In-vehicle device, program, and information processing method

Abstract

To provide an on-vehicle device or the like capable of efficiently controlling a driving device.SOLUTION: An on-vehicle device includes a driving device mounted on a vehicle to include a first power feeding switch to be connected to a first on-vehicle load and a second power feeding switch to be connected to a second on-vehicle load, a first processing part being a communicably connected on-vehicle device, and connected communicably to the first power supplying switch to output a first control signal for driving the first on-vehicle load to the first power feeding switch, and a second processing part connected communicably to the second power feeding switch to output a second control signal for driving the second on-vehicle load to the second power feeding switch. The first processing part and the second processing part are connected in a communicable manner, and the second processing part outputs a third control signal for driving the first on-vehicle load to the first power feeding switch through a first signal line for connecting the first processing part and the first power feeding switch in the case that the first processing part becomes abnormal.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an in-vehicle device, a program, and an information processing method. [Background technology]

[0002] A vehicle is equipped with a body ECU, which is an on-board ECU (Electronic Control Unit) that controls body-related devices such as a wiper drive device, interior and exterior lighting devices, door lock devices, and power windows (see, for example, Patent Document 1). The wiper drive device of Patent Document 1 includes an on-board ECU (body ECU) and is driven by a control program applied to the on-board ECU. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2017-224926 Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the wiper drive device of Patent Document 1, there is no separation between a control device (control circuit) that executes a control program to control actuators (vehicle loads) such as wipers, and a drive device (drive circuit) that drives the actuators (vehicle loads), and furthermore, no consideration is given to making the control device (control circuit) for the drive device (drive circuit) redundant.

[0005] The present disclosure aims to provide an in-vehicle device or the like that can efficiently control a drive device. [Means for solving the problem]

[0006] An in-vehicle device according to one embodiment of the present disclosure includes a drive device mounted on a vehicle and including a first power supply switch connected to a first in-vehicle load and a second power supply switch connected to a second in-vehicle load, and an in-vehicle device communicatively connected to the drive device, the in-vehicle device including: a first processing unit communicatively connected to the first power supply switch and outputting a first control signal to the first power supply switch for driving the first in-vehicle load; and a second processing unit communicatively connected to the second power supply switch and outputting a second control signal to the second power supply switch for driving the second in-vehicle load, the first processing unit and the second processing unit being communicatively connected, and when an abnormality occurs in the first processing unit, the second processing unit outputs a third control signal to the first power supply switch via a first signal line connecting the first processing unit and the first power supply switch, for driving the first in-vehicle load. [Effects of the Invention]

[0007] According to one aspect of the present disclosure, it is possible to provide an in-vehicle device or the like that efficiently controls a drive device. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating a system configuration of an in-vehicle system according to a first embodiment. [Figure 2] FIG. 2 is a block diagram illustrating an example of the internal configuration of an in-vehicle device included in the in-vehicle system. [Figure 3] 6 is a flowchart illustrating a process performed by a second processing unit included in the in-vehicle device. [Figure 4] FIG. 10 is a schematic diagram illustrating the system configuration of an in-vehicle system according to a second embodiment (separate in-vehicle devices). [Figure 5] FIG. 10 is a schematic diagram illustrating the system configuration of an in-vehicle system according to a third embodiment (mutually alternative). DETAILED DESCRIPTION OF THE INVENTION

[0009] [Description of the embodiment of the present invention] First, embodiments of the present disclosure will be listed and described. At least some of the embodiments described below may be combined in any desired manner.

[0010] (1) An in-vehicle device according to one aspect of the present disclosure includes: a drive device mounted on a vehicle and including a first power supply switch connected to a first in-vehicle load and a second power supply switch connected to a second in-vehicle load; and an in-vehicle device communicatively connected to the drive device, the in-vehicle device comprising: a first processing unit communicatively connected to the first power supply switch and outputting a first control signal to the first power supply switch for driving the first in-vehicle load; and a second processing unit communicatively connected to the second power supply switch and outputting a second control signal to the second power supply switch for driving the second in-vehicle load. The first processing unit and the second processing unit are communicatively connected; and when the first processing unit becomes abnormal, the second processing unit outputs a third control signal to the first power supply switch via a first signal line connecting the first processing unit and the first power supply switch for driving the first in-vehicle load.

[0011] In this aspect, the in-vehicle device is a device (ECU) equipped with multiple processing units (multi-microcomputers) including a first processing unit (first microcomputer) and a second processing unit (second microcomputer), each of which is configured by a microcomputer or the like. The in-vehicle device and a drive unit (extender) that drives the first in-vehicle load and the second in-vehicle load are configured as separate devices, and the in-vehicle device and the drive unit are communicatively connected. In the connection configuration between the in-vehicle device and the drive unit, the first processing unit and a first power supply switch included in the drive unit are connected via a first signal line. The second processing unit is communicatively connected to the first processing unit and periodically or steadily monitors the operating state of the first processing unit by, for example, performing polling communication with the first processing unit. If the periodic communication with the first processing unit is interrupted, the second processing unit determines that the first processing unit is in an abnormal state (malfunction) and outputs a third control signal to the first power supply switch via the first signal line to drive the first in-vehicle load. In this case, the third control signal may have the same signal format (specifications) as the first control signal. That is, by outputting a third control signal similar to the first control signal, the second processing unit may substitute for the first processing unit that outputs the first control signal. Alternatively, the third control signal output by the second processing unit may have a different signal format (specifications) from the first control signal output by the first processing unit, but the first power supply switch may be configured to perform the same on / off control regardless of whether the signal format (specifications) is the first control signal or the third control signal, thereby absorbing the difference in signal format (specifications). In this way, even if the first processing unit fails, for example, the second processing unit can continue to control the drive of the first vehicle load by outputting the third control signal in place of the first processing unit, thereby creating a fail-safe environment. When the first processing unit fails, the third control signal output from the second processing unit to the first processing unit is output via the first signal line. In this way, the first signal line used when the second processing unit replaces the first processing unit is the signal line (first signal line) used by the first processing unit during normal operation, so a fail-safe environment can be created without increasing the number of signal lines installed between the in-vehicle device and the drive device.Therefore, when the vehicle-mounted device and the drive device are located at a distance from each other, it is not necessary to install additional signal lines between the vehicle-mounted device and the drive device to create a fail-safe environment, thereby reducing component costs and device weight.

[0012] (2) In the in-vehicle device according to one aspect of the present disclosure, the first signal line and the second processing unit are connected by a communication line, and when an abnormality occurs in the first processing unit, the second processing unit The third control signal is output via the coupling wire and the first signal line.

[0013] In this aspect, the connecting line extending from the second processing unit is connected to the first signal line, i.e., the first signal line has a connection end to which the connecting line is connected. The connection end corresponds to a branch point where the connecting line branches off from the first signal line. The third control signal from the second processing unit is output to the first power feed switch via the connecting line and the first signal line, so that the third control signal can be output from the second processing unit to the first power feed switch with a relatively simple configuration.

[0014] (3) In an in-vehicle device according to one embodiment of the present disclosure, the connection line is provided with a conversion unit that converts the third control signal into the first control signal, and the third control signal output by the second processing unit via the connection line is converted into the first control signal by the conversion unit, and the first control signal converted by the conversion unit is output to the first power supply switch via the first signal line.

[0015] In this aspect, the communication line is provided with a converter that converts the third control signal output by the second processing unit into the first control signal that the first processing unit normally outputs. The converter may be configured with a signal conversion circuit or IC (integrated circuit), such as a filter circuit, a PWM waveform conversion circuit, or an output voltage conversion circuit. Alternatively, the converter may be configured with a microcomputer or the like, and convert the third control signal into the first control signal through software processing. By using such a converter, even if the first processing unit malfunctions and the second processing unit replaces the first processing unit, the converter converts the third control signal into the first control signal, thereby absorbing the difference in signal output specifications even if there is a difference between the signal output specifications of the second processing unit and the first processing unit when the first processing unit malfunctions and the second processing unit replaces the first processing unit.

[0016] (4) In an in-vehicle device according to one embodiment of the present disclosure, the first processing unit and the second processing unit are connected to a communication cable extending from an operation switch for operating the first in-vehicle load.

[0017] In this aspect, the vehicle is provided with an operation switch for operating the first vehicle load, and a vehicle occupant can start or stop driving the first vehicle load by operating the operation switch. For example, if the first vehicle load is a windshield wiper, the operation switch corresponds to a wiper switch. A communication cable such as a wire harness extending from the operation switch is branched into two, with each end connected to a first processing unit and a second processing unit. As a result, an operation signal generated when the operation switch is operated is input to both the first processing unit and the second processing unit. When the first processing unit is operating normally, the first processing unit outputs a first control signal in response to the input (acquired) operation signal, thereby controlling the on / off of the first power supply switch. When the first processing unit determines that the first processing unit is in an abnormal state (malfunction), the second processing unit outputs a third control signal, which is substantially equivalent to the first control signal, in response to the input (acquired) operation signal, thereby controlling the on / off of the first power supply switch. In this way, by connecting the communication cable extending from the operating switch to the in-vehicle device to both the first processing unit and the second processing unit to create a duplicated connection, the second processing unit can efficiently perform alternative processing (fail-safe) for the first processing unit.

[0018] (5) In one embodiment of the in-vehicle device of the present disclosure, the in-vehicle device is composed of a first in-vehicle device and a second in-vehicle device, the first in-vehicle device includes the first processing unit, the second in-vehicle device includes the second processing unit, and the second in-vehicle device replaces the first in-vehicle device when an abnormality occurs in the first in-vehicle device.

[0019] In this aspect, the in-vehicle device includes a first in-vehicle device including a first processing unit and a second in-vehicle device including a second processing unit. The vehicle-mounted device includes a second in-vehicle device including a power supply and a power supply voltage, and is configured separately from the first in-vehicle device and the second in-vehicle device. By separating the in-vehicle device into two devices (the first in-vehicle device and the second in-vehicle device) in this manner, the size of each device can be reduced, improving the flexibility of placement in the vehicle. The first in-vehicle device (first processing unit) and the second in-vehicle device (second processing unit) are communicatively connected by a network cable such as a CAN bus or an Ethernet (registered trademark) cable, and the second in-vehicle device (second processing unit) constantly monitors the operating status of the first in-vehicle device (first processing unit). If an abnormality occurs in the first in-vehicle device (first processing unit), the second in-vehicle device (second processing unit) takes over from the first in-vehicle device and controls the on / off of the first power supply switch connected to the first in-vehicle device, thereby enabling efficient control of the drive device.

[0020] (6) A program according to one embodiment of the present disclosure is a program that causes a computer to execute processing, the computer being mounted on a vehicle and communicatively connected to a drive device including a first power supply switch connected to a first in-vehicle load and a second power supply switch connected to a second in-vehicle load, the computer being communicatively connected to the first power supply switch and outputting a first control signal to the first power supply switch for driving the first in-vehicle load, and a second processing unit being communicatively connected to the second power supply switch and outputting a second control signal to the second power supply switch for driving the second in-vehicle load, the program causing the second processing unit to determine whether the first processing unit is abnormal, and if it is determined that the first processing unit is abnormal, outputting a third control signal to the first power supply switch for driving the first in-vehicle load via a first signal line connecting the first processing unit and the first power supply switch.

[0021] In this aspect, it is possible to provide a program that causes a computer to function as an in-vehicle device that efficiently controls the drive device.

[0022] (7) An information processing method according to one aspect of the present disclosure is an information processing method that causes a computer to execute processing, the computer being mounted on a vehicle and communicatively connected to a drive device including a first power supply switch connected to a first vehicle load and a second power supply switch connected to a second vehicle load, the computer being communicatively connected to the first power supply switch and outputting a first control signal to the first power supply switch for driving the first vehicle load, and a second processing unit being communicatively connected to the second power supply switch and outputting a second control signal to the second power supply switch for driving the second vehicle load, the information processing method comprising: causing the second processing unit to determine whether the first processing unit is abnormal; and, if it is determined that the first processing unit is abnormal, outputting a third control signal to the first power supply switch for driving the first vehicle load via a first signal line connecting the first processing unit and the first power supply switch.

[0023] In this aspect, it is possible to provide an information processing method that causes a computer to function as an in-vehicle device that efficiently controls a drive device.

[0024] [Details of the embodiments of the present disclosure] The present disclosure will be specifically described with reference to drawings showing embodiments thereof. An in-vehicle system S according to an embodiment of the present disclosure will be described below with reference to the drawings. Note that the present disclosure is not limited to these examples, but is defined by the claims, and is intended to include all modifications within the meaning and scope equivalent to the claims.

[0025] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is a schematic diagram illustrating the system configuration of an in-vehicle system S according to the first embodiment. FIG. 2 is a block diagram illustrating the internal configuration of an in-vehicle device 1 and the like included in the in-vehicle system S. The block diagram mainly illustrates the connection mode of the communication system. The in-vehicle system S includes an in-vehicle device 1 and a drive device 7 mounted on a vehicle C. The in-vehicle device 1 is controlled by a first operation switch 51 or a second operation switch 52. In response to the output operation signal, the control circuit 7 outputs a first control signal or a second control signal to the drive device 7.

[0026] When the drive device 7 receives the first control signal, it controls the on / off of the first power supply switch 71 to drive the first in-vehicle load 81 connected to the first power supply switch 71. When the drive device 7 receives the second control signal, it controls the on / off of the second power supply switch 72 to drive the second in-vehicle load 82 connected to the second power supply switch 72.

[0027] Power is supplied to the in-vehicle device 1 and the drive device 7 by a power supply device 6 mounted on the vehicle C. The power supply device 6 is connected to the in-vehicle device 1 and the drive device 7 by a power line 61. The drive device 7 is connected to a first in-vehicle load 81 via a first power supply switch 71 and the power line 61. The drive device 7 is connected to a second in-vehicle load 82 via a second power supply switch 72 and the power line 61.

[0028] The in-vehicle device 1 and the drive device 7 are communicatively connected by a first signal line 106 and a second signal line 206. A first control signal is output (transmitted) from the in-vehicle device 1 to the drive device 7 via the first signal line 106. A second control signal is output (transmitted) from the in-vehicle device 1 to the drive device 7 via the second signal line 206. In this embodiment, the first signal line 106 and the second signal line 206 are shown as single lines, but are not limited to this. When communication between the in-vehicle device 1 and the drive device 7 is performed using, for example, SPI communication, the signal lines used in the SPI communication may be configured by an SPI communication circuit including a CS (chip select) signal line, an SCLK (clock) signal line, an MOSI (master output / slave input) signal line, and an MISO (master input / slave output) signal line. The in-vehicle device 1 and the drive device 7 may be further connected by a power line 61, and the voltage stepped down by the first regulator 105 provided in the in-vehicle device 1 may be supplied (applied) to the drive device 7 via the power line 61.

[0029] The in-vehicle device 1 includes a first processing unit 100, a second processing unit 200, a first regulator 105, a second regulator 205, and a conversion unit 3. The in-vehicle device 1 includes multiple processing units (multi-microcomputers) each consisting of a first processing unit 100 (first microcomputer) and a second processing unit 200 (second microcomputer), each consisting of a microcomputer or the like, and may be, for example, an integrated ECU configured by a vehicle computer or the like. Alternatively, the in-vehicle device 1 may be a PLB (Power LAN Box) that also functions as a power distribution device that distributes and relays power output from a power supply device 6 and supplies it to a drive device 7 connected to the in-vehicle device 1 itself.

[0030] The first processing unit 100 is configured with, for example, a microcomputer or the like, and includes a first control unit 101, a first storage unit 102, a first communication unit 103, and a first input / output I / F 104. The first control unit 101 is configured with a CPU (Central Processing Unit) or an MPU (Micro Processing Unit) or the like, and performs various control processes, arithmetic processes, etc. by reading and executing a program P (program product) and data pre-stored in the first storage unit 102. The first control unit 101 is not limited to only a software processing unit that performs software processing such as a CPU, but may also include a hardware processing unit that performs various control processes, arithmetic processes, etc. by hardware processing such as an FPGA, ASIC, or SOC.

[0031] The first storage unit 102 is configured with a volatile memory element such as a RAM (Random Access Memory) or a non-volatile memory element such as a ROM (Read Only Memory), an EEPROM (Electrically Erasable Programmable ROM) or a flash memory, and stores in advance a program P (program product) and data to be referenced during processing. The program P (program product) stored in the first storage unit 102 may be a program P (program product) read from a recording medium M readable by the in-vehicle device 1. Alternatively, the program P (program product) may be downloaded from an external computer (not shown) connected to a communication network (not shown) and stored in the first storage unit 102.

[0032] The first communication unit 103 is a communication interface that uses a communication protocol such as CAN (Control Area Network) or Ethernet (registered trademark), and the first control unit 101 communicates with various ECUs and the like that are connected to the in-vehicle network via the first communication unit 103. The first control unit 101 may communicate with a second control unit 201 of the second processing unit 200 via the first communication unit 103 and the in-vehicle network.

[0033] The first input / output I / F 104 is, for example, configured with a plurality of connectors or terminals, and is a communication interface for performing, for example, SPI communication or the like. To the first input / output I / F 104, for example, a first operation switch 51, a first power supply switch 71, and a second input / output I / F 204 are connected. The first input / output I / F 104 and the first operation switch 51 are connected via a communication cable 500. The first input / output I / F 104 and the first power supply switch 71 are connected via a first signal line 106. The first input / output I / F 104 and the second input / output I / F 204 are connected via an inter-microcomputer communication line 4. The inter-microcomputer communication line 4 may be, for example, configured with an internal bus.

[0034] The second processing unit 200 is configured with, for example, a microcomputer or the like, and includes a second control unit 201, a second storage unit 202, a second communication unit 203, and a second input / output I / F 204. The second control unit 201, the second storage unit 202, the second communication unit 203, and the second input / output I / F 204 of the second processing unit 200 may have the same configuration or specifications as the first control unit 101, the first storage unit 102, the first communication unit 103, and the first input / output I / F 104 of the first processing unit 100.

[0035] The second input / output I / F 204 is, for example, configured with a plurality of connectors or terminals, and is a communication interface for performing, for example, SPI communication, etc. The second input / output I / F 204 is connected to, for example, the second operation switch 52, the second power supply switch 72, and the first input / output I / F 104. As described above, the second input / output I / F 204 of the second processing unit 200 and the first input / output I / F 104 of the first processing unit 100 are connected by the inter-microcomputer communication line 4, which allows the second control unit 201 of the second processing unit 200 to monitor whether the first processing unit 100 is operating normally.

[0036] A communication line 31 is further connected to the second input / output I / F 204, and the communication line 31 is connected to a first signal line 106 that connects the first processing unit 100 and the first operation switch 51. A conversion unit 3 is provided on the communication line 31. Although details will be described later, a second control unit 201 of the second processing unit 200 (second microcomputer) outputs a third control signal via the communication line 31 to replace the first processing unit 100 when the first processing unit 100 malfunctions (fails to function).

[0037] The conversion unit 3 is configured by a circuit or IC (integrated circuit) that performs signal conversion, such as a filter circuit, a PWM waveform conversion circuit, or an output voltage conversion circuit. As will be described in detail later, the conversion unit 3 converts the third control signal output from the second processing unit 200 (second microcomputer) into a first control signal that is output by the first processing unit 100 (first microcomputer) in a normal state.

[0038] The first regulator 105 is a switching regulator, a linear regulator, or the like, that is connected to the power supply device 6, steps down the voltage applied from the power supply device 6, and applies the stepped-down voltage to the first processing unit 100 (first microcomputer) and the drive device 7. The first regulator 105 and the drive device 7 are connected by a power line 61, and the first regulator 105 is connected to the drive device 7. Power is supplied by the stepped-down voltage of 5.

[0039] The second regulator 205 is configured by a switching regulator or the like, similar to the first regulator 105. The voltage stepped down by the second regulator 205 is applied to the second processing unit 200 (second microcomputer) and is used as the operating voltage of the second processing unit 200.

[0040] The power supply device 6 is configured with a lead battery, an alternator, or a secondary battery such as a lithium battery, and outputs (applies) a voltage of, for example, 12 V. The power supply device 6 is connected to the in-vehicle device 1 and the drive device 7 via a power line. The power supply device 6 is connected to the first in-vehicle load 81 and the second in-vehicle load 82 via the drive device 7.

[0041] The drive device 7 includes a first power supply switch 71 and a second power supply switch 72, and may function as an extender equipped with a drive circuit for driving in-vehicle loads (first in-vehicle load 81, second in-vehicle load 82) such as actuators connected to the drive device 7. A voltage stepped down by a first regulator 105 is applied to the drive device 7. The drive device 7 uses the stepped down voltage as the operating voltage for the first power supply switch 71 and the second power supply switch 72, which are configured by an IPD (Intelligent Power Device) or the like.

[0042] The first power feed switch 71 and the second power feed switch 72 are configured by an IPD (Intelligent Power Device) including a switching element such as a FET (Field Effect Transistor) or an IGBT (Insulated Gate Bipolar Transistor). A first signal line 106 is connected to the first power feed switch 71. The first power feed switch 71 performs on / off control in response to a first control signal, such as a PWM signal, input via the first signal line 106. A first vehicle load 81 is connected to the switching element included in the first power feed switch 71 via a power supply line. When the first power feed switch 71 is turned on, power is supplied from the power supply device 6 to the first vehicle load 81. A second signal line 206 is connected to the second power feed switch 72. The second power feed switch 72 performs on / off control in response to a second control signal, such as a PWM signal, input via the second signal line 206. A second vehicle load 82 is connected to a switching element included in the second power supply switch 72 via a power supply line, and when the second power supply switch 72 is turned on, power is supplied from the power supply device 6 to the second vehicle load 82.

[0043] The first operation switch 51 is an operation switch for operating the first in-vehicle load 81, and is operated, for example, by an occupant of the vehicle C. For example, if the first in-vehicle load 81 is a windshield wiper, the first operation switch 51 corresponds to a wiper switch. The first operation switch 51 is connected to a terminal of the first processing unit 100 (first input / output I / F 104) and a terminal of the second processing unit 200 (second input / output I / F 204) via a communication cable 500.

[0044] The second operation switch 52 is an operation switch for operating the second vehicle load 82, and is operated by, for example, an occupant of the vehicle C. For example, if the second vehicle load 82 is a door mirror, the second operation switch 52 corresponds to a door mirror switch. 。 The second operation switch 52 is connected to a terminal of the second processing unit 200 (the second input / output I / F 204) via a communication cable 500.

[0045] The first vehicle load 81 is, for example, an actuator such as a wiper, and is connected to the first power supply switch 71 of the drive device 7 via a power line. When the first power supply switch 71 is turned on, power output from the power supply device 6 is supplied to the first vehicle load 81 via the first power supply switch 71.

[0046] The second vehicle load 82 is, for example, an actuator for a door mirror or the like, and is connected to the power supply line. , is connected to the second power supply switch 72 of the drive device 7. When the second power supply switch 72 is turned on, the power output from the power supply device 6 is supplied to the second vehicle load 82 via the second power supply switch 72.

[0047] 3 is a flowchart illustrating processing by the second processing unit 200 included in the in-vehicle device 1. The first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) of the in-vehicle device 1 are configured to output control signals (first control signal, second control signal) to the drive device 7 in response to operation signals from operation switches (first operation switch 51, second operation switch 52) connected to them, respectively. In this way, the first processing unit 100 and the second processing unit 200 execute control processing for different operation systems (drive systems). In addition, the second processing unit 200 (second microcomputer) steadily executes the following processing, for example, when the vehicle C is in a started state (IG switch is on) or a stopped state (IG switch is off).

[0048] The second control unit 201 of the second processing unit 200 determines whether the first processing unit 100 is operating normally (S101). The second control unit 201 of the second processing unit 200 periodically or steadily monitors the operating state of the first processing unit 100 by periodically or periodically performing polling communication or the like with the first processing unit 100 via the inter-microcomputer communication line 4, which is constituted by an internal bus or the like. Alternatively, the first control unit 101 of the first processing unit 100 may be configured to periodically or periodically output (transmit) a heartbeat signal to the second processing unit 200 via the inter-microcomputer communication line 4, for example, and the second control unit 201 of the second processing unit 200 may determine whether the first processing unit 100 is operating normally based on whether the heartbeat signal has been received.

[0049] When it is determined that the first processing unit 100 is operating normally (S101: YES), the second control unit 201 of the second processing unit 200 performs loop processing to execute the processing of S101 again. By performing loop processing in this manner, the second control unit 201 of the second processing unit 200 continues to monitor the operation of the first processing unit 100. In this way, the second processing unit 200, which monitors whether the first processing unit 100 is operating normally, may function as a watchdog timer (WDT) for the first processing unit 100.

[0050] When it is determined that the first processing unit 100 is not operating normally (S101: NO), the second control unit 201 of the second processing unit 200 determines whether or not an operation signal has been acquired from the first operation switch 51 (S102). A communication cable 500 extending from the first operation switch 51 branches into two and is connected to both the first processing unit 100 and the second processing unit 200. The second control unit 201 of the second processing unit 200 determines whether or not an operation signal has been acquired (received) from the first operation switch 51 via the communication cable 500 thus branched.

[0051] When it is determined that an operation signal has not been received from the first operation switch 51 (S102: NO), the second control unit 201 of the second processing unit 200 performs a loop process to execute the process of S102 again. By performing the loop process in this manner, the second control unit 201 of the second processing unit 200 continues the process of waiting for an operation signal from the first operation switch 51.

[0052] When it is determined that an operation signal has been acquired from the first operation switch 51 (S102: YES), the second control unit 201 of the second processing unit 200 outputs a third control signal (S103). The second control unit 201 of the second processing unit 200 outputs the third control signal via a terminal (second input / output I / F 204) to which the communication line 31 is connected. The third control signal output via the communication line 31 is converted by the conversion unit 3 provided on the communication line 31 into a first control signal that is output by the first processing unit 100 (first microcomputer) in a normal state. The first control signal converted by the conversion unit 3 propagates through the communication line 31 and the first signal line 106 to which the communication line 31 is connected, and is output to the first power supply switch 71 via the first signal line 106. The first power supply switch 71 performs on / off control in response to the input first control signal, thereby controlling the drive of the first in-vehicle load 81 connected to the first power supply switch 71. As a result, even if the first processing unit 100 fails, for example, the second processing unit 200 can continue (fail-safe) the drive control of the first in-vehicle load 81 by outputting the third control signal in place of the first processing unit 100, thereby improving the reliability of the in-vehicle device 1.

[0053] In the present embodiment, the third control signal from the second processing unit 200 (second microcomputer) is converted by the conversion unit 3 into the first signal line 106, and the converted first signal line 106 is output to the first power supply switch 71 via the first signal line 106, but this is not limiting. The third control signal from the second processing unit 200 (second microcomputer) may have the same signal format (specifications) as the first control signal output by the first processing unit 100 (first microcomputer) in a normal state, and the third control signal may be output to the first power supply switch 71 via the connection line 31 and the first signal line 106. In this case, the conversion unit 3 can be eliminated.

[0054] In the present embodiment, the second processing unit 200 (second microcomputer) substitutes for the first processing unit 100 (first microcomputer) in outputting the third control signal, etc., in response to the operation signal output from the first operation switch 51. However, this is not limiting. The second processing unit 200 (second microcomputer) may substitute for the first processing unit 100 (first microcomputer) in outputting the third control signal, etc., in response to communication data, such as a CAN message, acquired via the second communication unit 203. That is, for example, if the CAN message acquired via the second communication unit 203 is a message ID (CAN-ID) for driving the first in-vehicle load 81, the second processing unit 200 (second microcomputer) may substitute for the first processing unit 100 (first microcomputer) in outputting the third control signal, etc., in response to the acquired CAN message.

[0055] (Embodiment 2) 4 is a schematic diagram illustrating the system configuration of an in-vehicle system S according to a second embodiment (separate in-vehicle devices 1). The in-vehicle system S of the second embodiment is configured by separate in-vehicle devices 1, each of which is composed of a first in-vehicle device 11 including a first processing unit 100 (first microcomputer) and a second in-vehicle device 12 including a second processing unit 200 (second microcomputer). That is, the multi-microcomputer in-vehicle device 1 including the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) described in the first embodiment corresponds to a device configuration in the second embodiment that is a combination of the first in-vehicle device 11 including the first processing unit 100 (first microcomputer) and the second in-vehicle device 12 including the second processing unit 200 (second microcomputer).

[0056] In this embodiment, the in-vehicle system S includes separate in-vehicle devices 1 consisting of a first in-vehicle device 11 and a second in-vehicle device 12, but the connection between the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) is the same as the connection between the first and second in-vehicle devices 11 and 12. That is, the first in-vehicle device 11 and the second in-vehicle device 12 are communicatively connected via an inter-microcomputer communication line 4, similar to the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) in the first embodiment. The first in-vehicle device 11 and the second in-vehicle device 12 may also be communicatively connected via a first communication unit 103, a second communication unit 203, a CAN bus, or an Ethernet cable.

[0057] The connection between the first processing unit 100 (first microcomputer) and the first power supply switch 71 and the connection between the second processing unit 200 (second microcomputer) and the second power supply switch 72 are the same as those in embodiment 1. That is, the first in-vehicle device 11 is connected to the first power supply switch 71 of the drive device 7 via a first signal line 106, and the second in-vehicle device 12 is connected to the second power supply switch 72 of the drive device 7 via a second signal line 206.

[0058] The second in-vehicle device 12 including the second processing unit 200 periodically or steadily performs monitoring processing to determine whether the first in-vehicle device 11 including the first processing unit 100 is operating normally, as in the first embodiment. If the second processing unit 200 of the second in-vehicle device 12 determines that the first processing unit 100 of the first in-vehicle device 11 is in an abnormal state (malfunction), it outputs a third control signal via the communication line 31.

[0059] The second in-vehicle device 12 includes a conversion unit 3, similar to the first embodiment. The third control signal output via the connection line 31 is converted into a first control signal by the conversion unit 3. The first control signal converted by the conversion unit 3 is input to the first power supply switch 71 via a first signal line 106 connecting the first in-vehicle device 11 and the first power supply switch 71.

[0060] Even when the first in-vehicle device 11 and the second in-vehicle device 12 are each a single-microcomputer in-vehicle device 1 configured with a single microcomputer or the like, when an abnormality occurs in the first in-vehicle device 11 (first processing unit 100), the second in-vehicle device 12 (second processing unit 200) takes over for the first in-vehicle device 11 and controls on / off the first power supply switch 71 connected to the first in-vehicle device 11. This makes it possible to create a fail-safe environment for the first in-vehicle load 81.

[0061] (Embodiment 3) 5 is a schematic diagram illustrating the system configuration of an in-vehicle system S according to a third embodiment (mutually alternative). The in-vehicle device 1 of the third embodiment includes a first processing unit 100, a second processing unit 200, a first regulator 105, a second regulator 205, and a conversion unit 3, similar to the in-vehicle device 1 of the first embodiment. The configurations of the first processing unit 100, the second processing unit 200, the first regulator 105, the second regulator 205, and the conversion unit 3 are the same as those of the first embodiment.

[0062] In the in-vehicle device 1 of the third embodiment, not only the first operation switch 51 but also the communication cable 500 extending from the second operation switch 52 is branched, and each end (branch end) of the branched communication cable 500 is connected to the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer), respectively. Like the communication cable 500 extending from the first operation switch 51, the communication cable 500 extending from the second operation switch 52 is branched, and the branched communication cable 500 is connected to a terminal (first input / output I / F 104) of the first processing unit 100 and a terminal (second input / output I / F 204) of the second processing unit 200. As a result, an operation signal from the second operation switch 52 is input to both the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer). As in the first embodiment, an operation signal from the first operation switch 51 is input to both the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer).

[0063] A communication line 31 similar to the communication line 31 in the first embodiment is connected to the first input / output I / F 104 of the first processing unit 100 (first microcomputer), and the communication line 31 is connected to a second signal line 206 that connects the second input / output I / F 204 of the second processing unit 200 and the second power supply switch 72. A conversion unit 3 is provided in the communication line 31 that connects the first input / output I / F 104 of the first processing unit 100 and the second signal line 206, as in the first embodiment. Therefore, the conversion unit 3 is arranged so as to straddle two communication lines 31, namely, the communication line 31 that connects the first input / output I / F 104 of the first processing unit 100 and the second signal line 206, and the communication line 31 that connects the second input / output I / F 204 of the second processing unit 200 and the first signal line 106.

[0064] The first control unit 101 of the first processing unit 100 (first microcomputer) periodically or constantly performs a monitoring process to determine whether the second processing unit 200 (second microcomputer) is operating normally. The monitoring process is performed by the second control unit 201 of the second processing unit 200 (second microcomputer) in the first embodiment, similar to the monitoring process for the first processing unit 100 (first microcomputer), by performing inter-microcomputer communication. Polling communication or a heartbeat signal may be used via the line 4. The first control unit 101 of the first processing unit 100 (first microcomputer) outputs a fourth control signal via the communication line 31 when it determines that the second processing unit 200 (second microcomputer) is in an abnormal state (malfunction).

[0065] The conversion unit 3 converts the fourth control signal output from the first processing unit 100 (first microcomputer) into a second control signal that is output by the second processing unit 200 (second microcomputer) in a normal state. The second control signal converted by the conversion unit 3 propagates through the connection line 31 and the second signal line 206 to which the connection line 31 is connected, and is output to the second power supply switch 72 via the second signal line 206.

[0066] The second power supply switch 72 performs on / off control in response to the input second control signal, thereby controlling the drive of the second in-vehicle load 82 connected to the second power supply switch 72. As a result, even if the second processing unit 200 fails, for example, the first processing unit 100 can continue (fail-safe) the drive control of the second in-vehicle load 82 by outputting the fourth control signal in place of the second processing unit 200. The first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) included in the in-vehicle device 1 monitor each other's processing unit and, if an abnormal state (failure) occurs, each performs a substitute process. Therefore, the drive control of the first in-vehicle load 81 and the second in-vehicle load 82 can be continued, and the reliability of the in-vehicle device 1 can be improved.

[0067] When the first processing unit 100 (first microcomputer) and the second processing unit 200 (second microcomputer) perform processes that are alternative to each other, the control signal (the first control signal and the second control signal converted by the conversion unit 3) output to the drive device 7 is output via the first signal line 106 or the second signal line 206. Therefore, when creating a fail-safe environment for the first vehicle load 81 and the second vehicle load 82, it is not necessary to add additional signal lines, and product costs and device weight can be reduced.

[0068] The embodiments disclosed herein are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the claims, not by the above meaning, and is intended to include all modifications within the meaning and scope of the claims.

[0069] Multiple claims may be combined with each other regardless of the form of reference. Multiple dependent claims may be included in the claims, depending on multiple claims. Multiple dependent claims may be included in a multiple dependent claim. If multiple dependent claims are not included in a multiple dependent claim, this does not limit the number of multiple dependent claims that are included in a multiple dependent claim. [Explanation of symbols]

[0070] C vehicle S In-vehicle system 1 In-vehicle device 11 1st onboard device 12 2nd onboard device 100 First processing unit (first microcomputer) 101 First Control Section 102 1st memory section 103 First Communications Department 104 First input / output I / F 105 First regulator 106 First signal line 200 Second processing unit (second microcomputer) 201 Second Control Section 202 2nd memory section 203 Second Communications Department 204 Second input / output I / F 205 Second regulator 206 Second signal line P Program (Program Product) M Recording medium 3. Conversion section 31 Connecting Line 4. Microcomputer communication line 51 First operation switch 52 Second operation switch 500 Communication Cable 6 Power supply 61 Power Lines 7. Drive unit 71 First power supply switch 72 Second power supply switch 81 1st onboard load 82 2nd onboard load

Claims

1. a driving device mounted on a vehicle and including a first power supply switch connected to a first in-vehicle load and a second power supply switch connected to a second in-vehicle load; and an in-vehicle device communicatively connected to the driving device, the in-vehicle device comprising: a first processing unit communicatively connected to the first power supply switch and outputting a first control signal to the first power supply switch for driving the first in-vehicle load; a second processing unit that is communicatively connected to the second power supply switch and that outputs a second control signal to the second power supply switch for driving the second vehicle load; the first processing unit and the second processing unit are communicatively connected, When the first processing unit becomes abnormal, the second processing unit is configured to a first signal line connecting the first power supply switch to the first in-vehicle power supply switch; outputting a third control signal for driving the load; the in-vehicle device includes a second signal line connecting the second processing unit and the second power supply switch, and a connection line separate from the second signal line; the first signal line and the second processing unit are connected by the connection line, when the first processing unit becomes abnormal, the second processing unit outputs the third control signal via the connection line and the first signal line without via the second signal line; a converter that converts the third control signal into the first control signal is provided in the connection line; the third control signal output by the second processing unit via the connection line is converted into the first control signal by the conversion unit, The first control signal converted by the conversion unit is output to the first power supply switch via the first signal line. In-vehicle device.

2. A communication cable extending from an operation switch for operating the first vehicle load is connected to the first processing unit and the second processing unit. The in-vehicle device according to claim 1 .

3. the in-vehicle device is configured with a first in-vehicle device and a second in-vehicle device, the first in-vehicle device includes the first processing unit, the second in-vehicle device includes the second processing unit, The second in-vehicle device takes over the first in-vehicle device when the first in-vehicle device becomes abnormal. The in-vehicle device according to claim 1 or 2.

4. a power supply switch connected to a first on-vehicle load and a second on-vehicle load; a first processing unit communicatively connected to the first power supply switch and configured to output a first control signal to the first power supply switch for driving the first vehicle load; a second processing unit that is communicatively connected to the second power supply switch and that outputs a second control signal to the second power supply switch for driving the second vehicle load; A program for causing a computer to execute a process, The second processing unit, determining whether the first processing unit is abnormal; when it is determined that the first processing unit is abnormal, a third control signal for driving the first in-vehicle load is output to the first power supply switch via a first signal line connecting the first processing unit and the first power supply switch; the computer includes a second signal line connecting the second processing unit and the second power supply switch, and a communication line separate from the second signal line; the first signal line and the second processing unit are connected by the connection line, when the first processing unit becomes abnormal, the second processing unit outputs the third control signal via the connection line and the first signal line without via the second signal line; a converter that converts the third control signal into the first control signal is provided in the connection line; the third control signal output by the second processing unit via the connection line is converted into the first control signal by the conversion unit, The first control signal converted by the conversion unit is output to the first power supply switch via the first signal line. A program that executes a process.

5. a power supply switch connected to a first on-vehicle load and a second on-vehicle load; a first processing unit communicatively connected to the first power supply switch and configured to output a first control signal to the first power supply switch for driving the first vehicle load; a second processing unit that is communicatively connected to the second power supply switch and that outputs a second control signal to the second power supply switch for driving the second vehicle load; An information processing method for causing a computer to execute a process, comprising: The second processing unit, determining whether the first processing unit is abnormal; when it is determined that the first processing unit is abnormal, a third control signal for driving the first in-vehicle load is output to the first power supply switch via a first signal line connecting the first processing unit and the first power supply switch; the computer includes a second signal line connecting the second processing unit and the second power supply switch, and a communication line separate from the second signal line; the first signal line and the second processing unit are connected by the connection line, when the first processing unit becomes abnormal, the second processing unit outputs the third control signal via the connection line and the first signal line without via the second signal line; a converter that converts the third control signal into the first control signal is provided in the connection line; the third control signal output by the second processing unit via the connection line is converted into the first control signal by the conversion unit, The first control signal converted by the conversion unit is output to the first power supply switch via the first signal line. An information processing method for executing a process.

Images