Vehicle-mounted control device

Abstract

A vehicle-mounted control device (10) is included in a vehicle-mounted system (100) which is provided with: a first power supply unit (90); a second power supply unit (91); a conductive path (80) that is provided between the first power supply unit (90) and the second power supply unit (91); a switch (81) that is provided in the conductive path (80); a first load (70) that is connected to the conductive path (80) on the first power supply unit (90) side with respect to the switch (81); and a second load (71) that is connected to the conductive path (80) on the second power supply unit (91) side with respect to the switch (81). The vehicle-mounted control device (10) has a control unit (83) for controlling the switch (81). The control unit (83) switches the switch (81) to an OFF state when an abnormal state of the conductive path (80) is detected in a state in which the switch (81) is in an ON state, and returns the switch (81) to the ON state when a return condition is satisfied.

Description

In-vehicle control device

[0001] The present disclosure relates to an in-vehicle control device.

[0002] The power supply system of Patent Document 1 includes a first power output unit, a second power output unit, an inter-system switch provided between the first power output unit and the second power output unit, and a controller that controls the inter-system switch. When the output current from each of the first power output unit and the second power output unit exceeds a threshold, the controller shuts off the inter-system switch to continue supplying power to a load on the side where no ground fault occurs.

[0003] JP 2019-62727 A

[0004] However, in the case of the configuration as disclosed in Patent Document 1, there is a possibility that the controller may erroneously shut off the inter-system switch due to external noise, etc. Furthermore, in the configuration disclosed in Patent Document 1, after the erroneous shutoff, no control is performed to return the inter-system switch to a conductive state.

[0005] The present disclosure has been made based on the above-mentioned circumstances, and aims to provide an in-vehicle control device that can easily return a switch to an on state if the switch is switched to an off state due to a malfunction.

[0006] The vehicle control device disclosed herein is an vehicle control device included in an vehicle system including a first power supply unit, a second power supply unit, a conductive path provided between the first power supply unit and the second power supply unit, a switch provided in the conductive path, a first load connected to the conductive path on the first power supply unit side of the switch, and a second load connected to the conductive path on the second power supply unit side of the switch, and has a control unit that controls the switch, and when the control unit detects that the conductive path is in an abnormal state while the switch is in an on state, it switches the switch to an off state, and when a recovery condition is met, it restores the switch to an on state.

[0007] According to the present disclosure, when a switch is switched to the OFF state due to a malfunction, the switch can be easily returned to the ON state.

[0008] FIG. 1 is a circuit diagram schematically showing the configuration of an in-vehicle system according to a first embodiment, a second embodiment, and a third embodiment. FIG. 2 is a block diagram showing an example of the configuration of a cutoff circuit according to the first embodiment. FIG. 3 is a flowchart showing an example of control in the in-vehicle control device according to the first embodiment. FIG. 4 is a block diagram showing an example of the configuration of a cutoff circuit according to the second embodiment. FIG. 5 is a flowchart showing an example of control in the in-vehicle control device according to the second embodiment. FIG. 6 is a flowchart showing an example of control in the in-vehicle control device according to the third embodiment. FIG. 7 is a circuit diagram schematically showing the configuration of an in-vehicle system according to a fourth embodiment. FIG. 8 is a block diagram showing an example of the configuration of a cutoff circuit according to the fourth embodiment. FIG. 9 is a flowchart showing an example of control in the in-vehicle control device according to the fourth embodiment. FIG. 10 is a circuit diagram schematically showing the configuration of an in-vehicle system according to a fifth embodiment. FIG. 11 is a block diagram showing an example of the configuration of a cutoff circuit according to the fifth embodiment. FIG. 12 is a flowchart showing an example of control in the in-vehicle control device according to the fifth embodiment.

[0009] [Description of Embodiments of the Present Disclosure] In the following, embodiments of the present disclosure are listed and illustrated.

[0010] (1) An in-vehicle control device included in an in-vehicle system including: a first power supply unit; a second power supply unit; a conductive path provided between the first power supply unit and the second power supply unit; a switch provided in the conductive path; a first load connected to the conductive path on the first power supply unit side of the switch; and a second load connected to the conductive path on the second power supply unit side of the switch, the in-vehicle control device having a control unit that controls the switch, wherein the control unit switches the switch to an off state when it detects that the conductive path is in an abnormal state while the switch is in an on state, and restores the switch to an on state when a restoration condition is met.

[0011] (1) The in-vehicle control device can recover from the switch being switched to the off state due to a malfunction of the control unit by returning the switch to the on state when a return condition is met, even if the switch is switched to the off state due to a malfunction of the control unit.

[0012] (2) The in-vehicle control device according to (1), wherein the abnormal state is a state in which the voltage in the conductive path is outside a normal range.

[0013] The in-vehicle control device of (2) can make it easier for the control unit to perform the determination operation in a shorter time by utilizing the voltage in the conductive path.

[0014] (3) The in-vehicle control device described in (1), wherein the electrical path between the first power supply unit and the switch among the conductive paths is a first power supply side conductive path, the electrical path between the second power supply unit and the switch among the conductive paths is a second power supply side conductive path, and the restoration condition is a condition that is met when the potential difference between the voltage of the first power supply side conductive path and the voltage of the second power supply side conductive path is within a predetermined potential difference range.

[0015] (3) The in-vehicle control device can return the switch to the on state when the potential difference between the first power supply side conductive path and the second power supply side conductive path is within the potential difference range (even if the potential differences are not exactly the same), thereby enabling flexible operation of the in-vehicle system.

[0016] (4) The in-vehicle control device according to (2), wherein the electrical path between the first power supply unit and the switch among the conductive paths is a first power supply side conductive path, the electrical path between the second power supply unit and the switch among the conductive paths is a second power supply side conductive path, and the restoration condition is a condition that is met when the voltage of the first power supply side conductive path and the voltage of the second power supply side conductive path are within a predetermined restoration voltage range.

[0017] (4) The in-vehicle control device can return the switch to the on state when the voltage of the first power supply side conductive path and the voltage of the second power supply side conductive path are within the return voltage range, thereby enabling flexible operation of the in-vehicle system.

[0018] (5) The vehicle control device according to (1), wherein the restoration condition is a condition that is met when a predetermined restoration time has elapsed since the control unit switched the switch to the off state.

[0019] The in-vehicle control device (5) can recover the operation of the in-vehicle system by simply returning the switch to the on state after the recovery time has elapsed.

[0020] (6) The in-vehicle control device described in (1), wherein the restoration condition is a condition that is met every time a second time shorter than the first time elapses during a first time period from when the control unit switches the switch to the off state, and the control unit restores the switch to the on state every time the second time elapses until the first time elapses.

[0021] (6) The in-vehicle control device can recover malfunction of the control unit caused by noise by the control unit returning the switch to the on state every time the second time period elapses while the first time period elapses.

[0022] 1 is a system mounted on a vehicle. The in-vehicle system 100 includes a first power supply unit 90, a second power supply unit 91, a conductive path 80, a switch 81, a first load 70, a second load 71, and an in-vehicle control device 10. The in-vehicle system 100 supplies power based on the first power supply unit 90 and the second power supply unit 91 to the first load 70 and the second load 71 via the conductive path 80.

[0023] The first power supply unit 90 is configured, for example, as a known step-down DC-DC converter. The first power supply unit 90 steps down a voltage input from a high-voltage power supply (not shown) and applies the stepped-down voltage to the conductive path 80. The second power supply unit 91 is, for example, a battery pack configured by combining multiple unit cells, such as lithium-ion batteries or nickel-metal hydride batteries, in series. The output voltage of the second power supply unit 91 is equal to the output voltage of the first power supply unit 90.

[0024] The conductive path 80 is provided between the first power supply unit 90 and the second power supply unit 91. The switch 81 is provided on the conductive path 80. For example, a pair of switching elements such as FETs (Field Effect Transistors) is used as the switch 81. The pair of switching elements are butted together so that the body diodes are oriented in opposite directions. For example, in the switch 81, the anode of the body diode on the first power supply unit 90 side is connected to the first power supply unit 90 side, and the cathode of the body diode is connected to the second power supply unit 91 side. In the switch 81, the anode of the body diode on the second power supply unit 91 side is connected to the second power supply unit 91 side, and the cathode of the body diode is connected to the first power supply unit 90 side.

[0025] The conductive path 80 between the switch 81 and the first power supply unit 90 is a first power supply side conductive path 80A. The conductive path 80 between the switch 81 and the second power supply unit 91 is a second power supply side conductive path 80B. The switch 81 is provided between the first power supply side conductive path 80A and the second power supply side conductive path 80B. The switch 81 switches between an ON state that allows bidirectional current flow between the first power supply side conductive path 80A and the second power supply side conductive path 80B via the switch 81, and an OFF state that blocks bidirectional current flow.

[0026] The first load 70 and the second load 71 are so-called important loads that may affect the safety of the vehicle, for example. Examples of the first load 70 and the second load 71 include an ECU (Electronic Control Unit) of an electric brake device, an ECU of a shift-by-wire device, an ECU of a door lock device, a display device, an ECU of an airbag device, and a DCM (Data Communication Module). The first load 70 is electrically connected to a first power supply side conductive path 80A, which is a conductive path 80 closer to the first power supply unit 90 than the switch 81. The second load 71 is electrically connected to a second power supply side conductive path 80B, which is a conductive path 80 closer to the second power supply unit 91 than the switch 81. The first load 70 and the second load 71 may be loads that perform equivalent functions.

[0027] In the present disclosure, "electrically connected" preferably refers to a configuration in which the connection targets are connected in a mutually conductive state (a state in which a current can flow) so that the potentials of both connection targets are equal. However, this configuration is not limited to this. For example, "electrically connected" may also refer to a configuration in which the connection targets are connected in a state in which the two connection targets can be electrically connected with an electrical component interposed between them.

[0028] The first power supply side conductive path 80A is provided with a first potential detection unit 87A. The second power supply side conductive path 80B is provided with a second potential detection unit 87B. The first potential detection unit 87A and the second potential detection unit 87B are configured as, for example, known potential detection circuits. The first potential detection unit 87A outputs a signal V1 (hereinafter simply referred to as signal V1) that can identify the potential of the first power supply side conductive path 80A. The second potential detection unit 87B outputs a signal V2 (hereinafter simply referred to as signal V2) that can identify the potential of the second power supply side conductive path 80B.

[0029] [Configuration of the In-Vehicle Control Device] The in-vehicle control device 10 is included in the in-vehicle system 100. The in-vehicle control device 10 has a control unit 83. The control unit 83 has a function of controlling the switch 81. The control unit 83 has a cutoff circuit 83A. For example, as shown in FIG. 2 , the cutoff circuit 83A is configured by a hardware circuit including a subtraction circuit S, a comparator C1, and a drive circuit Dr.

[0030] For example, a known differential amplifier circuit is used for the subtraction circuit S. The signal V1 from the first potential detection unit 87A and the signal V2 from the second potential detection unit 87B are input to the subtraction circuit S. The subtraction circuit S calculates the difference between the signal V1 and the signal V2 and outputs a difference signal Di indicating this difference.

[0031] The comparator C1 is configured as a known comparator. The comparator C1 receives a differential signal Di and a differential threshold ThP. For example, the differential threshold ThP is set to a maximum allowable value for the potential difference between the signals V1 and V2. The comparator C1 compares the magnitude of the differential signal Di with the differential threshold ThP. When the differential signal Di exceeds the differential threshold ThP, the comparator C1 outputs an out-of-range signal Or1 indicating that the potential difference between the signals V1 and V2 is outside a predetermined potential difference range (i.e., the conductive path 80 is in an abnormal state).

[0032] The comparator C1 does not output the out-of-range signal Or1 when the differential signal Di is equal to or less than the differential threshold ThP. For example, the comparator C1 detects that the potential difference between the potential of the first power supply side conductive path 80A (signal V1) and the potential of the second power supply side conductive path 80B (signal V2) becomes greater than the differential threshold ThP due to an overvoltage fault (hereinafter simply referred to as an overvoltage fault) in which the first power supply unit 90 outputs an overvoltage, a ground fault (hereinafter simply referred to as a ground fault) in which the output voltage drops to the reference potential (ground potential), or a ground fault in the second power supply unit 91. For example, while the comparator C1 is outputting the out-of-range signal Or1, the comparator C1 stops outputting the out-of-range signal Or1 when the differential signal Di becomes equal to or less than the differential threshold ThP.

[0033] The drive circuit Dr is configured as a known drive circuit that drives a switching element. An out-of-range signal Or1 is input to the drive circuit Dr from the comparator C1. When a vehicle equipped with the in-vehicle system 100 is running, the drive circuit Dr outputs a conduction signal On to the switch 81, turning the switch 81 to an on state. When the out-of-range signal Or1 is input from the comparator C1 while the vehicle equipped with the in-vehicle system 100 is running, the drive circuit Dr outputs a cutoff signal Off to the switch 81. When the out-of-range signal Or1 is no longer input from the comparator C1 while the drive circuit Dr is outputting the cutoff signal Off to the switch 81, the drive circuit Dr again outputs the conduction signal On to the switch 81, turning the switch 81 to an on state. This causes the switch 81 to return to an on state.

[0034] When the comparator C1 of the interrupting circuit 83A determines that the potential difference between the first power supply side conductive path 80A and the second power supply side conductive path 80B is outside the potential difference range (the conductive path 80 is in an abnormal state), the interrupting circuit 83A outputs an out-of-range signal Or1 from the comparator C1 to the drive circuit Dr. When the out-of-range signal Or1 is input from the comparator C1, the drive circuit Dr outputs an interrupting signal Off to the switch 81, switching the switch 81 to the off state. When the out-of-range signal Or1 is no longer input to the drive circuit Dr, the drive circuit Dr outputs a conducting signal On to the switch 81, returning the switch 81 to the on state. In other words, the return condition for returning the switch 81 to the on state is met when the potential difference (differential signal Di) between the voltage of the first power supply side conductive path 80A and the voltage of the second power supply side conductive path 80B is within a predetermined potential difference range (less than or equal to the differential threshold ThP). When the return condition is met, the control unit 83 returns the switch 81 to the on state.

[0035] [Example of Operation of the In-Vehicle Control Device] Next, an example of operation of the in-vehicle control device 10 will be described with reference to Fig. 3. For example, when the vehicle equipped with the in-vehicle system 100 is running, the switch 81 is controlled by the control unit 83 to be maintained in an on state. The in-vehicle control device 10 periodically monitors the signals V1 and V2 while the vehicle is running. Periodic monitoring corresponds to, for example, repeatedly executing the flowchart of Fig. 3 at predetermined intervals.

[0036] In step S1, the control unit 83 determines whether the potential difference (differential signal Di) between the voltage of the first power supply side conductive path 80A and the voltage of the second power supply side conductive path 80B is within the potential difference range (less than or equal to the differential threshold ThP). If the control unit 83 determines in step S1 that the potential difference between the voltage of the first power supply side conductive path 80A and the voltage of the second power supply side conductive path 80B is within the potential difference range (Yes in step S1), the control unit 83 proceeds to step S2 and determines whether the switch 81 is in the OFF state. For example, in step S2, the control unit 83 determines whether the shut-off signal Off is being output from the drive circuit Dr.

[0037] If it is determined in step S2 that the switch 81 is not in the OFF state (No in step S2, the switch 81 is in the ON state), the control unit 83 ends the process shown in FIG. 3 and executes the process shown in FIG. 3 again.

[0038] If it is determined in step S2 that the switch 81 is in the OFF state (Yes in step S2), the process proceeds to step S3. Then, the control unit 83 switches the output from the drive circuit Dr from the blocking signal Off to the conducting signal On, thereby returning the OFF-state switch 81 to the ON state. Then, the control unit 83 ends the process shown in FIG. 3 and executes the process shown in FIG. 3 again.

[0039] If it is determined in step S1 that the potential difference between signals V1 and V2 is not within the potential difference range (No in step S1, meaning the potential difference between signals V1 and V2 is outside the potential difference range), the process proceeds to step S4. Then, the control unit 83 switches the output from the drive circuit Dr from a conduction signal On to a cutoff signal Off, thereby switching the switch 81 from an ON state to an OFF state. In other words, when the control unit 83 detects that the conductive path 80 is in an abnormal state (the potential difference between signals V1 and V2 is outside the potential difference range) while the switch 81 is in the ON state, it switches the switch 81 to an OFF state. Then, the control unit 83 ends the process shown in FIG. 3 and executes the process shown in FIG. 3 again.

[0040] Next, an example of the effect of this configuration will be described. The vehicle control device 10 is included in an in-vehicle system 100 that includes a first power supply unit 90, a second power supply unit 91, a conductive path 80 provided between the first power supply unit 90 and the second power supply unit 91, a switch 81 provided on the conductive path 80, a first load 70 connected to the conductive path 80 on the first power supply unit 90 side of the switch 81, and a second load 71 connected to the conductive path 80 on the second power supply unit 91 side of the switch 81. The vehicle control device 10 has a control unit 83 that controls the switch 81. When the control unit 83 detects that the conductive path 80 is in an abnormal state (the potential difference between the signal V1 and the signal V2 is outside the potential difference range) while the switch 81 is in an on state, the control unit 83 switches the switch 81 to an off state, and when a restoration condition is satisfied, the control unit 83 restores the switch 81 to an on state.

[0041] According to this configuration, even if the switch 81 is switched to the off state due to a malfunction of the control unit 83, the operation of the in-vehicle system 100 can be recovered by returning the switch 81 to the on state when the recovery condition is met.

[0042] The electrical path between the first power supply unit 90 and the switch 81 in the conductive path 80 is the first power supply side conductive path 80A, and the electrical path between the second power supply unit 91 and the switch 81 in the conductive path 80 is the second power supply side conductive path 80B. The restoration condition is met when the potential difference between the voltage (V1) of the first power supply side conductive path 80A and the voltage (V2) of the second power supply side conductive path 80B is within a predetermined potential difference range. With this configuration, the switch 81 can be restored to the on state when the potential difference between the first power supply side conductive path 80A and the second power supply side conductive path 80B is within the potential difference range (even if the potential differences are not exactly the same), thereby enabling flexible operation of the in-vehicle system 100.

[0043] 1 has an in-vehicle control device 20 that is different from the in-vehicle system 100 in the configuration of a blocking circuit 183A and the operation of a control unit 183, but is otherwise the same as the in-vehicle system 100. The configuration of the in-vehicle system 200 is the same as the configuration of the in-vehicle system 100, and detailed description thereof will be omitted.

[0044] As shown in FIG. 4, the cutoff circuit 183A of the control unit 183 is composed of a hardware circuit including a second comparator C2, a third comparator C3, a fourth comparator C4, an OR circuit Lc, and a drive circuit Dr.

[0045] The second comparator C2 is configured as a known comparator. The second comparator C2 receives the signal V1 and a first ground fault threshold ThG1. The first ground fault threshold ThG1 is set, for example, to a value indicating a voltage smaller than the minimum value of the output voltage when the first power supply unit 90 is in a normal state. The second comparator C2 compares the magnitude of the signal V1 with the first ground fault threshold ThG1. When the signal V1 is smaller than the first ground fault threshold ThG1, the second comparator C2 outputs a ground fault signal Gf1 indicating that the first power supply unit 90 has a ground fault (the conductive path 80 is in an abnormal state).

[0046] The second comparator C2 does not output the ground fault signal Gf1 when the signal V1 is equal to or greater than the first ground fault threshold ThG1. For example, if a ground fault occurs in the first power supply unit 90, the potential (signal V1) of the first power supply side conductive path 80A changes to a magnitude close to the reference potential (ground potential). That is, the second comparator C2 detects that a ground fault in the first power supply unit 90 causes the potential (signal V1) of the first power supply side conductive path 80A to decrease and become smaller than the first ground fault threshold ThG1, which is smaller than the output voltage of the first power supply unit 90 in a normal state. For example, while the second comparator C2 is outputting the ground fault signal Gf1, the second comparator C2 stops outputting the ground fault signal Gf1 when the potential (signal V1) of the first power supply side conductive path 80A becomes equal to or greater than the first ground fault threshold ThG1.

[0047] The third comparator C3 is configured as a known comparator similar to the second comparator C2. The third comparator C3 receives a signal V1 and an overvoltage threshold ThV1. The overvoltage threshold ThV1 is set, for example, to a value indicating a voltage greater than the maximum output voltage when the first power supply unit 90 is in a normal state. The third comparator C3 compares the magnitude of the signal V1 with that of the overvoltage threshold ThV1. When the signal V1 is greater than the overvoltage threshold ThV1, the third comparator C3 outputs an overvoltage signal Ov1 indicating that the first power supply unit 90 is in an overvoltage fault state (the conductive path 80 is in an abnormal state).

[0048] The third comparator C3 does not output the overvoltage signal Ov1 when the signal V1 is equal to or less than the overvoltage threshold ThV1. For example, if the first power supply unit 90 experiences an overvoltage failure, the potential (signal V1) of the first power supply side conductive path 80A changes to a value greater than the maximum output voltage in a normal state. That is, the third comparator C3 detects that the overvoltage failure of the first power supply unit 90 causes the signal V1 to exceed the maximum output voltage in a normal state and thus the overvoltage threshold ThV1. For example, while the third comparator C3 is outputting the overvoltage signal Ov1, if the potential (signal V1) of the first power supply side conductive path 80A falls below the overvoltage threshold ThV1, the third comparator C3 stops outputting the overvoltage signal Ov1.

[0049] Here, the normal state of the first power supply unit 90 refers to a state in which the first power supply unit 90 is free from a ground fault or an overvoltage fault and can output a voltage according to predetermined specifications. The abnormal state of the conductive path 80 refers to a state in which the voltage (signal V1) in the first power supply side conductive path 80A (conductive path 80) is outside the normal range (i.e., is lower than the first ground fault threshold ThG1 or higher than the overvoltage threshold ThV1) due to a ground fault or an overvoltage fault in the first power supply unit 90. One of the recovery conditions for restoring the switch 81 to the on state is satisfied when the voltage (V1) in the first power supply side conductive path 80A is equal to or higher than the first ground fault threshold ThG1 and equal to or lower than the overvoltage threshold ThV1. The recovery voltage range is a predetermined range that is equal to or higher than the first ground fault threshold ThG1 and lower than the overvoltage threshold ThV1.

[0050] The fourth comparator C4 is configured as a known comparator. The fourth comparator C4 receives the signal V2 and a second ground fault threshold ThG2. The second ground fault threshold ThG2 is set to, for example, a value indicating a voltage smaller than the minimum value of the output voltage when the second power supply unit 91 is in a normal state. The second ground fault threshold ThG2 may be the same as or different from the first ground fault threshold ThG1. The fourth comparator C4 compares the magnitude of the signal V2 with the second ground fault threshold ThG2. When the signal V2 is smaller than the second ground fault threshold ThG2, the fourth comparator C4 outputs a ground fault signal Gf2 indicating that the second power supply unit 91 is in a ground fault state (the conductive path 80 is in an abnormal state).

[0051] The fourth comparator C4 does not output the ground fault signal Gf2 when the signal V2 is equal to or greater than the second ground fault threshold ThG2. For example, if a ground fault occurs in the second power supply unit 91, the potential (signal V2) of the second power supply side conductive path 80B changes to a magnitude close to the reference potential (ground potential). In other words, the fourth comparator C4 detects that the ground fault in the second power supply unit 91 causes the signal V2 to decrease and become smaller than the second ground fault threshold ThG2, which is smaller than the minimum value of the output voltage when the second power supply unit 91 is in a normal state. For example, while the fourth comparator C4 is outputting the ground fault signal Gf2, if the potential (signal V2) of the second power supply side conductive path 80B becomes equal to or greater than the second ground fault threshold ThG2, the fourth comparator C4 stops outputting the ground fault signal Gf2.

[0052] One of the conditions for returning the switch 81 to the on state is satisfied when the voltage (V2) of the second power supply side conductive path 80B is equal to or higher than the second ground fault threshold value ThG2. The return voltage range is equal to or higher than the second ground fault threshold value ThG2.

[0053] Here, because the second power supply unit 91 is configured using a single cell such as a lithium-ion battery or a nickel-metal hydride battery, an overvoltage fault is unlikely to occur. Therefore, without a configuration for comparing the signal V2 with an overvoltage threshold, the second power supply unit 91 can be considered to be in a normal state if the signal V2 is equal to the second ground fault threshold ThG2. Here, the normal state of the second power supply unit 91 means that the second power supply unit 91 is not experiencing a ground fault and is capable of outputting a voltage according to the predetermined specifications. The abnormal state of the conductive path 80 means that a ground fault in the second power supply unit 91 causes the voltage (signal V2) on the second power supply side conductive path 80B (conductive path 80) to fall outside the normal range (below the second ground fault threshold ThG2).

[0054] The OR circuit Lc is configured to receive the ground fault signals Gf1, Gf2 and the overvoltage signal Ov1. When at least one of the ground fault signals Gf1, Gf2 and the overvoltage signal Ov1 is input, the OR circuit Lc outputs a shutdown instruction signal Cu. When none of the ground fault signals Gf1, Gf2 and the overvoltage signal Ov1 is input, the OR circuit Lc does not output the shutdown instruction signal Cu. When none of the ground fault signals Gf1, Gf2 and the overvoltage signal Ov1 is input while the OR circuit Lc is outputting the shutdown instruction signal Cu, the OR circuit Lc stops outputting the shutdown instruction signal Cu.

[0055] When the second comparator C2 of the interruption circuit 183A determines that the first power supply unit 90 has a ground fault (the conductive path 80 is in an abnormal state), the second comparator C2 outputs a ground fault signal Gf1 to the OR circuit Lc. When the third comparator C3 of the interruption circuit 183A determines that the first power supply unit 90 has an overvoltage fault (the conductive path 80 is in an abnormal state), the third comparator C3 outputs an overvoltage signal Ov1 to the OR circuit Lc. When the fourth comparator C4 of the interruption circuit 183A determines that the second power supply unit 91 has a ground fault (the conductive path 80 is in an abnormal state), the fourth comparator C4 outputs a ground fault signal Gf2 to the OR circuit Lc.

[0056] When at least one of the ground fault signals Gf1, Gf2 and the overvoltage signal Ov1 is input, the OR circuit Lc outputs a cutoff instruction signal Cu to the drive circuit Dr. When the cutoff instruction signal Cu is input, the drive circuit Dr outputs a cutoff signal Off to the switch 81, switching the switch 81 to the off state.

[0057] The second comparator C2 stops outputting the ground fault signal Gf1 when it determines that the first power supply unit 90 is not in a ground fault state (the conductive path 80 is in an abnormal state). The third comparator C3 stops outputting the overvoltage signal Ov1 when it determines that the first power supply unit 90 is not in an overvoltage fault state (the conductive path 80 is in an abnormal state). The fourth comparator C4 stops outputting the ground fault signal Gf2 when it determines that the second power supply unit 91 is not in a ground fault state (the conductive path 80 is in an abnormal state). The OR circuit Lc stops outputting the cutoff instruction signal Cu to the drive circuit Dr when the ground fault signals Gf1, Gf2, and the overvoltage signal Ov1 are no longer input. When the cutoff instruction signal Cu is no longer input, the drive circuit Dr outputs a conduction signal On to the switch 81, returning the switch 81 to the on state. That is, the restoration condition is met when the voltage (signal V1) of the first power supply side conductive path 80A is within a restoration voltage range that is equal to or greater than the first ground fault threshold value ThG1 and equal to or less than the overvoltage threshold value ThV1, and the voltage (signal V2) of the second power supply side conductive path 80B is within a restoration voltage range that is equal to or greater than the second ground fault threshold value ThG2. When the restoration condition is met, the on-board controller 20 restores the switch 81 to the on state.

[0058] [Example of Operation of the In-Vehicle Control Device] Next, an example of operation of the in-vehicle control device 20 will be described with reference to Fig. 5. For example, when the vehicle equipped with the in-vehicle system 200 is running, the switch 81 is controlled by the control unit 183 to be maintained in an on state. The in-vehicle control device 20 periodically monitors the signals V1 and V2 while the vehicle is running. Periodic monitoring corresponds to, for example, repeatedly executing the flowchart of Fig. 5 at predetermined intervals.

[0059] In step S11, the control unit 183 determines whether the voltage (signal V1) of the first power supply side conductive path 80A and the voltage (signal V2) of the second power supply side conductive path 80B are within the recovery voltage range. If the control unit 183 determines in step S11 that the signals V1 and V2 are within the recovery voltage range (Yes in step S11), the control unit 183 proceeds to step S12 and determines whether the switch 81 is in the OFF state. For example, in step S12, the control unit 183 determines whether the shut-off signal Off is being output from the drive circuit Dr.

[0060] If the control unit 183 determines in step S12 that the switch 81 is not in the OFF state (No in step S12, the switch 81 is in the ON state), it ends the processing shown in Figure 5 and executes the processing shown in Figure 5 again.

[0061] If the control unit 183 determines in step S12 that the switch 81 is in the OFF state (Yes in step S12), the control unit 183 proceeds to step S13. Then, the control unit 183 switches the output from the drive circuit Dr from the blocking signal Off to the conducting signal On, thereby returning the OFF-state switch 81 to the ON state. Then, the control unit 183 ends the processing shown in FIG. 5 and executes the processing shown in FIG. 5 again.

[0062] If the control unit 183 determines in step S11 that the voltage (signal V1) of the first power supply side conductive path 80A and the voltage (signal V2) of the second power supply side conductive path 80B are outside the recovery voltage range (No in step S11), the control unit 183 proceeds to step S14. Then, the control unit 183 switches the output from the drive circuit Dr from a conduction signal On to a cutoff signal Off, thereby switching the switch 81 from an on state to an off state. Then, the control unit 183 ends the processing shown in FIG. 5 and executes the processing shown in FIG. 5 again.

[0063] The abnormal state is a state in which the voltage in the conductive path 80 is outside the normal range. According to this configuration, by using the voltage in the conductive path 80, the determination operation in the control unit 183 can be easily performed in a shorter time.

[0064] The electrical path between the first power supply unit 90 and the switch 81 in the conductive path 80 is the first power supply side conductive path 80A, and the electrical path between the second power supply unit 91 and the switch 81 in the conductive path 80 is the second power supply side conductive path 80B. The restoration condition is met when the voltage (signal V1) of the first power supply side conductive path 80A and the voltage (signal V2) of the second power supply side conductive path 80B are within a predetermined restoration voltage range. With this configuration, the switch 81 can be restored to the on state when the voltage (signal V1) of the first power supply side conductive path 80A and the voltage (signal V2) of the second power supply side conductive path 80B are within the restoration voltage range, thereby enabling flexible operation of the in-vehicle system 200.

[0065] 1 has an in-vehicle control device 30 that is different from that of the first embodiment in the operation of the control unit 83. The configuration of the in-vehicle system 300 is the same as that of the in-vehicle system 100, and detailed description thereof will be omitted.

[0066] [Example of Operation of the In-Vehicle Control Device] An example of operation of the in-vehicle control device 30 will be described with reference to Fig. 6. For example, when a vehicle equipped with the in-vehicle system 300 is running, the switch 81 is controlled by the control unit 83 to be maintained in an on state. The in-vehicle control device 30 periodically monitors the potential (signal V1) of the first power supply side conductive path 80A and the potential (signal V2) of the second power supply side conductive path 80B while the vehicle is running. Periodic monitoring corresponds to repeatedly executing the flowchart of Fig. 6 at predetermined intervals.

[0067] In step S21, if the shutdown signal Off is not output from the shutdown circuit 83A (No in step S21), the process shown in FIG. 6 is ended, and the process shown in FIG. 6 is executed again.

[0068] In step S21, if the shutdown signal Off is output from the shutdown circuit 83A (Yes in step S21), the process proceeds to step S22. The shutdown circuit 83A then switches the switch 81 from the ON state to the OFF state. In step S23, the control unit 83 determines whether a predetermined return time has elapsed. For example, the control unit 83 has a timer function, and starts measuring the return time when the shutdown signal Off is output from the shutdown circuit 83A as a trigger. If the control unit 83 determines in step S23 that the predetermined return time has elapsed, the process proceeds to step S24, where the control unit 83 returns the switch 81 from the OFF state to the ON state. In other words, the return condition for returning the switch 81 to the ON state is a condition that is met when a predetermined return time has elapsed since the control unit 83 switched the switch 81 to the OFF state. In this manner, the control unit 83 terminates the process shown in FIG. 6 .

[0069] 6 , the switch 81 is returned to the ON state regardless of whether the potential difference between the first power supply unit 90 and the second power supply unit 91 falls outside the potential difference range (the conductive path 80 is in an abnormal state). For this reason, assuming that the first power supply unit 90 or the second power supply unit 91 actually fails and the conductive path 80 falls into an abnormal state, the number of times the switch 81 switches from the OFF state to the ON state is counted. It is preferable to add control such that the switch 81 remains in the OFF state when this number of times reaches a predetermined number.

[0070] The recovery condition is a condition that is met when a predetermined recovery time has elapsed since the control unit 83 switched the switch 81 to the off state. According to this configuration, the operation of the in-vehicle system 300 can be recovered by a simple control of returning the switch 81 to the on state when the recovery time has elapsed.

[0071] 7 is different from the first embodiment in that it has a recovery instruction unit 83C, the configuration of a cutoff circuit 283A, and the operation of a control unit 283, but is otherwise common to the first embodiment. In the following description, detailed description of the same configuration as the in-vehicle system 100 of the first embodiment will be omitted.

[0072] As shown in FIG. 7, the control unit 283 of the on-board control device 40 includes a recovery instruction unit 83C and a shutoff circuit 283A.

[0073] The restoration instruction unit 83C is configured, for example, by an MCU (Micro Controller Unit). The restoration instruction unit 83C is configured to output a restoration instruction signal Re to the cutoff circuit 283A when it determines that a restoration condition is met. The restoration condition is a condition for restoring the switch 81 from an OFF state to an ON state. The restoration condition is met every time a second time period, which is shorter than the first time period, elapses during a first time period from when the control unit 283 switches the switch 81 to the OFF state. The first time period is a time period determined starting from when an out-of-range signal Or1 is input from the cutoff circuit 283A while the vehicle equipped with the in-vehicle system 400 is traveling. The second time period corresponds to a period during which the restoration instruction unit 83C periodically executes a process for determining whether the first power supply unit 90 and the second power supply unit 91 are in an abnormal state.

[0074] The cutoff circuit 283A is configured by a hardware circuit including a subtraction circuit S, a comparator C1, and a latch circuit La, for example, as shown in FIG.

[0075] The out-of-range signal Or1 and the return instruction signal Re are input to the latch circuit La. When the vehicle equipped with the in-vehicle system 400 is running, the latch circuit La outputs a conduction signal On to the switch 81 to turn it on. When the vehicle equipped with the in-vehicle system 400 is running and the out-of-range signal Or1 is input from the comparator C1, the latch circuit La outputs a cut-off signal Off to the switch 81.

[0076] Once the latch circuit La outputs the disconnection signal Off while the vehicle is running, it continues to output the disconnection signal Off regardless of whether the out-of-range signal Or1 is input. In other words, once the disconnection circuit 283A of the control unit 283 determines that the potential difference between the first power supply unit 90 and the second power supply unit 91 is outside the potential difference range (the conductive path 80 is in an abnormal state), it switches the switch 81 to the off state and maintains the switch 81 in the off state. The switch 81 is switched to the off state by the disconnection signal Off. If the latch circuit La receives a restoration instruction signal Re from the restoration instruction unit 83C while outputting the disconnection signal Off, it outputs a conduction signal On to the switch 81 instead of the disconnection signal Off. The switch 81 in the off state returns to the on state when the conduction signal On is input. In this way, the latch circuit La of the disconnection circuit 83A restores the switch 81 to the on state upon receiving the restoration instruction signal Re.

[0077] [Example of Operation of the In-Vehicle Control Device] Next, an example of operation of the in-vehicle control device 40 will be described with reference to Fig. 9. For example, when the vehicle equipped with the in-vehicle system 400 is running, the control unit 283 controls the switch 81 to be maintained in the on state. The in-vehicle control device 40 periodically monitors the signals V1 and V2 while the vehicle is running. Periodic monitoring corresponds to, for example, repeatedly executing the flowchart of Fig. 9 at predetermined intervals.

[0078] In step S31, if the shutdown signal Off is not output from the shutdown circuit 283A (No in step S31), the control unit 283 ends the process shown in Fig. 9 and executes the process shown in Fig. 9 again. Here, the time required from the end of the process shown in Fig. 9 until the process shown in Fig. 9 is executed again is the second time.

[0079] In step S31, if the shutdown signal Off is being output from the shutdown circuit 283A (Yes in step S31), the process proceeds to step S32. Then, the shutdown circuit 283A switches the switch 81 from the ON state to the OFF state. In other words, the shutdown circuit 283A switches the switch 81 to the OFF state when the vehicle is running and the switch 81 is in the ON state. In step S31, it is only determined whether the shutdown signal Off is being output from the shutdown circuit 283A, and it is not determined whether the shutdown circuit 283A is malfunctioning due to external noise. Therefore, it is possible that the shutdown signal Off will be output from the shutdown circuit 283A due to external noise, and the process proceeds to step S32.

[0080] Next, the process proceeds to step S33, where the restoration instruction unit 83C increments a counter included in the restoration instruction unit 83C by 1. For example, the counter is configured as part of a RAM included in the restoration instruction unit 83C, and is preset to 0.

[0081] Next, in step S34, the restoration instruction unit 83C determines whether the first time has elapsed and whether the counter has reached a predetermined value. Step S34 is a step for eliminating the possibility that the shutoff circuit 283A has malfunctioned due to external noise. For example, the restoration instruction unit 83C is configured to receive an out-of-range signal Or1 (see FIG. 8 ), and the input of the out-of-range signal Or1 triggers the start of measurement of the first time. For example, the first time may be measured using a timer function possessed by the restoration instruction unit 83C. The first time is a time longer than the second time required to repeatedly execute the process shown in FIG. 9 . For example, the first time may be set to a length that allows the process shown in FIG. 9 to be executed multiple times before the first time elapses. The predetermined value to be compared with the counter value is, for example, stored as a constant in a memory or the like possessed by the restoration instruction unit 83C.

[0082] If the restoration instruction unit 83C determines in step S34 that the first time has elapsed or that the counter has not reached the predetermined value (No in step S34), the process proceeds to step S37. The control unit 283 then restores the switch 81, which is currently in the OFF state, to the ON state. Specifically, when the switch 81 is in the OFF state, the restoration instruction unit 83C outputs a restoration instruction signal Re to the interruption circuit 283A. This causes the interruption circuit 283A to output a conduction signal On to the switch 81, restoring the switch 81 to the ON state. The control unit 283 then terminates the process shown in FIG. 9 and executes the process shown in FIG. 9 again. For example, the control unit 283 executes the process shown in FIG. 9 every time the second time elapses until the first time elapses, thereby restoring the switch 81 to the ON state.

[0083] A No in step S34 means that the first time has elapsed and therefore it has been determined that the potential difference between the first power supply unit 90 and the second power supply unit 91 is within the potential difference range. Therefore, when the No in step S34 is reached after the first time has elapsed, measurement of the first time using the timer function of the recovery instruction unit 83C is terminated. Furthermore, a No in step S34 means that the counter has not yet reached a predetermined value, so the switch 81, which is in the OFF state, is returned to the ON state and it is again determined whether the cutoff circuit 283A will output the cutoff signal Off.

[0084] In step S34, if the restoration instruction unit 83C determines that the first time period has not elapsed and the counter has reached a predetermined value (Yes in step S34), the process proceeds to step S35. The restoration instruction unit 83C then determines that the potential difference between the first power supply unit 90 and the second power supply unit 91 has fallen outside the potential difference range (the conductive path 80 is in an abnormal state). The process then proceeds to step S36, in which the interrupter circuit 283A maintains the switch 81 in the OFF state. The control unit 283 then ends the process shown in FIG. 9.

[0085] A Yes in step S34 means that the interrupter circuit 283A did not malfunction due to external noise, but rather that the first power supply unit 90 or the second power supply unit 91 has failed, causing the potential difference between the first power supply unit 90 and the second power supply unit 91 to fall outside the potential difference range (the conductive path 80 is in an abnormal state). Thus, if the potential difference between the first power supply unit 90 and the second power supply unit 91 falls outside the potential difference range (the conductive path 80 is in an abnormal state) while the switch 81 is in the on state, the control unit 283 switches the switch 81 to the off state in step S32. The control unit 283 then maintains this state.

[0086] The restoration condition is a condition that is met every time a second time shorter than the first time elapses during the first time period from when the control unit 283 switched the switch 81 to the OFF state in step S32 (every time the process shown in FIG. 9 is executed). In other words, the control unit 283 switches the switch 81 to the OFF state in step S32 when the vehicle is running and the switch 81 is in the ON state. Thereafter, the control unit 283 restores the switch 81 to the ON state every time the process shown in FIG. 9 is executed (i.e., when the restoration condition is met).

[0087] The restoration condition is a condition that is met every time a second time shorter than the first time elapses during the first time period from when the control unit 283 switches the switch 81 to the off state. The control unit 283 restores the switch 81 to the on state every time the second time elapses before the first time period elapses. With this configuration, the control unit 283 restores the switch 81 to the on state every time the second time elapses during the first time period, thereby making it possible to recover from malfunctions of the control unit 283 caused by noise.

[0088] 10 differs from the first embodiment in that it has a temperature detection unit 93A, the configuration of a cutoff circuit 383A, and the operation of the control unit 383 of the in-vehicle control device 50, but is otherwise common to the first embodiment. In the following description, detailed description of the same configuration as the in-vehicle system 100 of the first embodiment will be omitted.

[0089] The temperature detection unit 93A may be, for example, a thermistor or a resistance temperature detector. The temperature detection unit 93A is configured to output a temperature signal indicating the temperature around the location where the temperature detection unit 93A is installed. The temperature detection unit 93A is disposed near the switch 81. The temperature detection unit 93A outputs a signal T1 (hereinafter simply referred to as signal T1) that can identify the temperature of the switch 81.

[0090] As shown in FIG. 11 , the shutoff circuit 383A is configured, for example, as a hardware circuit including a fifth comparator C5 and a drive circuit Dr. The fifth comparator C5 is configured as a known comparator. The fifth comparator C5 receives a signal T1 and a temperature threshold ThT. For example, the temperature threshold ThT is set to a predetermined value corresponding to a temperature higher than the temperature that would be reached if the maximum possible current were to flow when the switch 81 is in the on state. The fifth comparator C5 compares the magnitude of the signal T1 with the temperature threshold ThT. If the signal T1 is greater than the temperature threshold ThT, the fifth comparator C5 outputs an overheat signal Oh indicating that the switch 81 has exceeded the possible temperature and is in an overheated state (the conductive path 80 is in an abnormal state).

[0091] The fifth comparator C5 does not output the overheat signal Oh when the signal T1 is equal to or lower than the temperature threshold value ThT. For example, if the first power supply unit 90 experiences a ground fault, a large current flows into the first power supply unit 90 via the switch 81. Also, if the second power supply unit 91 experiences a ground fault, a large current flows into the second power supply unit 91 via the switch 81. In other words, the fifth comparator C5 detects that a ground fault in the first power supply unit 90 or the second power supply unit 91 has caused a large current to flow through the switch 81, causing the switch 81 to become overheated (the conduction path 80 to enter an abnormal state).

[0092] An overheat signal Oh is input to the drive circuit Dr. When the vehicle equipped with the in-vehicle system 500 is running, the drive circuit Dr outputs a conduction signal On to the switch 81 to turn the switch 81 on. When the overheat signal Oh is input from the fifth comparator C5 while the vehicle equipped with the in-vehicle system 500 is running, the drive circuit Dr outputs a shutdown signal Off to the switch 81. In this way, when the shutdown circuit 383A determines that the switch 81 is in an overheated state (abnormal state) exceeding an expected temperature, it can control the switch 81 to switch off. In other words, the recovery condition for returning the switch 81 to the on state is met when the temperature (signal T1) of the switch 81 is within the recovery temperature range (less than or equal to the temperature threshold ThT), and when the recovery condition is met, the switch 81 is returned to the on state.

[0093] [Example of Operation of In-Vehicle Control Device] An example of operation of the in-vehicle control device 50 will be described with reference to Fig. 12. For example, when a vehicle equipped with the in-vehicle system 500 is running, the control unit 383 controls the switch 81 to be maintained in an on state. The in-vehicle control device 50 periodically monitors the temperature of the switch 81 while the vehicle is running. Periodic monitoring corresponds to repeatedly executing the flowchart of Fig. 12 at predetermined intervals.

[0094] In step S41, it is determined whether the temperature (signal T1) of the switch 81 is within the recovery temperature range (less than or equal to the temperature threshold ThT). If it is determined in step S41 that the temperature (signal T1) of the switch 81 is within the recovery temperature range (less than or equal to the temperature threshold ThT) (Yes in step S41), the process proceeds to step S42, where it is determined whether the switch 81 is in the OFF state. For example, in step S42, it is determined whether the shut-off signal Off is being output from the drive circuit Dr.

[0095] If it is determined in step S42 that the switch 81 is not in the OFF state (No in step S42, the switch 81 is in the ON state), the control unit 383 ends the process shown in FIG. 12 and executes the process shown in FIG. 12 again.

[0096] If it is determined in step S42 that the switch 81 is in the OFF state (Yes in step S42), the control unit 383 proceeds to step S43. Then, the control unit 383 switches the output from the drive circuit Dr from the blocking signal Off to the conducting signal On, thereby returning the OFF-state switch 81 to the ON state. Then, the control unit 383 ends the process shown in FIG. 12 and executes the process shown in FIG. 12 again.

[0097] If it is determined in step S41 that the temperature (signal T1) of the switch 81 is outside the recovery temperature range (greater than the temperature threshold value ThT) (No in step S41), the process proceeds to step S44. Then, the control unit 383 switches the output from the drive circuit Dr from the conduction signal On to the cutoff signal Off, thereby switching the switch 81 from the ON state to the OFF state. Then, the control unit 383 ends the process shown in FIG. 12 and executes the process shown in FIG. 12 again.

[0098] The condition for returning the switch 81 to the on state is met when the temperature (signal T1) of the switch 81 is equal to or lower than a predetermined temperature threshold value ThT. The control unit 383 returns the switch 81 to the on state when the temperature (signal T1) of the switch 81 is equal to or lower than the temperature threshold value ThT. With this configuration, the switch 81 is returned to the on state based on the temperature (signal T1) of the switch 81, which makes it easier to control the return of the switch 81 to the on state compared to when voltage is detected.

[0099] <Other Embodiments> The embodiments disclosed herein should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is not limited to the embodiments disclosed herein, but is defined by the claims, and is intended to include all modifications within the meaning and scope of the claims.

[0100] Unlike the first embodiment, the first potential detection unit may be replaced with a first current detection unit, and the second potential detection unit may be replaced with a second current detection unit. For example, the first current detection unit outputs a first current signal that can identify the direction and magnitude of the current flowing through the first power supply side conductive path. The second current detection unit outputs a second current signal that can identify the direction and magnitude of the current flowing through the second power supply side conductive path. The first current detection unit and the second current detection unit may be configured as known current detection circuits using, for example, a current transformer or a shunt resistor.

[0101] For example, the interruption circuit switches the switch to the OFF state when it determines that the direction of the current indicated by the first current signal is toward the first power supply unit or that the magnitude of the current indicated by the first current signal is greater than a current threshold, indicating an abnormal state. The interruption circuit switches the switch to the OFF state when it determines that the direction of the current indicated by the second current signal is toward the second power supply unit or that the magnitude of the current indicated by the second current signal is greater than a current threshold, indicating an abnormal state. The interruption circuit switches the switch to the ON state when the direction of the current indicated by the first current signal is not toward the first power supply unit and the magnitude of the current indicated by the first current signal is equal to or less than the current threshold, and the direction of the current indicated by the second current signal is not toward the second power supply unit and the magnitude of the current indicated by the second current signal is equal to or less than the current threshold.

[0102] Unlike the fourth embodiment, the restoration instruction unit may be configured by a plurality of hardware circuits other than the MCU. Also, the shutdown circuit and the restoration instruction unit may be configured by a single MCU.

[0103] Unlike the above embodiments, a configuration may be adopted in which one FET is used as a switch.

[0104] Unlike the first embodiment, the difference threshold used when determining whether to switch the switch to the OFF state may be set to different magnitudes from the difference threshold used when determining whether to return the switch to the ON state. Also, unlike the second embodiment, the first ground fault threshold, the overvoltage threshold, and the second ground fault threshold may be set to different magnitudes when determining whether to switch the switch to the OFF state and when determining whether to return the switch to the ON state.

[0105] 10, 20, 30, 40, 50: In-vehicle control device 70: First load 71: Second load 80: Conduction path 80A: First power supply side conduction path 80B: Second power supply side conduction path 81: Switch 83, 183, 283, 383: Control unit 83A, 183A, 283A, 383A: Breaking circuit 83C: Recovery instruction unit 87A: First potential detection unit 87B: Second potential detection unit 90: First power supply unit 91: Second power supply unit 93A: Temperature detection unit 100, 200, 300, 400, 500: In-vehicle system T1, V1, V2: Signal C1: Comparator C2: Second comparator C3: Third comparator C4: Fourth comparator C5 : Fifth comparator Cu: Shutdown instruction signal Di: Differential signal Dr: Drive circuit Gf1, Gf2: Ground fault signal La: Latch circuit Lc: OR circuit Off: Shutdown signal Oh: Overheat signal On: Conduction signal Or1: Out-of-range signal Ov1: Overvoltage signal Re: Recovery instruction signal S: Subtraction circuit ThG1: First ground fault threshold ThG2: Second ground fault threshold ThP: Differential threshold ThT: Temperature threshold ThV1: Overvoltage threshold

Claims

1. An in-vehicle control device included in an in-vehicle system comprising: a first power supply unit; a second power supply unit; a conductive path provided between the first power supply unit and the second power supply unit; a switch provided in the conductive path; a first load connected to the conductive path on the first power supply unit side of the switch; and a second load connected to the conductive path on the second power supply unit side of the switch, the in-vehicle control device having a control unit that controls the switch, wherein the control unit switches the switch to an off state when it detects that the conductive path is in an abnormal state while the switch is in an on state, and returns the switch to an on state when a return condition is met.

2. The vehicle-mounted control device according to claim 1, wherein the abnormal state is a state in which the voltage in the conductive path is outside a normal range.

3. The in-vehicle control device according to claim 1, wherein the electrical path between the first power supply unit and the switch among the conductive paths is a first power supply side conductive path, the electrical path between the second power supply unit and the switch among the conductive paths is a second power supply side conductive path, and the recovery condition is a condition that is met when the potential difference between the voltage of the first power supply side conductive path and the voltage of the second power supply side conductive path is within a predetermined potential difference range.

4. The in-vehicle control device according to claim 2, wherein the electrical path between the first power supply unit and the switch among the conductive paths is a first power supply side conductive path, the electrical path between the second power supply unit and the switch among the conductive paths is a second power supply side conductive path, and the recovery condition is a condition that is met when the voltage of the first power supply side conductive path and the voltage of the second power supply side conductive path are within a predetermined recovery voltage range.

5. The vehicle control device according to claim 1, wherein the recovery condition is a condition that is met when a predetermined recovery time has elapsed since the control unit switched the switch to the off state.

6. The in-vehicle control device according to claim 1, wherein the restoration condition is a condition that is met every time a second time shorter than the first time elapses during a first time period from when the control unit switches the switch to the off state, and the control unit restores the switch to the on state every time the second time elapses until the first time elapses.

Images