate a fifth control signal for turning off each of the first control switches, the input unit may further receive a sixth control signal for turning off each of the first control switches from outside the automotive power supply control system, and the signal generating unit may generate the sixth control signal using conditions different from the conditions for generating the fifth control signal.

[0023] With this configuration, even if an abnormality occurs in the signal generating unit, for example, the switch can be turned off by a control signal output from outside the vehicle power supply control system, thereby making the control for turning off the switch redundant.

[0024] (7) A switch control method according to an embodiment of the present disclosure is a switch control method in an on-board power supply control system mounted on a vehicle, the on-board power supply control system including a plurality of first control switches that switch on / off the supply of power to a first on-board device in the vehicle, and a plurality of first measurement units provided for each of the first control switches and performing measurements related to the first control switches, the method including the steps of generating a first control signal for turning on each of the first control switches, receiving a second control signal for turning on each of the first control switches from outside the on-board power supply control system, turning on each of the first control switches based on an OR condition of the generated first control signal and the second control signal, and turning off the corresponding first control switch based on the measurement results of the first measurement units, regardless of the OR condition.

[0025] In this way, by configuring the system to turn on the first control switch based on an OR condition of the generated first control signal and the second control signal input from outside the in-vehicle power supply control system, even if an abnormality occurs and the first control signal cannot be generated, the first control switch can be turned on by the second control signal. In other words, the control for turning on the first control switch is made redundant, and the possibility of power supply to a specific in-vehicle device being stopped can be reduced.

[0026] Furthermore, by configuring the first control switch to be turned off depending on the measurement result for the first control switch, regardless of the above OR condition, for example, if the measurement result indicates the occurrence of an abnormality, the first control switch corresponding to the measurement result can be forcibly turned off, thereby suppressing the effects of the abnormality.

[0027] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0028] [In-vehicle system] 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to FIG. 1, the in-vehicle system 301 includes an in-vehicle relay device 101, an in-vehicle device group including a plurality of in-vehicle devices 201, and a power supply unit 10. The in-vehicle system 301 is mounted on a vehicle 1.

[0029] The in-vehicle devices 201 include an in-vehicle ECU (Electronic Control Unit), an OTA (Over The Air) master, a sensor, an actuator, a motor, a navigation device, a human-machine interface, and a camera. The in-vehicle ECUs include an autonomous driving ECU, an engine ECU, a body ECU, a verification ECU, a steering ECU, a parking brake ECU, and a TCU (Telematics Communication Unit).

[0030] The in-vehicle relay device 101 and the multiple in-vehicle devices 201 configure an in-vehicle network 401. The multiple in-vehicle devices 201 are connected to the in-vehicle relay device 101 via, for example, a CAN bus 2 conforming to the CAN (Controller Area Network) standard and a connector (not shown).

[0031] 1, the in-vehicle system 301 includes in-vehicle devices 201A, 201B, 201C, 201D, 201E, 201F, 201G, 201H, and 201J that are in-vehicle devices 201. Also, in the example shown in FIG. 1, CAN buses 2A, 2B, 2C, and 2D are provided as the CAN bus 2.

[0032] The in-vehicle devices 201A, 201B, and 201C are connected to the in-vehicle relay device 101 via a CAN bus 2A. The in-vehicle devices 201D and 201E are connected to the in-vehicle relay device 101 via a CAN bus 2B. The in-vehicle devices 201F and 201G are connected to the in-vehicle relay device 101 via a CAN bus 2C. The in-vehicle devices 201H and 201J are connected to the in-vehicle relay device 101 via a CAN bus 2D.

[0033] The vehicle-mounted relay device 101 performs a relay process for relaying frames transmitted and received between the vehicle-mounted devices 201 .

[0034] For example, each in-vehicle device 201 transmits a CAN frame including various information (described later) such as information for assisting the autonomous driving performed by the vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, to another in-vehicle device 201 or the in-vehicle repeater 101. The in-vehicle repeater 101 relays a CAN frame received from a certain in-vehicle device 201 to another in-vehicle device 201. The in-vehicle repeater 101 also creates a CAN frame including the above-mentioned various information and the CAN-ID, and transmits the created CAN frame to the destination in-vehicle device 201.

[0035] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 2 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 2 are provided.

[0036] In addition, the vehicle-mounted relay device 101 and the vehicle-mounted equipment 201 may be configured to communicate in accordance with communication protocols such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark), instead of or in addition to communication in accordance with the CAN standard.

[0037] The vehicle-mounted relay device 101 and each vehicle-mounted device 201 communicate with each other to provide various services to the vehicle 1.

[0038] Specifically, the in-vehicle network 401 provides services related to the operation of the vehicle 1, a service for updating various software used in the in-vehicle network 401 via OTA, a service for contactlessly charging the battery 61a installed in the vehicle 1, a service for detecting malfunctions in the vehicle 1, and a service for remotely operating the vehicle 1.

[0039] [Power supply section] The power supply unit 10 supplies power to the vehicle 1. The power supply unit 10 includes a first power supply 61 and a second power supply 62. When a service is being executed, both the first power supply 61 and the second power supply 62 supply power to each device in the in-vehicle system 301. When the execution of the service is stopped, the second power supply 62 supplies power to each device in the in-vehicle system 301.

[0040] The first power supply 61 is connected to the in-vehicle repeater 101 via a power supply line 3. The second power supply 62 is connected to the in-vehicle repeater 101 via a power supply line 4. Each in-vehicle device 201 is connected to the in-vehicle repeater 101 via a power supply line 5. The power supply line 3 and the power supply line 5 are connected within the in-vehicle repeater 101. The power supply line 4 and the power supply line 5 are connected within the in-vehicle repeater 101.

[0041] 1, power lines 5A, 5B, 5C, and 5D are provided as the power line 5. In-vehicle devices 201A, 201B, and 201C are connected to the in-vehicle relay device 101 via the power line 5A. In-vehicle devices 201D and 201E are connected to the in-vehicle relay device 101 via the power line 5B. In-vehicle devices 201F and 201G are connected to the in-vehicle relay device 101 via the power line 5C. In-vehicle devices 201H and 201J are connected to the in-vehicle relay device 101 via the power line 5D.

[0042] For example, the first power supply 61 includes a battery 61a and a DC / DC converter 61b. The battery 61a is a high-voltage battery such as a lithium-ion battery. The DC / DC converter 61b, for example, steps down a DC voltage Va of the battery 61a to generate a DC voltage Vb. The DC / DC converter 61b then outputs the DC voltage Vb to the power supply line 3.

[0043] The second power supply 62 includes, for example, a low-voltage battery having a lower voltage than the battery 61a of the first power supply 61.

[0044] [Travel-related equipment] For example, the in-vehicle devices 201F, 201G, and 201J are in-vehicle devices 201 (hereinafter also referred to as "driving-related devices") that execute functions related to driving (hereinafter also referred to as "driving-related functions") of the vehicle 1. Specifically, the driving-related devices include an EPS (Electric Power Steering) ECU, a steering ECU, an autonomous driving ECU, a foot brake ECU, an ABS (Anti-lock Braking System) ECU, and a parking brake ECU.

[0045] 1, a plurality of driving-related devices are provided in a vehicle 1. Specifically, the driving-related devices are in-vehicle devices 201F, 201G, and 201J. The in-vehicle device 201F is a parking brake ECU, and the in-vehicle devices 201G and 201J are autonomous driving ECUs.

[0046] Hereinafter, the in-vehicle device 201F, the in-vehicle device 201G, and the in-vehicle device 201J will also be referred to as the parking brake ECU 201F, the automatic driving ECU 201G, and the automatic driving ECU 201J, respectively.

[0047] [First Switch 91] The vehicle-mounted relay device 101 includes a plurality of first switches 91 that switch on and off the supply of power to specific vehicle-mounted devices 201 in the vehicle 1. Each first switch 91 is, for example, a semiconductor switch. For ease of understanding, FIG. 1 shows the first switches 91 outside the vehicle-mounted relay device 101. The first switches 91 are an example of a first control switch. The term "first" does not imply a priority.

[0048] More specifically, for example, each first switch 91 switches between supplying and not supplying power to a driving-related device.

[0049] Specifically, for example, the in-vehicle relay device 101 includes first switches 91A and 91B that are multiple first switches 91. The first switch 91A and the first switch 91B switch between supplying and not supplying power to the autonomous driving ECU 201G and the autonomous driving ECU 201J, respectively.

[0050] [Power switch] For example, the vehicle-mounted repeater 101 further includes a power switch 93. The power switch 93 is provided between the power supply unit 10 and the first switch 91. The power switch 93 is, for example, a semiconductor switch. Note that, in FIG. 1, for ease of understanding, the power switch 93 is shown outside the vehicle-mounted repeater 101.

[0051] In the example shown in FIG. 1, the vehicle-mounted relay device 101 includes the power switch 93, which is made up of power switches 93A and 93B.

[0052] The power switch 93A switches the connection state between the first power source 61 and the first switch 91. In this embodiment, for example, the power switch 93A is in the ON state when a service is being executed in the in-vehicle network 401, and is in the OFF state when the execution of the service is stopped. The power switch 93B is always in the ON state.

[0053] [ON control signal] The in-vehicle relay device 101 outputs an ON control signal S11 for turning on each first switch 91 to the first switch 91. The in-vehicle device 201H outputs an ON control signal S21 for turning on each first switch 91 to the first switch 91 via the in-vehicle relay device 101. For example, each of the ON control signal S11 and the ON control signal S21 is a logical high level signal. The ON control signal S11 is an example of a first control signal, and the ON control signal S21 is an example of a second control signal. In the following description, the in-vehicle device 201H is also referred to as the management device 201H.

[0054] Vehicle repeater 101 outputs an ON control signal S51 for turning on power switch 93A to power switch 93A. Management device 201H outputs an ON control signal S61 for turning on power switch 93A to power switch 93A via vehicle repeater 101. For example, each of ON control signal S51 and ON control signal S61 is a logic high level signal.

[0055] Vehicle repeater 101 outputs an ON control signal S53 for turning on power switch 93B to power switch 93B. Management device 201H outputs an ON control signal S71 for turning on power switch 93B to power switch 93B via vehicle repeater 101. For example, each of ON control signal S53 and ON control signal S71 is a logic high level signal.

[0056] The power switch 93A is turned on under the OR condition of the ON control signal S51 and the ON control signal S61. The power switch 93B is turned on under the OR condition of the ON control signal S53 and the ON control signal S71. Details of the ON control of each power switch 93 will be described later.

[0057] For example, management device 201H is connected to in-vehicle relay device 101 via a plurality of signal lines. Hereinafter, each of the plurality of signal lines for transmitting various control signals output from management device 201H is also referred to as signal line 6. Note that management device 201H is not limited to a configuration in which it is connected to in-vehicle relay device 101 via a plurality of signal lines 6, and it may also be configured in which it is connected to in-vehicle relay device 101 via a single signal line 6.

[0058] 1, the in-vehicle devices 201B, 201C, 201D, and 201E are a body ECU, an occupant sensor, a buckle sensor, and a door opening / closing sensor, respectively. Hereinafter, the in-vehicle devices 201B, 201C, 201D, and 201E are also referred to as the body ECU 201B, the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E.

[0059] [Occupant sensor] For example, the occupant sensor 201C is a sensor that detects whether the driver is seated in the driver's seat of the vehicle 1 or whether the driver is leaving the driver's seat.

[0060] More specifically, for example, the occupant sensor 201C is a pressure sensor that measures the pressure P applied to the seat surface of the driver's seat. The occupant sensor 201C measures the pressure P, for example, periodically.

[0061] Then, the occupant sensor 201C detects whether or not a driver is seated in the driver's seat based on the measurement result of the pressure P, and performs a detection process D1 in which sensor information C1 indicating the detection result is transmitted to the body ECU 201B.

[0062] Specifically, for example, when the measurement value is equal to or greater than a predetermined threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver is seated in the driver's seat, including the measurement time ta of the measurement value.

[0063] On the other hand, for example, when the measurement value is less than the threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver has left the driver's seat, together with the measurement time ta of the measurement value.

[0064] The occupant sensor 201C is not limited to a pressure sensor, and may be a camera that takes an image of the driver's seat.

[0065] [Buckle sensor] The buckle sensor 201D is provided on the buckle of the driver's seat of the vehicle 1. The buckle sensor 201D periodically detects the state of the seat belt in the driver's seat and performs a detection process D2 in which sensor information C2 indicating the detection result and the detection time tb is transmitted to the body ECU 201B. For example, the buckle sensor 201D performs the detection process D2 at the same timing as the detection process D1 by the occupant sensor 201C.

[0066] Specifically, for example, when the tongue of the seat belt is engaged with the buckle, the buckle sensor 201D transmits, to the body ECU 201B, sensor information C2 indicating that the seat belt is in the locked state as a detection result.

[0067] On the other hand, for example, when the tongue of the seat belt is not engaged with the buckle, the buckle sensor 201D transmits sensor information C2 indicating that the state of the seat belt is unlocked as a detection result to the body ECU 201B.

[0068] [Door open / close sensor] The door opening / closing sensor 201E periodically detects the state of the door at the driver's seat, and performs a detection process D3 in which sensor information C3 indicating the detection result and the detection time tc is transmitted to the body ECU 201B. For example, the door opening / closing sensor 201E performs the detection process D3 at the same timing as the detection process D1 by the occupant sensor 201C.

[0069] [Body ECU] The body ECU 201B outputs control signals to drive body-related devices such as door lock mechanisms, wipers, and power windows. Specifically, for example, the body ECU 201B receives sensor information from each of the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, and outputs control signals based on the received sensor information to the body-related devices.

[0070] Furthermore, the body ECU 201B creates a CAN frame (hereinafter also referred to as "frame F") including the sensor information C1, sensor information C2, and sensor information C3 received from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively.

[0071] As described above, the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E transmit the sensor information C1, the sensor information C2, and the sensor information C3, respectively, to the body ECU 201B, for example, periodically.

[0072] When the body ECU 201B receives sensor information C1, sensor information C2, and sensor information C3 from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively, it stores the received sensor information C1, sensor information C2, and sensor information C3 in a memory unit not shown.

[0073] For example, when the processing timing Ta for creating a frame F arrives, the body ECU 201B acquires, from the storage unit, the sensor information C1, C2, and C3 accumulated during the period from the previous processing timing Ta to the current processing timing Ta, and creates a frame F including the acquired sensor information C1, C2, and C3. Then, the body ECU 201B transmits the created frame F to the in-vehicle relay device 101.

[0074] Furthermore, the body ECU 201B performs a switch monitoring process to monitor the state of the brake pedal switch or the engine switch. Then, the body ECU 201B transmits switch monitoring information indicating the monitoring results of the switch monitoring process to the in-vehicle relay device 101. The body ECU 201B performs the switch monitoring process and transmits the switch monitoring information, for example, periodically.

[0075] [Verification ECU] 1, the in-vehicle device 201A is a verification ECU, and will hereinafter also be referred to as the verification ECU 201A.

[0076] For example, the verification ECU 201A is connected to an electronic key sensor (not shown) that can measure radio waves output from the electronic key. The electronic key sensor transmits the measurement results and key information indicating identification information (hereinafter also referred to as "key ID") contained in the radio waves to the verification ECU 201A. The key ID is an ID unique to each electronic key.

[0077] The storage unit of the verification ECU 201A stores the key ID. When the verification ECU 201A receives key information from the electronic key sensor, if the measurement result indicated by the received key information satisfies a predetermined condition and the key ID indicated by the key information matches the key ID stored in the storage unit, the verification ECU 201A transmits key verification information to the in-vehicle relay device 101 indicating that the electronic key is present near the vehicle 1 and the key IDs match.

[0078] [Parking brake ECU] The parking brake ECU 201F controls, for example, the parking brake of the vehicle 1. When activated, the parking brake ECU 201F broadcasts parking brake information indicating the state of the parking brake to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0079] [Second Switch 92] For example, the in-vehicle relay device 101 further includes a second switch 92 that switches on / off the supply of power to in-vehicle devices 201 other than the driving-related devices (hereinafter also referred to as "non-driving-related devices"). The second switch 92 is, for example, a semiconductor switch. The second switch 92 is an example of a second control switch. Note that, for ease of understanding, in FIG. 1, the second switch 92 is shown outside the in-vehicle relay device 101. Also, the term "second" does not imply priority.

[0080] 1, the non-driving-related devices are the verification ECU 201A, the body ECU 201B, the occupant sensor 201C, the buckle sensor 201D, the door opening / closing sensor 201E, and the management device 201H. Hereinafter, an example will be described in which the second switch 92 switches between supplying and not supplying power to the door opening / closing sensor 201E.

[0081] The in-vehicle relay device 101 is not limited to having one second switch 92, and may have a configuration including a plurality of second switches 92.

[0082] [In-vehicle relay device] FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle relay device 101 includes a relay unit 11, a processing unit 12, and a storage unit 13. The processing unit 12 includes a power management unit 21, a determination unit 22, a notification unit 23, a signal generation unit 24, a logic circuit unit 25, a plurality of first monitoring units 26, a second monitoring unit 27, and a plurality of third monitoring units 28. One or both of the relay unit 11 and the processing unit 12 are realized, for example, by a processing circuit including one or more processors. The storage unit 13 is, for example, a non-volatile memory included in the processing circuit. The logic circuit unit 25 is an example of an input unit.

[0083] (Relay section) The relay unit 11 receives a CAN frame transmitted from a certain in-vehicle device 201. Then, the relay unit 11 checks whether the received CAN frame is a CAN frame that the in-vehicle relay device 101 of its own should receive.

[0084] The storage unit 13 stores, for example, a reception list L1 that indicates the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list L1 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0085] When the relay unit 11 receives a CAN frame, it refers to the reception list in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0086] For example, if the CAN-ID included in the received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0087] On the other hand, if the CAN-ID included in the received CAN frame is registered in the reception list L1 and the destination of the CAN frame is the in-vehicle device 201, for example, the relay unit 11 performs relay processing.

[0088] Specifically, for example, the storage unit 13 stores a routing table indicating the correspondence between the CAN-ID, the device to which the CAN frame is to be transmitted, and the CAN bus 2 to which the device to which the CAN frame is to be transmitted (hereinafter also referred to as the "destination bus"). The routing table is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0089] For example, if the CAN-ID contained in the CAN frame received from the in-vehicle device 201 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0090] When the relay unit 11 confirms that the destination device of the received CAN frame is the in-vehicle device 201, it refers to the routing table to identify the destination bus corresponding to the destination device, and then outputs the received CAN frame to the identified destination bus.

[0091] On the other hand, when the relay unit 11 confirms that the device to which the received CAN frame is to be transmitted is its own in-vehicle relay unit 101, it outputs the CAN frame to the processing unit 12.

[0092] [Problem description] 1 again, in the in-vehicle system 301, for example, if an abnormality occurs in a device that controls the first switch 91 that switches on and off the supply of power to the driving-related equipment, the power supply to the driving-related equipment may be stopped. In this case, there is a possibility that the driving-related functions executed by the driving-related equipment may be limited or stopped.

[0093] Furthermore, if an abnormality such as a short to the power supply, a ground fault, an overvoltage, or an overcurrent occurs in the driving-related equipment, the power supply unit 10, or the power lines 5 connected to the driving-related equipment, a further abnormality such as a drop or rise in the power supply voltage supplied to the driving-related equipment may occur. Therefore, when an abnormality occurs in the vehicle 1, it is necessary to suppress the effect of the abnormality.

[0094] Therefore, the in-vehicle system 301 according to the embodiment of the present disclosure solves the above problem by the following configuration and operation.

[0095] [In-vehicle relay device] (Judgment Department) 2 again, in the vehicle-mounted relay device 101, for example, the determination unit 22 performs a determination process to determine the state of the vehicle 1. More specifically, for example, the determination unit 22 performs a determination process J1 to determine whether or not the vehicle 1 is in a state in which it can start traveling (hereinafter also referred to as a "traveling start state").

[0096] For example, when the verification of the electronic key by the verification ECU 201A is completed and the monitoring result indicated by the switch monitoring information B satisfies a predetermined condition, the determination unit 22 determines that the vehicle 1 is in a traveling start state.

[0097] More specifically, when the determination unit 22 receives key verification information from the verification ECU 201A via the relay unit 11, the determination unit 22 checks the monitoring result indicated by the switch monitoring information (hereinafter also referred to as "switch monitoring information B") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the key verification information. If the switch monitoring information B indicates that the brake switch or the engine switch is in the on state, the determination unit 22 determines that the vehicle 1 is in the running start state.

[0098] For example, when the determination unit 22 determines that the state of the vehicle 1 is a running start state, the determination unit 22 periodically broadcasts a running start notification indicating that the state of the vehicle 1 is a running start state to each in-vehicle device 201 via the relay unit 11. In addition, the determination unit 22 outputs the running start notification to the signal generation unit 24, the first monitoring units 26A and 26B, and the second monitoring unit 27.

[0099] On the other hand, if the switch monitoring information B indicates that key matching information has not arrived from the matching ECU 201A or that the brake switch or engine switch is in the off state, the judgment unit 22 judges that the vehicle 1 is not in the running start state.

[0100] [ON control signal S11] 3 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. With reference to FIG. 2 and FIG. 3, for example, a signal generating unit 24 in the in-vehicle relay device 101 generates an ON control signal S11 based on the state of the vehicle 1 determined by the determining unit 22.

[0101] More specifically, for example, when the signal generating unit 24 receives a running start notification from the determining unit 22, that is, when the determining unit 22 determines that the state of the vehicle 1 is a running start state, the signal generating unit 24 generates an ON control signal S11. Then, the signal generating unit 24 outputs the generated ON control signal S11 to the logic circuit unit 25.

[0102] The logic circuit unit 25 receives an ON control signal S11 from the signal generating unit 24. The logic circuit unit 25 also receives an ON control signal S21 via a signal line 6 from outside the vehicle relay device 101, that is, from the management device 201H.

[0103] Logic circuit unit 25 includes a plurality of OR gates 71 and a plurality of AND gates 81. In the example shown in Fig. 3, logic circuit unit 25 includes OR gates 71A and 71B which are the plurality of OR gates 71, and AND gates 81A and 81B which are the plurality of AND gates 81.

[0104] [1st Monitoring Department] 4 is a diagram illustrating an example of the configuration of a first monitoring unit in an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 4, a first monitoring unit 26 is provided for each first switch 91. First monitoring unit 26A includes a first measuring unit 31A and a first control unit 32A. First monitoring unit 26B includes a first measuring unit 31B and a first control unit 32B.

[0105] (First measurement section) The first measuring unit 31A and the first measuring unit 31B perform a measurement process H1 related to the first switch 91. More specifically, the first measuring unit 31A and the first measuring unit 31B perform measurements related to the first switch 91A and the first switch 91B, respectively.

[0106] Specifically, for example, first measurement unit 31A and first measurement unit 31B measure a current U1 flowing between the input terminal of power switch 93A and the output terminal of first switch 91A, and a current U2 flowing between the drain and source of first switch 91B, respectively. First measurement unit 31A and first measurement unit 31B perform measurement processing H1, for example, periodically. Note that first measurement unit 31A and first measurement unit 31B may also be configured to measure a voltage V1 between the input terminal of power switch 93A and the output terminal of first switch 91A, and a voltage V2 between the drain and source of first switch 91B, respectively.

[0107] Then, the first measuring unit 31A outputs measurement result information M1 indicating the measurement result K1 to the first control unit 32A. Furthermore, the first measuring unit 31B outputs measurement result information M2 indicating the measurement result K2 to the first control unit 32B.

[0108] (First control section) 3 and 4, first control unit 32A determines the state of first switch 91A based on measurement result K1 of first measuring unit 31A.

[0109] More specifically, for example, if the measurement result K1 indicated by the measurement result information M1 received from the first measurement unit 31A satisfies a predetermined condition W1, the first control unit 32A determines that the state of the first switch 91A is normal. In this case, the first control unit 32A generates a control signal E1 of a logically high level. The first control unit 32A then outputs the generated control signal E1 to the logic circuit unit 25. For example, when the first measurement unit 31A measures a current U1, the predetermined condition W1 is that the measurement result K1 is less than a predetermined threshold value Th11. Note that when the first measurement unit 31A measures a voltage V1, the predetermined condition W1 may be that the measurement result K1 is a value within a predetermined range.

[0110] On the other hand, if the measurement result K1 indicated by the measurement result information M1 received from the first measuring unit 31A does not satisfy the predetermined condition W1, the first control unit 32A determines that the state of the first switch 91A is abnormal. In this case, the first control unit 32A generates a control signal E3 of a logical low level. The first control unit 32A then outputs the generated control signal E3 to the logic circuit unit 25. The control signal E1 and the control signal E3 are output exclusively.

[0111] Furthermore, when first control unit 32A receives a driving start notification from determination unit 22 or a power-on completion notification (described later) from management device 201H, first control unit 32A generates a control signal E1 of a logical high level. Then, first control unit 32A outputs the generated control signal E1 to logic circuit unit 25.

[0112] The first control unit 32B determines the state of the first switch 91B based on the measurement result K2 of the first measurement unit 31B.

[0113] More specifically, for example, if the measurement result K2 indicated by the measurement result information M2 received from the first measurement unit 31B satisfies a predetermined condition W2, the first control unit 32B determines that the state of the first switch 91B is normal. In this case, the first control unit 32B generates a control signal E2 of a logical high level. The first control unit 32B then outputs the generated control signal E2 to the logic circuit unit 25. For example, when the first measurement unit 31B measures a current U2, the predetermined condition W2 is that the measurement result K2 is less than a predetermined threshold value Th12. Note that when the first measurement unit 31B measures a voltage V2, the predetermined condition W2 may be that the measurement result K2 is a value within a predetermined range.

[0114] On the other hand, if the measurement result K2 indicated by the measurement result information M2 received from the first measurement unit 31B does not satisfy the predetermined condition W2, the first control unit 32B determines that the state of the first switch 91B is abnormal. In this case, the first control unit 32B generates a control signal E4 of a logical low level. The first control unit 32B then outputs the generated control signal E4 to the logic circuit unit 25. The control signals E2 and E4 are output exclusively.

[0115] Furthermore, when first control unit 32B receives a driving start notification from determination unit 22 or a power-on completion notification (described later) from management device 201H, first control unit 32B generates control signal E2 of a logical high level. Then, first control unit 32B outputs the generated control signal E2 to logic circuit unit 25.

[0116] 5 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 5, in in-vehicle relay device 101, logic circuit unit 25 further includes a plurality of OR gates 72 and a plurality of AND gates 73. In the example illustrated in FIG. 5, logic circuit unit 25 includes OR gates 72A and 72B, which are the plurality of OR gates 72, and a plurality of AND gates 73A and 73B, which are the plurality of AND gates 73.

[0117] [Third Monitoring Department] 6 is a diagram illustrating an example of the configuration of a third monitoring unit in an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 6, a third monitoring unit 28 is provided for each power switch 93. Third monitoring unit 28A includes a third measurement unit 35A and a third control unit 36A. Third monitoring unit 28B includes a third measurement unit 35B and a third control unit 36B.

[0118] (Third measurement section) The first measuring unit 31A and the first measuring unit 31B perform a measurement process H3 related to the power switch 93. More specifically, the third measuring unit 35A and the third measuring unit 35B perform measurements related to the power switch 93A and the power switch 93B, respectively.

[0119] Specifically, for example, third measurement unit 35A and third measurement unit 35B measure current U3 flowing between the drain and source of power switch 93A and current U4 flowing between the drain and source of power switch 93B, respectively. Third measurement unit 35A and third measurement unit 35B perform measurement process H3, for example, periodically. Note that third measurement unit 35A and third measurement unit 35B may also be configured to measure voltage V3 between the drain and source of power switch 93A and voltage V4 between the drain and source of power switch 93B, respectively.

[0120] Then, the third measuring unit 35A outputs measurement result information M5 indicating the measurement result K5 to the third control unit 36A. Furthermore, the third measuring unit 35B outputs measurement result information M6 indicating the measurement result K6 to the third control unit 36B.

[0121] (Third control section) The third control unit 36A determines the state of the power switch 93A based on the measurement result K5 of the third measurement unit 35A.

[0122] More specifically, for example, if the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A satisfies a predetermined condition W5, the third control unit 36A determines that the power switch 93A is in a normal state. In this case, the third control unit 36A generates a control signal E7 of a logically high level. The third control unit 36A then outputs the generated control signal E7 to the logic circuit unit 25. For example, when the third measurement unit 35A measures the current U3, the predetermined condition W5 is that the measurement result K5 is less than a predetermined threshold value Th21. Note that when the third measurement unit 35A measures the voltage V3, the predetermined condition W5 may be that the measurement result K5 is within a predetermined range.

[0123] On the other hand, if the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A does not satisfy the predetermined condition W5, the third control unit 36A determines that the state of the power switch 93A is abnormal. In this case, the third control unit 36A generates a control signal E9 of a logical low level. The third control unit 36A then outputs the generated control signal E9 to the logic circuit unit 25. The control signals E7 and E9 are output exclusively.

[0124] The third control unit 36B determines the state of the power switch 93B based on the measurement result K6 of the third measurement unit 35B.

[0125] More specifically, for example, if the measurement result K6 indicated by the measurement result information M6 received from the third measurement unit 35B satisfies a predetermined condition W6, the third control unit 36B determines that the power switch 93B is in a normal state. In this case, the third control unit 36B generates a control signal E8 of a logically high level. The third control unit 36B then outputs the generated control signal E8 to the logic circuit unit 25. For example, when the third measurement unit 35B measures the current U4, the predetermined condition W6 is that the measurement result K6 is less than a predetermined threshold value Th22. Note that when the third measurement unit 35B measures the voltage V2, the predetermined condition W6 may be that the measurement result K6 is within a predetermined range.

[0126] On the other hand, if the measurement result K6 indicated by the measurement result information M6 received from the third measurement unit 35B does not satisfy the predetermined condition W6, the third control unit 36B determines that the state of the power switch 93B is abnormal. In this case, the third control unit 36B generates a control signal E10 at a logical low level. The third control unit 36B then outputs the generated control signal E10 to the logic circuit unit 25. The control signals E8 and E10 are output exclusively.

[0127] [On-control of each switch by the in-vehicle relay device 101] (Turning on the first switch 91) FIG. 7 is a diagram for explaining the on-control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0128] Referring to FIG. 7, when at least one of ON control signal S11 and ON control signal S21 is input to OR gate 71A, gate signal G1 at a logic high level is output from OR gate 71A to AND gate 81A.

[0129] When gate signal G1 at a logic high level and control signal E1 at a logic high level are input to AND gate 81A, gate signal A1 at a logic high level is output from AND gate 81A to first switch 91A.

[0130] The first switch 91A is turned on when it receives a gate signal A1 of a logic high level from the AND gate 81A, thereby supplying power from the power supply unit 10 to the automatic driving ECU 201G.

[0131] When at least one of ON control signal S11 and ON control signal S21 is input to OR gate 71B, gate signal G2 at a logic high level is output from OR gate 71B to AND gate 81B.

[0132] When gate signal G2 at a logic high level and control signal E2 at a logic high level are input to AND gate 81B, gate signal A2 at a logic high level is output from AND gate 81B to first switch 91B.

[0133] First switch 91B is turned on when it receives gate signal A2 of a logic high level from AND gate 81B, thereby supplying power from power supply unit 10 to automatic driving ECU 201J.

[0134] (Power switch 93 ON control) FIG. 8 is a diagram for explaining the on-control of the power switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0135] Referring to FIG. 8, when at least one of ON control signal S51 and ON control signal S61 is input to OR gate 72A, gate signal G5 at a logic high level is output from OR gate 72A.

[0136] When gate signal G5 at a logic high level and control signal E7 at a logic high level are input to AND gate 73A, gate signal A7 at a logic high level is output from AND gate 73A to power switch 93A.

[0137] Furthermore, when at least one of ON control signal S53 and ON control signal S71 is input to OR gate 72B, gate signal G7 at a logic high level is output from OR gate 72B.

[0138] When gate signal G7 at a logic high level and control signal E8 at a logic high level are input to AND gate 73B, gate signal A8 at a logic high level is output from AND gate 73B to power switch 93B.

[0139] The power switch 93A is turned on when it receives a gate signal A7 of a logic high level from the AND gate 73A. The power switch 93B is turned on when it receives a gate signal A8 of a logic high level from the AND gate 73B. This causes the connection state between the first power supply 61 and the first switch 91 and the connection state between the second power supply 62 and the first switch 91 to transition from the off state to the on state.

[0140] As described above, in this embodiment, the power switch 93B is always in the on state. That is, the power switch 93B remains in the on state even when the microcomputer mounted on the in-vehicle relay device 101 is in the sleep state. In order to maintain the power switch 93B in the on state, for example, an on-holding unit (not shown) is provided between the signal generating unit 24 and the AND gate 73B in the in-vehicle relay device 101. This makes it possible to reduce the dark current flowing through the power supply unit 10 when the ignition power of the vehicle 1 is in the off state.

[0141] In order to keep the power switch 93B in the on state, the power switch 93B may be a normally-on switch.

[0142] [Startup completion notification] Referring again to FIG. 1, for example, when the state of the vehicle 1 is in a driving start state and the state of the first switch 91 is in an on state by the on control signal S11 or the on control signal S21, the automatic driving ECUs 201G, 201J start executing driving-related functions, specifically automatic driving functions.

[0143] More specifically, the autonomous driving ECUs 201G and 201J are activated when the first switches 91A and 91B are turned on while the vehicle 1 is in a traveling start state. The autonomous driving ECUs 201G and 201J then start executing the autonomous driving function. Furthermore, upon activation, the autonomous driving ECUs 201G and 201J transmit activation completion notifications N1 to the in-vehicle relay device 101, indicating that they have been activated.

[0144] The autonomous driving ECUs 201G, 201J may be configured to start executing the autonomous driving function when the vehicle 1 is in a traveling start state, the first switch 91 is in an on state, and the parking brake is in an off state. In this case, when the first switch 91 is in an on state and the parking brake state indicated by the brake information received from the parking brake ECU 201F is in an off state, the autonomous driving ECUs 201G, 201J are activated and start executing the autonomous driving function.

[0145] [Device status notification] Referring again to Figure 2, in the in-vehicle relay device 101, when the notification unit 23 receives a startup completion notification N1 from the autonomous driving ECUs 201G, 201J via the relay unit 11, it periodically broadcasts an equipment status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each in-vehicle device 201 via the relay unit 11.

[0146] [Managed equipment] 9 is a diagram illustrating an example of the configuration of an in-vehicle device according to an embodiment of the present disclosure, showing the configuration of a management device 201H.

[0147] 9, management device 201H includes communication unit 41, processing unit 42, and storage unit 43. Processing unit 42 includes determination unit 51, signal generation unit 52, and notification unit 53. One or both of communication unit 41 and processing unit 42 are realized, for example, by a processing circuit including one or more processors. Storage unit 43 is, for example, a non-volatile memory included in the processing circuit.

[0148] For example, the storage unit 43 stores a reception list L2 that indicates CAN-IDs included in CAN frames that should be received by the management device 201H. The reception list L2 is registered in the storage unit 43 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0149] When the communication unit 41 receives a CAN frame from the in-vehicle relay device 101 or another in-vehicle device 201 other than the management device 201H, it reads out the reception list L2 in the storage unit 43. Then, by referring to the reception list L2, the communication unit 41 checks whether the CAN-ID included in the received CAN frame is registered in the reception list L2.

[0150] If the CAN-ID included in the received CAN frame is registered in the reception list L2, the communication unit 41 outputs the CAN frame to the processing unit 12. On the other hand, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the communication unit 41 discards the CAN frame.

[0151] The determination unit 51 determines the states of the autonomous driving ECUs 201G and 201J. Specifically, for example, when the determination unit 51 receives an equipment state notification from the in-vehicle relay device 101 via the communication unit 41, the determination unit 51 determines that the autonomous driving ECU 201G or the autonomous driving ECU 201J is operating. Then, the determination unit 51 outputs the received equipment state notification to the signal generation unit 52.

[0152] (Generation and output of ON control signals S21, S61, S71) For example, the second ON condition under which management device 201H outputs ON control signal S21 is different from the first ON condition under which in-vehicle relay device 101 outputs ON control signal S11. As described above, in-vehicle relay device 101 generates ON control signal S11 when it determines that the state of vehicle 1 is the traveling start state. On the other hand, in response to receiving a device state notification from in-vehicle relay device 101, management device 201H generates ON control signals S21, S61, and S71.

[0153] Specifically, for example, in managed device 201H, when signal generating section 52 receives device state notification from determining section 51, it generates ON control signals S21, S61, S71.

[0154] Then, the signal generating unit 52 outputs the generated ON control signals S21, S61, and S71 to the in-vehicle repeater 101. For example, the signal generating unit 52 outputs the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at the same timing. Note that the signal generating unit 52 may output some of the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at a timing different from that of the other ON control signals.

[0155] Specifically, for example, when the signal generating unit 52 generates the ON control signal S21, the signal generating unit 52 transmits the generated ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6.

[0156] Furthermore, for example, when the signal generating unit 52 generates the ON control signals S61 and S71, it transmits the generated ON control signals S61 and S71 to the vehicle-mounted relay device 101 via the signal line 6.

[0157] [Controlling the on-state of each switch using control device 201H] (Power switch 93 ON control) 8, logic circuit unit 25 in in-vehicle relay device 101 receives ON control signals S61 and S71 from management device 201H via signal line 6 shown in FIG. 2. OR gate 72A in logic circuit unit 25 outputs gate signal S3 of a logic high level to power switch 93A. OR gate 72B in logic circuit unit 25 outputs gate signal S5 of a logic high level to power switch 93B.

[0158] Power switch 93A is turned on when it receives gate signal S3 of a logic high level from OR gate 72A, and power switch 93B is turned on when it receives gate signal S5 of a logic high level from OR gate 72B.

[0159] Furthermore, when logic circuit unit 25 receives ON control signals S61, S71 from managed device 201H, it outputs to notification unit 23 a switch ON notification N22 indicating that ON control signals S61, S71 have been received.

[0160] When the notification unit 23 receives the switch-on notification N22 from the logic circuit unit 25, it transmits the switch-on notification N22 to the management device 201H via the relay unit 11.

[0161] (Turning on the first switch 91) 7 again, in in-vehicle relay device 101, logic circuit unit 25 receives ON control signal S21 from management device 201H via signal line 6. Then, OR gate 71A in logic circuit unit 25 outputs gate signal G1 of a logical high level to first switch 91A. Also, OR gate 71B in logic circuit unit 25 outputs gate signal G2 of a logical high level to first switch 91B.

[0162] (Switch-on notification N21, N22) Furthermore, when logic circuit unit 25 receives ON control signal S21 from managed device 201H, logic circuit unit 25 outputs switch ON notification N21 to notification unit 23 indicating that ON control signal S21 has been received from managed device 201H.

[0163] When the notification unit 23 receives the switch-on notification N21 from the logic circuit unit 25, it transmits the switch-on notification N21 to the management device 201H via the relay unit 11.

[0164] Furthermore, when logic circuit unit 25 receives ON control signals S61, S71 from managed device 201H via signal line 6a, it outputs to notification unit 23 a switch ON notification N22 indicating that ON control signals S61, S71 have been received from managed device 201H.

[0165] When the notification unit 23 receives the switch-on notification N22 from the logic circuit unit 25, it transmits the switch-on notification N22 to the management device 201H via the relay unit 11.

[0166] [On pending notification] Referring again to Figure 9, in the management device 201H, the notification unit 53 broadcasts an on-uncertainty notification via the communication unit 41 to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H, indicating that the execution of the on control of the first switch 91 by the on control signal S21, the on control of the power switch 93A by the on control signal S61, and the on control of the power switch 93B by the on control signal S71 is unconfirmed.

[0167] Specifically, the notification unit 53 broadcasts the on-unconfirmed notification to the other in-vehicle devices 201 and the in-vehicle relay 101, for example periodically, until it receives the switch-on notification N21 from the in-vehicle relay 101 via the communication unit 41.

[0168] [On completion notification] In addition, when the notification unit 53 receives a switch-on notification N21 from the vehicle-mounted relay device 101 via the communication unit 41, it broadcasts an on-completion notification via the communication unit 41 to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 other than its own management device 201H, indicating that on control of the first switch 91 is being executed using the on control signal S21, i.e., that the execution of the on control in the vehicle-mounted relay device 101 has been confirmed.

[0169] [Parking brake off control] Referring again to Figure 1, for example, when the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101 while the parking brake is in the on state, receives an on completion notification from the management device 201H, and performs an operation Q1 to turn the parking brake off in the vehicle 1, the parking brake ECU 201F performs a parking brake release process to transition the parking brake from the on state to the off state.

[0170] The following describes an example in which the parking brake ECU 201F performs parking brake release processing when it receives a driving start notification and an on completion notification from the in-vehicle relay device 101 and the management device 201H, respectively, and the driver performs operation Q1. Operation Q1 is, for example, an operation in which the driver of the vehicle 1 moves the shift lever to a position other than "parking."

[0171] Specifically, for example, a shift lever sensor (not shown) is connected to the parking brake ECU 201F. The shift lever sensor periodically detects the position of the shift lever and performs detection processing D4, in which sensor information C4 indicating the detection result is transmitted to the parking brake ECU 201F.

[0172] When the parking brake ECU 201F receives the sensor information C4 from the shift lever sensor, the parking brake ECU 201F stores the received sensor information C4 in a storage unit.

[0173] For example, when the parking brake ECU 201F receives a driving start notification from the in-vehicle relay device 101, the parking brake ECU 201F acquires, from the storage unit, the sensor information C4 received during a period from the reception of the driving start notification until a predetermined time has elapsed.

[0174] When the sensor information C4 acquired from the storage unit indicates a shift lever position other than "parking" as the detection result and the parking brake ECU 201F receives an ON completion notification from the management device 201H, the parking brake ECU 201F outputs an OFF control signal S32 to the parking brake to transition the parking brake to the OFF state. This transitions the parking brake from the ON state to the OFF state.

[0175] [Parking brake on control] For example, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state when it receives an ON completion notification from the management device 201H and a predetermined operation Q2 is performed in the vehicle 1. For example, the operation Q2 is an operation in which the driver moves the shift lever to the "parking" position.

[0176] More specifically, for example, after receiving an ON completion notification from the management device 201H, if the sensor information C4 received from the shift lever sensor indicates "parking" as the detection result, the parking brake ECU 201F outputs an ON control signal S31 to the parking brake to transition the parking brake to an ON state. As a result, the parking brake transitions from an OFF state to an ON state.

[0177] Then, the parking brake ECU 201F broadcasts to the other in-vehicle devices 201 and the in-vehicle relay device 101 a brake-on notification indicating that the on control signal S31 has been output to the parking brake.

[0178] In addition, the parking brake ECU 201F is not limited to being configured to transition the parking brake from the off state to the on state when it receives an on completion notification from the management device 201H and operation Q2 is performed on the vehicle 1, but may also be configured to transition the parking brake from the off state to the on state when another operation is performed on the vehicle 1 instead of operation Q2.

[0179] In this case, for example, when the parking brake ECU 201F receives an ON completion notification from the management device 201H and at least two or more of the following operations are performed in the vehicle 1: operation Q3 in which the driver leaves the driver's seat; operation Q4 in which the driver unlocks the seat belt; and operation Q5 in which the driver unlocks the driver's door, the parking brake ECU 201F transitions the parking brake from an OFF state to an ON state.

[0180] [In-vehicle relay device] (Judgment Department) 2 again, in the in-vehicle relay device 101, the determination unit 22 performs a determination process J2 to determine whether the vehicle 1 is in a state where it has finished traveling (hereinafter also referred to as a "traveling end state"). More specifically, for example, when the determination unit 22 receives a brake-on notification from the parking brake ECU 201F and operations Q3, Q4, and Q5 are performed in the vehicle 1, the determination unit 22 determines that the state of the vehicle 1 is in the traveling end state.

[0181] Specifically, when the judgment unit 22 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11, it checks whether the sensor information C1, C2, and C3 contained in frame F (hereinafter also referred to as "frame F1") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the brake-on notification satisfy predetermined conditions.

[0182] For example, if frame F1 contains sensor information C1 indicating that the driver has left the seat, sensor information C2 indicating that the seat belt is in an unlocked state, and sensor information C3 indicating that the driver's door is in an open state, the judgment unit 22 judges that the state of vehicle 1 is in an end-of-travel state.

[0183] Then, the determination unit 22 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each in-vehicle device 201 via the relay unit 11. The determination unit 22 also outputs the driving end notification to the signal generation unit 24.

[0184] In addition, the judgment unit 22 may be configured to judge that the state of vehicle 1 is in the end-of-travel state when it receives a brake-on notification from the parking brake ECU 201F and any two of operations Q3, Q4, and Q5 are performed in vehicle 1.

[0185] [Off transition request] For example, the in-vehicle relay device 101 transmits an OFF transition request to the automatic driving ECUs 201G and 201J to request the stopping of the execution of the driving-related functions.

[0186] More specifically, for example, in the in-vehicle relay device 101, when the signal generating unit 24 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11 and also receives a driving end notification from the judgment unit 22, it broadcasts an off transition request to each in-vehicle device 201 via the relay unit 11 before generating the off control signal S12.

[0187] [Stop preparation completion notification] Referring again to Figure 1, for example, when the autonomous driving ECUs 201G, 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and the management device 201H outputs an off control signal S22 described later, they perform pre-processing to stop the execution of the autonomous driving function before the power supply to the autonomous driving ECUs 201G, 201J is stopped.

[0188] More specifically, for example, when the autonomous driving ECUs 201G and 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and also receive an off completion notification (described later) from the management device 201H, they perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function.

[0189] Specifically, for example, the autonomous driving ECUs 201G, 201J include a volatile memory that stores data indicating the processing content during execution of the autonomous driving function, and a non-volatile memory that is used in preprocessing.

[0190] When the autonomous driving ECUs 201G and 201J receive a driving end notification from the vehicle relay device 101 and an off completion notification from the management device 201H, they perform a preprocessing process to back up the data stored in the volatile memory to the non-volatile memory.

[0191] Furthermore, for example, actuators (not shown) are connected to the automatic driving ECUs 201G and 201J. The automatic driving ECUs 201G and 201J drive the actuators while the automatic driving function is being executed.

[0192] When the autonomous driving ECUs 201G and 201J receive the driving end notification from the in-vehicle relay device 101 and the power-off completion notification from the management device 201H, they perform a process of stopping the operation of the actuator as pre-processing.

[0193] Then, when the automatic driving ECUs 201G and 201J have completed preparations to stop the execution of the automatic driving function, they transmit a stop preparation completion notification to the in-vehicle relay device 101.

[0194] [OFF control signal S22] 3 and 9 again, for example, management device 201H outputs an OFF control signal S22 to first switch 91 to turn off first switch 91. For example, OFF control signal S22 is a signal at a logical low level. ON control signal S21 and OFF control signal S22 are output exclusively. OFF control signal S22 is an example of a sixth control signal.

[0195] For example, the condition under which the vehicle relay device 101 outputs the off control signal S12 (hereinafter also referred to as the "first off condition") is different from the condition under which the management device 201H outputs the off control signal S22 (hereinafter also referred to as the "second off condition").

[0196] More specifically, for example, the first OFF condition includes a condition related to the state of the automatic driving ECUs 201G and 201J. The second OFF condition does not include a condition related to the state of the automatic driving ECUs 201G and 201J.

[0197] Specifically, for example, when the in-vehicle relay device 101 receives a stop preparation completion notification from the autonomous driving ECUs 201G and 201J, it outputs an OFF control signal S12.

[0198] For example, in the management device 201H, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output an off control signal S22.

[0199] Then, the signal generating unit 52 generates an OFF control signal S22 and outputs the generated OFF control signal S22 to the vehicle-mounted relay device 101.

[0200] Specifically, for example, the signal generating unit 52 transmits the generated OFF control signal S22 to the vehicle-mounted relay device 101 via the signal line 6.

[0201] [Switch off notification N12] 2 again, in the in-vehicle relay device 101, the logic circuit unit 25 receives the off control signal S22 from outside the in-vehicle system 301, specifically from the management device 201H. More specifically, the logic circuit unit 25 receives the off control signal S22 from the management device 201H via the signal line 6.

[0202] When the logic circuit unit 25 receives the OFF control signal S22, it outputs to the notification unit 23 a switch OFF notification N12 indicating that the OFF control signal S22 has been received.

[0203] When the notification unit 23 receives the switch-off notification N12 from the logic circuit unit 25, it transmits the switch-off notification N12 to the management device 201H via the relay unit 11.

[0204] [Notification of unconfirmed off] Referring again to Figure 9, in the management device 201H, the notification unit 53 broadcasts an off-uncertainty notification, indicating that the off control of the first switch 91 by the off control signal S22 is undetermined, via the communication unit 41 to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H.

[0205] Specifically, during the period from when the notification unit 53 outputs the off control signal S22 to the vehicle-mounted relay device 101 to when it receives the switch-off notification N12 from the vehicle-mounted relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off-unconfirmed notification to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101, for example, periodically.

[0206] [Off completion notification] After outputting the off control signal S22 to the vehicle-mounted relay device 101, the notification unit 53, when it receives a switch-off notification N12 from the vehicle-mounted relay device 101, sends an off completion notification to the autonomous driving ECUs 201G, 201J indicating that the transmission of the off control signal S22 has been completed.

[0207] Specifically, when the notification unit 53 receives the switch-off notification N12 from the in-vehicle relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H via the communication unit 41. The notification unit 53 broadcasts the off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101, for example, periodically.

[0208] [Switch off control] (Generation and output of the off control signal S12) FIG. 10 is a diagram for explaining an example of the off control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0209] 10, for example, the in-vehicle relay device 101 outputs an OFF control signal S12 for turning off the first switch 91 to the first switch 91. The OFF control signal S12 is an example of a first OFF control signal. The OFF control signal S12 is an example of a fifth control signal.

[0210] More specifically, for example, when the management device 201H outputs an off control signal S22 and the autonomous driving ECUs 201G, 201J perform preprocessing to stop the execution of the autonomous driving function, the vehicle relay device 101 outputs an off control signal S12 to the first switch 91.

[0211] More specifically, for example, in the in-vehicle relay device 101, the signal generating unit 24 generates an OFF control signal S12 when it receives a stop preparation completion notification from the autonomous driving ECUs 201G, 201J via the relay unit 11. For example, the OFF control signal S12 is a signal at a logical low level.

[0212] (Turning off the first switch 91A) When logic circuit unit 25 receives OFF control signal S12 from signal generating unit 24 and OFF control signal S22 from management device 201H, it outputs a gate signal of a logic low level to each first switch 91.

[0213] Specifically, when both the OFF control signal S12 and the OFF control signal S22 are input to OR gate 71A, gate signal G3 at a logic low level is output from OR gate 71A to AND gate 81A.

[0214] When gate signal G3 at a logic low level is input to AND gate 81A, gate signal A3 at a logic low level is output from AND gate 81A to first switch 91A.

[0215] The first switch 91A is turned off when it receives a gate signal A3 of a logical low level from the AND gate 81A, thereby stopping the supply of power to the automatic driving ECU 201G.

[0216] When both the OFF control signal S12 and the OFF control signal S22 are input to OR gate 71B, gate signal G4 at a logic low level is output from OR gate 71B to AND gate 81B.

[0217] When gate signal G4 at a logic low level is input to AND gate 81B, gate signal A4 at a logic low level is output from AND gate 81B to first switch 91B.

[0218] The first switch 91B is turned off when it receives a gate signal A3 of a logical low level from the AND gate 81B, thereby stopping the supply of power to the automatic driving ECU 201J.

[0219] (Generation and output of the OFF control signal S52) 11 is a diagram for explaining an example of the power switch OFF control by the in-vehicle relay device according to the embodiment of the present disclosure. FIG. 11 shows an example of the power switch 93A OFF control by the in-vehicle relay device 101.

[0220] 2 and 11, for example, in the vehicle-mounted relay device 101, the signal generating unit 24 generates an OFF control signal S52 for turning off the power switch 93A.

[0221] More specifically, for example, the signal generating unit 24 generates the OFF control signal S52 when execution of various services is stopped in the in-vehicle network 401. For example, the OFF control signal S52 is a signal at a logic low level.

[0222] More specifically, for example, when the signal generating unit 24 receives a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 via the communication unit 41, the signal generating unit 24 determines that the execution of various services in the in-vehicle network 401 has stopped. In this case, the signal generating unit 52 generates an OFF control signal. Note that the signal generating unit 24 may be configured to determine that the execution of various services has stopped when the signal generating unit 24 receives a stop preparation completion notification from the in-vehicle ECU that controls the DC / DC converter 61b in the power supply unit 10.

[0223] Then, the signal generating unit 24 outputs the generated OFF control signal S52 to the logic circuit unit 25. The ON control signal S51 and the OFF control signal S52 are output exclusively.

[0224] (Generation and output of OFF control signals S62 and S72) 9 and 11, for example, in management device 201H, signal generation unit 52 generates off control signal S62 for turning off power switch 93A and off control signal S72 for turning off power switch 93B. For example, off control signals S62 and S72 are signals of a logical low level.

[0225] More specifically, for example, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output off control signals S62, S72.

[0226] Then, the signal generating unit 52 generates OFF control signals S62, S72 and transmits the generated OFF control signals S62, S72 to the in-vehicle relay device 101 via the signal line 6a. The ON control signal S61 and the OFF control signal S62 are output exclusively. The ON control signal S71 and the OFF control signal S72 are output exclusively.

[0227] (Switch off notification N11) Referring again to Figure 2, in the vehicle-mounted relay device 101, when the logic circuit unit 25 receives the off control signals S62, S72 from the management device 201H via the signal line 6a, it outputs a switch off notification N11 to the notification unit 23 indicating that the off control signals S62, S72 have been received from the management device 201H.

[0228] When the notification unit 23 receives the switch-off notification N11 from the logic circuit unit 25, it transmits the switch-off notification N11 to the management device 201H via the relay unit 11.

[0229] (Power switch 93A turned off) In vehicle-mounted relay device 101, when logic circuit unit 25 receives OFF control signal S52 from signal generating unit 24 and OFF control signal S62 from management device 201H, it outputs gate signal G4 of a logic low level to power switch 93A.

[0230] Specifically, for example, when both OFF control signal S52 and OFF control signal S62 are input to OR gate 72A, gate signal G6 at a logic low level is output from OR gate 72A to AND gate 73A.

[0231] When gate signal G6 at a logic low level is input to AND gate 73A, gate signal A9 at a logic low level is output from AND gate 73A to power switch 93A.

[0232] Power switch 93A is turned off when it receives gate signal A9 of a logic low level from AND gate 73A.

[0233] [ON control signal S31] 12 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 12, for example, the signal generating unit 24 in the in-vehicle relay device 101 generates an ON control signal S31 for turning on the second switch 92 based on the state of the vehicle 1 determined by the determining unit 22. The ON control signal S31 is a signal with a logical high level. The ON control signal S31 is an example of a third control signal.

[0234] More specifically, for example, when the signal generating unit 24 receives a running start notification from the determining unit 22, the signal generating unit 24 generates an ON control signal S31. Then, the signal generating unit 24 outputs the generated ON control signal S31 to the logic circuit unit 25.

[0235] [Second Monitoring Department] 13 is a diagram illustrating an example of a configuration of a second monitoring unit in the vehicle-mounted relay device according to the embodiment of the present disclosure. Referring to FIG. 13, second monitoring unit 27 includes a second measurement unit 33 and a second control unit 34.

[0236] (Second measurement unit) For example, the second measuring unit 33 is provided in correspondence with the second switch 92 and performs a measurement process H2 relating to the second switch 92.

[0237] More specifically, for example, the second measuring unit 33 measures the current flowing between the drain and source of the second switch 92. The second measuring unit 33 performs a measurement process H2, for example, periodically. Then, the second measuring unit 33 outputs measurement result information M3 indicating a measurement result K3 to the second control unit 34.

[0238] (Second control section) 12 and 13, the second control unit 34 determines the state of the second switch 92 based on the measurement result K3 of the second measurement unit 33.

[0239] More specifically, for example, if the measurement result K3 indicated by the measurement result information M3 received from the second measuring unit 33 is less than the threshold value Th13, the second control unit 34 determines that the state of the second switch 92 is abnormal. In this case, the second control unit 34 generates a control signal E5 of a logical high level. The second control unit 34 then outputs the generated control signal E5 to the logic circuit unit 25.

[0240] On the other hand, if the measurement result K3 indicated by the measurement result information M3 received from the second measuring unit 33 is equal to or greater than the predetermined threshold value Th13, the second control unit 34 determines that the state of the second switch 92 is normal. In this case, the second control unit 34 generates a control signal E6 of a logically low level. The second control unit 34 then outputs the generated control signal E6 to the logic circuit unit 25. The control signals E5 and E6 are output exclusively.

[0241] [Turning on the second switch] FIG. 14 is a diagram for explaining the on-control of the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0242] 14, for example, the second switch 92 is turned on by an ON control signal S31 generated by the signal generating unit 24.

[0243] More specifically, as described above, when the second control unit 34 determines that the state of the second switch 92 is normal, the second control unit 34 generates the control signal E6 of a logical low level. Then, the second control unit 34 outputs the generated control signal E6 to the logic circuit unit 25.

[0244] The logic circuit section 25 further includes an AND gate 82 and a NOT gate 83. When the control signal E6 is input to the NOT gate 83, the gate signal T11 at a logic high level is output from the NOT gate 83 to the AND gate 82.

[0245] When the ON control signal S31 and the gate signal T11 are input to the AND gate 82, a gate signal A5 at a logic high level is output from the AND gate 82 to the second switch 92.

[0246] Second switch 92 is turned on when it receives gate signal A5 of a logic high level from AND gate 82. As a result, power from power supply unit 10 is supplied to door open / close sensor 201E.

[0247] [Second switch off control] FIG. 15 is a diagram illustrating the off control of the second switch performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0248] 15, for example, when signal generating unit 24 receives a driving end notification from determining unit 22, it generates off control signal S32. For example, off control signal S32 is a signal at a logical low level. Off control signal S32 is an example of a fourth control signal.

[0249] Then, the signal generating unit 24 outputs the generated OFF control signal S32 to the logic circuit unit 25. The ON control signal S31 and the OFF control signal S32 are output exclusively.

[0250] For example, the second switch 92 is turned off by an OFF control signal S32 generated by the signal generating unit 24.

[0251] More specifically, when the OFF control signal S32 and the gate signal T11 are input to the AND gate 82 in the logic circuit section 25, the gate signal A6 at a logic low level is output from the AND gate 82 to the second switch 92.

[0252] The second switch 92 is turned off when it receives the gate signal A6 of the logic low level from the AND gate 82. This stops the power supply to the door open / close sensor 201E.

[0253] [When an abnormality occurs in the first switch 91] 16 is a diagram illustrating another example of the off control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure, and is a diagram illustrating the off control of the first switch 91A when an abnormality occurs in the first switch 91A.

[0254] 16, the first control unit 32A turns off the first switch 91A based on the measurement result K1 of the first measuring unit 31A, regardless of the OR condition for turning on the corresponding first switch 91A.

[0255] More specifically, as described above, the first control unit 32A outputs a control signal E3 of a logical low level to the logic circuit unit 25 when the measurement result K1 indicated by the measurement result information M1 received from the first measurement unit 31A is less than the threshold value Th11.

[0256] When control signal E3 is input to AND gate 81A in logic circuit section 25, gate signal A3 at a logic low level is output to first switch 91A regardless of the gate signal from OR gate 71A.

[0257] The first switch 91A turns off when it receives a gate signal A3 of a logical low level from the AND gate 81A. This stops the power supply to the autonomous driving ECU 201G. This makes it possible to cut off the power supply to the location where the abnormality has occurred and to prevent a voltage rise or drop in other in-vehicle devices 201 other than the autonomous driving ECU 201G. Therefore, when a certain device in the in-vehicle network 401 controls a specific in-vehicle device 201, the control can be performed normally.

[0258] Furthermore, as described above, the in-vehicle system 301 includes multiple driving-related devices, specifically two autonomous driving ECUs 201G and 201J. As a result, even after an abnormality occurs in one of the multiple first switches 91 connected to the multiple driving-related devices, the driving-related function can be provided by the driving-related device connected to the other first switch 91 in the in-vehicle network 401. In the example shown in Fig. 16, even if an abnormality occurs in the first switch 91A to which the autonomous driving ECU 201G is connected, the autonomous driving function can be provided by the autonomous driving ECU 201J connected to the first switch 91B.

[0259] [When an abnormality occurs in the second switch 92] FIG. 17 is a diagram for explaining another example of the control of turning off the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0260] Referring to Figure 17, for example, the second control unit 34 turns off the second switch 92 based on the measurement result K3 of the second measurement unit 33, regardless of the on control signal S31 and the off control signal S32 generated by the signal generation unit 24.

[0261] More specifically, as described above, when the measurement result K3 indicated by the measurement result information M3 received from the second measurement unit 33 is less than the threshold value Th13, the second control unit 34 outputs a control signal E5 of a logical high level to the logic circuit unit 25.

[0262] When the control signal E5 is input to the NOT gate 83 in the logic circuit unit 25, a gate signal T12 of a logic low level is output to the AND gate 82. When the gate signal T12 is input to the AND gate 82, a gate signal A6 of a logic low level is output to the second switch 92, regardless of the control signal from the signal generating unit 24.

[0263] The second switch 92 is turned off when it receives the gate signal A6 of the logic low level from the AND gate 82. This stops the supply of power to the verification ECU 201A.

[0264] [If an abnormality occurs in power switch 93] 18 is a diagram illustrating another example of the power switch OFF control by the vehicle-mounted relay device according to the embodiment of the present disclosure, in which the power switch 93A is turned OFF when an abnormality occurs in the power switch 93A.

[0265] Referring to FIG. 18, the third control unit 36A turns off the power switch 93A based on the measurement result K5 of the third measurement unit 35A, regardless of the OR condition for turning on the power switch 93A.

[0266] More specifically, as described above, the third control unit 36A outputs a control signal E9 of a logical low level to the logic circuit unit 25 when the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A satisfies a predetermined condition W5.

[0267] When control signal E9 is input to AND gate 73A in logic circuit section 25, gate signal A9 of the logic low level is output to power switch 93A regardless of the gate signal from OR gate 72A.

[0268] The power switch 93A is turned off when it receives a gate signal A9 of a logical low level from the AND gate 73A, thereby stopping the supply of power to the automatic driving ECU 201G.

[0269] [Operation flow] Next, the flow of operations of the in-vehicle relay device 101 and the in-vehicle device 201 in the in-vehicle system 301 according to the embodiment of the present disclosure will be described with reference to the drawings.

[0270] 19, 20, and 21 are flowcharts showing an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. 19, 20, and 21 show an operation when the in-vehicle relay device 101 turns on the first switches 91A, 91B, and the second switch 92 using the ON control signal S11 and the ON control signal S31, respectively, when the first switches 91A, 91B, and the second switch 92 are in a normal state.

[0271] 19, 20 and 21, first, the vehicle-mounted relay device 101 generates the control signals E1 and E2 at a logical high level (step ST101).

[0272] Next, the second control unit 34 in the vehicle-mounted relay device 101 generates a control signal E5 at a logical low level (step ST102). Note that steps ST101 and ST102 may be executed in reverse order or in parallel.

[0273] Next, the in-vehicle relay device 101 waits for reception of key verification information from the verification ECU 201A (NO in step ST103).

[0274] Next, when the in-vehicle relay device 101 receives the key verification information from the verification ECU 201A (YES in step ST103), it waits for reception of the switch monitoring information B from the body ECU 201B (NO in step ST104).

[0275] Then, when the in-vehicle relay device 101 receives switch monitoring information B from the body ECU 201B within a predetermined time after receiving the key verification information from the verification ECU 201A (YES in step ST104), it uses the received switch monitoring information B to determine whether the state of the vehicle 1 is in a running start state (step ST105).

[0276] Then, if the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the off state, the vehicle relay device 101 determines that the vehicle 1 is not in the running start state (NO in step ST105) and waits to receive new switch monitoring information B from the body ECU 201B (NO in step ST104).

[0277] On the other hand, if the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the on state, it is determined that the vehicle 1 is in the driving start state (YES in step ST105), and a driving start notification is broadcast to each in-vehicle device 201 (step ST106).

[0278] Next, the signal generating unit 24 in the vehicle-mounted relay device 101 generates an ON control signal S11 for turning on each first switch 91, an ON control signal S31 for turning on the second switch 92, and an ON control signal S51 for turning on the power switch 93A (step ST107).

[0279] Next, the in-vehicle repeater 101 turns on the power switch 93A. For example, as described above, in the in-vehicle repeater 101, the signal generating unit 24 outputs the generated ON control signal S51 to the logic circuit unit 25. Then, the OR gate 72A in the logic circuit unit 25 outputs a gate signal G3 of a logic high level to the power switch 93A (step ST108).

[0280] Next, the in-vehicle relay device 101 turns on the first switches 91A and 91B. For example, as described above, the signal generating unit 24, the first control unit 32A, and the first control unit 32B output the ON control signal S11, the control signal E1 at a logically high level, and the control signal E2 at a logically high level, which they have generated, to the logic circuit unit 25. Then, the AND gate 81A and the AND gate 81B in the logic circuit unit 25 output gate signals at a logically high level to the first switches 91A and 91B, respectively (step ST109). This starts the supply of power to the autonomous driving ECUs 201G and 201J.

[0281] Next, the in-vehicle relay device 101 turns on the second switch 92. For example, as described above, the signal generating unit 24 and the second control unit 34 output the ON control signal S31 and the control signal E6 of a logically low level, which they respectively generate, to the logic circuit unit 25. When the control signal E6 of a logically low level is input to the NOT gate 83, a gate signal T11 of a logically high level is output from the NOT gate 83 to the AND gate 82. When the ON control signal S31 and the gate signal T11 of a logically high level are input to the AND gate 82, a gate signal A5 of a logically high level is output from the AND gate 82 to the second switch 92 (step ST110). This starts the supply of power to the door opening / closing sensor 201E.

[0282] Next, the in-vehicle relay device 101 waits for reception of the start-up completion notification N1 from the autonomous driving ECUs 201G and 201J (NO in step ST111).

[0283] Next, when the in-vehicle relay device 101 receives the start-up completion notification N1 from the autonomous driving ECUs 201G, 201J (YES in step ST111), it broadcasts an equipment status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each in-vehicle device 201 (step ST112).

[0284] Next, the vehicle-mounted relay device 101 waits for reception of the ON control signals S21, S61, and S71 from the management device 201H (NO in step ST113).

[0285] Then, when the vehicle-mounted relay device 101 receives the on control signals S21, S61, and S71 from the management device 201H (YES in step ST113), it transmits a switch-on notification N21 indicating that the on control signal S21 has been received, and a switch-on notification N22 indicating that the on control signals S61 and S71 have been received, to the management device 201H (step ST114), and waits to receive a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (NO in step ST115).

[0286] Next, when the vehicle relay device 101 receives a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (YES in step ST115), it determines whether the state of the vehicle 1 is in a driving end state based on the sensor information C1, C2, and C3 contained in the received sensor monitoring information (step ST116).

[0287] Then, when the vehicle relay device 101 determines that the state of the vehicle 1 is the traveling end state (YES in step ST116), it broadcasts a traveling end notification to each of the vehicle-mounted devices 201 (step ST117).

[0288] Furthermore, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 to request the suspension of the execution of the driving-related functions (step ST118).

[0289] Next, the vehicle relay device 101 waits to receive from the management device 201H an off control signal S22 for turning off the first switches 91A and 91B, and off control signals S62 and S72 for turning off the power switches 93A and 93B, respectively (NO in step ST119).

[0290] Then, when the vehicle-mounted relay device 101 receives the off control signals S22, S62, and S72 from the management device 201H (YES in step ST119), it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201H (step ST120).

[0291] Next, after transmitting the switch-off notifications N11 and N12 to the management device 201H, the in-vehicle relay device 101 waits for reception of a stop preparation completion notification from the autonomous driving ECUs 201G and 201J (NO in step ST121).

[0292] Next, in the vehicle relay device 101, when the signal generation unit 24 receives a notification from the management device 201H that stop preparation is complete from the autonomous driving ECUs 201G and 201J (YES in step ST121), it generates an off control signal S12 for turning off the first switches 91A and 91B and outputs it to the logic circuit unit 25 (step ST122).

[0293] Next, the in-vehicle relay device 101 turns off the first switches 91A and 91B. For example, as described above, the logic circuit unit 25 receives the OFF control signal S22 from the management device 201H via the signal line 6. Furthermore, upon receiving a stop preparation completion notification from the autonomous driving ECUs 201G and 201J, the signal generating unit 24 outputs the OFF control signal S12 to the logic circuit unit 25. Then, the AND gate 81A and the AND gate 81B in the logic circuit unit 25 output gate signals of a logic low level to the first switch 91A and the first switch 91B, respectively (step ST123).

[0294] Next, the in-vehicle relay device 101 turns off the first switch 91 and waits for a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 (NO in step ST124).

[0295] Then, in the in-vehicle relay device 101, when the signal generating unit 24 receives a notification that the stop preparation is complete from all the in-vehicle ECUs in the in-vehicle network 401 (YES in step ST124), it generates an off control signal S52 for turning off the power switch 93A and outputs it to the logic circuit unit 25 (step ST125).

[0296] Next, the in-vehicle repeater 101 turns off the power switch 93A. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 25 inputs both the off control signal S52 and the off control signal S62 to the OR gate 72A. Then, the OR gate 72A outputs the gate signal S6 at a logic low level to the power switch 93A (step ST126).

[0297] 22 is a flowchart showing another example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. Fig. 22 shows the operation when the power switch 93A, the power switch 93B, and the first switch 91 are turned on by the ON control signal S61, the ON control signal S71, and the ON control signal S21, respectively, generated in the management device 201H.

[0298] 22, first, the in-vehicle relay device 101 receives, via signal line 6, on-control signals S61 and S71 for turning on the power switches 93A and 93B, respectively, from the management device 201H, and turns on the power switches 93A and 93B. For example, as described above, in the in-vehicle relay device 101, the logic circuit unit 25 receives the on-control signals S61 and S71 from the management device 201H via signal line 6a. Furthermore, the third control unit 36A and the third control unit 36B output the control signals E7 and E8, which are respectively generated at a logical high level, to the logic circuit unit 25. Then, the AND gate 73A in the logic circuit unit 25 outputs a gate signal A7 at a logical high level to the power switch 93A. Furthermore, the AND gate 73B in the logic circuit unit 25 outputs a gate signal A8 at a logical high level to the power switch 93B (step ST201).

[0299] Next, the vehicle-mounted relay device 101 transmits to the management device 201H a switch-on notification N22 indicating that the on-control signals S61 and S71 have been received from the management device 201H (step ST202).

[0300] Next, the vehicle-mounted relay device 101 receives an ON control signal S21 for turning on the first switches 91A and 91B from the management device 201H via the signal line 6, and turns on the first switches 91A and 91B. For example, as described above, the logic circuit unit 25 receives the ON control signal S21 from the management device 201H via the signal line 6. Furthermore, the first control unit 32A and the first control unit 32B output the control signal E1 and the control signal E2 of a logical high level that they have generated, respectively, to the logic circuit unit 25. Then, the AND gate 81A and the AND gate 81B in the logic circuit unit 25 output the gate signal A1 and the gate signal A2 of a logical high level to the first switch 91A and the first switch 91B, respectively (step ST203).

[0301] Next, the vehicle-mounted relay device 101 transmits to the management device 201H a switch-on notification N21 indicating that the on-control signal S21 has been received from the management device 201H (step ST204).

[0302] 23 and 24 are flowcharts illustrating an example of an operation procedure when the in-vehicle repeater 101 performs measurement processing according to an embodiment of the present disclosure. The flowcharts illustrate the operation of the in-vehicle repeater 101 when performing measurements on the first switch 91A, the first switch 91B, and the second switch 92.

[0303] 23 and 24, first, the first measuring unit 31A, the first measuring unit 31B, and the second measuring unit 33 in the vehicle-mounted relay device 101 perform measurements on the first switch 91A, the first switch 91B, and the second switch 92, respectively (step ST301).

[0304] Next, the first measuring unit 31A, the first measuring unit 31B, and the second measuring unit 33 output the measurement result information to the first control unit 32A, the first control unit 32B, and the second control unit 34, respectively (step ST302).

[0305] Next, the first control unit 32A checks whether the measurement result K1 indicated by the measurement result information received from the first measuring unit 31A is equal to or greater than the threshold value Th11 (step ST303).

[0306] If the measurement result K1 is less than the threshold value Th11 (NO in step ST303), the first control unit 32A determines that the state of the first switch 91A is abnormal (step ST304).

[0307] Next, the first control unit 32A generates a control signal E3 at a logically low level, and outputs the generated control signal E3 to the logic circuit unit 25 (step ST305).

[0308] Next, the in-vehicle relay device 101 turns off the first switch 91A. For example, as described above, when the control signal E3 at a logically low level is input to the AND gate 81A in the logic circuit unit 25, the gate signal A3 at a logically low level is output to the first switch 91A (step ST306). This stops the power supply to the autonomous driving ECU 201G.

[0309] On the other hand, if the measurement result K1 is equal to or greater than the threshold value Th11 (YES in step ST303), the first control unit 32A determines that the state of the first switch 91A is normal (step ST307).

[0310] Next, the first control unit 32A generates a control signal E1 at a logical high level, and outputs the generated control signal E1 to the logic circuit unit 25 (step ST308).

[0311] Next, the first control unit 32B checks whether the measurement result K2 indicated by the measurement result information received from the first measuring unit 31B is equal to or greater than the threshold value Th12 (step ST309).

[0312] If the measurement result K2 is less than the threshold value Th12 (NO in step ST309), the first control unit 32B determines that the state of the first switch 91B is abnormal (step ST310).

[0313] Next, the first control unit 32B generates a control signal E4 at a logically low level, and outputs the generated control signal E4 to the logic circuit unit 25 (step ST311).

[0314] Next, the in-vehicle relay device 101 turns off the first switch 91B. For example, as described above, when the control signal E4 at a logically low level is input to the AND gate 81B in the logic circuit unit 25, the gate signal A4 at a logically low level is output to the first switch 91B (step ST312). This stops the power supply to the autonomous driving ECU 201J.

[0315] On the other hand, if the measurement result K2 is equal to or greater than the threshold value Th12 (YES in step ST309), the first control unit 32B determines that the state of the first switch 91B is normal (step ST313).

[0316] Next, the first control unit 32B generates a control signal E2 at a logical high level, and outputs the generated control signal E2 to the logic circuit unit 25 (step ST314).

[0317] Next, the second control unit 34 checks whether the measurement result K3 indicated by the measurement result information received from the second measuring unit 33 is equal to or greater than the threshold value Th13 (step ST315).

[0318] If the measurement result K3 is less than the threshold value Th13 (NO in step ST315), the second control unit 34 determines that the state of the second switch 92 is abnormal (step ST316).

[0319] Next, the second control section 34 generates a control signal E6 at a logically low level, and outputs the generated control signal E6 to the logic circuit section 25 (step ST317).

[0320] Next, the in-vehicle relay device 101 turns off the second switch 92. For example, as described above, when the control signal E6 at a logically low level is input to the AND gate 82 in the logic circuit unit 25, the gate signal A6 at a logically low level is output to the second switch 92 (step ST318). This stops the power supply to the door open / close sensor 201E.

[0321] On the other hand, if the measurement result K3 is equal to or greater than the threshold value Th13 (YES in step ST315), the second control unit 34 determines that the state of the second switch 92 is normal (step ST319).

[0322] Next, the second control section 34 generates a control signal E5 at a logical high level, and outputs the generated control signal E5 to the logic circuit section 25 (step ST320).

[0323] 25 and 26 are diagrams illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0324] 25 and 26, first, the management device 201H broadcasts a turn-off completion notification indicating that the turn-off control signal S22 has been transmitted to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST401).

[0325] Furthermore, the vehicle-mounted relay device 101 generates control signals E1 and E2 at a logically high level (step ST402).

[0326] Furthermore, the verification ECU 201A transmits the key verification information to the in-vehicle relay device 101 (step ST403).

[0327] Furthermore, the body ECU 201B transmits switch monitoring information indicating the monitoring results of the states of the brake pedal switch and the engine switch to the in-vehicle relay device 101 (step ST404).

[0328] Next, when the in-vehicle relay device 101 receives the key verification information and the switch monitoring information from the verification ECU 201A and the body ECU 201B, respectively, it performs a determination process J1 to determine whether the state of the vehicle 1 is in a traveling start state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling start state (step ST405).

[0329] Next, the vehicle relay device 101 broadcasts a travel start notification indicating that the state of the vehicle 1 is a travel start state to each of the vehicle-mounted devices 201 (step ST406).

[0330] Next, the in-vehicle repeater 101 generates an ON control signal S11 for turning on the first switches 91A and 91B. The in-vehicle repeater 101 also generates ON control signals S51 and S53 for turning on the power switches 93A and 93B, respectively (step ST407).

[0331] Next, the in-vehicle relay device 101 turns on the power switches 93A and 93B using the OR gates 72A and 72B and the AND gates 73A and 73B as described above. Also, the in-vehicle relay device 101 turns on the first switches 91A and 91B using the OR gates 71A and 71B and the AND gates 81A and 81B as described above. This starts the supply of power to the autonomous driving ECUs 201G and 201J (step ST408).

[0332] Next, the autonomous driving ECUs 201G and 201J start up (step ST409) and transmit a start-up completion notification N1 indicating that they have started up to the in-vehicle relay device 101 (step ST410).

[0333] Next, the automatic driving ECUs 201G, 201J start executing the automatic driving function (step ST411). Note that step ST410 and step ST411 may be executed in reverse order, or may be executed in parallel.

[0334] Furthermore, when the in-vehicle relay device 101 receives the activation completion notification N1 from the automatic driving ECUs 201G, 201J, it broadcasts to each in-vehicle device 201 a device status notification indicating that the automatic driving ECUs 201G, 201J are operating (step ST412).

[0335] In addition, management device 201H receives a device status notification from vehicle-mounted relay device 101 and generates ON control signals S61 and S71 for turning on power switches 93A and 93B, respectively, and ON control signal S21 for turning on first switches 91A and 91B (step ST413).

[0336] Next, the management device 201H transmits the generated ON control signals S61, S71, and S21 to the vehicle-mounted relay device 101 via the signal line 6 (step ST414).

[0337] Next, the management device 201H broadcasts an on-uncertainty notification to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 indicating that the execution of the on control of the first switch 91 by the on control signal S21, the on control of the power switch 93A by the on control signal S61, and the on control of the power switch 93B by the on control signal S71 is undetermined (step ST415).

[0338] Next, when the vehicle-mounted relay device 101 receives the ON control signal S21 from the management device 201H, the vehicle-mounted relay device 101 transmits a switch-on notification N21 indicating that the ON control signal S21 has been received to the management device 201H (step ST416).

[0339] Furthermore, when the vehicle-mounted relay device 101 receives the ON control signals S61, S71 from the management device 201H, it transmits a switch-on notification N22 indicating that the ON control signals S61, S71 have been received to the management device 201H (step ST417).

[0340] Next, when the management device 201H receives the switch-on notification N21 from the in-vehicle relay device 101, it broadcasts an on-completion notification indicating that the on control of the first switch 91 has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST418).

[0341] Next, the parking brake ECU 201F receives the OFF completion notification, the ON unconfirmed notification, and the ON completion notification from the management device 201H, and performs a parking brake release process to transition the parking brake from the ON state to the OFF state (step ST419).

[0342] 27 and 28 are diagrams illustrating another example of the processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0343] 27 and 28, first, the management device 201H broadcasts an ON completion notification indicating that ON control of the first switches 91A and 91B has been completed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST501).

[0344] In addition, the body ECU 201B transmits to the vehicle relay device 101 a frame F including sensor information C1, sensor information C2, and sensor information C3, which respectively indicate the detection results of the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E while the vehicle 1 is traveling (step ST502).

[0345] The parking brake ECU 201F also determines whether to transition the parking brake from the OFF state to the ON state. Here, it is assumed that the parking brake ECU 201F has received an ON completion notification from the management device 201H and has determined to transition the parking brake from the OFF state to the ON state because the operation Q1 has been performed in the vehicle 1 (step ST503).

[0346] Next, the parking brake ECU 201F broadcasts a brake-on notification indicating that the parking brake has been switched to the on state to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST504).

[0347] Furthermore, the in-vehicle relay device 101 receives a frame F and a brake-on notification from the body ECU 201B and the parking brake ECU 201F, respectively, and performs a determination process J2 to determine whether the state of the vehicle 1 is in a traveling end state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling end state (step ST505).

[0348] Next, the vehicle-mounted relay device 101 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each of the vehicle-mounted devices 201 (step ST506).

[0349] Furthermore, when receiving the brake-on notification from the parking brake ECU 201F, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 before generating the OFF control signal S12 (step ST507).

[0350] Next, when the management device 201H receives a parking brake on notification from the parking brake ECU 201F and a driving end notification or an off transition request from the vehicle relay device 101, it generates an off control signal S22 for turning off the first switch 91, and off control signals S62 and S72 for turning off the power switches 93A and 93B, respectively (step ST508).

[0351] Next, the management device 201H broadcasts an OFF unconfirmed notification indicating that the OFF control of the first switch 91 by the OFF control signal S22 is unconfirmed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST509).

[0352] Next, management device 201H transmits the generated OFF control signals S22, S62, and S72 to in-vehicle relay device 101 via signal line 6 (step ST510).

[0353] Next, when the vehicle-mounted relay device 101 receives the off control signals S22, S62, and S72 from the management device 201H, it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201H (step ST511).

[0354] Next, when the management device 201H receives the switch-off notifications N11 and N12 from the vehicle-mounted relay device 101, it broadcasts an off-completion notification indicating that the off-control signals S22, S62, and S72 have been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST512).

[0355] Next, when the autonomous driving ECUs 201G, 201J receive a driving end notification or an OFF transition request from the in-vehicle relay device 101 and an OFF completion notification from the management device 201H, they perform pre-processing to stop the execution of the autonomous driving function. For example, as described above, the autonomous driving ECUs 201G, 201J perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function (step ST513).

[0356] Next, the autonomous driving ECUs 201G and 201J transmit a stop preparation completion notification indicating that preparation for stopping the execution of the autonomous driving function has been completed to the in-vehicle relay device 101 (step ST514).

[0357] Next, when the in-vehicle relay device 101 receives the stop preparation completion notification from the automatic driving ECUs 201G and 201J, it generates the OFF control signal S12 (step ST515).

[0358] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S12, it turns off the first switch 91 using the OR gate 71 and the AND gate 81 as described above (step ST516).

[0359] Next, the in-vehicle relay device 101 checks whether or not the execution of various services has been stopped in the in-vehicle network 401. For example, as described above, when the in-vehicle relay device 101 receives a notification that the preparation for stopping has been completed from all the in-vehicle ECUs in the in-vehicle network 401, the in-vehicle relay device 101 determines that the execution of various services has been stopped (step ST517).

[0360] Next, when the in-vehicle relay device 101 confirms that the execution of various services has been stopped, it generates an OFF control signal S52 (step ST518).

[0361] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S52, it turns off the power switch 93A using the OR gate 72A and the AND gate 73A as described above (step ST519).

[0362] In the in-vehicle system 301 according to the embodiment of the present disclosure, the first switch 91, the second switch 92, and the power switches 93A and 93B are configured to be provided in the in-vehicle relay device 101, but this is not limited to this. Some or all of the first switches 91A and 91B, the second switch 92, and the power switches 93A and 93B may be configured to be provided outside the in-vehicle relay device 101.

[0363] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to include the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34. However, this is not limited to this. A device other than the in-vehicle relay device 101 may be configured to include some or all of the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34. Furthermore, a plurality of devices may be configured to include the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34 as an in-vehicle power supply control system. For example, the in-vehicle relay device 101 may be configured to include some of the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34, and a device other than the in-vehicle relay device 101 may be configured to include the remaining units.

[0364] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the logic circuit unit 25 is configured to include the OR gate 71, but this is not limited thereto. The logic circuit unit 25 may be configured to include a NAND gate instead of the OR gate 71. In this case, the signal generating unit 24 in the in-vehicle relay device 101 and the signal generating unit 52 in the management device 201H generate an ON control signal S11 and an ON control signal S21 at a logical low level, respectively. When at least one of the ON control signal S11 and the ON control signal S21 is input to the NAND gate, a gate signal at a logical high level is output from the NAND gate to the first switch 91. In other words, even when the logic circuit unit 25 includes a NAND gate, the first switch 91 is turned on under the OR condition of the ON control signal S11 and the ON control signal S21.

[0365] Furthermore, although the in-vehicle repeater 101 according to the embodiment of the present disclosure is configured to include the second switch 92 that is turned on and off by the on control signal S31 and the off control signal S32 generated by the signal generating unit 24, this is not limitative. The in-vehicle repeater 101 may be configured without the second switch 92. In this case, the in-vehicle repeater 101 does not include the second monitoring unit 27.

[0366] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform measurements on the second switch 92 and turn off the second switch 92 based on the measurement results regardless of the ON control signal S31 and the OFF control signal S32, but this is not limiting. The in-vehicle relay device 101 may also be configured not to perform measurements on the second switch 92.

[0367] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S11 using a condition different from the condition under which the ON control signal S21 is generated, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S11 using the same condition as the condition under which the ON control signal S21 is generated.

[0368] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S11 using a criterion J1 that is different from the criterion J2 used by the management device 201H to generate the ON control signal S21, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S11 using the same criterion as the criterion J2.

[0369] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the judgment criterion J2 used in the generation of the ON control signal S21 by the management device 201H includes a criterion related to the state of the parking brake of the vehicle 1, and the judgment criterion J1 used in the judgment process by the in-vehicle relay device 101 does not include a criterion related to the state of the parking brake, but this is not limited to this. The judgment criterion J2 may include other criteria different from the criterion related to the state of the parking brake, and the judgment criterion J1 may not include the other criteria.

[0370] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the off control signal S12 using a condition different from that for the off control signal S22, but this is not limited thereto. The in-vehicle relay device 101 may be configured to generate the off control signal S12 using the same condition as that for generating the off control signal S22.

[0371] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0372] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the programs read from the one or more memories, or according to logic circuits pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a field programmable gate array (FPGA), and an application-specific integrated circuit (ASIC). Note that the physically separate processors may cooperate with each other to execute each of the processes. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium.

[0373] The above description includes the following additional features. [Appendix 1] An on-board power supply control system mounted on a vehicle, The in-vehicle power supply control system includes: a plurality of first control switches that switch between supplying and not supplying power to in-vehicle devices in the vehicle; a plurality of first measurement units provided for each of the first control switches, each of which performs measurement related to the first control switch; a processing circuit; The processing circuitry generating a first control signal for turning on each of the first control switches; receiving a second control signal for turning on each of the first control switches from an external device of the in-vehicle power supply control system; each of the first control switches is turned on in response to an OR condition of the generated first control signal and the generated second control signal; The processing circuitry further comprises: an in-vehicle power supply control system that turns off the corresponding first control switch based on the measurement result of the first measurement unit, regardless of the OR condition; [Explanation of symbols]

[0374] 1 vehicle 2, 2A, 2B, 2C, 2D CAN bus 5,5A,5B,5C,5D power wire 6 Signal Line 10 Power supply section 11 Relay Section 12,42 Processing section 13,43 Storage section 21 Power management section 22,51 Judgment section 23,53 Notification Department 24,52 Signal generation unit 25 Logic Circuit Section 26,26A,26B 1st monitoring section 27 Second Monitoring Department 28,28A,28B 3rd monitoring department 31A, 31B First measurement section 32A, 32B First control section 33 Second Measurement Section 34 Second Control Section 35A, 35B Third measurement section 36A, 36B Third control section 41 Communications Department 61 1st power supply 61a Battery 61b DC / DC Converter 62 2nd power supply 71, 71A, 71B, 72, 72A, 72B OR gates 73, 73A, 73B, 81, 81A, 81B, 82 AND gates 83 NOT Gate 91, 91A, 91B First switch 92 Second Switch 93, 93A, 93B Power switch 101 Vehicle relay device 201A Verification ECU 201B Body ECU 201C Occupant Sensor 201D Buckle Sensor 201E Door Open / Close Sensor 201F Parking brake ECU 201G, 201J Autonomous Driving ECU 201H Management equipment 301 In-Vehicle Systems 401 In-Vehicle Network

Claims

1. An on-board power supply control system mounted on a vehicle, a plurality of first control switches for switching on and off the supply of power to in-vehicle devices in the vehicle; a signal generating unit that generates a first control signal for turning on each of the first control switches; an input unit that receives a second control signal for turning on each of the first control switches from an external device of the in-vehicle power supply control system, each of the first control switches is turned on in response to an OR condition of the first control signal generated by the signal generating unit and the second control signal received by the input unit; The in-vehicle power supply control system further comprises: a plurality of first measurement units provided for each of the first control switches, each of which performs measurement related to the first control switch; a first control unit that turns off the corresponding first control switch based on the measurement result of the first measurement unit regardless of the OR condition.

2. The in-vehicle power supply control system further comprises: a second control switch that is turned on and off by a third control signal and a fourth control signal generated by the signal generating unit, respectively; a second measurement unit provided in correspondence with the second control switch and performing measurement related to the second control switch; 2. The in-vehicle power supply control system according to claim 1, further comprising: a second control unit that turns off the second control switch based on a measurement result of the second measurement unit, regardless of the third control signal and the fourth control signal.

3. 3. The in-vehicle power supply control system according to claim 1, wherein the signal generator generates the first control signal using a condition different from a condition under which the second control signal is generated.

4. The in-vehicle power supply control system further includes a determination unit for determining a state of the vehicle, the signal generation unit generates the first control signal based on the state determined by the determination unit; 3. The in-vehicle power supply control system according to claim 1, wherein the second control signal is generated using a determination criterion different from a determination criterion for the state used by the signal generating unit to generate the first control signal.

5. the criteria used to generate the second control signal include a criterion related to a parking brake state of the vehicle; The in-vehicle power supply control system according to claim 4 , wherein the criteria used to generate the first control signal do not include a criteria related to a state of the parking brake.

6. the signal generating unit further generates a fifth control signal for turning off each of the first control switches; the input unit further receives a sixth control signal for turning off each of the first control switches from an external device of the in-vehicle power supply control system, 3. The in-vehicle power supply control system according to claim 1, wherein the signal generator generates the sixth control signal using a condition different from a condition under which the fifth control signal is generated.

7. A switch control method in an on-board power supply control system mounted on a vehicle, comprising: The in-vehicle power supply control system includes: a plurality of first control switches for switching on and off the supply of power to a first in-vehicle device in the vehicle; a plurality of first measurement units provided for each of the first control switches, each of which performs measurement related to the first control switch; generating a first control signal for turning on each of the first control switches; receiving a second control signal for turning on each of the first control switches from an external device of the in-vehicle power supply control system; turning on each of the first control switches under an OR condition of the generated first control signal and the generated second control signal; and turning off the corresponding first control switch based on the measurement result of the first measurement unit regardless of the OR condition.

Images