Control device and control method

Abstract

To provide a control device and a control method that are able to suppress a decrease in opportunities of automatic operation while securing safety.SOLUTION: A control device according to an embodiment includes a first system, a second system, an inter-system switch, a specifying unit, a control unit, and a fail-safe unit. The first system supplies power of a first power source to a first load for automatic operation. The second system supplies power of the second power source to a second load for automatic operation. The inter-system switch is provided in a connection path connecting the first and second systems and can connect and disconnect the connection path. The specifying unit detects an occurrence of disconnection or ground fault in the first and second systems and specifies a point of the occurrence. The control unit permits or inhibits continuation of the automatic operation according to the point of the occurrence specified by the specifying unit. When an occurrence of a disconnection or a ground fault is detected during automatic operation and continuation of the automatic operation is inhibited, the fail-safe unit shifts to a retreat travel.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The disclosed embodiments relate to a control device and a control method. [Background technology]

[0002] Conventionally, there has been a power supply system that is equipped with a first power source and a second power source so that even if a power failure occurs while the vehicle is traveling in autonomous driving mode, the vehicle can be driven to a safe location and stopped, and if a ground fault occurs in one of the power supply systems, the other power supply system supplies power to on-board equipment (load) for autonomous driving, allowing the vehicle to be driven to a safe location (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2018-182864 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the case of conventional power supply systems, when a power failure occurs, even if the system is able to supply enough power to the load for evacuation driving to enable evacuation driving, the system will uniformly stop autonomous driving and have the vehicle drive to an evacuation drive, reducing the opportunities for autonomous driving.

[0005] One aspect of the embodiment has been made in consideration of the above, and aims to provide a control device and a control method that can prevent a decrease in opportunities for autonomous driving while ensuring safety. [Means for solving the problem]

[0006] A control device according to an aspect of the embodiment includes a first system, a second system, an inter-system switch, a determination unit, a control unit, and a fail-safe unit. The first system supplies power from a first power source to a first load for automatic driving. The second system supplies power from a second power source to a second load for automatic driving. The inter-system switch is provided in a connection path connecting the first system and the second system, and is capable of connecting and disconnecting the connection path. The determination unit detects the occurrence of a break or a ground fault in the first system and the second system, and identifies the location of the break or the ground fault. The control unit permits or prohibits continuation of automatic driving according to the location identified by the determination unit. The fail-safe unit transitions to evacuation running when the determination unit detects the occurrence of the break or the ground fault during automatic driving and the control unit prohibits continuation of automatic driving. Effect of the Invention

[0007] A control device and a control method according to one aspect of an embodiment have the advantage of being able to suppress a decrease in opportunities for autonomous driving while ensuring safety. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a control device according to an embodiment. [Diagram 2] FIG. 2 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Diagram 3] FIG. 3 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Figure 4] FIG. 4 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Diagram 5] FIG. 5 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Figure 6] FIG. 6 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Figure 7] FIG. 7 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. [Figure 8]FIG. 8 is a flowchart illustrating an example of a process executed by the control device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of a control device and a determination method will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiment. In the following, a control device that is mounted on a vehicle with an automatic driving function and supplies power to a load will be described as an example, but the control device according to the embodiment may be mounted on a vehicle that does not have an automatic driving function.

[0010] In addition, although the following description will be given of a case where the vehicle in which the control device is installed is an electric vehicle or a hybrid vehicle, the vehicle in which the control device is installed may also be an engine vehicle that is run by an internal combustion engine.

[0011] [1. Control device configuration] Fig. 1 is an explanatory diagram showing a configuration example of a control device according to an embodiment. As shown in Fig. 1, the control device 1 according to the embodiment is connected to a first power source 10, a first load 101, a general load 102, a second load 103, and an automatic driving control device 100. The control device 1 includes a first system 110 that supplies power from the first power source 10 to the first load 101 and the general load 102, and a second system 120 that supplies power from a second power source 20 (described later) to the second load 103.

[0012] The first load 101 includes a load for autonomous driving. For example, the first load 101 includes a steering motor, an electric brake device, an in-vehicle camera, a radar, etc. that operate during autonomous driving. The general load 102 includes, for example, a display, an air conditioner, an audio device, a video device, various lights, etc.

[0013] The second load 103 has the same function as the first load 101. The second load 103 includes devices that operate during automatic driving, such as a steering motor, an electric brake device, an in-vehicle camera, and a radar. The first load 101, the general load 102, and the second load 103 operate with power supplied from the control device 1. The automatic driving control device 100 is a device that operates the first load 101 or the second load 103 to control the automatic driving of the vehicle.

[0014] The first power source 10 includes a DC / DC converter (hereinafter, referred to as "DC / DC 11") and a lead battery (hereinafter, referred to as "PbB 12"). The battery of the first power source 10 may be any secondary battery other than PbB 12.

[0015] The DC / DC 11 is connected to a generator and a high-voltage battery having a higher voltage than the PbB 12, and steps down the voltages of the generator and the high-voltage battery and outputs the stepped-down voltage to the first system 110. The generator is, for example, an alternator that converts the kinetic energy of a traveling vehicle into electricity to generate power. The high-voltage battery is, for example, a battery for driving the vehicle that is mounted on an electric vehicle or a hybrid vehicle.

[0016] When the first power source 10 is installed in an engine vehicle, an alternator (generator) is provided instead of the DC / DC 11. The DC / DC 11 charges the PbB 12, supplies power to the first load 101 and the general load 102, supplies power to the second load 103, and charges the second power source 20 described later.

[0017] The control device 1 includes a second power source 20, an inter-system switch 41, a first switch 42, a second switch 43, a third switch 44, an identification unit 31, a control unit 32, and a fail-safe unit 33. The control device 1 further includes current sensors 51, 52, 53, 54, 55, and 56, and a voltage sensor 57.

[0018] The second power source 20 is a backup power source in case the first power source 10 is unable to supply power. The second power source 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). Note that the battery of the second power source 20 may be any secondary battery other than the LiB21.

[0019] The inter-system switch 41 is provided in a connection path 130 that connects the first system 110 and the second system 120, and is a switch that can connect and disconnect the connection path 130. The first switch 42 is a switch that can connect and disconnect a second load power supply path 140 that connects between a connection point P of the connection path 130 and the second system 120 and the second load 103, at an end of the second load power supply path 140 on the side of the connection point P.

[0020] The second switch 43 is a switch capable of connecting and disconnecting the second load power supply path 140 at an end of the second load power supply path 140 on the second load 103 side. The third switch 44 is a switch capable of connecting and disconnecting a bypass path 150 that bypasses the second load power supply path 140 and supplies power from the connection path 130 to the second load 103.

[0021] The current sensor 51 detects the value of a current supplied to the first load 101, and outputs the detection result to the identification unit 31. The current sensor 52 detects the value of a current supplied to the general load 102, and outputs the detection result to the identification unit 31. The current sensor 53 detects the value of a current flowing through the second load power supply path 140, and outputs the detection result to the identification unit 31.

[0022] The current sensor 54 detects a value of a current supplied to the second load 103, and outputs the detection result to the identification unit 31. The current sensor 55 detects a value of a current flowing through a power supply path between the inter-system switch 41 and the connection point P, and outputs the detection result to the identification unit 31.

[0023] The current sensor 56 detects the value of a current flowing between the first power source 10 and a connection point P1 between the connection path 130 and the first system 110, and outputs the detection result to the identification unit 31. The voltage sensor 57 detects the voltage value of the power supply path between the inter-system switch 41 and the connection point P, and outputs the detection result to the identification unit 31.

[0024] The identification unit 31, the control unit 32, and the fail-safe unit 33 include various circuits and a microcomputer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), etc. The identification unit 31, the control unit 32, and the fail-safe unit 33 may be configured with hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0025] The identifying unit 31 detects the occurrence of a break or a ground fault in the first system 110 and the second system 120 and identifies the location of the break or the ground fault by having the CPU execute a program stored in the ROM using the RAM as a working area. The identifying unit 31 identifies the location of the break or the ground fault based on the detection results input from the current sensors 51, 52, 53, 54, and 55 and the voltage sensor 57. A method of identifying the location of the break or the ground fault by the identifying unit 31 will be described later with reference to FIG. 2.

[0026] The control unit 32 executes a program stored in the ROM by the CPU using the RAM as a working area, thereby performing on / off control of the inter-system switch 41, the first switch 42, the second switch 43, and the third switch 44. The on / off control of each switch by the control unit 32 will be described later with reference to Figs. 2 to 8.

[0027] Furthermore, the control unit 32 permits or prohibits continuation of the automatic operation depending on the location of the disconnection or ground fault identified by the identification unit 31. For example, even if a disconnection or ground fault occurs in the first system 110 or the second system 120, the control unit 32 permits continuation of the automatic operation as long as the location of the disconnection or ground fault is a location where the first power source 10 can be backed up by the second power source 20.

[0028] This allows the control device 1 to suppress a decrease in the opportunities for automatic operation while ensuring safety. Furthermore, if the location where the disconnection or ground fault occurs is a location where the second power source 20 cannot back up the first power source 10, the control unit 32 prohibits continuation of the automatic operation. This allows the control device 1 to ensure safety.

[0029] The fail-safe unit 33 outputs a command to the automatic driving control device 100 to transition to evacuation driving when the identification unit 31 detects the occurrence of a wire break or ground fault during automatic driving and the control unit 32 prohibits continuation of automatic driving.

[0030] Next, the operation of the control device 1 will be described with reference to Figures 2 to 8. In order to facilitate understanding of the operation of the control device 1, the identification unit 31, the control unit 32, the fail-safe unit 33, and the control signal lines shown by dashed or dotted arrows in Figure 1 are omitted in Figures 2 to 8.

[0031] [2. Normal operation of the control device] In normal operation when no break or ground fault occurs in the first system 110 and the second system 120, the control unit 32 turns on the inter-system switch 41, the first switch 42, and the second switch 43, and turns off the third switch 44, as shown in Fig. 2. This allows the control device 1 to supply power from the first power source 10 to the first load 101, the general load 102, and the second load 103.

[0032] The identifying unit 31 normally monitors whether or not a disconnection or a ground fault has occurred in the first system 110 or the second system 120. Specifically, the identifying unit 31 monitors whether or not a disconnection or a ground fault has occurred upstream of the first load 101 in the power supply path of the first system 110, that is, in a section A-1 from the first power source 10 to the first load 101.

[0033] The identifying unit 31 also monitors whether or not a disconnection or a ground fault has occurred in a section A-2 downstream of the first load 101 in the power supply path of the first system 110. The identifying unit 31 also monitors whether or not a disconnection or a ground fault has occurred in a section B between the inter-system switch 41 and the second system 120. The identifying unit 31 also monitors whether or not a disconnection or a ground fault has occurred in a section C between the first switch 42 and the second switch 43, which constitutes the second load power supply path 140.

[0034] An example of the operation of the control device 1 when a break or a ground fault occurs in the above-mentioned sections A-1, A-2, B, and C will be described below.

[0035] [3. If a ground fault or disconnection occurs in section A-1, or if a ground fault occurs in section A-2] 2, when a ground fault occurs in the first system 110 or the second system 120, an overcurrent flows to the ground fault point, and therefore the current value detected by the current sensor 55 increases and the current values ​​detected by the current sensors 51, 52, 53, 54, and 56 decrease. Specifically, when a ground fault occurs in the first system 110, an overcurrent flows in the current sensor 55 from the second system 120 toward the first system 110, and when a ground fault occurs in the second system 120, an overcurrent flows in the current sensor 55 from the first system 110 toward the second system 120. On the other hand, the current flowing in the current sensors 51, 52, 53, 54, and 56 becomes zero.

[0036] For this reason, when the detection result of the current sensor 55 is equal to or greater than the first ground fault threshold for the current value, the identifying unit 31 determines that a ground fault has occurred in the first system 110 or the second system 120. When the detection result of the current sensor 55 is equal to or greater than the first ground fault threshold for the current value and at least one of the detection results of the current sensors 51, 52, 53, 54, and 56 is equal to or less than the second ground fault threshold for the current value, the identifying unit 31 may be configured to determine that a ground fault has occurred in the first system 110 or the second system 120.

[0037] The first ground fault threshold is a threshold for detecting an overcurrent, and is a value larger than the current that flows when the first load 101 and the second load 103 are driven normally (hereinafter referred to as the "normal current"). The second ground fault threshold is a threshold for detecting that no current is flowing, and is a value smaller than the normal current. When the identification unit 31 determines that a ground fault has occurred, the control unit 32 shuts off the inter-system switch 41, as shown in FIG. 3.

[0038] The identifying unit 31 may determine that a ground fault has occurred in the first system 110 or the second system 120 when the voltage detected by the voltage sensor 57, instead of the current sensor 55, drops below a threshold value.

[0039] At this time, if a ground fault 201 occurs in section A-1 or section A-2, the current from the first power source 10 does not flow to the current sensors 51, 52, 56, so the detection results of the current sensors 51, 52, 56 remain below the second ground fault threshold for the current value. On the other hand, power is supplied to the second system 120 from the second power source 20, so the detection results of the current sensors 53, 54 become higher than the second ground fault threshold for the current value.

[0040] Therefore, after the inter-system switch 41 is cut off, if the detection results of the current sensors 51, 52, 56 are below the second ground fault threshold for the current value and the detection results of the current sensors 53, 54 are higher than the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section A-1 or section A-2.

[0041] In addition, when a break 202 occurs between the first power source 10 and connection point P1 in section A-1 during normal operation as shown in Figure 2, the detection result of the current sensor 56 becomes below the second ground fault threshold, and the detection results of the current sensors 51, 52 become above the second ground fault threshold and below the first ground fault threshold.

[0042] In addition, when a break 202 occurs between connection point P1 in section A-1 and the first load 101 during normal operation as shown in Figure 2, the detection result of current sensor 56 becomes greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold, and the detection result of current sensors 51, 52 becomes less than the second ground fault threshold.

[0043] Therefore, when the detection result of current sensor 56 becomes equal to or less than the second ground fault threshold and the detection results of current sensors 51, 52 become equal to or greater than the second ground fault threshold and equal to or less than the first ground fault threshold, or when the detection result of current sensor 56 becomes equal to or greater than the second ground fault threshold and equal to or less than the first ground fault threshold and the current sensors 51, 52 become equal to or less than the second ground fault threshold, identifying unit 31 determines that a break has occurred and identifies the location of break 202 as section A-1.

[0044] If the location of the disconnection 202 identified by the identification unit 31 is in section A-1, or if the location of the earth fault 201 identified by the identification unit 31 is in section A-1 or A-2, the control unit 32 prohibits continuation of automatic operation with the inter-system switch 41 turned off, and causes the power of the second power source 20 to be supplied to the second load 103.

[0045] When the identifying unit 31 detects the disconnection 202, the power of the second power source 20 may be supplied to the first load 101 and the second load 103 without turning off the inter-system switch 41, but the power of the second power source 20 will run out correspondingly sooner. Therefore, when the identifying unit 31 detects the disconnection 202, it is desirable to turn off the inter-system switch 41.

[0046] Then, when the occurrence of the disconnection 202 or the ground fault 201 is detected by the identification unit 31 during autonomous driving and the continuation of autonomous driving is prohibited by the control unit 32, the fail-safe unit 33 outputs a command to the autonomous driving control device 100 to shift to evacuation driving. As a result, when a power failure occurs in the first system 110, the autonomous driving control device 100 can cause the vehicle to evacuate to a safe place and stop.

[0047] [4. If a line break occurs in section A-2] 4, when a break 202 occurs in section A-2 during normal operation, power is supplied from the first power source 10 to the first load 101, but power is not supplied to the general load 102. Therefore, when the detection result of the current sensor 51 is a normal value (greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold) and the detection result of the current sensor 52 is less than or equal to the second ground fault threshold, the identifying unit 31 identifies that the break 202 has occurred and that the location where the break 202 has occurred is section A-2.

[0048] At this time, current is being supplied to the first load 101 and the second load 103 required for the automatic operation. Therefore, when the location of the occurrence of the disconnection 202 is section A-2, the control unit 32 permits the continuation of the automatic operation. As a result, even if the disconnection 202 occurs in section A-2, the control device 1 can continue the automatic operation, so that it is possible to prevent a decrease in opportunities for automatic operation while ensuring safety.

[0049] [5. If a line break or ground fault occurs in section B] When the detection result of the voltage sensor 57 becomes equal to or less than the ground fault threshold for the voltage value, the identifying unit 31 determines that a ground fault has occurred somewhere inside the control device 1. Note that the identifying unit 31 may determine that a ground fault has occurred somewhere inside the control device 1 when the detection result of at least one of the current sensors 51, 52, 53, 54, 56 becomes equal to or less than a second ground fault threshold for the current value, or when the detection result of the current sensor 55 becomes equal to or more than a first ground fault threshold for the current value. When it is determined that a ground fault has occurred, the control unit 32 shuts off the inter-system switch 41 as shown in FIG. 5.

[0050] Thereafter, when the detection results of the current sensors 51, 52, 56 become higher than the second ground fault threshold value for the current value, the identifying unit 31 determines that a ground fault has not occurred in the first system 110, but has occurred in section B or section C. Next, the control unit 32 turns off the first switch 42 and the second switch 43, and turns on the third switch 44.

[0051] As a result, if the detection values ​​of the current sensors 54, 55 become higher than the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section C, and if the detection values ​​of the current sensors 54, 55 are still lower than or equal to the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section B.

[0052] In addition, when the detection result of the current sensor 55 under normal conditions is below the second ground fault threshold and the detection results of the current sensors 53, 54 are equivalent to the detection results under normal conditions (above the second ground fault threshold and below the first ground fault threshold), the identification unit 31 identifies the location where the break 202 has occurred as section B.

[0053] Furthermore, when the detection result of current sensor 53 during normal operation is equal to or lower than the second ground fault threshold, identifying unit 31 determines that disconnection 202 has occurred in section B or section C. Thereafter, control unit 32 turns off first switch 42 and second switch 43, and turns on third switch 44. As a result, when the detection results of current sensors 54 and 55 are equivalent to the detection results during normal operation, identifying unit 31 identifies the location where disconnection 202 has occurred as section C.

[0054] When the location of the disconnection 202 or the ground fault 201 is section B, the control unit 32 prohibits continuation of the automatic operation with the inter-system switch 41 turned off. Then, the fail-safe unit 33 outputs a command to the automatic operation control device 100 to shift from automatic operation to manual operation. This allows the control device 1 to continue traveling in manual operation using the power of the first power source 10.

[0055] [6. If a ground fault occurs in section C] When the occurrence location of the ground fault 201 is identified as section C by the above-mentioned method, the control unit 32 turns off the first switch 42 and the second switch 43 and turns on the third switch 44, as shown in FIG.

[0056] As a result, even if a power failure occurs in the first system 110 thereafter, the control device 1 can ensure a backup state in which the inter-system switch 41 can be shut off and power can be supplied from the second power source 20 to the second load 103 via the third switch 44. Therefore, the control unit 32 permits continuation of the automatic operation. As a result, the control device 1 can continue the automatic operation even if a ground fault 201 occurs in the section C, and therefore it is possible to suppress a decrease in opportunities for automatic operation while ensuring safety.

[0057] [7. If a line break occurs in section C] When the location of the disconnection 202 is identified as section C by the above-mentioned method, the control unit 32 turns on the third switch 44 as shown in Fig. 7. This allows the control device 1 to ensure a backup state by the second power source 20, similar to the case where the ground fault 201 occurs in section C.

[0058] Therefore, the control unit 32 permits the continuation of the automatic driving. As a result, the control device 1 can continue the automatic driving even if the disconnection 202 occurs in the section C, so that it is possible to suppress a decrease in opportunities for automatic driving while ensuring safety.

[0059] [8. Processing performed by the control device] Next, a process executed by the control device according to the embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of a process executed by the control device according to the embodiment. The control device 1 repeatedly executes the process shown in Fig. 8 during normal operation when no power failure occurs.

[0060] 8, the identifying unit 31 determines whether or not the disconnection 202 or the ground fault 201 has occurred (step S101). When the identifying unit 31 determines that the disconnection 202 or the ground fault 201 has not occurred (step S101, No), the identifying unit 31 ends the process and starts the process again from step S101.

[0061] Furthermore, when the identifying unit 31 determines that the disconnection 202 or the ground fault 201 has occurred (Yes at step S101), it identifies the location of the disconnection 202 or the ground fault 201 (step S102). After that, the control unit 32 determines whether the location of the disconnection 202 or the ground fault 201 has been identified as section A-1, or whether the location of the ground fault 201 has been identified as section A-2 (step S103).

[0062] When the control unit 32 determines that the location of the disconnection 202 or the ground fault 201 is specified as the section A-1 or the location of the ground fault 201 is specified as the section A-2 (step S103, Yes), the control unit 32 prohibits the automatic operation (step S105) with the system switch 41 turned off (step S104). After that, the fail-safe unit 33 transitions to evacuation running (step S106) and ends the process.

[0063] In addition, if the control unit 32 determines that the location of the break 202 or the ground fault 201 has not been identified as section A-1, or that the location of the ground fault 201 has not been identified as section A-2 (step S103, No), it determines whether the location of the break 202 has been identified as section A-2 (step S107).

[0064] When the control unit 32 determines that the location of the disconnection 202 is identified as section A-2 (step S107, Yes), it permits the continuation of the automatic operation (step S108) and ends the process. When the control unit 32 determines that the location of the disconnection 202 is not identified as section A-2 (step S107, No), it determines whether the location of the disconnection 202 or the ground fault 201 is identified as section B (step S109).

[0065] When the control unit 32 determines that the location of the disconnection 202 or the ground fault 201 is identified as section B (step S109, Yes), it prohibits continuation of the automatic operation (step S111) with the system switch 41 in a cut-off state (step S110). After that, the fail-safe unit 33 shifts to manual operation (step S112) and ends the process.

[0066] In addition, if the control unit 32 determines that the location of the disconnection 202 or the ground fault 201 has not been identified as section B (step S109, No), it determines whether the location of the ground fault 201 has been identified as section C (step S113).

[0067] If the control unit 32 determines that the location of the ground fault 201 has been identified as section C (step S113, Yes), it turns off the first switch 42 and the second switch 43 and turns on the third switch 44 (step S114), permits automatic operation (step S115), and terminates the processing.

[0068] Furthermore, if the control unit 32 determines that the location of the ground fault 201 has not been identified as section C (step S113, No), it determines that the location of the disconnection 202 has been identified as section C (step S116), turns on the third switch 44 (step S117), permits automatic operation (step S115), and terminates the process.

[0069] Further advantages and modifications may readily occur to those skilled in the art. Thus, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof. [Explanation of symbols]

[0070] 1 Control device 10 1st power supply 11 DC / DC 12 PbB 20 2nd power supply 21 LiB 31 Specific section 32 Control section 33 Fail-safe section 41 Intersystem switch 42 First Switch 43 Second Switch 44 Third Switch 51, 52, 53, 54, 55, 56 Current sensors 57 Voltage Sensor 100 Automatic driving control device 101 1st load 102 General load 103 2nd load 110 1st system 120 2nd system 130 Connection Path 140 Second load power supply path 150 Bypass Route

Claims

1. a first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path; an identification unit that detects an occurrence of a break or a ground fault in the first system and the second system and identifies a location where the break or the ground fault has occurred; A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit; a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and Equipped with The control unit is When the location of the disconnection or the ground fault is upstream of the first load in the power supply path of the first system, the system switch is shut off and continuation of the automatic operation is prohibited. A control device comprising:

2. The control unit: When the occurrence location of the ground fault is downstream of the first load in the power supply path of the first system, or when the occurrence location of the disconnection or the ground fault is between the inter-system switch and the second system, the inter-system switch is shut off and continuation of automatic operation is prohibited. The control device according to claim 1 .

3. A first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path; an identification unit that detects an occurrence of a break or a ground fault in the first system and the second system and identifies a location where the break or the ground fault has occurred; A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit; a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and Equipped with The control unit is When the location of the disconnection is downstream of the first load in the power supply path of the first system, continuation of the automatic operation is permitted. A control device comprising:

4. A first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path; an identification unit that detects an occurrence of a break or a ground fault in the first system and the second system and identifies a location where the break or the ground fault has occurred; A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit; a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and Equipped with The control unit is When the location of the ground fault is downstream of the first load in the power supply path of the first system, the system switch is shut off and continuation of the automatic operation is prohibited. A control device comprising:

5. A first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path; an identification unit that detects an occurrence of a break or a ground fault in the first system and the second system and identifies a location where the break or the ground fault has occurred; A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit; a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and Equipped with The control unit is When the location of the disconnection or the ground fault is between the inter-system switch and the second system, the inter-system switch is shut off and continuation of the automatic operation is prohibited, The fail-safe unit includes: Transition from automated to manual driving A control device comprising:

6. A first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path; an identification unit that detects an occurrence of a break or a ground fault in the first system and the second system and identifies a location where the break or the ground fault has occurred; A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit; A fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and a first switch capable of connecting and disconnecting the connection path and a second load power supply path connecting a connection point of the second system and the second load at an end of the second load power supply path on the side of the connection point; a second switch capable of connecting and disconnecting the second load power supply path at an end of the second load power supply path on the second load side; a third switch capable of connecting and disconnecting a bypass path that bypasses the second load power supply path and supplies power from the connection path to the second load; Equipped with The control unit is In a normal state in which the occurrence of the disconnection or the ground fault is not detected by the identifying unit, the inter-system switch, the first switch, and the second switch are turned on, and the third switch is turned off. A control device comprising:

7. The control unit is When the ground fault occurs in the second load power supply path, the first switch and the second switch are cut off, and the third switch is kept in a conductive state to permit continuation of automatic operation.

7. The control device according to claim 6.

8. The control unit is When the disconnection occurs in the second load power supply path, the third switch is kept in a conductive state to permit continuation of the automatic operation. The control device according to claim 6 or 7.

9. a first system that supplies power from a first power source to a first load for automatic operation; a second system that supplies power from the second power source to a second load for automatic operation; an inter-system switch that is provided in a connection path that connects the first system and the second system and is capable of connecting and disconnecting the connection path; A control method in which a control device controls a vehicle including: Detecting an occurrence of a disconnection or a ground fault in the first system and the second system, and identifying a location where the disconnection or the ground fault occurs; Permitting or prohibiting continuation of the autonomous driving according to the identified occurrence location; When the occurrence of the disconnection or the ground fault is detected during the automatic driving and the continuation of the automatic driving is prohibited, transitioning to an evacuation driving mode; When the location of the disconnection or the ground fault is upstream of the first load in the power supply path of the first system, the system switch is shut off and continuation of the automatic operation is prohibited. A control method comprising:

Images