Vehicle control device

Abstract

To provide a vehicle control device capable of appropriate evacuation travel control in accordance with abnormality occurring situations.SOLUTION: A vehicle control device according to one embodiment is provided with a control part. The control part performs automatic driving by using a first load for which power is supplied by a first power source a power source device has via a first system and a second load for which power is supplied by a second power source the power source device has via a second system, and performs evacuation travel control by one of the first system and a second system when abnormality occurs to the other. The control part changes contents of evacuation travel control according to abnormality occurring parts.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a vehicle control device. [Background technology]

[0002] Conventionally, there has been a redundant power supply system that is provided with a first power supply and a second power supply so that, even if a power failure occurs while the vehicle is traveling, the vehicle can be evacuated to a safe place and stopped. If an abnormality such as a ground fault occurs in one of the power supply systems, the other power supply system supplies power to on-board equipment (load).

[0003] The redundant power supply system comprises a first system that supplies power from a first power source to a first load, a second system that supplies power from a second power source to a second load having the same functions as the first load, and an inter-system switch that can connect and disconnect the first system and the second system (see, for example, Patent Document 1).

[0004] In addition, under normal circumstances, the redundant power supply system connects the inter-system switch to supply power from the first power source to the first load and the second load, and when a power failure such as a ground fault occurs in the first system, the inter-system switch is shut off and power is supplied from the second power source to the second load, thereby performing backup control. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-62727 A Summary of the Invention [Problem to be solved by the invention]

[0006] In this type of redundant power supply system, there was room for further improvement in terms of the evacuation driving control that was performed according to the situation when different situations arose, such as when power supply redundancy could not be secured or when load redundancy could not be secured depending on the location of the abnormality.

[0007] The present invention has been made in consideration of the above, and has an object to provide a vehicle control device that can perform appropriate evacuation travel control in accordance with the occurrence of an abnormality. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems and achieve the object, the vehicle control device according to the present invention includes a control unit. The control unit performs automatic driving using a first load to which power is supplied from a first power source of a power supply device via a first system and a second load to which power is supplied from a second power source of the power supply device via a second system, and when an abnormality occurs in one of the first system or the second system, performs evacuation travel control using the other system. The control unit changes the content of the evacuation travel control depending on the location where the abnormality occurs. Effect of the Invention

[0009] According to the present invention, appropriate evacuation travel control can be performed in accordance with the occurrence state of the abnormality. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an autonomous driving system including a vehicle control device according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of an operation of the abnormality detection control. [Diagram 3] FIG. 3 is a diagram illustrating an example of the operation of the evacuation travel control. [Figure 4] FIG. 4 is a diagram showing the location of an abnormality. [Diagram 5] FIG. 5 is a diagram illustrating an example of the abnormality specifying information. [Figure 6] FIG. 6 is a diagram illustrating an example of the control information. [Figure 7] FIG. 7 is a block diagram showing an example of the configuration of the vehicle control device according to the embodiment. [Figure 8] FIG. 8 is a flowchart showing the procedure of the processing executed by the vehicle control device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of a vehicle control device disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiment described below. The vehicle control device according to the embodiment is mounted on a vehicle and performs automatic driving control of the vehicle by controlling a load related to the automatic driving control.

[0012] 1 is a diagram showing an example of the configuration of an autonomous driving system S including a vehicle control device 100 according to an embodiment. As shown in FIG. 1, the autonomous driving system S includes a power supply device 1, a first power source 10, the vehicle control device 100, a first load 101, a second load 102, and a third load 103.

[0013] The first load 101 and the second load 102 include loads related to autonomous driving. Specifically, the first load 101 and the second load 102 are loads related to FOP (Fail Operational), and for example, the first load 101 includes a steering motor, an electric brake device, an in-vehicle camera, a radar, and the like that operate during autonomous driving.

[0014] FOP is an evacuation driving control that evacuates an autonomously driving vehicle to a safe place such as the shoulder of the road and stops it when an abnormality occurs in the first system 110 or the second system 120 described below, since the redundancy of the power supply during autonomous driving is no longer guaranteed.

[0015] Specifically, FOP is a control including (TOR: Take Over Request) and (MRM: Minimal Risk Maneuver). TOR is a request to transfer authority to the driver, and the vehicle control device 100 requests the driver to switch the authority for driving operations. MRM is a risk minimization operation, and when TOR is not established (not established), that is, when the driver does not accept the request to switch the authority for driving operations, the vehicle control device 100 performs an operation (MRM: Minimal Risk Maneuver) to evacuate and stop the vehicle by automatic driving. Note that when TOR is established, that is, when the driver accepts the request to switch the authority for driving operations, the driving operation is left to the driver without performing MRM.

[0016] The third load 103 is a general load (non-FOP) that is not related to automatic operation, such as a display, an air conditioner, an audio system, a video system, and various lights.

[0017] The first load 101 is connected to the first system 110 via a fuse F1 (first fuse), the second load 102 is connected to the second system 120 via a fuse F2 (second fuse), and the third load 103 is connected to the first system 110 via a fuse F3 (third fuse) on the downstream side (or upstream side) of the first load 101. The first load 101, the second load 102, and the third load 103 each have a control unit configured by a microcomputer (not shown), and each microcomputer is capable of communicating with the control unit 31 of the power supply device 1.

[0018] The vehicle control device 100 is a control device that performs automatic driving control of a vehicle by operating a first load 101 and a second load 102. In the present disclosure, the vehicle control device 100 can change the content of the FOP depending on the location of the abnormality in the power supply device 1, and this point will be described in detail later.

[0019] The first power source 10 includes a DC / DC converter 11 (hereinafter, referred to as DC / DC 11) and a lead battery 12 (hereinafter, referred to as PbB 12). The battery of the first power source 10 may be any secondary battery other than the PbB 12.

[0020] The DC / DC 11 is connected on the upstream side to a generator that converts the vehicle's regenerative energy into electric power to generate electricity, and transforms and outputs the input voltage input from the generator. If the vehicle is equipped with an engine, the generator may be an alternator that converts the rotational force of the engine into electric power to generate electricity. The DC / DC 11 charges the PbB 12, supplies electric power to the first load 101, supplies electric power to the second load 102, and charges the second power source 20 described below.

[0021] The power supply device 1 is a device that controls power supply to a first load 101 and a second load 102. As shown in Fig. 1, the power supply device 1 includes a second power source 20, an inter-system switch 4, a control unit 31, and voltage sensors 51 and 52.

[0022] The second power source 20 is a backup power source in case the first power source 10 is unable to supply power. The second power source 20 includes a lithium ion battery 21 (hereinafter referred to as "LiB21") and a power source switch 22. The power source switch 22 connects the LiB21 and the second load 102 so as to be able to connect / disconnect them. Note that the battery of the second power source 20 may be any secondary battery other than the LiB21.

[0023] The power supply device 1 also includes a first system 110 that supplies power from the first power source 10 to the first load 101, and a second system 120 that supplies power from the second power source 20 to the second load 102.

[0024] The inter-system switch 4 connects the first system 110 and the second system 120 in a connectable / disconnectable manner.

[0025] The voltage sensor 51 is connected between the first power source 10 and the first load 101, and detects a voltage value of the first system 110. The voltage sensor 52 is connected between the second power source 20 and the second load 102, and detects a voltage value of the second system 120.

[0026] The control unit 31 includes a microcomputer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), etc., and various circuits. The control unit 31 may be configured with hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0027] The control unit 31 controls the operation of the power supply device 1 by causing the CPU to execute a program stored in the ROM using the RAM as a working area. The control unit 31 supplies power from the first power source 10 or the second power source 20 to the first load 101 and the second load 102 by controlling the on / off of the inter-system switch 4 and the power switch 22 based on the detection results (voltage values) input from the voltage sensors 51 and 52.

[0028] 1 shows an example of control during normal operation (normal control) when no abnormality such as a ground fault occurs in the first system 110 and the second system 120. Specifically, during normal control, the control unit 31 turns on the inter-system switch 4 and turns off the power supply switch 22.

[0029] As a result, power is supplied from the first power source 10 to the first load 101 via the first system 110, and power is supplied from the first power source 10 to the second load 102 via the first system 110, the inter-system switch 4, and the second system 120. This normal control is performed whether the vehicle is in automatic or manual driving mode.

[0030] Here, assume that the voltage value of the voltage sensor 51 drops below a predetermined threshold during normal control in automatic operation. In such a case, the power supply device 1 switches from normal control to abnormality detection control for identifying the location of the abnormality, since there is a possibility that an abnormality such as a ground fault has occurred in the first system 110 or the second system 120.

[0031] The abnormality detection control will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the operation of the abnormality detection control. During normal control, when the voltage value of the voltage sensor 51 falls below a predetermined ground fault threshold, the control unit 31 of the power supply device 1 turns off the inter-system switch 4 and turns on the power supply switch 22.

[0032] As a result, the connection between the first system 110 and the second system 120 is disconnected, and power is supplied to the first load 101 by the first power source 10, and power is supplied to the second load 102 by the second power source 20.

[0033] The control unit 31 detects whether or not an abnormality occurs in each of the first system 110 and the second system 120 based on the voltage values ​​of the voltage sensors 51 and 52. Specifically, the control unit 31 detects whether or not an abnormality occurs in the first system 110 based on the voltage value of the voltage sensor 51. More specifically, if the voltage value of the voltage sensor 51 is continuously less than the ground fault threshold value for a predetermined time or more, the control unit 31 detects that a ground fault abnormality occurs in the first system 110, and if the voltage value of the voltage sensor 51 returns to the ground fault threshold value or more within the predetermined time, the control unit 31 determines that no abnormality occurs in the first system 110. Also, the control unit 31 detects whether or not an abnormality occurs in the second system 120 based on the voltage value of the voltage sensor 52. More specifically, if the voltage value of the voltage sensor 52 is continuously below the ground fault threshold for a predetermined time or more, the control unit 31 detects that a ground fault has occurred in the second system 120, and if the voltage value of the voltage sensor 52 returns to above the ground fault threshold within the predetermined time, it determines that no abnormality has occurred in the second system 120. In other words, the control unit 31 specifies, by abnormality detection control, whether the location where the abnormality has occurred is the first system 110 or the second system 120 (or both).

[0034] 2, when no abnormality occurs in either the first system 110 or the second system 120, the control unit 31 determines that the voltage drop is due to a transient overload or the like, and turns on the inter-system switch 4 and turns off the power supply switch 22. That is, the control returns from the abnormality detection control to the normal control.

[0035] In this way, during normal control, when the voltage value of the voltage sensor 51 drops, the control unit 31 temporarily turns on the power switch 22 as shown in FIG. 2, thereby using the power of the second power source 20 to check for the presence or absence of an abnormality in the second system 120.

[0036] In addition, in the abnormality detection control, if an abnormality occurs only in the first system 110, the abnormality detection control is switched to the evacuation travel control shown in FIG.

[0037] 3 is a diagram showing an example of the operation of the evacuation driving control. The evacuation driving control is a control performed by the vehicle control device 100, and is a driving control for evacuating and stopping the vehicle during automatic driving to a safe place such as a road shoulder, since redundancy of the power supply during automatic driving is not guaranteed when an abnormality occurs in the first system 110 or the second system 120.

[0038] 3, when an abnormality GF such as a ground fault occurs in the first system 110, the control unit 31 keeps the inter-system switch 4 off and keeps the power switch 22 on. Then, the control unit 31 stops the power supply from the first power source 10 to the first load 101 and continues the power supply from the second power source 20 to the second load 102. In other words, when an abnormality occurs in the first system 110, the control unit 31 performs evacuation travel control using only the power of the second power source 20.

[0039] That is, the first system 110 is a main system that supplies power to the first load 101, the second load 102, and the third load 103 during normal control, and the second system 120 is a backup system that supplies power to at least the second load 102 in the event of an abnormality in the first system 110.

[0040] Here, the location of the abnormal GF may occur at various locations other than the locations shown in Fig. 3. Fig. 4 is a diagram showing the locations of the abnormal GF. As shown in Fig. 4, the abnormal GF may occur at at least five locations (GF1 to GF5).

[0041] Anomaly GF1 is an anomaly such as a ground fault occurring between the first load 101 and the fuse F1. Anomaly GF2 is an anomaly such as a ground fault occurring between the third load 103 and the fuse F3. Anomaly GF3 is an anomaly such as a ground fault occurring between the second load 102 and the fuse F2. Anomaly GF4 is an anomaly such as a ground fault occurring in the first system 110, and in the example shown in FIG. 4, it indicates an anomaly occurring between the connection point of the fuse F1 and the power supply device 1. Anomaly GF5 is an anomaly such as a ground fault occurring in the second system 120, and in the example shown in FIG. 4, it indicates an anomaly occurring between the connection point of the fuse F2 and the power supply device 1.

[0042] The locations of occurrence of abnormalities GF1 to GF5 are identified, for example, by the power supply device 1. Note that a method for identifying each of abnormalities GF1 to GF5 will be described later. The vehicle control device 100 according to the embodiment acquires abnormality location information indicating the location of occurrence of the identified abnormalities GF1 to GF5 from the power supply device 1, and changes the content of FOP, which is the evacuation travel control, according to the location of occurrence of abnormalities GF1 to GF5. This makes it possible to perform an appropriate evacuation travel control (FOP) according to the occurrence status of the abnormality.

[0043] Specifically, the power supply device 1 refers to the abnormality identification information shown in Fig. 5 to identify abnormalities GF1-GF5, and the vehicle control device 100 refers to the control information shown in Fig. 6 to execute FOP with contents corresponding to each of the occurrence locations of abnormalities GF1-GF5. Fig. 5 is a diagram showing an example of abnormality identification information. Fig. 6 is a diagram showing an example of control information. The abnormality identification information shown in Fig. 5 is stored in a storage unit (not shown) of the power supply device 1. The control information shown in Fig. 6 is stored as control information 310 (see Fig. 7) in the storage unit 300 (see Fig. 7) of the vehicle control device 100.

[0044] 5 shows the change in the input voltage of voltage sensors 51, 52 and first load 101 to third load 103 in scenes 0 to 5 where the ground fault location is different. That is, power supply device 1 identifies abnormal GF1 to GF5 based on the state of the voltage change of each part.

[0045] The input voltages of the first load 101 to the third load 103 are measured by the control unit 31 of the power supply device 1. Specifically, since the control unit 31 communicates with each of the first load 101 to the third load 103, when the power supply to the first load 101 to the third load 103 is cut off, the communication with the first load 101 to the third load 103 is cut off. Therefore, when the control unit 31 detects a cutoff in communication with the first load 101 to the third load 103, it detects a drop in the input voltage of the first load 101 to the third load 103. The control unit 31 may provide a voltage sensor at the input of the first load 101 to the third load 103 and detect a drop in the input voltage based on the voltage value of the voltage sensor.

[0046] 6 shows the contents of FOPs for scenes 1 to 5 corresponding to the locations where abnormalities have occurred in GF1 to GF5. Hereinafter, a method for identifying abnormal GF1 to GF5 and the contents of FOPs corresponding to scenes 0 to 5 will be described in detail with reference to FIGS. 5 and 6.

[0047] (Scene 0) Scene 0 is a case where a transient voltage drop occurs instead of an abnormality. Specifically, this is a case where a voltage drop occurs in the first system 110 during normal control, but the voltage is restored after that. Specifically, as shown in FIG. 5, this is a case where the power supply device 1 recovers after the voltage sensor 51, the voltage sensor 52, the input voltage of the first load 101, the input voltage of the second load 102, and the input voltage of the third load become less than the threshold value for determining a ground fault. In this case, the power supply device 1 does not notify the vehicle control device 100 of the abnormality characteristic information since no abnormality occurs. Therefore, the vehicle control device 100 continues normal automatic driving without performing FOP.

[0048] (Scene 1) Scene 1 is a case where an abnormality GF1 occurs. More specifically, the occurrence of the abnormality GF1 causes the fuse F1 to blow, resulting in a power failure (a state in which power cannot be supplied) of the first load 101.

[0049] The power supply device 1 identifies an abnormality GF1 when only the input voltage of the first load 101 continues to drop among the voltages shown in FIG. 5. The control unit 31 determines whether the input voltage of the first load 101 continues to drop based on whether communication with the first load 101 continues to be interrupted. Specifically, as shown in FIG. 5, when an abnormality GF1 occurs, the voltage of the voltage sensor 51 drops due to the abnormality GF1 and then recovers by blowing the fuse F1. Also, the voltage of the voltage sensor 52 drops due to the abnormality GF1 and then recovers by turning off the inter-system switch 4 and turning on the power switch 22. Also, the input voltage of the first load 101 continues to drop due to the fuse F1 being blown. As a result, communication between the control unit 31 and the first load 101 continues to be interrupted. Also, the input voltage of the second load 102 drops due to the abnormality GF1 and then recovers by turning off the inter-system switch 4 and turning on the power switch 22. This is because the fuse F2 is not blown and the power supply to the second load 102 is resumed. As a result, the communication of the second load 102 is not interrupted. Furthermore, after the input voltage of the third load 103 drops due to the abnormality GF1, the fuse F3 is not blown and the power supply to the third load 103 is resumed, so the voltage is restored. As a result, the communication of the third load 103 is not interrupted.

[0050] The control unit 31 determines that the voltage has recovered when the voltages of the voltage sensors 51, 52 return to or exceed the threshold value for determining a ground fault, and determines that the voltage has recovered if the communication between the first load 101, the second load 102, and the third load 103 is not interrupted. On the other hand, the control unit 31 determines that the voltage continues to decrease if the voltages of the voltage sensors 51, 52 remain below the threshold value for determining a ground fault, and determines that the voltage continues to decrease if the communication interruption between the first load 101, the second load 102, and the third load 103 continues. This determination is similar in scenes 2 to 5 in FIG. 5.

[0051] As shown in FIG. 6, in the case of scene 1, the power supply device 1 keeps the inter-system switch 4 off and keeps the power supply switch 22 on, thereby transitioning from abnormality detection control (FIG. 2) to evacuation driving control (FIG. 3), and notifying the vehicle control device 100 of abnormality location information indicating that an abnormality GF1 has occurred.

[0052] When the vehicle control device 100 acquires abnormality location information from the power supply device 1, it performs FOP to perform MRM without performing TOR. That is, when the location where the abnormality occurs is the first system 110, the vehicle control device 100 performs MRM by supplying power from the second system 120 without performing TOR. This is because the amount of stored power in the LiB 21 of the second power source 20 is finite. That is, this is to prevent the amount of power in the LiB 21 from running out during evacuation travel in the case where the amount of power consumed by the driver performing driving operations becomes greater than the amount of power consumed by MRM due to the establishment of TOR.

[0053] In this way, when an abnormality GF1 occurs in the first system 110, the vehicle control device 100 deliberately performs MRM without performing TOR, thereby being able to accurately avoid a situation in which the power supply of the LiB21 of the second power source 20 runs out and evacuation driving becomes impossible.

[0054] 6, in scene 1, after FOP is completed (after the vehicle is stopped), if the voltage of the first system 110 is restored, the power supply device 1 turns on the inter-system switch 4, keeps the power supply switch 22 on, and notifies the vehicle control device 100 of restoration information indicating that the voltage of the first system 110 has been restored. Note that after FOP is completed, the power of the second power supply 20 is depleted due to the implementation of FOP, but if the voltage of the first system 110 is restored, the inter-system switch 4 is turned on and the power supply switch 22 is kept on, thereby charging the second power supply 20.

[0055] When the vehicle control device 100 acquires the return information after the completion of FOP, it prohibits the automatic driving and permits only the manual driving. This is because, although the power supply can be performed by the first system 110 and the second system 120, the first load 101 cannot be used due to the fuse F1 being blown, and the driving control is performed only by the second load 102. In other words, this is because the redundancy on the load side is not ensured. This makes it possible to prevent the automatic driving from being performed with high accuracy when the redundancy on the load side is not ensured.

[0056] (Scene 2) Scene 2 is a case where an abnormality GF2 occurs. More specifically, the occurrence of the abnormality GF2 causes the fuse F3 to blow, resulting in a power failure (a state in which power cannot be supplied) of the third load 103.

[0057] The power supply device 1 identifies an abnormality GF2 when only the input voltage of the third load 103 continues to drop among the voltages shown in FIG. 5. Specifically, as shown in FIG. 5, when an abnormality GF2 occurs, the voltage of the voltage sensor 51 drops due to the abnormality GF2 and then recovers by blowing the fuse F3. Also, the voltage of the voltage sensor 52 drops due to the abnormality GF2 and then recovers by turning off the inter-system switch 4 and turning on the power switch 22. Also, the input voltage of the first load 101 drops due to the abnormality GF2, but the fuse F1 does not blow, so the voltage is restored by resuming the power supply to the first load 101. As a result, the communication of the first load 101 is not interrupted. Also, the input voltage of the second load 102 drops due to the abnormality GF2, but the fuse F2 does not blow, so the input voltage of the second load 102 recovers by turning off the inter-system switch 4 and turning on the power switch 22. As a result, the communication of the second load 102 is not interrupted. Furthermore, the input voltage of the third load 103 continues to decrease due to the blowing of the fuse F3, causing the communication of the third load 103 to be interrupted.

[0058] As shown in FIG. 6, in the case of scene 2, when the voltage of the first system 110 is restored after the fuse F3 is blown, the power supply device 1 turns on the inter-system switch 4 and turns off the power supply switch 22, thereby returning from the abnormality detection control to normal control, and notifying the vehicle control device 100 of abnormality location information indicating that an abnormality GF2 has occurred and that the voltage of the first system 110 has been restored.

[0059] When the vehicle control device 100 acquires abnormality location information from the power supply device 1, the vehicle control device 100 permits and performs automatic driving. In other words, when the location of the abnormality is between the third load 103 and the fuse F3, and when the voltage of the first system 110 is restored after the fuse F3 is blown, the vehicle control device 100 permits automatic driving. This is because when the voltage of the first system 110 is restored, the redundancy of the power supply by the first system 110 and the second system 120 is ensured. This makes it possible to reduce unnecessary execution of evacuation travel control.

[0060] In addition, the vehicle control device 100 may execute TOR and leave driving operations to the driver until the voltage of the first system 110 is restored, or may continue automatic driving by supplying power to the second load 102 via the second system 120.

[0061] Furthermore, in scene 2, after completion of FOP, the power supply device 1 continues normal control by keeping the inter-system switch 4 on and the power supply switch 22 off, because the voltage of the first system 110 has been restored. When charging the second power source 20 that has been depleted due to the implementation of FOP, the power supply device 1 charges the second power source 20 by turning on the inter-system switch 4 and turning on the power supply switch 22. Then, after receiving a notification from the power supply device 1 that charging of the second power source 20 is completed, the vehicle control device 100 permits and performs automatic driving.

[0062] (Scene 3) Scene 3 is a case where an abnormality GF3 occurs, and more specifically, a case where a power failure (a state in which power cannot be supplied) occurs in the second load 102 due to the occurrence of the abnormality GF3.

[0063] The power supply device 1 identifies an abnormality GF3 when only the input voltage of the second load 102 continues to drop among the voltages shown in FIG. 5. Specifically, as shown in FIG. 5, when an abnormality GF3 occurs, the voltage of the voltage sensor 51 drops due to the abnormality GF3, and then recovers by turning off the system switch 4. Also, the voltage of the voltage sensor 52 drops due to the abnormality GF3, and then recovers by turning on the power switch 22, because the fuse F2 is blown. Also, the input voltage of the first load 101 drops due to the abnormality GF3, and then recovers by turning off the system switch 4, because the fuse F1 is not blown. As a result, the communication of the first load 101 is not interrupted. Also, the input voltage of the second load 102 continues to drop due to the fuse F2 being blown. As a result, the communication interruption of the second load 102 continues. Furthermore, since the fuse F3 is not blown after the input voltage of the third load 103 drops due to the abnormality GF3, the power supply to the third load 103 is resumed by turning off the inter-system switch 4, and the voltage is restored. As a result, the communication of the third load 103 is not interrupted.

[0064] As shown in FIG. 6, in the case of scene 3, the power supply device 1 keeps the inter-system switch 4 off and keeps the power supply switch 22 on, thereby transitioning from abnormality detection control to evacuation driving control, and notifying the vehicle control device 100 of abnormality location information indicating that an abnormality GF3 has occurred.

[0065] When the vehicle control device 100 acquires such abnormality location information, it performs TOR. Then, when the TOR is established, the vehicle control device 100 leaves driving operation to the driver, that is, it switches from automatic driving to manual driving and does not perform MRM. On the other hand, when the TOR is not established, the vehicle control device 100 performs MRM. In other words, when the location where the abnormality occurred is the second system 120, the vehicle control device 100 performs FOP, which performs TOR and performs MRM when the TOR is not established.

[0066] Also, in scene 3, after FOP is completed, the power supply device 1 keeps the system switch 4 off because the fuse F2 is blown, and the vehicle control device 100 prohibits automatic driving and allows only manual driving because the second load 102 cannot be used and load redundancy is not ensured.

[0067] (Scene 4) Scene 4 is a case where an abnormality GF4 occurs, and more specifically, a case where a power failure (a state in which power cannot be supplied) occurs in the first load 101 and the third load 103 due to the occurrence of the abnormality GF4.

[0068] The power supply device 1 identifies an abnormality GF4 when the voltages of the voltage sensor 51, the first load 101, and the third load 103 continue to drop among the voltages shown in FIG. 5. Specifically, as shown in FIG. 5, when an abnormality GF4 occurs, the voltage of the voltage sensor 51 continues to drop due to the continuation of the abnormality GF4. In addition, the voltage of the voltage sensor 52 is restored by turning off the inter-system switch 4 and turning on the power switch 22 after dropping due to the abnormality GF4. In addition, the input voltage of the first load 101 continues to drop because the power supply is not supplied due to the continuation of the abnormality GF4, although the fuse F1 is not blown. As a result, the communication of the first load 101 is interrupted. In addition, the input voltage of the second load 102 is reduced due to the abnormality GF4, and the power supply to the second load 102 is resumed by turning off the inter-system switch 4 and turning on the power switch 4, and the voltage is restored. As a result, the communication of the second load 102 is not interrupted. Although the fuse F3 does not blow, the input voltage of the third load 103 continues to drop because power is not supplied due to the continuation of the abnormality GF4. As a result, communication with the third load 103 is interrupted.

[0069] 6, in scene 4, the power supply device 1 and the vehicle control device 100 perform the same control as in scene 1. That is, the power supply device 1 keeps the inter-system switch 4 off and keeps the power supply switch 22 on, thereby transitioning from abnormality detection control to evacuation travel control, and notifying the vehicle control device 100 of abnormality location information indicating that an abnormality GF4 has occurred.

[0070] When the vehicle control device 100 acquires abnormality location information from the power supply device 1, the vehicle control device 100 performs FOP in which MRM is performed without performing TOR.

[0071] Furthermore, after completion of FOP, if the voltage of the first system 110 is restored, the power supply device 1 turns on the inter-system switch 4 and notifies the vehicle control device 100 of restoration information indicating that the voltage of the first system 110 has been restored. If the vehicle control device 100 acquires restoration information indicating that the voltage of the first system 110 has been restored, it permits and performs automatic operation. This is because, since the fuses F1 and F2 are not blown, the restoration of the voltage of the first system 110 ensures redundancy of the power supplies (the first power supply 10 and the second power supply 20) and redundancy of the loads (the first load 101 and the second load 102).

[0072] On the other hand, after the completion of FOP, if the voltage of the first system 110 does not recover, the power supply device 1 notifies the vehicle control device 100 of non-recovery information. Then, when the vehicle control device 100 acquires the non-recovery information, it prohibits driving. This is because the first power source 10 has failed and the second power source 20, which has run out of power due to the implementation of FOP, cannot be charged.

[0073] (Scene 5) Scene 5 is a case where an abnormality GF5 occurs, and more specifically, a case where a power failure (a state in which power cannot be supplied) of the second load 102 occurs due to the occurrence of the abnormality GF5.

[0074] The power supply device 1 identifies an abnormality GF5 when the voltages of the voltage sensor 52 and the second load 102 continue to drop among the voltages shown in FIG. 5. Specifically, as shown in FIG. 5, when an abnormality GF5 occurs, the voltage of the voltage sensor 51 is restored by turning off the inter-system switch 4. Furthermore, the voltage of the voltage sensor 52 continues to drop due to the continuation of the abnormality GF5. Furthermore, after the input voltage of the first load 101 drops due to the abnormality GF5, the fuse F1 is not blown, so the power supply to the first load 101 is resumed by turning off the inter-system switch 4, and the voltage is restored. As a result, the communication of the first load 101 is not interrupted. Furthermore, the input voltage of the second load 102 continues to drop because the fuse F2 is not blown, but power is not supplied due to the continuation of the abnormality GF5. As a result, the communication of the second load 102 is interrupted. Furthermore, since the fuse F3 is not blown after the input voltage of the third load 103 drops due to the abnormality GF5, the power supply to the third load 103 is resumed by turning off the inter-system switch 4, and the voltage is restored. As a result, the communication of the third load 103 is not interrupted.

[0075] 6, in the case of scene 5, from the determination of an abnormality to the completion of FOP, the power supply device 1 and the vehicle control device 100 perform the same control as in scene 3. That is, the power supply device 1 keeps the inter-system switch 4 off and keeps the power supply switch 22 on, thereby transitioning from abnormality detection control to evacuation driving control, and notifying the vehicle control device 100 of abnormality location information indicating that an abnormality GF5 has occurred.

[0076] When the vehicle control device 100 acquires such abnormality location information, it performs TOR. When the TOR is established, the vehicle control device 100 leaves driving operation to the driver, that is, switches from automatic driving to manual driving and does not perform MRM. On the other hand, when the TOR is not established, the vehicle control device 100 performs MRM.

[0077] Furthermore, after completion of FOP, if the voltage of the second system 120 is restored, the power supply device 1 turns on the inter-system switch 4 and notifies the vehicle control device 100 of restoration information indicating that the voltage of the second system 120 has been restored. If the vehicle control device 100 acquires restoration information indicating that the voltage of the second system 120 has been restored, it permits and performs automatic operation. This is because, since the fuses F1 and F2 are not blown, the restoration of the voltage of the second system 120 ensures redundancy of the power supplies (the first power supply 10 and the second power supply 20) and redundancy of the loads (the first load 101 and the second load 102).

[0078] On the other hand, after completion of FOP, if the voltage of the second system 120 has not been restored, the power supply device 1 turns off the inter-system switch 4 and notifies the vehicle control device 100 of non-restore information. Then, when the vehicle control device 100 acquires the non-restore information, it prohibits automatic driving. This is because power supply redundancy cannot be ensured due to the failure of the second power supply 20.

[0079] Next, a configuration example of the vehicle control device 100 according to the embodiment will be described with reference to Fig. 7. Fig. 7 is a block diagram showing a configuration example of the vehicle control device 100 according to the embodiment. As shown in Fig. 7, the vehicle control device 100 according to the embodiment is connected to a power supply device 1, a first load 101, a second load 102, and a third load 103. In addition, the vehicle control device 100 includes a control unit 200 and a storage unit 300.

[0080] The control unit 200 includes a microcomputer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), etc., and various circuits. The control unit 200 may be configured with hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0081] The control unit 200 controls the operation of the vehicle control device 100 by the CPU executing a program stored in the ROM using the RAM as a working area.

[0082] The storage unit 300 is configured with a storage device such as a non-volatile memory, a data flash, a hard disk drive, etc. The storage unit 300 stores control information 310 and various programs.

[0083] Next, the procedure of the process executed in the vehicle control device 100 according to the embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing the procedure of the process executed by the vehicle control device 100 according to the embodiment.

[0084] As shown in FIG. 8, first, the control unit 200 acquires abnormality location information indicating the location where the abnormality has occurred from the power supply device 1 (step S101).

[0085] Next, the control unit 200 determines whether the location where the abnormality has occurred is the abnormal GF1 based on the abnormality location information (step S102).

[0086] If GF1 is abnormal (step S102: Yes), the control unit 200 executes the control of scene 1 in the control information 310 (step S103), and ends the process.

[0087] On the other hand, if GF1 is not abnormal (step S102: No), the control unit 200 determines whether GF2 is abnormal (step S104).

[0088] If GF2 is abnormal (step S104: Yes), the control unit 200 executes the control of scene 2 in the control information 310 (step S105), and ends the process.

[0089] On the other hand, if GF2 is not abnormal (step S104: No), the control unit 200 determines whether GF3 is abnormal (step S106).

[0090] If GF3 is abnormal (step S106: Yes), the control unit 200 executes the control of scene 3 in the control information 310 (step S107), and ends the process.

[0091] On the other hand, if GF3 is not abnormal (step S106: No), the control unit 200 determines whether GF4 is abnormal (step S108).

[0092] If GF4 is abnormal (step S108: Yes), the control unit 200 executes the control of scene 4 in the control information 310 (step S109), and ends the process.

[0093] On the other hand, if GF4 is not abnormal (step S108: No), abnormal GF5 is identified, so the control unit 200 executes control of scene 5 in the control information 310 (step S110) and ends the process.

[0094] As described above, the vehicle control device 100 according to the embodiment includes the control unit 200. The control unit 200 performs automatic driving using the first load 101 to which power is supplied from the first power source 10 of the power source device 1 via the first system 110 and the second load 102 to which power is supplied from the second power source 20 of the power source device 1 via the second system 120, and when an abnormality occurs in one of the first system 110 or the second system 120, performs evacuation travel control using the other system. The control unit 200 changes the content of the evacuation travel control depending on the location where the abnormality occurs. This makes it possible to perform appropriate evacuation travel control depending on the occurrence situation of the abnormality.

[0095] Further advantages and modifications may readily occur to those skilled in the art. Thus, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof. [Explanation of symbols]

[0096] 1 Power supply 4-system switch 10 1st power supply 11 DC / DC converter 12 Lead-acid battery 20 2nd power supply 21 Lithium-ion battery 22 Power switch 31 Control Unit 51, 52 Voltage sensor 100 Vehicle control device 101 1st load 102 2nd load 103 Third load 110 1st system 120 2nd system 200 Control section 300 Storage section 310 Control Information S Autonomous Driving System

Claims

1. A vehicle control device provided in an autonomous driving vehicle, A first system which is a main system that supplies power from a first power source to a first load related to automatic operation; A second system is a backup system that supplies power from a second power source to a second load related to automatic driving, and when an abnormality occurs in one of the first system and the second system, a control unit performs evacuation driving control using the other system, The control unit is When the location of the abnormality is the first system, the evacuation travel control is performed to execute MRM, which controls the vehicle to evacuate without executing TOR, which requests the driver to change driving operations; When the occurrence location is the second system, the TOR is implemented, and when the TOR is not established, the MRM is implemented, thereby performing the evacuation travel control. A vehicle control device comprising:

2. A vehicle control device provided in an autonomous driving vehicle, A first system which is a main system that supplies power from a first power source to a first load related to automatic operation; A second system which is a backup system that supplies power from the second power source to a second load related to the automatic operation; an inter-system switch that connects the first system and the second system; a control unit that, when an abnormality occurs in one of the first system and the second system, turns off the inter-system switch and performs evacuation travel control using the other system; The control unit is changing the content of the evacuation travel control depending on whether the location of the abnormality is the first system or the second system; A vehicle control device comprising:

3. the first load is connected to the first system via a first fuse; The control unit is When the first fuse is blown due to the occurrence of the abnormality between the first load and the first fuse, the automatic driving is prohibited when the voltage of the first system is restored after the evacuation travel control is completed. The vehicle control device according to claim 1 or 2,

4. The control unit is When the abnormality occurs between the first power source and the first fuse, if the voltage of the first system is restored after the evacuation driving control is completed, the automatic driving is permitted, and if the voltage of the first system is not restored, driving is prohibited. The vehicle control device according to claim 3 .

5. the second load is connected to the second system via a second fuse; The control unit is When the second fuse is blown due to the occurrence of the abnormality between the second load and the second fuse, the automatic driving is prohibited after the evacuation travel control is completed.

5. The vehicle control device according to claim 1,

6. The control unit is When the abnormality occurs between the second power source and the second fuse, and when the evacuation travel control is completed and the voltage of the second system is restored, the automatic driving is permitted, and when the voltage of the second system is not restored, the automatic driving is prohibited. The vehicle control device according to claim 5 .

7. The first system is connected to a third load, which is a general load unrelated to the automatic driving, via a third fuse, The control unit is permitting the automatic operation when the voltage of the first system is restored after the third fuse is blown due to the occurrence of the abnormality between the third load and the third fuse; 7. The vehicle control device according to claim 1,

Images