In-vehicle system, abnormality detection method, and notification method

Abstract

To further surely detect abnormality related to a control signal, while restraining restriction or stopping of a function executed by an on-vehicle apparatus.SOLUTION: An in-vehicle system including an in-vehicle device that controls a switch for switching between supply and non-supply of electric power to in-vehicle equipment in a vehicle, the in-vehicle device including: a signal generation unit that generates a first ON control signal for turning on the switch; and an input unit that receives a second ON control signal for turning on the switch from outside the in-vehicle device, wherein the switch is turned on under an OR condition of the first ON control signal and the second ON control signal, and wherein the in-vehicle device further includes: an acquisition unit that acquires state information indicating a state of the second ON control signal by communicating with another in-vehicle device; and a detection unit that detects an abnormality related to the second ON control signal based on a comparison result between the second ON control signal received by the input unit and the state indicated by the state information acquired by the acquisition unit.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present disclosure relates to an in-vehicle system, an abnormality detection method, and a notification method. [Background technology]

[0002] Conventionally, technologies for controlling a switch that switches on and off the supply of power to an in-vehicle device have been developed. For example, Patent Document 1 (JP 2020-089066 A) discloses the following electronic control device. An electronic control device (10) applied to a vehicle equipped with relay means (SMRB, SMRG, SMRP) that can switch between an electrically conductive state in which a high-voltage battery (5) mounted on the vehicle and an inverter (30) that drives a vehicle traction motor (31) and that is electrically non-conductive, and a cut-off state in which the relay means includes first relay means (SMRB, SMRG) that is maintained in a conductive state while the vehicle is running, and second relay means (SMRB, SMRP) that is turned on when a start switch (3) of the vehicle is turned on to turn on the vehicle, and that passes a current between the high-voltage battery and the inverter that is more limited than the current that flows when the first relay means is turned on, and that outputs an inverter control signal to the inverter to drive the vehicle traction motor and run the vehicle, and The vehicle includes a first arithmetic unit (13) that controls the first and second relay means so that the second relay means is brought into a conductive state when the vehicle start switch is turned on to start the vehicle, and then switches the first relay means into a conductive state instead of the second relay means and maintains the first relay means in the conductive state; and a second arithmetic unit (14) that is provided independently of the first arithmetic unit and outputs an inverter control signal to the inverter when an abnormality occurs in the first arithmetic unit, and controls the first relay means so that the first relay means is maintained in the conductive state. When the vehicle start switch is turned off and a predetermined running continuation condition is met, the second arithmetic unit continues to maintain the first relay means in the conductive state even when the vehicle start switch is turned off, and when the predetermined running continuation condition is not met, switches the first relay means into a cut-off state. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-089066 Summary of the Invention [Problem to be solved by the invention]

[0004] If an abnormality occurs in the control signal for controlling the switch, the power supply to the in-vehicle device may be stopped, which may limit or stop the functions performed by the in-vehicle device.

[0005] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an on-board device, an abnormality detection method, and a notification method that can more reliably detect abnormalities in control signals while suppressing the restriction or suspension of functions executed by the on-board equipment. [Means for solving the problem]

[0006] The in-vehicle system of the present disclosure is an in-vehicle system including an in-vehicle device that controls a switch that switches on and off the supply of power to in-vehicle equipment in a vehicle, wherein the in-vehicle device includes a signal generating unit that generates a first on control signal to turn on the switch, and an input unit that receives a second on control signal to turn on the switch from outside the in-vehicle device, and the switch turns on under an OR condition of the first on control signal generated by the signal generating unit and the second on control signal received by the input unit, and the in-vehicle device further includes an acquisition unit that acquires status information indicating the state of the second on control signal by communicating with another in-vehicle device, and a detection unit that detects an abnormality related to the second on control signal based on a comparison result between the second on control signal received by the input unit and the state indicated by the status information acquired by the acquisition unit.

[0007] One aspect of the present disclosure can be realized not only as an in-vehicle system equipped with such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the in-vehicle device. [Effects of the Invention]

[0008] According to the present disclosure, it is possible to more reliably detect abnormalities in control signals while suppressing the restriction or suspension of functions executed by in-vehicle devices. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration of an in-vehicle system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 3] FIG. 3 is a diagram illustrating in detail a partial configuration of the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram for explaining the on-control of the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 5] FIG. 5 is a diagram illustrating an example of a configuration of an in-vehicle device according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram for explaining the on-control of the power switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram for explaining the control of turning off the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram for explaining the power switch OFF control by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram for explaining an example of an abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 12]FIG. 12 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure. [Figure 13] FIG. 13 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 14] FIG. 14 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 15] FIG. 15 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 16] FIG. 16 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 17] FIG. 17 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch. [Figure 18] FIG. 18 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs a process of transmitting communication disruption information. [Figure 19] FIG. 19 is a flowchart defining an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch. [Figure 20] FIG. 20 is a flowchart illustrating an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch. [Figure 21] FIG. 21 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 22] FIG. 22 is a diagram illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 23] FIG. 23 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. [Figure 24] FIG. 24 is a diagram illustrating another example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0010] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system including an in-vehicle device that controls a switch that switches on and off the supply of power to in-vehicle equipment in a vehicle, the in-vehicle device including a signal generating unit that generates a first on-control signal to turn on the switch, and an input unit that receives a second on-control signal to turn on the switch from outside the in-vehicle device, the switch being turned on under an OR condition of the first on-control signal generated by the signal generating unit and the second on-control signal received by the input unit, the in-vehicle device further including an acquisition unit that acquires status information indicating the status of the second on-control signal by communicating with another in-vehicle device, and a detection unit that detects an abnormality related to the second on-control signal based on a comparison result between the second on-control signal received by the input unit and the status indicated by the status information acquired by the acquisition unit.

[0011] In this way, by configuring the control switch to be turned on based on an OR condition of the generated first ON control signal and the second ON control signal input from outside the in-vehicle device, even if an abnormality occurs and the first ON control signal cannot be generated, the control switch can be turned on by the second ON control signal. In other words, the control for turning on the control switch is made redundant, and the possibility of power supply to the in-vehicle device being stopped can be reduced.

[0012] Furthermore, by acquiring status information indicating the status of the second ON control signal and comparing the second ON control signal actually input from outside the in-vehicle device with the status indicated by the acquired status information, abnormalities related to the second ON control signal can be detected more reliably. Therefore, abnormalities related to the control signal can be detected more reliably while suppressing limitations or suspensions of functions executed by the in-vehicle device.

[0013] (2) In the above (1), the in-vehicle device may further include a warning unit that outputs warning information when the abnormality is detected by the detection unit.

[0014] With this configuration, for example, a user of the vehicle can recognize the occurrence of an abnormality related to the second ON control signal and take appropriate measures to deal with the abnormality.

[0015] (3) In the above (1) or (2), the on-board device may further include a control unit that maintains the parking brake of the vehicle in an on state when the abnormality is detected by the detection unit before the vehicle starts moving.

[0016] With this configuration, it is possible to prevent the vehicle from starting to move when an abnormality occurs in the second ON control signal.

[0017] (4) In any of (1) to (3) above, the in-vehicle device may further include a transition processing unit that, when the abnormality is detected by the detection unit while the vehicle is traveling, transitions the in-vehicle equipment to an operating mode for driving the vehicle to an evacuation destination.

[0018] With this configuration, when an abnormality occurs in the second ON control signal, the vehicle can be evacuated to a safe place such as the shoulder of the road before the abnormality restricts or stops the vehicle's driving function.

[0019] (5) In any of (1) to (4) above, the vehicle-mounted device may further include a reset processing unit that performs a reset process to reset the other vehicle-mounted device when the monitoring unit determines that an abnormality has occurred in the other vehicle-mounted device.

[0020] With this configuration, if an abnormality occurs with the second on control signal, for example, the other in-vehicle device that is the source of the second on control signal can be initialized, and the control signal can be generated again in that in-vehicle device, thereby ensuring that the switch is turned on.

[0021] (6) In any of (1) to (5) above, the vehicle-mounted device may further include a notification unit that, when communication with the other vehicle-mounted device is interrupted, notifies the user of the vehicle of information indicating that communication with the other vehicle-mounted device has been interrupted.

[0022] With this configuration, the user can be made aware that an abnormality has occurred in the other in-vehicle device that is the source of the status information.

[0023] (7) In any one of the above (1) to (6), the signal generating section may generate the first ON control signal using a condition different from a condition under which the second ON control signal is generated.

[0024] With this configuration, the control for turning on the control switch can be made redundant.

[0025] (8) In any of (1) to (7) above, the signal generating unit may further generate a first off control signal for turning off the switch, the input unit may further receive a second off control signal for turning off the switch from outside the in-vehicle device, and the signal generating unit may generate the first off control signal using conditions different from the conditions for generating the second off control signal.

[0026] With this configuration, even if an abnormality occurs in the signal generating unit, for example, the switch can be turned off by a control signal output from outside the vehicle device, thereby making the control for turning off the switch redundant.

[0027] (9) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system including an in-vehicle device that controls a switch that switches on / off the supply of power to in-vehicle equipment in a vehicle, wherein another in-vehicle device is mounted on the vehicle and generates a first on-control signal for turning on the switch and outputs it to the switch, the in-vehicle device includes a signal generating unit that generates a second on-control signal for turning on the switch, and an output unit that outputs the second on-control signal generated by the signal generating unit to the other in-vehicle device, the switch is turned on under an OR condition of the first on-control signal generated by the other in-vehicle device and the second on-control signal generated by the in-vehicle device, and the in-vehicle device further includes a notification unit that performs processing to notify the other in-vehicle device of information indicating the state of the second on-control signal by communicating with the other in-vehicle device.

[0028] In this way, by configuring the control switch to be turned on based on an OR condition of the first ON control signal generated in the other in-vehicle device and the second ON control signal input to the other in-vehicle device, even if an abnormality occurs in the other in-vehicle device and the first ON control signal cannot be generated, the control switch can be turned on by the second ON control signal. In other words, the control for turning on the control switch is made redundant, and the possibility of power supply to the in-vehicle device being stopped can be reduced.

[0029] Furthermore, by notifying the other in-vehicle device of the information indicating the state of the second ON control signal, the other in-vehicle device can compare the second ON control signal that it actually received with the state, thereby more reliably detecting an abnormality related to the second ON control signal. Therefore, it is possible to more reliably detect an abnormality related to the control signal while suppressing the restriction or suspension of functions executed by the in-vehicle device.

[0030] (10) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system including an in-vehicle device that controls a switch that switches on and off the supply of power to in-vehicle equipment in a vehicle, the in-vehicle device including a signal generating unit that generates a first off control signal to turn off the switch, and an input unit that receives a second off control signal to turn off the switch from outside the in-vehicle device, the switch turns off based on an AND condition of the first off control signal generated by the signal generating unit and the second off control signal received by the input unit, the in-vehicle device further including an acquisition unit that acquires status information indicating the status of the second off control signal by communicating with another in-vehicle device, and a detection unit that detects an abnormality related to the switch based on a comparison result between the second off control signal received by the input unit and the status indicated by the status information acquired by the acquisition unit.

[0031] In this way, by acquiring status information indicating the status of the second off control signal and comparing the second off control signal actually input from outside the in-vehicle device with the status indicated by the acquired status information, it is possible to more reliably detect an abnormality related to the second off control signal, thereby more reliably detecting an abnormality related to the control signal.

[0032] (11) An abnormality detection method according to an embodiment of the present disclosure is an abnormality detection method in an in-vehicle system including an in-vehicle device that controls a switch that switches on and off the supply of power to in-vehicle equipment in a vehicle, and includes the steps of: the in-vehicle device generating a first on control signal for turning on the switch; the in-vehicle device receiving a second on control signal for turning on the switch from outside the in-vehicle device; the in-vehicle device turning on the switch based on an OR condition of the generated first on control signal and the second on control signal; the in-vehicle device acquiring status information indicating the state of the second on control signal by communicating with another in-vehicle device; and the in-vehicle device detecting an abnormality related to the second on control signal based on a comparison result between the second on control signal and the state indicated by the acquired status information.

[0033] In this way, by using an OR condition of the generated first ON control signal and the second ON control signal input from outside the in-vehicle device to turn on the control switch, even if an abnormality occurs and the first ON control signal cannot be generated, the control switch can be turned on by the second ON control signal. In other words, the control for turning on the control switch is made redundant, and the possibility of power supply to the in-vehicle device being stopped can be reduced.

[0034] Furthermore, by acquiring status information indicating the status of the second ON control signal and comparing the second ON control signal actually input from outside the in-vehicle device with the status indicated by the acquired status information, it is possible to more reliably detect an abnormality related to the second ON control signal. Therefore, it is possible to more reliably detect an abnormality related to the control signal while suppressing restriction or suspension of functions executed by the in-vehicle device.

[0035] (12) A notification method according to an embodiment of the present disclosure is a notification method in an in-vehicle system including an in-vehicle device that controls a switch that switches on / off the supply of power to in-vehicle equipment in a vehicle, wherein another in-vehicle device is mounted on the vehicle and generates a first on-control signal for turning on the switch and outputs it to the switch, and the notification method includes a step in which the in-vehicle device generates a second on-control signal for turning on the switch and a step in which the in-vehicle device outputs the generated second on-control signal to the other in-vehicle device, and the switch is turned on under an OR condition of the first on-control signal generated by the other in-vehicle device and the second on-control signal generated by the in-vehicle device, and the notification method further includes a step in which the in-vehicle device notifies the other in-vehicle device of information indicating the state of the second on-control signal by communicating with the other in-vehicle device.

[0036] In this way, by configuring the control switch to be turned on based on an OR condition of the first ON control signal generated in the other in-vehicle device and the second ON control signal input to the other in-vehicle device, even if an abnormality occurs in the other in-vehicle device and the first ON control signal cannot be generated, the control switch can be turned on by the second ON control signal. In other words, the control for turning on the control switch is made redundant, and the possibility of power supply to the in-vehicle device being stopped can be reduced.

[0037] Furthermore, by notifying the other in-vehicle device of the information indicating the state of the second ON control signal, the other in-vehicle device can compare the second ON control signal that it actually received with the state, thereby more reliably detecting an abnormality related to the second ON control signal. Therefore, it is possible to more reliably detect an abnormality related to the control signal while suppressing the restriction or suspension of functions executed by the in-vehicle device.

[0038] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0039] [In-vehicle system] 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to FIG. 1, the in-vehicle system 301 includes an in-vehicle relay device 101, an in-vehicle device group including a plurality of in-vehicle devices 201, and a power supply unit 10. The in-vehicle system 301 is mounted on a vehicle 1. The in-vehicle relay device 101 and the in-vehicle devices 201 are examples of in-vehicle devices.

[0040] The in-vehicle devices 201 include an in-vehicle ECU (Electronic Control Unit), an OTA (Over The Air) master, a sensor, an actuator, a motor, a navigation device, a human-machine interface, and a camera. The in-vehicle ECUs include an autonomous driving ECU, an engine ECU, a body ECU, a verification ECU, a steering ECU, a parking brake ECU, and a TCU (Telematics Communication Unit).

[0041] The in-vehicle relay device 101 and the plurality of in-vehicle devices 201 constitute an in-vehicle network 401. The plurality of in-vehicle devices 201 are connected to the in-vehicle relay device 101 via a CAN bus 2 that conforms to the CAN (Controller Area Network) standard, for example.

[0042] 1, the in-vehicle system 301 includes in-vehicle devices 201A, 201B, 201C, 201D, 201E, 201F, 201G, 201H, and 201J that are in-vehicle devices 201. Also, in the example shown in FIG. 1, CAN buses 2A, 2B, 2C, and 2D are provided as the CAN bus 2.

[0043] The in-vehicle devices 201A, 201B, and 201C are connected to the in-vehicle relay device 101 via a CAN bus 2A. The in-vehicle devices 201D and 201E are connected to the in-vehicle relay device 101 via a CAN bus 2B. The in-vehicle devices 201F and 201G are connected to the in-vehicle relay device 101 via a CAN bus 2C. The in-vehicle devices 201H and 201J are connected to the in-vehicle relay device 101 via a CAN bus 2D.

[0044] The vehicle-mounted relay device 101 performs a relay process for relaying frames transmitted and received between the vehicle-mounted devices 201 .

[0045] For example, each in-vehicle device 201 transmits a CAN frame including various information (described later) such as information for assisting the autonomous driving performed by the vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, to another in-vehicle device 201 or the in-vehicle repeater 101. The in-vehicle repeater 101 relays a CAN frame received from a certain in-vehicle device 201 to another in-vehicle device 201. The in-vehicle repeater 101 also creates a CAN frame including the above-mentioned various information and the CAN-ID, and transmits the created CAN frame to the destination in-vehicle device 201.

[0046] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 2 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 2 are provided.

[0047] In addition, the vehicle-mounted relay device 101 and the vehicle-mounted equipment 201 may be configured to communicate in accordance with communication protocols such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark), instead of or in addition to communication in accordance with the CAN standard.

[0048] The vehicle-mounted relay device 101 and each vehicle-mounted device 201 communicate with each other to provide various services to the vehicle 1.

[0049] Specifically, the in-vehicle network 401 provides services related to the operation of the vehicle 1, a service for updating various software used in the in-vehicle network 401 via OTA, a service for contactlessly charging the battery 61a installed in the vehicle 1, a service for detecting malfunctions in the vehicle 1, and a service for remotely operating the vehicle 1.

[0050] [Power supply section] The power supply unit 10 supplies power to the vehicle 1. The power supply unit 10 includes a first power supply 61 and a second power supply 62. When a service is being executed in the in-vehicle network 401, both the first power supply 61 and the second power supply 62 supply power to each device in the in-vehicle system 301. When the execution of the service is stopped, the second power supply 62 supplies power to each device in the in-vehicle system 301.

[0051] The first power supply 61 is connected to the in-vehicle repeater 101 via a power supply line 3. The second power supply 62 is connected to the in-vehicle repeater 101 via a power supply line 4. Each in-vehicle device 201 is connected to the in-vehicle repeater 101 via a power supply line 5. The power supply line 3 and the power supply line 5 are connected within the in-vehicle repeater 101. The power supply line 4 and the power supply line 5 are connected within the in-vehicle repeater 101.

[0052] 1, power lines 5A, 5B, 5C, and 5D are provided as the power line 5. In-vehicle devices 201A, 201B, and 201C are connected to the in-vehicle relay device 101 via the power line 5A. In-vehicle devices 201D and 201E are connected to the in-vehicle relay device 101 via the power line 5B. In-vehicle devices 201F and 201G are connected to the in-vehicle relay device 101 via the power line 5C. In-vehicle devices 201H and 201J are connected to the in-vehicle relay device 101 via the power line 5D.

[0053] For example, the first power supply 61 includes a battery 61a and a DC / DC converter 61b. The battery 61a is a high-voltage battery such as a lithium-ion battery. The DC / DC converter 61b, for example, steps down a DC voltage Va of the battery 61a to generate a DC voltage Vb. The DC / DC converter 61b then outputs the DC voltage Vb to the power supply line 3.

[0054] The second power supply 62 includes, for example, a low-voltage battery having a lower voltage than the battery 61a of the first power supply 61.

[0055] [Travel-related equipment] For example, the in-vehicle devices 201F, 201G, and 201J are in-vehicle devices 201 (hereinafter also referred to as "driving-related devices") that execute functions related to driving (hereinafter also referred to as "driving-related functions") of the vehicle 1. Specifically, the driving-related devices include an EPS (Electric Power Steering) ECU, a steering ECU, an autonomous driving ECU, a foot brake ECU, an ABS (Anti-lock Braking System) ECU, and a parking brake ECU.

[0056] 1, a plurality of driving-related devices are provided in a vehicle 1. Specifically, the driving-related devices are in-vehicle devices 201F, 201G, and 201J. The in-vehicle device 201F is a parking brake ECU, and the in-vehicle devices 201G and 201J are autonomous driving ECUs.

[0057] Hereinafter, the in-vehicle device 201F, the in-vehicle device 201G, and the in-vehicle device 201J will also be referred to as the parking brake ECU 201F, the automatic driving ECU 201G, and the automatic driving ECU 201J, respectively. Here, an example will be described in which the control switch 91 switches between supplying and not supplying power to the automatic driving ECUs 201G and 201J.

[0058] [Control switch] The vehicle-mounted relay device 101 includes a plurality of control switches 91 that switch on and off the supply of power to specific vehicle-mounted devices 201 in the vehicle 1. Each control switch 91 is, for example, a semiconductor switch. Note that, in FIG. 1, the control switches 91 are shown outside the vehicle-mounted relay device 101 for ease of understanding.

[0059] More specifically, for example, each control switch 91 switches between supplying and not supplying power to the driving-related devices.

[0060] Specifically, for example, the in-vehicle relay device 101 includes control switches 91A and 91B that are the multiple control switches 91. The control switch 91A and the control switch 91B switch between supplying and not supplying power to the automatic driving ECU 201G and the automatic driving ECU 201J, respectively.

[0061] [Power switch] For example, the vehicle-mounted repeater 101 further includes a power switch 92. The power switch 92 is provided between the power supply unit 10 and the control switch 91. The power switch 92 is, for example, a semiconductor switch. Note that, in FIG. 1, for ease of understanding, the power switch 92 is shown outside the vehicle-mounted repeater 101.

[0062] In the example shown in FIG. 1, the vehicle-mounted relay device 101 includes the power switch 92, which is made up of power switches 92A and 92B.

[0063] The power switch 92A switches the connection state between the first power source 61 and the control switch 91. In this embodiment, for example, the power switch 92A is in the ON state when a service is being executed in the in-vehicle network 401, and is in the OFF state when the execution of the service is stopped. The power switch 92B is always in the ON state.

[0064] [ON control signal] The in-vehicle relay device 101 outputs an ON control signal S11 for turning on the control switch 91 to the control switch 91. The in-vehicle device 201H outputs an ON control signal S21 for turning on the control switch 91 to the control switch 91 via the in-vehicle relay device 101. For example, each of the ON control signal S11 and the ON control signal S21 is a logical high level signal. The ON control signal S11 is an example of a first ON control signal, and the ON control signal S21 is an example of a second ON control signal. In the following description, the in-vehicle device 201H will also be referred to as the management device 201H.

[0065] Vehicle repeater 101 outputs an ON control signal S51 for turning on power switch 92A to power switch 92A. Management device 201H outputs an ON control signal S61 for turning on power switch 92A to power switch 92A via vehicle repeater 101. For example, each of ON control signal S51 and ON control signal S61 is a logic high level signal.

[0066] Vehicle repeater 101 outputs an ON control signal S53 for turning on power switch 92B to power switch 92B. Management device 201H outputs an ON control signal S71 for turning on power switch 92B to power switch 92B via vehicle repeater 101. For example, each of ON control signal S53 and ON control signal S71 is a logic high level signal.

[0067] The power switch 92A is turned on under the OR condition of the ON control signal S51 and the ON control signal S61. The power switch 92B is turned on under the OR condition of the ON control signal S53 and the ON control signal S71. The ON control of each power switch 92 will be described in detail later.

[0068] Furthermore, the vehicle-mounted relay device 101 outputs a reset signal Re, which will be described later, to the management device 201H.

[0069] For example, management device 201H is connected to in-vehicle relay device 101 via multiple signal lines 6. Hereinafter, each of the multiple signal lines 6 for transmitting various control signals output from management device 201H will also be referred to as signal line 6a. Furthermore, signal line 6 for transmitting reset signal Re will also be referred to as signal line 6b. Note that management device 201H is not limited to a configuration in which it is connected to in-vehicle relay device 101 via multiple signal lines 6a, and it may also be configured in which it is connected to in-vehicle relay device 101 via a single signal line 6a.

[0070] [Problem description] An abnormality such as a power short, a ground short, or a break may occur in the signal line 6a through which the ON control signals S21, S61, and S71 are transmitted. For example, if such an abnormality occurs in the ON control signal S21 and a failure occurs in the in-vehicle relay device 101, there is a possibility that both the ON control signal S11 and the ON control signal S21 will not be output to the control switch 91. In this case, the power supply to the driving-related device connected to the control switch 91 will be stopped, and there is a possibility that the driving-related function executed by the driving-related device will be limited or stopped.

[0071] Therefore, the in-vehicle system 301 according to the embodiment of the present disclosure solves the above problem by the following configuration and operation.

[0072] [In-vehicle system] 1, the in-vehicle device 201B, the in-vehicle device 201C, the in-vehicle device 201D, and the in-vehicle device 201E are a body ECU, an occupant sensor, a buckle sensor, and a door opening / closing sensor, respectively. Hereinafter, the in-vehicle device 201B, the in-vehicle device 201C, the in-vehicle device 201D, and the in-vehicle device 201E will also be referred to as the body ECU 201B, the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E.

[0073] (Occupant sensor) For example, the occupant sensor 201C is a sensor that detects whether the driver is seated in the driver's seat of the vehicle 1 or whether the driver is leaving the driver's seat.

[0074] More specifically, for example, the occupant sensor 201C is a pressure sensor that measures the pressure P applied to the seat surface of the driver's seat. The occupant sensor 201C measures the pressure P, for example, periodically.

[0075] Then, the occupant sensor 201C detects whether or not a driver is seated in the driver's seat based on the measurement result of the pressure P, and performs a detection process D1 in which sensor information C1 indicating the detection result is transmitted to the body ECU 201B.

[0076] Specifically, for example, when the measurement value is equal to or greater than a predetermined threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver is seated in the driver's seat, including the measurement time ta of the measurement value.

[0077] On the other hand, for example, when the measurement value is less than the threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver has left the driver's seat, together with the measurement time ta of the measurement value.

[0078] The occupant sensor 201C is not limited to a pressure sensor, and may be a camera that takes an image of the driver's seat.

[0079] (Buckle sensor) The buckle sensor 201D is provided on the buckle of the driver's seat of the vehicle 1. The buckle sensor 201D periodically detects the state of the seat belt in the driver's seat and performs a detection process D2 in which sensor information C2 indicating the detection result and the detection time tb is transmitted to the body ECU 201B. For example, the buckle sensor 201D performs the detection process D2 at the same timing as the detection process D1 by the occupant sensor 201C.

[0080] Specifically, for example, when the tongue of the seat belt is engaged with the buckle, the buckle sensor 201D transmits, to the body ECU 201B, sensor information C2 indicating that the seat belt is in the locked state as a detection result.

[0081] On the other hand, for example, when the tongue of the seat belt is not engaged with the buckle, the buckle sensor 201D transmits sensor information C2 indicating that the state of the seat belt is unlocked as a detection result to the body ECU 201B.

[0082] (Door open / close sensor) The door opening / closing sensor 201E periodically detects the state of the door at the driver's seat, and performs a detection process D3 in which sensor information C3 indicating the detection result and the detection time tc is transmitted to the body ECU 201B. For example, the door opening / closing sensor 201E performs the detection process D3 at the same timing as the detection process D1 by the occupant sensor 201C.

[0083] (Body ECU) The body ECU 201B outputs control signals to drive body-related devices such as door lock mechanisms, wipers, and power windows. Specifically, for example, the body ECU 201B receives sensor information from each of the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, and outputs control signals based on the received sensor information to the body-related devices.

[0084] Furthermore, the body ECU 201B creates a CAN frame (hereinafter also referred to as "frame F") including the sensor information C1, sensor information C2, and sensor information C3 received from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively.

[0085] As described above, the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E transmit the sensor information C1, the sensor information C2, and the sensor information C3, respectively, to the body ECU 201B, for example, periodically.

[0086] When the body ECU 201B receives sensor information C1, sensor information C2, and sensor information C3 from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively, it stores the received sensor information C1, sensor information C2, and sensor information C3 in a memory unit not shown.

[0087] For example, when the processing timing Ta for creating a frame F arrives, the body ECU 201B acquires, from the storage unit, the sensor information C1, C2, and C3 accumulated during the period from the previous processing timing Ta to the current processing timing Ta, and creates a frame F including the acquired sensor information C1, C2, and C3. Then, the body ECU 201B transmits the created frame F to the in-vehicle relay device 101.

[0088] Furthermore, the body ECU 201B performs a switch monitoring process to monitor the states of the brake pedal switch and the engine switch. Then, the body ECU 201B transmits switch monitoring information indicating the monitoring results of the switch monitoring process to the in-vehicle relay device 101. The body ECU 201B performs the switch monitoring process and transmits the switch monitoring information, for example, periodically.

[0089] (Verification ECU) 1, the in-vehicle device 201A is a verification ECU, and will hereinafter also be referred to as the verification ECU 201A.

[0090] For example, the verification ECU 201A is connected to an electronic key sensor (not shown) that can measure radio waves output from the electronic key. The electronic key sensor transmits the measurement results and key information indicating identification information (hereinafter also referred to as "key ID") contained in the radio waves to the verification ECU 201A. The key ID is an ID unique to each electronic key.

[0091] The storage unit of the verification ECU 201A stores the key ID. When the verification ECU 201A receives key information from the electronic key sensor, if the measurement result indicated by the received key information satisfies a predetermined condition and the key ID indicated by the key information matches the key ID stored in the storage unit, the verification ECU 201A transmits key verification information to the in-vehicle relay device 101 indicating that the electronic key is present near the vehicle 1 and the key IDs match.

[0092] [Parking brake ECU] The parking brake ECU 201F controls, for example, the parking brake of the vehicle 1. When activated, the parking brake ECU 201F broadcasts parking brake information indicating the state of the parking brake to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0093] [In-vehicle relay device] FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 2, the in-vehicle relay device 101 includes a relay unit 11, a processing unit 12, and a storage unit 13. The processing unit 12 includes a power management unit 21, a determination unit 22, a signal generation unit 23, a logic circuit unit 24, a detection unit 25, an abnormality processing unit 26, and a notification unit 27. One or both of the relay unit 11 and the processing unit 12 are realized, for example, by a processing circuit including one or more processors. The storage unit 13 is, for example, a non-volatile memory included in the processing circuit. The relay unit 11 is an example of an acquisition unit. The logic circuit unit 24 is an example of an input unit. The abnormality processing unit 26 is an example of a warning unit, an example of a control unit, an example of a transition processing unit, and an example of a reset processing unit.

[0094] (Relay section) The relay unit 11 receives a CAN frame transmitted from a certain in-vehicle device 201. Then, the relay unit 11 checks whether the received CAN frame is a CAN frame that the in-vehicle relay device 101 of its own should receive.

[0095] The storage unit 13 stores, for example, a reception list L1 that indicates the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list L1 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0096] When the relay unit 11 receives a CAN frame, it refers to the reception list in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0097] For example, if the CAN-ID included in the received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0098] On the other hand, if the CAN-ID included in the received CAN frame is registered in the reception list L1 and the destination of the CAN frame is the in-vehicle device 201, for example, the relay unit 11 performs relay processing.

[0099] Specifically, for example, the storage unit 13 stores a routing table indicating the correspondence between the CAN-ID, the device to which the CAN frame is to be transmitted, and the CAN bus 2 to which the device to which the CAN frame is to be transmitted (hereinafter also referred to as the "destination bus"). The routing table is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0100] For example, if the CAN-ID included in the CAN frame received from the in-vehicle device 201 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0101] When the relay unit 11 confirms that the destination device of the received CAN frame is the in-vehicle device 201, it refers to the routing table to identify the destination bus corresponding to the destination device, and then outputs the received CAN frame to the identified destination bus.

[0102] On the other hand, when the relay unit 11 confirms that the device to which the received CAN frame is to be transmitted is its own in-vehicle relay unit 101, it outputs the CAN frame to the processing unit 12.

[0103] (Judgment Department) For example, the determination unit 22 performs a determination process to determine the state of the vehicle 1. More specifically, for example, the determination unit 22 performs a determination process J1 to determine whether or not the vehicle 1 is in a state in which it can start traveling (hereinafter also referred to as a "traveling start state").

[0104] For example, when the verification of the electronic key by the verification ECU 201A is completed and the monitoring result indicated by the switch monitoring information B satisfies a predetermined condition, the determination unit 22 determines that the vehicle 1 is in a traveling start state.

[0105] More specifically, when the determination unit 22 receives key verification information from the verification ECU 201A via the relay unit 11, the determination unit 22 checks the monitoring result indicated by the switch monitoring information (hereinafter also referred to as "switch monitoring information B") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the key verification information. If the switch monitoring information B indicates that the brake switch or the engine switch is in the on state, the determination unit 22 determines that the vehicle 1 is in the running start state.

[0106] For example, when the determination unit 22 determines that the state of the vehicle 1 is the running start state, the determination unit 22 periodically broadcasts a running start notification indicating that the state of the vehicle 1 is the running start state to each in-vehicle device 201 via the relay unit 11. In addition, the determination unit 22 outputs the running start notification to the signal generation unit 23.

[0107] On the other hand, if the switch monitoring information B indicates that key matching information has not arrived from the matching ECU 201A or that the brake switch or engine switch is in the off state, the judgment unit 22 judges that the vehicle 1 is not in the running start state.

[0108] [On-control of the control switch by the vehicle-mounted relay device 101] 3 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. With reference to FIG. 2 and FIG. 3, for example, a signal generating unit 23 in the in-vehicle relay device 101 generates an ON control signal S11 based on the state of the vehicle 1 determined by the determining unit 22.

[0109] More specifically, for example, when the signal generating unit 23 receives a running start notification from the determining unit 22, that is, when the determining unit 22 determines that the state of the vehicle 1 is a running start state, the signal generating unit 23 generates an ON control signal S11. Then, the signal generating unit 23 outputs the generated ON control signal S11 to the logic circuit unit 24.

[0110] The logic circuit unit 24 receives an ON control signal S11 from the signal generating unit 23. The logic circuit unit 24 also receives an ON control signal S21 from the outside of the vehicle relay device 101, that is, from the management device 201H, via the signal line 6a.

[0111] For example, the logic circuit unit 24 includes a plurality of OR gates 71. In the example shown in Fig. 3, the logic circuit unit 24 includes a plurality of OR gates 71, that is, OR gates 71A and 71B.

[0112] FIG. 4 is a diagram for explaining the on-control of the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0113] 3 and 4, when at least one of the on control signal S11 and the on control signal S21 is input to the OR gate 71A, a gate signal G1 of a logic high level is output from the OR gate 71A to the control switch 91A. When at least one of the on control signal S11 and the on control signal S21 is input to the OR gate 71B, a gate signal G2 of a logic high level is output from the OR gate 71B to the control switch 91B. In the example shown in FIG. 4, the on control signal S11 is input to the OR gates 71A and 71B.

[0114] Control switches 91A and 91B are turned on when they receive gate signals G1 of a logic high level from OR gates 71A and 71B, respectively, so that power from power supply unit 10 is supplied to automatic driving ECUs 201G and 201J.

[0115] [Startup completion notification] Referring again to FIG. 1, for example, when the state of the vehicle 1 is in a driving start state and the state of the control switch 91 is in an on state by the on control signal S11 or the on control signal S21, the automatic driving ECUs 201G, 201J start executing driving-related functions, specifically automatic driving functions.

[0116] More specifically, for example, when the control switch 91 is turned on while the vehicle 1 is in a traveling start state, the autonomous driving ECUs 201G, 201J are activated. Then, the autonomous driving ECUs 201G, 201J start executing the autonomous driving function. Furthermore, when activated, the autonomous driving ECUs 201G, 201J transmit an activation completion notification to the in-vehicle relay device 101 indicating that they have been activated.

[0117] The automatic driving ECUs 201G, 201J may be configured to start executing the automatic driving function when the vehicle 1 is in a traveling start state, the control switch 91 is in an on state, and the parking brake is in an off state. In this case, when the control switch 91 is in an on state and the parking brake state indicated by the brake information received from the parking brake ECU 201F is in an off state, the automatic driving ECUs 201G, 201J are started up and start executing the automatic driving function.

[0118] [Device status notification] Referring again to Figure 2, in the in-vehicle relay device 101, when the notification unit 27 receives a startup completion notification from the autonomous driving ECUs 201G, 201J via the relay unit 11, it periodically broadcasts an equipment status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each in-vehicle device 201 via the relay unit 11.

[0119] [Managed equipment] Fig. 5 is a diagram showing an example of the configuration of an in-vehicle device according to an embodiment of the present disclosure, showing the configuration of a management device 201H.

[0120] 5, management device 201H includes communication unit 41, processing unit 42, and storage unit 43. Processing unit 42 includes determination unit 51, signal generation unit 52, and notification unit 53. One or both of communication unit 41 and processing unit 42 are realized, for example, by a processing circuit including one or more processors. Storage unit 43 is, for example, a non-volatile memory included in the processing circuit.

[0121] For example, the storage unit 43 stores a reception list L2 that indicates CAN-IDs included in CAN frames that should be received by the management device 201H. The reception list L2 is registered in the storage unit 43 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0122] When the communication unit 41 receives a CAN frame from the in-vehicle relay device 101 or an in-vehicle device 201 other than the management device 201H, the communication unit 41 reads out the reception list L2 in the storage unit 43. Then, by referring to the reception list L2, the communication unit 41 checks whether the CAN-ID included in the received CAN frame is registered in the reception list L2.

[0123] If the CAN-ID included in the received CAN frame is registered in the reception list L2, the communication unit 41 outputs the CAN frame to the processing unit 12. On the other hand, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the communication unit 41 discards the CAN frame.

[0124] The determination unit 51 determines the state of the vehicle 1. Specifically, for example, the determination unit 51 determines that the state of the vehicle 1 is a traveling start state by receiving a traveling start notification from the in-vehicle relay device 101 via the communication unit 41. Then, the determination unit 51 outputs the received traveling start notification to the signal generation unit 52.

[0125] The determination unit 51 further determines the states of the autonomous driving ECUs 201G and 201J. Specifically, for example, when the determination unit 51 receives an equipment state notification from the in-vehicle relay device 101 via the communication unit 41, the determination unit 51 determines that the autonomous driving ECUs 201G and 201J are operating. Then, the determination unit 51 outputs the received equipment state notification to the signal generation unit 52.

[0126] (Generation and output of ON control signals S21, S61, S71) For example, the second ON condition under which management device 201H outputs ON control signal S21 is different from the first ON condition under which in-vehicle relay device 101 outputs ON control signal S11. As described above, in-vehicle relay device 101 generates ON control signal S11 when it determines that the state of vehicle 1 is the traveling start state. On the other hand, in response to receiving a device state notification from in-vehicle relay device 101, management device 201H generates ON control signals S21, S61, and S71.

[0127] Specifically, for example, in managed device 201H, when signal generating section 52 receives device state notification from determining section 51, it generates ON control signals S21, S61, S71.

[0128] Then, the signal generating unit 52 outputs the generated ON control signals S21, S61, and S71 to the in-vehicle repeater 101. For example, the signal generating unit 52 outputs the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at the same timing. Note that the signal generating unit 52 may output some of the ON control signals S21, S61, and S71 to the in-vehicle repeater 101 at a timing different from that of the other ON control signals.

[0129] Specifically, for example, when the signal generating unit 52 generates the ON control signal S21, it transmits the generated ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6a.

[0130] Furthermore, for example, when the signal generating unit 52 generates the ON control signals S61, S71, it transmits the generated ON control signals S61, S71 to the in-vehicle relay device 101 via the signal line 6a. When the signal generating unit 52 generates the ON control signals S21, S61, S71, it outputs a generation completion notification H1 to the notification unit 53, indicating that the ON control signals S21, S61, S71 have been generated.

[0131] (Power switch 92 ON control) FIG. 6 is a diagram for explaining the on-control of the power switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0132] 6, in the vehicle-mounted relay device 101, the logic circuit unit 24 further includes a plurality of OR gates 72. In the example shown in FIG. 6, the logic circuit unit 24 includes the plurality of OR gates 72, that is, OR gates 72A and 72B.

[0133] When at least one of on control signal S51 and on control signal S61 is input to OR gate 72A, a gate signal G5 of a logic high level is output from OR gate 72A to power switch 92A. When at least one of on control signal S53 and on control signal S71 is input to OR gate 72B, a gate signal G7 of a logic high level is output from OR gate 72B to power switch 92B.

[0134] The power switch 92A turns on when it receives a gate signal G5 of a logic high level from the OR gate 72A. The power switch 92B turns on when it receives a gate signal G7 of a logic high level from the OR gate 72B. This causes the connection state between the first power supply 61 and the control switch 91 and the connection state between the second power supply 62 and the control switch 91 to transition from the off state to the on state.

[0135] As described above, in this embodiment, the power switch 92B is always in the on state. That is, the power switch 92B remains in the on state even when the microcomputer mounted on the in-vehicle relay device 101 is in the sleep state. In order to maintain the power switch 92B in the on state, for example, an on-holding unit (not shown) is provided between the signal generating unit 23 and the OR gate 72B in the in-vehicle relay device 101. This makes it possible to reduce the dark current flowing through the power supply unit 10 when the ignition power of the vehicle 1 is in the off state.

[0136] In order to keep the power switch 92B in the on state, the power switch 92B may be a normally-on switch.

[0137] [Switch-on notification N21] 3, in vehicle-mounted relay device 101, logic circuit unit 24 receives ON control signal S21 from management device 201H via signal line 6a. Then, OR gate 71A in logic circuit unit 24 outputs gate signal G1 of a logical high level to control switch 91A. Also, OR gate 71B in logic circuit unit 24 outputs gate signal G2 of a logical high level to control switch 91B.

[0138] Furthermore, when the logic circuit unit 24 receives the ON control signal S21 from the managed device 201H, it outputs to the notification unit 27 a switch ON notification N21 indicating that the ON control signal S21 has been received.

[0139] When the notification unit 27 receives the switch-on notification N21 from the logic circuit unit 24, it monitors the state of the control switch 91. Then, when the state of the control switch 91 is in the on state, the notification unit 27 transmits the switch-on notification N21 to the managed device 201H via the relay unit 11.

[0140] Furthermore, when logic circuit unit 24 receives ON control signals S61, S71 from managed device 201H via signal line 6a, it outputs to notification unit 27 a switch ON notification N22 indicating that ON control signals S61, S71 have been received from managed device 201H.

[0141] When the notification unit 27 receives the switch-on notification N22 from the logic circuit unit 24, it transmits the switch-on notification N22 to the management device 201H via the relay unit 11.

[0142] [On pending notification] Referring again to Figure 5, in the management device 201H, the notification unit 53 broadcasts an on-uncertainty notification, via the communication unit 41, to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H, indicating that the execution of the on control of the control switch 91 by the on control signal S21, the on control of the power switch 92A by the on control signal S61, and the on control of the power switch 92B by the on control signal S71 is undetermined.

[0143] Specifically, the notification unit 53 broadcasts the on-unconfirmed notification to the other in-vehicle devices 201 and the in-vehicle relay 101, for example periodically, until it receives the switch-on notification N21 from the in-vehicle relay 101 via the communication unit 41.

[0144] [On completion notification] In addition, when the notification unit 53 receives a switch-on notification N21 from the vehicle-mounted relay device 101 via the communication unit 41, it broadcasts an on-completion notification via the communication unit 41 to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 other than its own management device 201H, indicating that on control of the control switch 91 is being executed using the on control signal S21, i.e., that the execution of the on control in the vehicle-mounted relay device 101 has been confirmed.

[0145] [Parking brake off control] Referring again to Figure 1, for example, when the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101 while the parking brake is in the on state, receives an on completion notification from the management device 201H, and performs an operation Q1 to turn the parking brake off in the vehicle 1, the parking brake ECU 201F performs a parking brake release process to transition the parking brake from the on state to the off state.

[0146] More specifically, for example, the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification or a device status notification from the in-vehicle relay device 101, receives an ON completion notification from the management device 201H, and the driver of the vehicle 1 performs an operation Q1 of moving the shift lever to a position other than "parking." Below, an example will be described in which the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification and an ON completion notification from the in-vehicle relay device 101 and the management device 201H, respectively, and the driver performs the operation Q1. Operation Q1 is, for example, an operation in which the driver of the vehicle 1 moves the shift lever to a position other than "parking."

[0147] Specifically, for example, a shift lever sensor (not shown) is connected to the parking brake ECU 201F. The shift lever sensor periodically detects the position of the shift lever and performs detection processing D4, in which sensor information C4 indicating the detection result is transmitted to the parking brake ECU 201F.

[0148] When the parking brake ECU 201F receives the sensor information C4 from the shift lever sensor, the parking brake ECU 201F stores the received sensor information C4 in a storage unit.

[0149] For example, when the parking brake ECU 201F receives a driving start notification from the in-vehicle relay device 101, the parking brake ECU 201F acquires, from the storage unit, the sensor information C4 received during a period from the reception of the driving start notification until a predetermined time has elapsed.

[0150] When the sensor information C4 acquired from the storage unit indicates a shift lever position other than "parking" as the detection result and the parking brake ECU 201F receives an ON completion notification from the management device 201H, the parking brake ECU 201F outputs an OFF control signal S1 to the parking brake to transition the parking brake to the OFF state. This transitions the parking brake from the ON state to the OFF state.

[0151] Then, the parking brake ECU 201F transmits a brake-off notification indicating that the parking brake has been transitioned to the off state to the automatic driving ECUs 201G and 201J.

[0152] [Parking brake on control] For example, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state when it receives an ON completion notification from the management device 201H and a predetermined operation Q2 is performed in the vehicle 1. For example, the operation Q2 is an operation in which the driver moves the shift lever to the "parking" position.

[0153] More specifically, for example, after receiving an ON completion notification from the management device 201H, if the sensor information C4 received from the shift lever sensor indicates "parking" as the detection result, the parking brake ECU 201F outputs an ON control signal S31 to the parking brake to transition the parking brake to an ON state. As a result, the parking brake transitions from an OFF state to an ON state.

[0154] Then, the parking brake ECU 201F broadcasts to the other in-vehicle devices 201 and the in-vehicle relay device 101 a brake-on notification indicating that the on control signal S31 has been output to the parking brake.

[0155] In addition, the parking brake ECU 201F is not limited to being configured to transition the parking brake from the off state to the on state when it receives an on completion notification from the management device 201H and operation Q2 is performed on the vehicle 1, but may also be configured to transition the parking brake from the off state to the on state when another operation is performed on the vehicle 1 instead of operation Q2.

[0156] In this case, for example, when the parking brake ECU 201F receives an ON completion notification from the management device 201H and at least two or more of the following operations are performed in the vehicle 1: operation Q3 in which the driver leaves the driver's seat; operation Q4 in which the driver unlocks the seat belt; and operation Q5 in which the driver unlocks the driver's door, the parking brake ECU 201F transitions the parking brake from an OFF state to an ON state.

[0157] [In-vehicle relay device] (Judgment Department) 2 again, in the in-vehicle relay device 101, the determination unit 22 performs a determination process J2 to determine whether the vehicle 1 is in a state where it has finished traveling (hereinafter also referred to as a "traveling end state"). More specifically, for example, when the determination unit 22 receives a brake-on notification from the parking brake ECU 201F and operations Q3, Q4, and Q5 are performed in the vehicle 1, the determination unit 22 determines that the state of the vehicle 1 is in the traveling end state.

[0158] Specifically, for example, when the judgment unit 22 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11, it checks whether the sensor information C1, C2, and C3 contained in frame F (hereinafter also referred to as "frame F1") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the brake-on notification satisfy predetermined conditions.

[0159] For example, if frame F1 contains sensor information C1 indicating that the driver has left the seat, sensor information C2 indicating that the seat belt is in an unlocked state, and sensor information C3 indicating that the driver's door is in an open state, the judgment unit 22 judges that the state of vehicle 1 is in an end-of-travel state.

[0160] Then, the determination unit 22 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each in-vehicle device 201 via the relay unit 11. The determination unit 22 also outputs the driving end notification to the signal generation unit 23.

[0161] In addition, the judgment unit 22 may be configured to judge that the state of vehicle 1 is in the end-of-travel state when it receives a brake-on notification from the parking brake ECU 201F and any two of operations Q3, Q4, and Q5 are performed in vehicle 1.

[0162] [Off transition request] For example, the in-vehicle relay device 101 transmits an OFF transition request to the automatic driving ECUs 201G and 201J to request the stopping of the execution of the driving-related functions.

[0163] More specifically, for example, in the in-vehicle relay device 101, when the signal generating unit 23 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11 and also receives a driving end notification from the judgment unit 22, it broadcasts an off transition request to each in-vehicle device 201 via the relay unit 11 before generating the off control signal S12.

[0164] [Stop preparation completion notification] Referring again to Figure 1, for example, when the autonomous driving ECUs 201G, 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and the management device 201H outputs an off control signal S22, they perform pre-processing to stop the execution of the autonomous driving function before the power supply to the autonomous driving ECUs 201G, 201J is stopped.

[0165] More specifically, for example, when the autonomous driving ECUs 201G, 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and an off completion notification from the management device 201H, they perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function.

[0166] Specifically, for example, the autonomous driving ECUs 201G, 201J include a volatile memory that stores data indicating the processing content during execution of the autonomous driving function, and a non-volatile memory that is used in preprocessing.

[0167] When the autonomous driving ECUs 201G and 201J receive a driving end notification from the vehicle relay device 101 and an off completion notification from the management device 201H, they perform a preprocessing process to back up the data stored in the volatile memory to the non-volatile memory.

[0168] Furthermore, for example, actuators (not shown) are connected to each of the automatic driving ECUs 201G and 201J. The automatic driving ECUs 201G and 201J drive the actuators while the automatic driving function is being executed.

[0169] When the autonomous driving ECUs 201G and 201J receive the driving end notification from the in-vehicle relay device 101 and the power-off completion notification from the management device 201H, they perform a process of stopping the operation of the actuator as pre-processing.

[0170] Then, when the automatic driving ECUs 201G and 201J have completed preparations to stop the execution of the automatic driving function, they transmit a stop preparation completion notification to the in-vehicle relay device 101.

[0171] [OFF control signal S22] 3 and 5 again, for example, management device 201H outputs an OFF control signal S22 to control switch 91. For example, OFF control signal S22 is a signal at a logical low level. ON control signal S21 and OFF control signal S22 are output exclusively. OFF control signal S22 is an example of a second OFF control signal.

[0172] For example, the condition under which the vehicle relay device 101 outputs the off control signal S12 (hereinafter also referred to as the "first off condition") is different from the condition under which the management device 201H outputs the off control signal S22 (hereinafter also referred to as the "second off condition").

[0173] More specifically, for example, the first OFF condition includes a condition related to the state of the automatic driving ECUs 201G and 201J. The second OFF condition does not include a condition related to the state of the automatic driving ECUs 201G and 201J.

[0174] Specifically, for example, when the in-vehicle relay device 101 receives a stop preparation completion notification from the autonomous driving ECUs 201G and 201J, it outputs an OFF control signal S12.

[0175] For example, in the management device 201H, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output an off control signal S22.

[0176] Then, the signal generating unit 52 generates an OFF control signal S22 and outputs the generated OFF control signal S22 to the vehicle-mounted relay device 101.

[0177] Specifically, for example, the signal generating unit 52 transmits the generated OFF control signal S22 to the vehicle-mounted relay device 101 via the signal line 6a.

[0178] [Switch off notification N12] Referring again to Figure 2, in the vehicle relay device 101, when the logic circuit unit 24 receives the off control signal S22 from the management device 201H via the signal line 6a, it outputs a switch off notification N12 to the notification unit 27 indicating that the off control signal S22 has been received.

[0179] When the notification unit 27 receives the switch-off notification N12 from the logic circuit unit 24, it transmits the switch-off notification N12 via the relay unit 11 to the management device 201H.

[0180] [Notification of unconfirmed off] Referring again to Figure 5, in the management device 201H, the notification unit 53 broadcasts an off-uncertainty notification, indicating that the off control of the control switch 91 by the off control signal S22 is undetermined, via the communication unit 41 to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H.

[0181] Specifically, during the period from when the notification unit 53 outputs the off control signal S22 to the vehicle-mounted relay device 101 to when it receives the switch-off notification N12 from the vehicle-mounted relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off-unconfirmed notification to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101, for example, periodically.

[0182] [Off completion notification] After outputting the off control signal S22 to the vehicle-mounted relay device 101, the notification unit 53, when it receives a switch-off notification N12 from the vehicle-mounted relay device 101, sends an off completion notification to the autonomous driving ECUs 201G, 201J indicating that the transmission of the off control signal S22 has been completed.

[0183] Specifically, when the notification unit 53 receives the switch-off notification N12 from the in-vehicle relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H via the communication unit 41. The notification unit 53 broadcasts the off completion notification to the other in-vehicle devices 201 and in-vehicle relay devices 101, for example, periodically.

[0184] [Controlling each switch to off] (Generation and output of the off control signal S12) 2 and 3 again, for example, the vehicle-mounted relay device 101 outputs an OFF control signal S12 for turning off the control switch 91 to the control switch 91. The OFF control signal S12 is an example of a first OFF control signal.

[0185] More specifically, for example, in the in-vehicle relay device 101, the signal generating unit 23 generates the off control signal S12 when the management device 201H outputs the off control signal S22 and receives a stop preparation completion notification from the autonomous driving ECUs 201G, 201J via the relay unit 11. For example, the off control signal S12 is a signal of a logical low level.

[0186] Then, the signal generating unit 23 outputs the generated OFF control signal S12 to the logic circuit unit 24. The ON control signal S11 and the OFF control signal S12 are output exclusively.

[0187] (Turning off the control switch 91) FIG. 7 is a diagram for explaining the control of turning off the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0188] Referring to Figure 7, for example, when the management device 201H outputs an off control signal S22 and the autonomous driving ECUs 201G, 201J perform preprocessing to stop the execution of the autonomous driving function, the vehicle relay device 101 outputs an off control signal S12 to the control switch 91.

[0189] More specifically, for example, in the in-vehicle relay device 101, when the signal generation unit 23 receives a notification that stop preparation is complete from the autonomous driving ECUs 201G, 201J via the relay unit 11, it outputs the generated off control signal S12 to the logic circuit unit 24.

[0190] The control switch 91 is turned off under an AND condition of the OFF control signal S12 generated by the signal generating unit 23 and the OFF control signal S22 received by the logic circuit unit 24.

[0191] More specifically, when logic circuit unit 24 receives OFF control signal S12 from signal generating unit 23 and OFF control signal S22 from management device 201H, logic circuit unit 24 outputs gate signal G3 of a logic low level to control switch 91.

[0192] Specifically, when both the OFF control signal S12 and the OFF control signal S22 are input to the OR gate 71A, the gate signal G3 at the logic low level is output from the OR gate 71A to the control switch 91A.

[0193] Control switch 91A turns off when it receives gate signal G3 of a logical low level from OR gate 71A, thereby stopping the supply of power to automatic driving ECU 201G.

[0194] When both the OFF control signal S12 and the OFF control signal S22 are input to OR gate 71B, gate signal G4 at a logic low level is output from OR gate 71B to control switch 91B.

[0195] Control switch 91B turns off when it receives gate signal G4 at a logical low level from OR gate 71B, thereby stopping the supply of power to automatic driving ECU 201J.

[0196] In addition to the control switch 91 that switches on / off the supply of power to the autonomous driving ECUs 201G and 201J, the in-vehicle relay device 101 may be configured to include another control switch that switches on / off the supply of power to the management device 201H. In this case, the in-vehicle relay device 101 and the management device 201H switch on and off the other switch in the same way as the control switch 91 described above is switched on and off.

[0197] (Generation and output of the OFF control signal S52) FIG. 8 is a diagram for explaining the power switch OFF control by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0198] 2 and 8, for example, in the vehicle-mounted relay device 101, the signal generating unit 23 generates an OFF control signal S52 for turning off the power switch 92A.

[0199] More specifically, for example, when the execution of various services in the in-vehicle network 401 is stopped, the signal generating unit 23 generates an OFF control signal S52 upon receiving a stop preparation completion notification from the autonomous driving ECUs 201G, 201J via the relay unit 11. For example, the OFF control signal S52 is a signal at a logical low level.

[0200] More specifically, for example, when the signal generating unit 23 receives a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 via the communication unit 41, the signal generating unit 23 determines that the execution of various services in the in-vehicle network 401 has stopped. In this case, the signal generating unit 52 generates an OFF control signal. Note that the signal generating unit 23 may be configured to determine that the execution of various services has stopped when the signal generating unit 23 receives a stop preparation completion notification from the in-vehicle ECU that controls the DC / DC converter 61b in the power supply unit 10.

[0201] Then, the signal generating unit 23 outputs the generated OFF control signal S52 to the logic circuit unit 24. The ON control signal S51 and the OFF control signal S52 are output exclusively. Furthermore, after generating the OFF control signal S52, the signal generating unit 23 outputs a generation completion notification H2 indicating that the OFF control signal S52 has been generated to the notification unit 53.

[0202] (Generation and output of OFF control signals S62 and S72) 5 and 8, for example, in management device 201H, signal generation unit 52 generates off control signal S62 for turning off power switch 92A and off control signal S72 for turning off power switch 92B. For example, off control signals S62 and S72 are signals at a logical low level.

[0203] More specifically, for example, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output off control signals S62, S72.

[0204] Then, the signal generating unit 52 generates OFF control signals S62, S72 and transmits the generated OFF control signals S62, S72 to the in-vehicle relay device 101 via the signal line 6a. The ON control signal S61 and the OFF control signal S62 are output exclusively. The ON control signal S71 and the OFF control signal S72 are output exclusively. Furthermore, when the signal generating unit 23 generates the OFF control signals S62, S72, it outputs a generation completion notification H3 indicating that the OFF control signals S62, S72 have been generated to the notification unit 53.

[0205] (Switch off notification N11) Referring again to Figure 2, in the vehicle-mounted relay device 101, when the logic circuit unit 24 receives the off control signals S62, S72 from the management device 201H via the signal line 6a, it outputs a switch off notification N11 to the notification unit 27 indicating that the off control signals S62, S72 have been received from the management device 201H.

[0206] When the notification unit 27 receives the switch-off notification N11 from the logic circuit unit 24, it transmits the switch-off notification N11 to the management device 201H via the relay unit 11.

[0207] (Power switch 92A turned off) In the vehicle-mounted relay device 101, when the logic circuit unit 24 receives the OFF control signal S52 from the signal generating unit 23 and the OFF control signal S62 from the management device 201H, it outputs the gate signal G8 of a logic low level to the power switch 92A.

[0208] Specifically, for example, when both OFF control signal S52 and OFF control signal S62 are input to OR gate 72A, gate signal G8 at a logic low level is output from OR gate 72A to power switch 92A.

[0209] Power switch 92A is turned off when it receives gate signal G8 of a logic low level from OR gate 72A.

[0210] [Notification of status information B1, B2, B3] Referring again to FIG. 5, in the management device 201H, the notification unit 53 performs a process of notifying the vehicle-mounted relay device 101 of status information B1 indicating the status of the ON control signals S21, S61, and S71 by communicating with the vehicle-mounted relay device 101.

[0211] More specifically, for example, when the notification unit 53 receives a generation completion notification H1 from the signal generation unit 52, it transmits status information B1 to the vehicle-mounted relay device 101 via the communication unit 41, indicating that the on-control signals S21, S61, S71 are being output from its own management device 201H as the status of the on-control signals S21, S61, S71.

[0212] Specifically, for example, the storage unit 43 stores the CAN-ID of the in-vehicle relay device 101. When the signal generation unit 52 determines that the on-control signal S21 is to be output to the in-vehicle relay device 101, the notification unit 53 creates a CAN frame (hereinafter also referred to as a "status frame F31") including the CAN-ID and status information B1. Then, the notification unit 53 transmits the created status frame F31 to the in-vehicle relay device 101 via the communication unit 41 and the CAN bus 2D. The notification unit 53 creates and transmits the status frame F31, for example, periodically.

[0213] Also, for example, the notification unit 53 performs a process of notifying the vehicle-mounted relay device 101 of state information B2 indicating the state of the OFF control signal S22 by communicating with the vehicle-mounted relay device 101.

[0214] More specifically, for example, when the notification unit 53 receives the generation completion notification H2 from the signal generation unit 52, the notification unit 53 determines that the signal generation unit 52 outputs the OFF control signal S22 to the vehicle-mounted relay device 101.

[0215] Then, the notification unit 53 transmits, to the vehicle-mounted relay device 101 via the communication unit 41, state information B2 indicating that the OFF control signal S22 is being output from its own management device 201H, as the state of the OFF control signal S22.

[0216] Specifically, for example, when the signal generating unit 52 determines that the off control signal S22 is to be output to the in-vehicle relay device 101, the notifying unit 53 creates a CAN frame (hereinafter also referred to as a "status frame F32") including the CAN-ID of the in-vehicle relay device 101 stored in the memory unit 43 and the status information B2. Then, the notifying unit 53 transmits the created frame F12 to the in-vehicle relay device 101 via the communication unit 41 and the CAN bus 2D. The notifying unit 53 creates and transmits the status frame F32, for example, periodically.

[0217] Also, for example, the notification unit 53 performs a process of notifying the vehicle-mounted relay device 101 of state information B3 indicating the state of the OFF control signals S62 and S72 by communicating with the vehicle-mounted relay device 101.

[0218] More specifically, for example, when the notification unit 53 receives the generation completion notification H3 from the signal generation unit 52, it determines that the signal generation unit 52 outputs the off control signals S62 and S72 to the vehicle-mounted relay device 101.

[0219] Then, the notification unit 53 transmits, to the vehicle-mounted relay device 101 via the communication unit 41, status information B3 indicating that the OFF control signals S62, S72 are being output from its own management device 201H, as the status of the OFF control signals S62, S72.

[0220] Specifically, for example, when the signal generating unit 52 determines that the off control signals S62 and S72 are to be output to the in-vehicle relay device 101, the notifying unit 53 creates a CAN frame (hereinafter also referred to as a "status frame F33") including the CAN-ID of the in-vehicle relay device 101 stored in the memory unit 43 and status information B3. Then, the notifying unit 53 transmits the created frame F33 to the in-vehicle relay device 101 via the communication unit 41 and the CAN bus 2D. The notifying unit 53 creates and transmits the status frame F33, for example, periodically. Hereinafter, each of the status frame F31, the status frame F32, and the status frame F33 will also be referred to as a status frame F3.

[0221] [Getting status information B1, B2, B3] Referring back to FIG. 2, in the vehicle-mounted relay device 101, the relay unit 11 acquires the status information B1, B2, and B3 by communicating with the management device 201H.

[0222] Specifically, for example, the relay unit 11 receives a status frame F3 from the management device 201H via the CAN bus 2D.

[0223] When relay unit 11 receives status frame F31 from managed device 201H, it outputs status information B1 included in status frame F31 to detection unit 25. When relay unit 11 receives status frame F32 from managed device 201H, it outputs status information B2 included in status frame F32 to detection unit 25. When relay unit 11 receives status frame F33 from managed device 201H, it outputs status information B3 included in status frame F33 to detection unit 25.

[0224] [Abnormality detection processing] (Abnormality related to the ON control signal S21) FIG. 9 is a diagram for explaining an example of an abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0225] 2 and 9, the detection unit 25 performs an abnormality detection process A1 to detect an abnormality K1 related to the ON control signal S21 based on the comparison result between the ON control signal S21 received by the logic circuit unit 24 and the state of the ON control signal S21 indicated by the state information B1 acquired by the relay unit 11.

[0226] More specifically, for example, upon receiving state information B1 from relay unit 11, detection unit 25 recognizes that ON control signal S21 is being output from management device 201H. Then, detection unit 25 monitors the transmission signal on signal line 6a between management device 201H and OR gate 71. Specifically, detection unit 25 checks whether or not ON control signal S21 is being transmitted on signal line 6a.

[0227] 9 shows a case where an ON control signal S21 is transmitted on signal line 6a between management device 201H and OR gate 71. In this case, detection unit 25 determines that abnormality K1 has not occurred.

[0228] FIG. 10 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0229] 10 shows a case where an OFF control signal S22 is transmitted instead of an ON control signal S21 on signal line 6a between management device 201H and OR gate 71. In this case, detection unit 25 determines that an abnormality K1 has occurred.

[0230] Then, the detection unit 25 outputs to the abnormality processing unit 26 abnormality detection information indicating that the abnormality K1 has occurred.

[0231] (Abnormality related to ON control signals S61, S71) Referring again to Figure 2, the detection unit 25 performs an abnormality detection process A11 to detect an abnormality K11 related to the ON control signal S61 based on the comparison result between the ON control signal S61 received by the logic circuit unit 24 and the state of the ON control signal S61 indicated by the state information B1 acquired by the relay unit 11.

[0232] In addition, the detection unit 25 performs an abnormality detection process A12 to detect an abnormality K12 related to the on control signal S71 based on the comparison result between the on control signal S71 received by the logic circuit unit 24 and the state of the on control signal S71 indicated by the state information B1 acquired by the relay unit 11.

[0233] More specifically, for example, upon receiving state information B1 from relay unit 11, detection unit 25 recognizes that ON control signals S61, S71 are being output from managed device 201H. Then, detection unit 25 checks whether or not ON control signal S61 is being transmitted over signal line 6a between managed device 201H and OR gate 72A, and whether or not ON control signal S71 is being transmitted over signal line 6a between managed device 201H and OR gate 72B.

[0234] When an ON control signal S61 is transmitted over signal line 6a between managed device 201H and OR gate 72A, detection unit 25 determines that abnormality K11 has not occurred. On the other hand, when an OFF control signal S62 is transmitted over signal line 6a instead of the ON control signal S61, detection unit 25 determines that abnormality K11 has occurred. Then, detection unit 25 outputs abnormality detection information indicating that abnormality K11 has occurred to abnormality processing unit 26.

[0235] Furthermore, when an ON control signal S71 is transmitted through signal line 6a between managed device 201H and OR gate 72B, detection unit 25 determines that abnormality K12 has not occurred. On the other hand, when an OFF control signal S72 is transmitted through signal line 6a instead of the ON control signal S71, detection unit 25 determines that abnormality K12 has occurred. Then, detection unit 25 outputs abnormality detection information indicating that abnormality K12 has occurred to abnormality processing unit 26.

[0236] (Abnormality related to the off control signal S22) FIG. 11 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0237] 2 and 11, the detection unit 25 performs an abnormality detection process A2 to detect an abnormality K2 related to the off control signal S22 based on the comparison result between the off control signal S22 received by the logic circuit unit 24 and the state of the off control signal S22 indicated by the state information B2 acquired by the relay unit 11.

[0238] More specifically, for example, upon receiving state information B2 from relay unit 11, detection unit 25 recognizes that OFF control signal S22 is being output from management device 201H. Then, detection unit 25 monitors the transmission signal on signal line 6a between management device 201H and OR gate 71. Specifically, detection unit 25 checks whether OFF control signal S22 is being transmitted on signal line 6a.

[0239] 11 shows a case where an OFF control signal S22 is transmitted on signal line 6a between management device 201H and OR gate 71. In this case, detection unit 25 determines that abnormality K2 has not occurred.

[0240] FIG. 12 is a diagram for explaining another example of the abnormality detection process performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0241] 12 shows a case where an ON control signal S21 is transmitted instead of an OFF control signal S22 on signal line 6a between management device 201H and OR gate 71. In this case, detection unit 25 determines that an abnormality K2 has occurred.

[0242] Then, the detection unit 25 outputs to the abnormality processing unit 26 abnormality detection information indicating that the abnormality K2 has occurred.

[0243] (Abnormality related to the off control signals S62 and S72) Referring again to Figure 2, the detection unit 25 performs an abnormality detection process A21 to detect an abnormality K21 related to the off control signal S62 based on the comparison result between the off control signal S62 received by the logic circuit unit 24 and the state of the off control signal S62 indicated by the state information B3 acquired by the relay unit 11.

[0244] In addition, the detection unit 25 performs an abnormality detection process A22 to detect an abnormality K22 related to the off control signal S72 based on the comparison result between the off control signal S72 received by the logic circuit unit 24 and the state of the off control signal S72 indicated by the state information B3 acquired by the relay unit 11.

[0245] More specifically, for example, upon receiving state information B3 from relay unit 11, detection unit 25 recognizes that OFF control signals S62, S72 are being output from managed device 201H. Then, detection unit 25 checks whether or not OFF control signal S62 is being transmitted on signal line 6a between managed device 201H and OR gate 72A, and whether or not OFF control signal S72 is being transmitted on signal line 6a between managed device 201H and OR gate 72B.

[0246] When an OFF control signal S62 is transmitted on signal line 6a between managed device 201H and OR gate 72A, detection unit 25 determines that abnormality K21 has not occurred. On the other hand, when an ON control signal S61 is transmitted on signal line 6a instead of OFF control signal S62, detection unit 25 determines that abnormality K21 has occurred. Then, detection unit 25 outputs abnormality detection information indicating that abnormality K21 has occurred to abnormality processing unit 26.

[0247] Furthermore, when an OFF control signal S72 is transmitted on signal line 6a between managed device 201H and OR gate 72B, detection unit 25 determines that abnormality K22 has not occurred. On the other hand, when an ON control signal S71 is transmitted on signal line 6a instead of the OFF control signal S72, detection unit 25 determines that abnormality K22 has occurred. Then, detection unit 25 outputs abnormality detection information indicating that abnormality K22 has occurred to abnormality processing unit 26.

[0248] (Warning information output) 10 and 12 again, for example, abnormality processing unit 26 performs warning processing to output warning information E when detection unit 25 detects an abnormality related to the ON control signal or the OFF control signal.

[0249] More specifically, for example, when abnormality processing unit 26 receives abnormality detection information from detection unit 25 indicating that an abnormality has occurred in the ON control signal transmitted from management device 201H, abnormality processing unit 26 transmits warning information E indicating that an abnormality has occurred in the ON control signal transmitted from management device 201H to a navigation device (not shown) via relay unit 11.

[0250] Furthermore, for example, if an abnormality occurs in the OFF control signal transmitted from management device 201H, that is, if an ON control signal is transmitted over signal line 6a instead of an OFF control signal, power from battery 61a is erroneously supplied to autonomous driving ECUs 201G, 201J. Therefore, when abnormality processing unit 26 receives from detection unit 25 abnormality detection information indicating that an abnormality has occurred in the OFF control signal transmitted from management device 201H, it transmits warning information E indicating that an abnormality has occurred in the OFF control signal transmitted from management device 201H and that there is a possibility of over-discharge of battery 61a to the navigation device via relay unit 11.

[0251] For example, when the navigation device receives warning information E from the in-vehicle relay device 101, it performs notification processing based on the received warning information E. Specifically, for example, the navigation device displays the content indicated by the warning information E on its display unit. This allows the user of the vehicle 1 to recognize that an abnormality has occurred in the control signal transmitted from the management device 201H, thereby preventing the abnormality from remaining hidden in the vehicle 1.

[0252] The navigation device may be configured to notify the passengers of the vehicle 1 of the contents indicated by the warning information E by a method other than displaying the contents indicated by the warning information E on its display unit, for example, by voice. In addition to the notification process, the navigation device may be configured to store the warning information E in its memory unit as diagnostic information.

[0253] (Reset information output) Furthermore, for example, when the detection unit 25 detects an abnormality related to the ON control signal or the OFF control signal, the abnormality processing unit 26 performs a reset process to reset the managed device 201H.

[0254] More specifically, when abnormality processing section 26 receives abnormality detection information from detection section 25, it outputs a reset signal Re to signal line 6b to reset the microcomputer mounted on management device 201H, for example.

[0255] When the management device 201H receives the reset signal Re from the vehicle-mounted relay device 101 via the signal line 6b, it resets the microcomputer mounted therein.

[0256] (Keeping the parking brake on) For example, if the detection unit 25 detects an abnormality in the on control signal or the off control signal before the vehicle 1 starts moving, the abnormality processing unit 26 performs brake on control to maintain the parking brake of the vehicle 1 in the on state.

[0257] More specifically, for example, when the abnormality processing unit 26 receives abnormality detection information from the detection unit 25, it checks whether the parking brake is in the ON state. If the parking brake is in the ON state, the abnormality processing unit 26 determines that an abnormality related to the ON control signal or the OFF control signal has occurred before the vehicle starts traveling. In this case, the abnormality processing unit 26 transmits an ON request notification U, which requests that the parking brake be maintained in the ON state, to the parking brake ECU 201F shown in FIG. 1 via the relay unit 11.

[0258] When the parking brake ECU 201F receives the on-request notification U from the in-vehicle relay device 101, it maintains the state of the parking brake in the on state in accordance with the received on-request notification U. This makes it possible to prevent the vehicle 1 from starting to travel when an abnormality occurs in the on control signal or the off control signal.

[0259] (Transition to evacuation driving mode) For example, when the detection unit 25 detects an abnormality related to an on control signal or an off control signal while the vehicle 1 is traveling, the abnormality processing unit 26 performs transition processing to transition the autonomous driving ECUs 201G, 201J to an operating mode for driving the vehicle 1 to an evacuation mode (hereinafter also referred to as the "evacuation driving mode").

[0260] For example, the evacuation driving mode includes a guidance mode that guides the vehicle 1 to a safe place such as a road shoulder. Note that the evacuation driving mode may include other modes in addition to or instead of the guidance mode, such as a mode that restricts driving-related functions of the vehicle 1 such as the engine output value, a mode that notifies the driver of the vehicle 1 of the occurrence of an abnormality, and a mode that drives the vehicle 1 with the hazard lights turned on.

[0261] When the abnormality processing unit 26 receives abnormality detection information from the detection unit 25 in a case where the parking brake is in the OFF state, the abnormality processing unit 26 determines to perform transition processing.

[0262] When the abnormality processing unit 26 determines to perform the transition process, it creates a CAN frame (hereinafter also referred to as a "transition request frame") that includes an evacuation request notification W indicating a request to transition to the evacuation travel mode.

[0263] Then, the abnormality processing unit 26 transmits the created transition request frame via the relay unit 11 to the autonomous driving ECUs 201G and 201J.

[0264] The autonomous driving ECUs 201G and 201J transition to the evacuation travel mode in accordance with the evacuation request notification W included in the transition request frame received from the in-vehicle relay device 101. For example, the autonomous driving ECUs 201G and 201J guide their own vehicles 1 to the shoulder of the road by autonomous driving in accordance with the evacuation request notification W.

[0265] [Notification Department] Referring again to FIG. 2, for example, when communication between the vehicle-mounted relay device 101 and the management device 201H is interrupted, the notification unit 27 notifies the user of the vehicle 1 of communication interruption information indicating that communication has been interrupted.

[0266] More specifically, for example, the in-vehicle relay device 101 includes a counter (not shown). Every time the relay unit 11 receives a status frame F3 from the management device 201H, the relay unit 11 stores the count value of the counter at the time of receiving the status frame F3 in the storage unit 13 as a reception time tr.

[0267] Relay unit 11 determines that communication with managed device 201H has been interrupted if a new status frame F3 from managed device 201H does not arrive within a predetermined time from the latest reception time tr stored in memory unit 13. Relay unit 11 then notifies notification unit 27 that communication with managed device 201H has been interrupted.

[0268] When the notification unit 27 receives the notification from the relay unit 11, it transmits communication disruption information to a navigation device (not shown) via the relay unit 11.

[0269] For example, when the navigation device receives communication disruption information from the in-vehicle relay device 101, it performs notification processing based on the received communication disruption information. Specifically, for example, the navigation device displays the content indicated by the communication disruption information on its own display unit. Note that the navigation device may be configured to notify the user by a method other than displaying the content indicated by the communication disruption information on its own display unit, for example, by voice. Furthermore, in addition to the notification processing, the navigation device may be configured to perform processing to store the communication disruption information in its own storage unit as diagnostic information.

[0270] [Operation flow] Next, the flow of operations of the in-vehicle relay device 101 and the in-vehicle device 201 in the in-vehicle system 301 according to the embodiment of the present disclosure will be described with reference to the drawings.

[0271] 13 to 17 are flowcharts defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure controls each switch.

[0272] 13 to 17, first, the in-vehicle relay device 101 waits for reception of key verification information from the verification ECU 201A (NO in step ST101).

[0273] Then, when the in-vehicle relay device 101 receives the key verification information from the verification ECU 201A (YES in step ST101), it waits for reception of the switch monitoring information B from the body ECU 201B (NO in step ST102).

[0274] When the in-vehicle relay device 101 receives the switch monitoring information B from the body ECU 201B within a predetermined time after receiving the key detection information from the verification ECU 201A (YES in step ST102), it checks the monitoring result of the switch monitoring information B (step ST103).

[0275] Then, if the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the off state (NO in step ST103), the vehicle relay device 101 waits to receive new switch monitoring information B from the body ECU 201B (NO in step ST102).

[0276] On the other hand, if the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the on state (YES in step ST103), the vehicle relay device 101 determines that the vehicle 1 is in the driving start state and broadcasts a driving start notification to each vehicle equipment 201 (step ST104).

[0277] Next, the signal generating unit 23 in the in-vehicle relay device 101 generates an ON control signal S11 for turning on the control switches 91A and 91B, and ON control signals S51 and S53 for turning on the power switches 92A and 92B, respectively (step ST105). Note that steps ST104 and ST105 may be executed in reverse order or in parallel.

[0278] Next, the in-vehicle repeater 101 turns on the power switches 92A and 92B. For example, as described above, in the in-vehicle repeater 101, the signal generating unit 23 outputs the generated on-control signals S51 and S53 to the logic circuit unit 24. Then, the OR gate 72A in the logic circuit unit 24 outputs a gate signal G5 of a logic high level to the power switch 92A. Also, the OR gate 72B in the logic circuit unit 24 outputs a gate signal G7 of a logic high level to the power switch 92B (step ST106).

[0279] Next, the in-vehicle relay device 101 turns on the control switches 91A and 91B. For example, as described above, the signal generating unit 23 outputs the generated ON control signal S11 to the logic circuit unit 24. Then, the OR gate 71A and the OR gate 71B in the logic circuit unit 24 output gate signals of a logic high level to the control switches 91A and 91B, respectively. This starts the supply of power to the autonomous driving ECUs 201G and 201J (step ST107).

[0280] Next, the in-vehicle relay device 101 waits for reception of a start-up completion notification from the autonomous driving ECUs 201G and 201J (NO in step ST108).

[0281] Next, when the in-vehicle relay device 101 receives the start-up completion notification from the autonomous driving ECUs 201G, 201J (YES in step ST108), it broadcasts a device status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each in-vehicle device 201 (step ST109).

[0282] Next, the vehicle-mounted relay device 101 waits for reception of the ON control signals S21, S61, and S71 from the management device 201H (NO in step ST110).

[0283] Then, when the vehicle-mounted relay device 101 receives the on control signals S21, S61, and S71 from the management device 201H (YES in step ST110), it transmits a switch-on notification N21 indicating that the on control signal S21 has been received, and a switch-on notification N22 indicating that the on control signals S61 and S71 have been received, to the management device 201H (step ST111).

[0284] Next, the vehicle-mounted relay device 101 waits for reception of the state information B1 from the management device 201H (NO in step ST112).

[0285] Next, when the vehicle-mounted relay device 101 receives the status information B1 from the management device 201H (YES in step ST112), it uses the received status information B1 to check whether the on control signal S21, the on control signal S61, and the on control signal S71 are being transmitted on the signal line 6a between the management device 201H and the OR gate 71, the signal line 6a between the management device 201H and the OR gate 72A, and the signal line 6a between the management device 201H and the OR gate 72B, respectively (step ST113).

[0286] If the on-control signals S21, S61, and S71 are being transmitted (YES in step ST113), the vehicle-mounted relay device 101 determines that no abnormality has occurred regarding the on-control signals (step ST114).

[0287] Next, the in-vehicle relay device 101 waits for reception of a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (NO in step ST115).

[0288] Then, when the vehicle relay device 101 receives a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (YES in step ST115), it determines whether the state of the vehicle 1 is in a driving end state based on the sensor information C1, C2, and C3 contained in the received sensor monitoring information (step ST116).

[0289] Then, when the vehicle relay device 101 determines that the state of the vehicle 1 is the traveling end state (YES in step ST113), it broadcasts a traveling end notification to each of the vehicle devices 201 in the vehicle system 301 (step ST117).

[0290] Furthermore, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 to request the suspension of the execution of the driving-related functions (step ST118).

[0291] Next, when the vehicle-mounted relay device 101 receives an off control signal S22 from the management device 201H to turn off the control switches 91A and 91B (YES in step ST119), it transmits a switch off notification N12 indicating that the off control signal S22 has been received to the management device 201H (step ST120).

[0292] Next, when the vehicle-mounted relay device 101 receives, from the management device 201H, off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (YES in step ST121), it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received to the management device 201H (step ST122).

[0293] Next, when the vehicle relay device 101 sends a switch-off notification N11 to the management device 201H, or if the off control signals S22, S62, 72 do not arrive from the management device 201H (NO in step ST119 and NO in step ST121), it waits to receive a stop preparation completion notification from the autonomous driving ECUs 201G, 201J (NO in step ST123).

[0294] Then, when the in-vehicle relay device 101 receives the stop preparation completion notification from the automatic driving ECUs 201G and 201J (YES in step ST123), it waits for the reception of the state information B2 and B3 from the management device 201H (NO in step ST124).

[0295] Next, when the vehicle-mounted relay device 101 receives the status information B2 and B3 from the management device 201H (YES in step ST124), it checks whether the off control signal S22, the off control signal S62, and the off control signal S72 are being transmitted on the signal line 6a between the management device 201H and the OR gate 71, the signal line 6a between the management device 201H and the OR gate 72A, and the signal line 6a between the management device 201H and the OR gate 72B, respectively (step ST125).

[0296] If the off control signals S22, S62, and S72 are being transmitted (YES in step ST125), the vehicle-mounted relay device 101 determines that no abnormality has occurred regarding the off control signals (step ST126).

[0297] Next, when the in-vehicle relay device 101 determines that no abnormality has occurred in the off control signal, it generates an off control signal S12 and turns off the control switches 91A and 91B. For example, as described above, when both the off control signal S12 and the off control signal S22 are input to the OR gate 71A, a gate signal G3 of a logic low level is output from the OR gate 71A to the control switch 91A. Furthermore, when both the off control signal S12 and the off control signal S22 are input to the OR gate 71B, a gate signal G4 of a logic low level is output from the OR gate 71B to the control switch 91B (step ST127).

[0298] Next, the in-vehicle relay device 101 turns off the control switches 91A and 91B and waits for notifications of completion of stop preparation from all the in-vehicle ECUs in the in-vehicle network 401 (NO in step ST128).

[0299] Then, in the vehicle relay device 101, when the signal generating unit 23 receives a notification that stop preparation is complete from all vehicle ECUs in the vehicle network 401 (YES in step ST128), it generates an off control signal S52 for turning off the power switch 92A and outputs it to the logic circuit unit 24 (step ST129).

[0300] Next, the in-vehicle repeater 101 turns off the power switch 92A. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 24 inputs both the off control signal S52 and the off control signal S62 to the OR gate 72A. Then, the OR gate 72A outputs a gate signal G8 at a logic low level to the power switch 92A (step ST130).

[0301] On the other hand, if at least one of the on control signals S21, S61, and S71 is not transmitted (NO in step ST113), the vehicle relay device 101 determines that an abnormality has occurred in the on control signal (step ST131).

[0302] Next, the in-vehicle relay device 101 checks whether the parking brake is in the on state (step ST132).

[0303] Then, if the parking brake is in the on state (YES in step ST132), the in-vehicle relay device 101 determines that an abnormality has occurred in the on control signal before the vehicle 1 starts traveling, and performs brake on control to maintain the parking brake of the vehicle 1 in the on state. For example, as described above, the in-vehicle relay device 101 transmits an on request notification U, which indicates a request to maintain the parking brake in the on state, to the parking brake ECU 201F (step ST133).

[0304] Next, the vehicle-mounted relay device 101 performs a warning process to output warning information E indicating that an abnormality has occurred in the ON control signal transmitted from the management device 201H (step ST134). For example, as described above, the abnormality processing unit 26 transmits the warning information E to the navigation device via the relay unit 11.

[0305] Next, vehicle-mounted relay device 101 performs a reset process to reset management device 201H. For example, as described above, vehicle-mounted relay device 101 outputs a reset signal Re to signal line 6b to reset the microcomputer mounted in management device 201H (step ST135).

[0306] On the other hand, if the parking brake is in the OFF state (NO in step ST132), the in-vehicle relay device 101 determines that an abnormality related to the ON control signal has occurred before the vehicle 1 starts traveling, and performs transition processing to transition the autonomous driving ECUs 201G, 201J to the evacuation traveling mode. For example, as described above, the in-vehicle relay device 101 transmits transition request frames F21, F22 to the autonomous driving ECUs 201G, 201J, respectively, via the relay unit 11 (step ST136).

[0307] Next, the abnormality processing unit 26 performs a warning process and a reset process (steps ST134 and ST135).

[0308] In addition, if at least one of the off control signals S22, S62, and S72 is not transmitted (NO in step ST125), the vehicle relay device 101 determines that an abnormality has occurred in the off control signal (step ST137).

[0309] Next, the in-vehicle relay device 101 performs a warning process to output warning information E indicating that an abnormality has occurred in the OFF control signal transmitted from the management device 201H and that there is a possibility of over-discharge of the battery 61a of the vehicle 1. For example, as described above, the in-vehicle relay device 101 transmits the warning information E to the navigation device via the relay unit 11 (step ST138).

[0310] Next, vehicle-mounted relay device 101 performs a reset process to reset management device 201H. For example, as described above, vehicle-mounted relay device 101 outputs a reset signal Re to signal line 6b to reset the microcomputer mounted in management device 201H (step ST138).

[0311] FIG. 18 is a flowchart defining an example of an operation procedure when the vehicle-mounted relay device according to the embodiment of the present disclosure performs a process of transmitting communication disruption information.

[0312] 18, first, the vehicle-mounted relay device 101 waits for reception of a status frame from the management device 201H (NO in step ST201).

[0313] Then, when the vehicle-mounted relay device 101 receives the status frame F3 from the management device 201H (YES in step ST201), the vehicle-mounted relay device 101 stores the reception time tr of the status frame F3 in the storage unit 13 (step ST202).

[0314] Next, if a new status frame F3 does not arrive from the management device 201H before a predetermined time has elapsed since the latest reception time tr stored in the memory unit 13 (YES in step ST203), the vehicle-mounted relay device 101 determines that communication with the management device 201H has been interrupted (step ST204).

[0315] Next, when the vehicle-mounted relay device 101 determines that communication with the management device 201H has been interrupted, it transmits communication interruption information indicating that communication with the management device 201H has been interrupted to the navigation device (step ST205).

[0316] On the other hand, if the vehicle-mounted relay device 101 receives a new status frame F3 from the management device 201H before a predetermined time has elapsed since the latest reception time tr stored in the memory unit 13 (NO in step ST203), it determines that communication with the management device 201H has not been interrupted (step ST206) and stores the reception time tr of the status frame F3 in the memory unit 13 (step ST202).

[0317] 19 and 20 are flowcharts defining an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch.

[0318] 19 and 20, first, management device 201H determines whether or not vehicle 1 is in a traveling start state. For example, as described above, management device 201H determines whether or not vehicle 1 is in a traveling start state by checking whether or not a traveling start notification has been received from in-vehicle relay device 101 (step ST301).

[0319] If the state of the vehicle 1 is the traveling start state (YES in step ST301), the management device 201H waits for reception of a device state notification from the vehicle-mounted relay device 101 (NO in step ST302).

[0320] Next, when the management device 201H receives a device status notification from the vehicle-mounted relay device 101 (YES in step ST302), it generates an ON control signal S61 for turning on the power switches 92A and 92B, and transmits the ON control signal S61 to the vehicle-mounted relay device 101 via the signal line 6a (step ST303).

[0321] Next, management device 201H generates an ON control signal S21 for turning on control switches 91A and 91B, and transmits it to vehicle-mounted relay device 101 via signal line 6a (step ST304).

[0322] Next, management device 201H waits for reception of switch-on notification N21 from vehicle-mounted relay device 101 (NO in step ST305).

[0323] Then, when the management device 201H receives a switch-on notification N21 from the vehicle-mounted relay device 101 (YES in step ST305), it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST306).

[0324] Next, the management device 201H waits for reception of a brake-on notification from the parking brake ECU 201F and a driving end notification from the in-vehicle relay device 101 (NO in step ST307 and NO in step ST308).

[0325] Then, when the management device 201H receives a brake-on notification and a driving end notification from the parking brake ECU 201F and the vehicle-mounted relay device 101, respectively (YES in step ST307 and YES in step ST308), it generates an off control signal S22 for turning off the control switches 91A and 91B, and transmits the off control signal S22 to the vehicle-mounted relay device 101 via the signal line 6a (step ST309).

[0326] Next, the management device 201H waits for reception of switch-off notifications N11 and N12 from the vehicle-mounted relay device 101 (NO in step ST310).

[0327] Then, when the management device 201H receives the switch-off notifications N11 and N12 from the vehicle-mounted relay device 101 (YES in step ST310), it broadcasts an off-completion notification indicating that the off control signal S22 has been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST311).

[0328] 21 and 22 are diagrams illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0329] 21 and 22, first, the management device 201H broadcasts a turn-off completion notification indicating that the turn-off control signal S22 has been transmitted to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST401).

[0330] Furthermore, the verification ECU 201A transmits the key verification information to the in-vehicle relay device 101 (step ST402).

[0331] Furthermore, the body ECU 201B transmits switch monitoring information indicating the monitoring results of the states of the brake pedal switch and the engine switch to the in-vehicle relay device 101 (step ST403).

[0332] Next, when the in-vehicle relay device 101 receives the key verification information and the switch monitoring information from the verification ECU 201A and the body ECU 201B, respectively, it performs a determination process J1 to determine whether the state of the vehicle 1 is in a traveling start state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling start state (step ST404).

[0333] Next, the vehicle relay device 101 broadcasts a travel start notification indicating that the state of the vehicle 1 is a travel start state to each of the vehicle-mounted devices 201 (step ST405).

[0334] Next, the vehicle-mounted relay device 101 generates ON control signals S51 and S53 for turning on the power switches 92A and 92B, respectively, and an ON control signal S11 for turning on the control switches 91A and 91B (step ST406).

[0335] Next, the in-vehicle relay device 101 turns on the power switches 92A and 92B using the OR gates 72A and 72B as described above. Also, the in-vehicle relay device 101 turns on the control switches 91A and 91B using the OR gates 71A and 71B as described above. This starts the supply of power to the autonomous driving ECUs 201G and 201J (step ST407).

[0336] Next, the autonomous driving ECUs 201G and 201J start up (step ST408) and transmit a start-up completion notification indicating that they have started up to the in-vehicle relay device 101 (step ST409).

[0337] Next, the automatic driving ECUs 201G, 201J start executing the automatic driving function (step ST410). Note that step ST409 and step ST410 may be executed in reverse order, or may be executed in parallel.

[0338] Furthermore, when the in-vehicle relay device 101 receives the start-up completion notification from the automatic driving ECUs 201G and 201J, it broadcasts to each in-vehicle device 201 a device status notification indicating that the automatic driving ECUs 201G and 201J are operating (step ST411).

[0339] In addition, management device 201H receives a device status notification from vehicle-mounted relay device 101 and generates ON control signals S61 and S71 for turning on power switches 92A and 92B, respectively, and ON control signal S21 for turning on control switches 91A and 91B (step ST412).

[0340] Next, the management device 201H transmits the generated ON control signals S61, S71, S21 to the vehicle-mounted relay device 101 via the signal line 6a (step ST413).

[0341] Next, the management device 201H broadcasts an on-uncertainty notification to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 indicating that the execution of the on control of the control switch 91 by the on control signal S21, the on control of the power switch 92A by the on control signal S61, and the on control of the power switch 92B by the on control signal S71 is undetermined (step ST414).

[0342] Next, when the vehicle-mounted relay device 101 receives the ON control signal S21 from the management device 201H, the vehicle-mounted relay device 101 transmits a switch-on notification N21 indicating that the ON control signal S21 has been received to the management device 201H (step ST415).

[0343] Furthermore, when the vehicle-mounted relay device 101 receives the ON control signals S61, S71 from the management device 201H, it transmits a switch-on notification N22 indicating that the ON control signals S61, S71 have been received to the management device 201H (step ST416).

[0344] Next, when the management device 201H receives the switch-on notification N21 from the in-vehicle relay device 101, it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST417).

[0345] Next, the parking brake ECU 201F receives the OFF completion notification, the ON unconfirmed notification, and the ON completion notification from the management device 201H, and performs a parking brake release process to transition the parking brake from the ON state to the OFF state (step ST418).

[0346] 23 and 24 are diagrams illustrating another example of the processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0347] 23 and 24, first, the management device 201H broadcasts an ON completion notification indicating that ON control of the control switches 91A and 91B has been completed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST501).

[0348] In addition, the body ECU 201B transmits to the vehicle relay device 101 a frame F including sensor information C1, sensor information C2, and sensor information C3, which respectively indicate the detection results of the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E while the vehicle 1 is traveling (step ST502).

[0349] The parking brake ECU 201F also determines whether to transition the parking brake from the OFF state to the ON state. Here, it is assumed that the parking brake ECU 201F receives an ON completion notification from the management device 201H and determines to transition the parking brake from the OFF state to the ON state because the operation Q1 has been performed in the vehicle 1 (step ST503).

[0350] Next, the parking brake ECU 201F broadcasts a brake-on notification indicating that the parking brake has been switched to the on state to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST504).

[0351] Next, the in-vehicle relay device 101 receives the frame F and the brake-on notification from the body ECU 201B and the parking brake ECU 201F, respectively, and performs a determination process J2 to determine whether the state of the vehicle 1 is in a traveling end state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling end state (step ST505).

[0352] Next, the vehicle-mounted relay device 101 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each of the vehicle-mounted devices 201 (step ST506).

[0353] Furthermore, when receiving the brake-on notification from the parking brake ECU 201F, the in-vehicle relay device 101 broadcasts an OFF transition request to each in-vehicle device 201 before generating the OFF control signal S12 (step ST507).

[0354] Next, when the management device 201H receives a parking brake on notification from the parking brake ECU 201F and a driving end notification or an off transition request from the vehicle relay device 101, it generates an off control signal S22 for turning off the control switches 91A and 91B, and off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (step ST508).

[0355] Next, the management device 201H broadcasts an OFF unconfirmed notification indicating that the OFF control of the control switch 91 by the OFF control signal S22 is unconfirmed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST509).

[0356] Next, the management device 201H transmits the generated OFF control signals S22, S62, and S72 to the vehicle-mounted relay device 101 via the signal line 6a (step ST510).

[0357] Next, when the vehicle-mounted relay device 101 receives the off control signals S22, S62, and S72 from the management device 201H, it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201H (step ST511).

[0358] Next, when the management device 201H receives the switch-off notifications N11 and N12 from the vehicle-mounted relay device 101, it broadcasts an off-completion notification indicating that the off-control signals S22, S62, and S72 have been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST512).

[0359] Next, the autonomous driving ECUs 201G, 201J receive a driving end notification or an OFF transition request from the in-vehicle relay device 101 and an OFF completion notification from the management device 201H, and perform pre-processing for stopping the execution of the autonomous driving function. For example, as described above, the autonomous driving ECUs 201G, 201J perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function (step ST513).

[0360] Next, the autonomous driving ECUs 201G and 201J transmit a stop preparation completion notification indicating that preparation for stopping the execution of the autonomous driving function has been completed to the in-vehicle relay device 101 (step ST514).

[0361] Next, when the in-vehicle relay device 101 receives the stop preparation completion notification from the automatic driving ECUs 201G and 201J, it generates the OFF control signal S12 (step ST515).

[0362] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S12, it turns off the control switch 91 using the OR gate 71 as described above (step ST516).

[0363] Next, the in-vehicle relay device 101 checks whether or not the execution of various services has been stopped in the in-vehicle network 401. For example, as described above, when the in-vehicle relay device 101 receives a notification that the preparation for stopping has been completed from all the in-vehicle ECUs in the in-vehicle network 401, the in-vehicle relay device 101 determines that the execution of various services has been stopped (step ST517).

[0364] Next, when the in-vehicle relay device 101 confirms that the execution of various services has been stopped, it generates an OFF control signal S52 (step ST518).

[0365] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S52, it turns off the power switch 92A using the OR gate 72A as described above (step ST519).

[0366] In the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to include a plurality of control switches 91 for switching on and off the supply of power to the driving-related devices, but this is not limited thereto. The in-vehicle relay device 101 may be configured to include a single control switch 91.

[0367] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the control switches 91A, 91B and the power switches 92A, 92B are configured to be provided in the in-vehicle relay device 101, but this is not limited to this. Some or all of the control switches 91A, 91B and the power switches 92A, 92B may be configured to be provided outside the in-vehicle relay device 101.

[0368] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the logic circuit unit 24 is configured to include an OR gate 71, but this is not limited thereto. The logic circuit unit 24 may be configured to include a NAND gate instead of the OR gate 71. In this case, the signal generating unit 23 in the in-vehicle relay device 101 and the signal generating unit 52 in the management device 201H generate an ON control signal S11 and an ON control signal S21 at a logical low level, respectively. When at least one of the ON control signal S11 and the ON control signal S21 is input to the NAND gate, a gate signal at a logical high level is output from the NAND gate to the control switch 91. In other words, even when the logic circuit unit 24 includes a NAND gate, the control switch 91 turns on under the OR condition of the ON control signal S11 and the ON control signal S21.

[0369] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform brake-on control, warning processing, and reset processing when it determines that an abnormality has occurred in the on-control signal S21 before the vehicle 1 starts traveling, but this is not limited to this. In the above case, the in-vehicle relay device 101 may be configured to perform part of the brake-on control, warning processing, and reset processing.

[0370] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform transition processing, warning processing, and reset processing when it determines that an abnormality K1 related to the ON control signal S21 has occurred while the vehicle 1 is traveling, but this is not limited to this. The in-vehicle relay device 101 may be configured to perform some of the transition processing, warning processing, and reset processing in the above case.

[0371] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform a notification process to notify the user of the vehicle 1 of communication disruption information when communication with the management device 201H is disrupted, but this is not limited to this. The in-vehicle relay device 101 may also be configured not to perform the notification process.

[0372] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S11 using a condition different from the condition under which the ON control signal S21 is generated, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S11 using the same condition as the condition under which the ON control signal S21 is generated.

[0373] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the off control signal S12 under conditions different from the conditions under which the off control signal S22 is generated, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the off control signal S12 under the same conditions as the conditions under which the off control signal S22 is generated.

[0374] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform an abnormality detection process for detecting an abnormality in a control signal output from the management device 201H, but this is not limited to this. A device other than the in-vehicle relay device 101 in the in-vehicle network 401 may be configured to perform the abnormality detection process.

[0375] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0376] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the programs read from the one or more memories, or according to logic circuits pre-designed to execute each of the processes. The processor may be various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separate processors may execute each of the processes in cooperation with each other. For example, the processors mounted on a plurality of physically separated computers may cooperate with each other to execute the above processes via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, etc. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and installed into the memory from the recording medium.

[0377] The above description includes the following additional features. [Appendix 1] An in-vehicle device that controls a switch that switches on / off the supply of power to an in-vehicle device in a vehicle, processing circuitry; The processing circuitry generating a first on control signal for turning on the switch; receiving a second ON control signal for turning on the switch from outside the in-vehicle device; the switch is turned on in response to an OR condition of the first on control signal and the second on control signal; The processing circuitry further comprises: acquiring status information indicating a status of the second ON control signal by communicating with another in-vehicle device; The in-vehicle device detects an abnormality related to the second on-control signal based on a comparison result between the second on-control signal received from outside the in-vehicle device and the state indicated by the acquired state information.

[0378] [Appendix 2] An in-vehicle device that controls a switch that switches on / off the supply of power to an in-vehicle device in a vehicle, another on-vehicle device is mounted on the vehicle and generates a first on-control signal for turning on the switch and outputs the first on-control signal to the switch; The in-vehicle device processing circuitry; The processing circuitry generating a second on control signal for turning on the switch; outputting the generated second ON control signal to the other in-vehicle device; the switch is turned on under an OR condition of the first ON control signal generated by the other in-vehicle device and the second ON control signal generated by the in-vehicle device; The processing circuitry further comprises: an in-vehicle device that performs a process of notifying the other in-vehicle device of information indicating the state of the second ON control signal by communicating with the other in-vehicle device; [Explanation of symbols]

[0379] 1 vehicle 2, 2A, 2B, 2C, 2D CAN bus 5,5A,5B,5C,5D power wire 6 Signal Line 10 Power supply section 11 Relay Section 12,42 Processing section 13,43 Storage section 21 Power management section 22,51 Judgment section 23,52 Signal generation unit 24 Logic Circuit Section 25 Detection unit 26 Abnormality processing unit 27,53 Notification Department 41 Communications Department 61 1st power supply 61a Battery 61b DC / DC Converter 62 2nd power supply 71, 71A, 71B, 72, 73 OR gates 81, 81A, 81B, 82 AND gates 91, 91A, 91B control switches 92, 92A, 92B Power switch 101 Vehicle relay device (vehicle device) 201A Verification ECU 201B Body ECU 201C Occupant Sensor 201D Buckle Sensor 201E Door Open / Close Sensor 201F Parking brake ECU 201G, 201J Autonomous Driving ECU 201H Management equipment (vehicle equipment) 301 In-Vehicle Systems 401 In-Vehicle Network

Claims

1. An in-vehicle system including an in-vehicle device that controls a switch for switching on / off the supply of power to an in-vehicle device in a vehicle, The in-vehicle device a signal generating unit that generates a first ON control signal for turning on the switch; an input unit that receives a second ON control signal for turning on the switch from an external device of the in-vehicle device; the switch is turned on in response to an OR condition of the first ON control signal generated by the signal generating unit and the second ON control signal received by the input unit; The in-vehicle device further an acquisition unit that acquires state information indicating a state of the second ON control signal by communicating with another in-vehicle device; An in-vehicle system comprising: a detection unit that detects an abnormality related to the second on control signal based on a comparison result between the second on control signal received by the input unit and the state indicated by the state information acquired by the acquisition unit.

2. The in-vehicle device further The in-vehicle system according to claim 1 , further comprising a warning unit that outputs warning information when the abnormality is detected by the detection unit.

3. The in-vehicle device further 3. The in-vehicle system according to claim 1, further comprising: a control unit that maintains a parking brake of the vehicle in an on state when the abnormality is detected by the detection unit before the vehicle starts to move.

4. The in-vehicle device further 3. The in-vehicle system according to claim 1, further comprising a transition processing unit that, when the abnormality is detected by the detection unit while the vehicle is traveling, transitions the in-vehicle equipment to an operation mode for driving the vehicle to an evacuation destination.

5. The in-vehicle device further 3. The in-vehicle system according to claim 1, further comprising a reset processing unit that performs a reset process to reset the other in-vehicle device when the abnormality is detected by the detection unit.

6. The in-vehicle device further 3. The in-vehicle system according to claim 1, further comprising a notification unit that, when communication with the other in-vehicle device is interrupted, notifies a user of the vehicle of information indicating that communication with the other in-vehicle device has been interrupted.

7. 3. The in-vehicle system according to claim 1, wherein the signal generating unit generates the first ON control signal using a condition different from a condition under which the second ON control signal is generated.

8. the signal generating unit further generates a first off control signal for turning off the switch; the input unit further receives a second off control signal for turning off the switch from outside the in-vehicle device; 3. The in-vehicle system according to claim 1, wherein the signal generating unit generates the first off control signal using a condition different from a condition under which the second off control signal is generated.

9. An in-vehicle system including an in-vehicle device that controls a switch for switching on / off the supply of power to an in-vehicle device in a vehicle, another on-vehicle device is mounted on the vehicle and generates a first on-control signal for turning on the switch and outputs the first on-control signal to the switch; The in-vehicle device a signal generating unit that generates a second ON control signal for turning on the switch; an output unit that outputs the second ON control signal generated by the signal generation unit to the other in-vehicle device, the switch is turned on in response to an OR condition of the first ON control signal generated by the other in-vehicle device and the second ON control signal generated by the in-vehicle device; The in-vehicle device further a notification unit that performs processing to notify the other in-vehicle device of information indicating a state of the second ON control signal by communicating with the other in-vehicle device.

10. An in-vehicle system including an in-vehicle device that controls a switch for switching on / off the supply of power to an in-vehicle device in a vehicle, The in-vehicle device a signal generating unit that generates a first off control signal for turning off the switch; an input unit that receives a second off control signal for turning off the switch from an external device of the in-vehicle device; the switch is turned off in response to an AND condition of the first off control signal generated by the signal generating unit and the second off control signal received by the input unit; The in-vehicle device further an acquisition unit that acquires state information indicating a state of the second off control signal by communicating with another in-vehicle device; an in-vehicle system comprising: a detection unit that detects an abnormality related to the switch based on a comparison result between the second off control signal received by the input unit and the state indicated by the state information acquired by the acquisition unit.

11. 1. A method for detecting an abnormality in an in-vehicle system including an in-vehicle device that controls a switch for switching on / off the supply of power to an in-vehicle device in a vehicle, comprising: generating a first ON control signal by the in-vehicle device to turn on the switch; receiving, by the in-vehicle device, a second on control signal for turning on the switch from an external device of the in-vehicle device; the in-vehicle device turns on the switch in accordance with an OR condition of the generated first on control signal and the generated second on control signal; the in-vehicle device acquiring status information indicating a status of the second ON control signal by communicating with another in-vehicle device; An abnormality detection method including a step in which the in-vehicle device detects an abnormality related to the second ON control signal based on a comparison result between the second ON control signal and the state indicated by the acquired state information.

12. A notification method in an in-vehicle system including an in-vehicle device that controls a switch for switching on / off the supply of power to an in-vehicle device in a vehicle, comprising: another on-vehicle device is mounted on the vehicle and generates a first on-control signal for turning on the switch and outputs the first on-control signal to the switch; The notification method includes: generating a second ON control signal by the in-vehicle device to turn on the switch; the in-vehicle device outputs the generated second ON control signal to the other in-vehicle device; the switch is turned on in response to an OR condition of the first ON control signal generated by the other in-vehicle device and the second ON control signal generated by the in-vehicle device; The notification method further includes: A notification method including a step of performing processing by the in-vehicle device to notify the other in-vehicle device of information indicating a state of the second ON control signal by communicating with the other in-vehicle device.

Images