Vehicle-mounted power supply control system, and switch control method

Abstract

This vehicle-mounted power supply control system, which is mounted in a vehicle, comprises a plurality of first control switches, a signal generating unit that generates a first control signal for turning on each of the first control switches, and an input unit that receives, from outside the vehicle-mounted power supply control system, a second control signal for turning on each of the first control switches, wherein: each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generating unit and the second control signal received by the input unit; and the vehicle-mounted power supply control system further comprises a plurality of first measuring units that are provided for each of the first control switches and that perform measurement related to the first control switches, and a first control unit that, on the basis of the measurement results from the first measurement units, turns off the corresponding first control switch regardless of the OR condition.

Description

In-vehicle power supply control system and switch control method

[0001] This application claims priority from Japanese Patent Application No. 2024-121045 filed on July 26, 2025, and Japanese Patent Application No. 2025-48389 filed on March 24, 2025, the disclosures of which are incorporated herein in their entirety by reference.

[0002] Patent Document 1 (JP 2011-195101 A) discloses the following control device: That is, the control device is connected to a relay switch to which one or more loads are connected, receives as input an instruction signal instructing the on / off of the load and a status signal corresponding to the status of the load, and controls the relay switch based on the input signals. The control device includes a plurality of control units that output control signals for controlling the on / off of the relay switch, and the instruction signal and status signal, a forced-off signal instructing the relay switch to be forced off, and a signal indicating the on / off status of the relay switch are input to one of the plurality of control units, and some or all of the signal input to the one control unit and the control signal output by the one control unit are input to the other control units.

[0003] JP 2011-195101 A

[0004] The automotive power supply control system of the present disclosure is an automotive power supply control system mounted on a vehicle, and includes a plurality of first control switches that switch on and off the supply of power to automotive equipment in the vehicle, a signal generation unit that generates a first control signal for turning on each of the first control switches, and an input unit that receives a second control signal for turning on each of the first control switches from outside the automotive power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generation unit and the second control signal received by the input unit, and the automotive power supply control system further includes a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switches, and a first control unit that turns off the corresponding first control switch based on the measurement results of the first measurement units regardless of the OR condition.

[0005] One aspect of the present disclosure can be realized not only as an in-vehicle power supply control system including such a characteristic processing unit, but also as a semiconductor integrated circuit that realizes part or all of the in-vehicle power supply control system.

[0006] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle power supply control system according to an embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 3 is a diagram illustrating in detail the configuration of a portion of the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 4 is a diagram illustrating an example of the configuration of a first monitoring unit in the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 5 is a diagram illustrating in detail the configuration of a portion of the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 6 is a diagram illustrating an example of the configuration of a third monitoring unit in the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 7 is a diagram illustrating ON control of a first switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 8 is a diagram illustrating ON control of a power switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 9 is a diagram illustrating an example of the configuration of an in-vehicle device according to an embodiment of the present disclosure. FIG. 10 is a diagram illustrating an example of OFF control of a first switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 11 is a diagram illustrating another example of OFF control of a power switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 12 is a diagram illustrating in detail the configuration of a portion of an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 13 is a diagram illustrating an example of the configuration of a second monitoring unit in an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 14 is a diagram illustrating on-control of a second switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 15 is a diagram illustrating off-control of a second switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 16 is a diagram illustrating another example of off-control of a first switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 17 is a diagram illustrating another example of off-control of a second switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 18 is a diagram illustrating another example of off-control of a power switch by an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 19 is a flowchart illustrating an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 20 is a flowchart illustrating an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch.FIG. 21 is a flowchart defining an example of an operational procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 22 is a flowchart defining another example of an operational procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 23 is a flowchart defining an example of an operational procedure when an in-vehicle relay device according to an embodiment of the present disclosure performs measurement processing. FIG. 24 is a flowchart defining an example of an operational procedure when an in-vehicle relay device according to an embodiment of the present disclosure performs measurement processing. FIG. 25 is a diagram illustrating an example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 26 is a diagram illustrating an example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 27 is a diagram illustrating another example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 28 is a diagram illustrating another example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure.

[0007] 2. Description of the Related Art Conventionally, techniques have been developed for controlling a switch that switches on and off the supply of power to an in-vehicle device.

[0008] [Problem to be Solved by the Present Disclosure] For example, if an abnormality occurs in the device that controls the switch, the power supply to the in-vehicle device may be stopped, which may limit or stop the functions executed by the in-vehicle device.

[0009] Furthermore, if an abnormality such as a short to power, a short to ground, or a break occurs in the on-board device, the power supply source to the on-board device, or the wire harness connected to the on-board device, it is necessary to quickly turn off the switch to suppress the effects of the abnormality.There is a need for technology that can suppress the restriction or suspension of functions executed by the on-board device and can suppress the effects of the abnormality when an abnormality occurs in the vehicle.

[0010] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle power supply control system and a switch control method that can suppress the restriction or suspension of functions executed by in-vehicle equipment and suppress the effects of abnormalities.

[0011] Effect of the Present Disclosure According to the present disclosure, it is possible to suppress the restriction or suspension of functions executed by in-vehicle devices and to suppress the influence of abnormalities.

[0012] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An onboard power supply control system according to an embodiment of the present disclosure is an onboard power supply control system mounted on a vehicle, comprising: a plurality of first control switches that switch on and off power supply to onboard devices in the vehicle; a signal generation unit that generates first control signals for turning on each of the first control switches; and an input unit that receives second control signals for turning on each of the first control switches from an external device of the onboard power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signals generated by the signal generation unit and the second control signals received by the input unit, and the onboard power supply control system further comprises: a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switches; and a first control unit that turns off the corresponding first control switch based on the measurement results of the first measurement units regardless of the OR condition.

[0013] In this way, by configuring the in-vehicle power supply control system to turn on the first control switch based on an OR condition of the generated first control signal and the second control signal input from outside the system, even if an abnormality occurs and the first control signal cannot be generated, the first control switch can be turned on by the second control signal. In other words, the control for turning on the first control switch is made redundant, thereby reducing the possibility of power supply to a specific in-vehicle device being stopped.

[0014] Furthermore, by configuring the first control switch to be turned off depending on the measurement result for the first control switch, regardless of the above OR condition, for example, if the measurement result indicates the occurrence of an abnormality, the first control switch corresponding to the measurement result can be forcibly turned off, thereby suppressing the effects of the abnormality.

[0015] (2) In the above (1), the in-vehicle power supply control system may further include a second control switch that is turned on and off by a third control signal and a fourth control signal generated by the signal generating unit, respectively; a second measuring unit that is provided corresponding to the second control switch and performs measurements related to the second control switch; and a second control unit that turns off the second control switch based on the measurement results of the second measuring unit, regardless of the third control signal and the fourth control signal.

[0016] With this configuration, if the measurement results for a second control switch different from the first control switch indicate the occurrence of an abnormality, the second control switch can be forcibly turned off. Therefore, in a configuration having multiple switches whose on and off conditions differ from one another, the effects of abnormalities can be reliably suppressed.

[0017] (3) In the above (1) or (2), the signal generating unit may generate the first control signal using a condition different from a condition under which the second control signal is generated.

[0018] With this configuration, the control for turning on the first control switch can be made redundant.

[0019] (4) In any of (1) to (3) above, the vehicle power supply control system may further include a judgment unit that judges the state of the vehicle, and the signal generation unit may generate the first control signal based on the state judged by the judgment unit, and the second control signal may be generated using a judgment criterion different from the judgment criterion for the state used to generate the first control signal by the signal generation unit.

[0020] With this configuration, the first control switch can be turned on in various vehicle states, so that power can be supplied to specific in-vehicle devices more reliably.

[0021] (5) In (4) above, the judgment criteria used to generate the second control signal may include judgment criteria regarding the state of the parking brake of the vehicle, and the judgment criteria used to generate the first control signal may not include judgment criteria regarding the state of the parking brake.

[0022] With this configuration, for example, a control signal for turning on the first control switch can be output from outside the in-vehicle device depending on whether the parking brake is on or not, i.e., whether the vehicle is stopped or parked, and power can be supplied to a specific in-vehicle device. Also, in the in-vehicle device, control for turning on the first control switch can be made redundant regardless of the state of the parking brake.

[0023] (6) In any of (1) to (5) above, the signal generating unit may further generate a fifth control signal for turning off each of the first control switches, the input unit may further receive a sixth control signal for turning off each of the first control switches from outside the automotive power supply control system, and the signal generating unit may generate the sixth control signal using conditions different from the conditions for generating the fifth control signal.

[0024] With this configuration, even if an abnormality occurs in the signal generating unit, for example, the switch can be turned off by a control signal output from outside the vehicle power supply control system, thereby making the control for turning off the switch redundant.

[0025] (7) A switch control method according to an embodiment of the present disclosure is a switch control method in an in-vehicle power supply control system mounted on a vehicle, the in-vehicle power supply control system including a plurality of first control switches that switch on / off the supply of power to a first in-vehicle device in the vehicle, and a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switches, and includes the steps of generating a first control signal for turning on each of the first control switches, receiving a second control signal for turning on each of the first control switches from outside the in-vehicle power supply control system, turning on each of the first control switches based on an OR condition of the generated first control signal and the second control signal, and turning off the corresponding first control switch based on the measurement result of the first measurement unit, regardless of the OR condition.

[0026] In this way, by configuring the in-vehicle power supply control system to turn on the first control switch based on an OR condition of the generated first control signal and the second control signal input from outside the system, even if an abnormality occurs and the first control signal cannot be generated, the first control switch can be turned on by the second control signal. In other words, the control for turning on the first control switch is made redundant, thereby reducing the possibility of power supply to a specific in-vehicle device being stopped.

[0027] Furthermore, by configuring the first control switch to be turned off depending on the measurement result for the first control switch, regardless of the above OR condition, for example, if the measurement result indicates the occurrence of an abnormality, the first control switch corresponding to the measurement result can be forcibly turned off, thereby suppressing the effects of the abnormality.

[0028] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0029] [In-Vehicle System] Fig. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to Fig. 1, the in-vehicle system 301 includes an in-vehicle relay device 101, an in-vehicle device group including a plurality of in-vehicle devices 201, and a power supply unit 10. The in-vehicle system 301 is mounted on a vehicle 1.

[0030] The in-vehicle devices 201 include an in-vehicle ECU (Electronic Control Unit), an OTA (Over The Air) master, sensors, actuators, motors, a navigation device, a human-machine interface, and a camera. The in-vehicle ECUs include an autonomous driving ECU, an engine ECU, a body ECU, a verification ECU, a steering ECU, a parking brake ECU, and a TCU (Telematics Communication Unit).

[0031] The in-vehicle relay device 101 and the plurality of in-vehicle devices 201 constitute an in-vehicle network 401. The plurality of in-vehicle devices 201 are connected to the in-vehicle relay device 101 via, for example, a CAN bus 2 conforming to the CAN (Controller Area Network) standard and a connector (not shown).

[0032] 1, in-vehicle system 301 includes in-vehicle devices 201A, 201B, 201C, 201D, 201E, 201F, 201G, 201H, and 201J that are in-vehicle device 201. Also, in the example shown in Fig. 1, CAN buses 2A, 2B, 2C, and 2D are provided as CAN bus 2.

[0033] In-vehicle devices 201A, 201B, and 201C are connected to the in-vehicle relay device 101 via a CAN bus 2A. In-vehicle devices 201D and 201E are connected to the in-vehicle relay device 101 via a CAN bus 2B. In-vehicle devices 201F and 201G are connected to the in-vehicle relay device 101 via a CAN bus 2C. In-vehicle devices 201H and 201J are connected to the in-vehicle relay device 101 via a CAN bus 2D.

[0034] The in-vehicle relay device 101 performs a relay process for relaying frames transmitted and received between the in-vehicle devices 201 .

[0035] For example, each in-vehicle device 201 transmits a CAN frame including various information (described later) such as information for assisting the autonomous driving performed by the vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, to another in-vehicle device 201 or the in-vehicle relay device 101. The in-vehicle relay device 101 relays a CAN frame received from one in-vehicle device 201 to another in-vehicle device 201. The in-vehicle relay device 101 also creates a CAN frame including the various information and the CAN-ID, and transmits the created CAN frame to the destination in-vehicle device 201.

[0036] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 2 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 2 are provided.

[0037] Furthermore, the on-board relay device 101 and the on-board device 201 may be configured to communicate in accordance with a communication protocol such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark), instead of or in addition to communication in accordance with the CAN standard.

[0038] The vehicle relay device 101 and each vehicle device 201 communicate with each other to provide various services in the vehicle 1 .

[0039] Specifically, the in-vehicle network 401 provides services related to the operation of the vehicle 1, a service for updating various software used in the in-vehicle network 401 via OTA, a service for contactlessly charging the battery 61a installed in the vehicle 1, a service for detecting malfunctions in the vehicle 1, and a service for remotely operating the vehicle 1.

[0040] [Power Supply Unit] The power supply unit 10 supplies power to the vehicle 1. The power supply unit 10 includes a first power supply 61 and a second power supply 62. When a service is being executed, both the first power supply 61 and the second power supply 62 supply power to each device in the in-vehicle system 301. When the execution of the service is stopped, the second power supply 62 supplies power to each device in the in-vehicle system 301.

[0041] The first power source 61 is connected to the on-board relay device 101 via a power line 3. The second power source 62 is connected to the on-board relay device 101 via a power line 4. Each on-board device 201 is connected to the on-board relay device 101 via a power line 5. The power line 3 and the power line 5 are connected within the on-board relay device 101. The power line 4 and the power line 5 are connected within the on-board relay device 101.

[0042] 1, power lines 5A, 5B, 5C, and 5D are provided as the power line 5. The on-board devices 201A, 201B, and 201C are connected to the on-board relay device 101 via the power line 5A. The on-board devices 201D and 201E are connected to the on-board relay device 101 via the power line 5B. The on-board devices 201F and 201G are connected to the on-board relay device 101 via the power line 5C. The on-board devices 201H and 201J are connected to the on-board relay device 101 via the power line 5D.

[0043] For example, the first power supply 61 includes a battery 61 a and a DC / DC converter 61 b. The battery 61 a is a high-voltage battery such as a lithium-ion battery. The DC / DC converter 61 b, for example, steps down a DC voltage Va of the battery 61 a to generate a DC voltage Vb. The DC / DC converter 61 b ​​then outputs the DC voltage Vb to the power supply line 3.

[0044] The second power supply 62 includes, for example, a low-voltage battery having a lower voltage than the battery 61 a of the first power supply 61 .

[0045] [Driving-Related Devices] For example, the in-vehicle devices 201F, 201G, and 201J are in-vehicle devices 201 (hereinafter also referred to as "driving-related devices") that execute functions (hereinafter also referred to as "driving-related functions") related to driving of the vehicle 1. Specifically, the driving-related devices include an EPS (Electric Power Steering) ECU, a steering ECU, an autonomous driving ECU, a foot brake ECU, an ABS (Anti-lock Braking System) ECU, and a parking brake ECU.

[0046] 1, a plurality of driving-related devices are provided in the vehicle 1. Specifically, the driving-related devices are in-vehicle devices 201F, 201G, and 201J. The in-vehicle device 201F is a parking brake ECU, and the in-vehicle devices 201G and 201J are autonomous driving ECUs.

[0047] Hereinafter, the in-vehicle device 201F, the in-vehicle device 201G, and the in-vehicle device 201J will also be referred to as the parking brake ECU 201F, the automatic driving ECU 201G, and the automatic driving ECU 201J, respectively.

[0048] [First switch 91] The vehicle relay device 101 includes a plurality of first switches 91 that switch on and off the supply of power to specific vehicle-mounted equipment 201 in the vehicle 1. Each first switch 91 is, for example, a semiconductor switch. Note that in FIG. 1, for ease of understanding, the first switch 91 is shown outside the vehicle relay device 101. The first switch 91 is an example of a first control switch. Note that the term "first" does not imply a priority.

[0049] More specifically, for example, each first switch 91 switches between supplying and not supplying power to a driving-related device.

[0050] Specifically, for example, the in-vehicle relay device 101 includes first switches 91A and 91B that are multiple first switches 91. The first switches 91A and 91B switch between supplying and not supplying power to the autonomous driving ECU 201G and the autonomous driving ECU 201J, respectively.

[0051] [Power Switch] For example, the in-vehicle repeater 101 further includes a power switch 93. The power switch 93 is provided between the power supply unit 10 and the first switch 91. The power switch 93 is, for example, a semiconductor switch. Note that, in FIG. 1 , the power switch 93 is shown outside the in-vehicle repeater 101 for ease of understanding.

[0052] In the example shown in FIG. 1, the vehicle-mounted relay device 101 includes power switches 93A and 93B that are the power switch 93.

[0053] The power switch 93A switches the connection state between the first power source 61 and the first switch 91. In the present embodiment, for example, the power switch 93A is in the ON state when a service is being executed in the in-vehicle network 401, and is in the OFF state when the execution of the service is stopped. The power switch 93B is always in the ON state.

[0054] [ON Control Signal] The in-vehicle relay device 101 outputs an ON control signal S11 to turn on each first switch 91 to the first switch 91. The in-vehicle device 201H outputs an ON control signal S21 to turn on each first switch 91 to the first switch 91 via the in-vehicle relay device 101. For example, each of the ON control signal S11 and the ON control signal S21 is a logically high level signal. The ON control signal S11 is an example of a first control signal, and the ON control signal S21 is an example of a second control signal. In the following description, the in-vehicle device 201H is also referred to as the management device 201H.

[0055] Vehicle repeater 101 outputs an ON control signal S51 for turning on power switch 93A to power switch 93A. Management device 201H outputs an ON control signal S61 for turning on power switch 93A to power switch 93A via vehicle repeater 101. For example, each of ON control signal S51 and ON control signal S61 is a logical high level signal.

[0056] Vehicle repeater 101 outputs an ON control signal S53 for turning on power switch 93B to power switch 93B. Management device 201H outputs an ON control signal S71 for turning on power switch 93B to power switch 93B via vehicle repeater 101. For example, each of ON control signal S53 and ON control signal S71 is a logical high level signal.

[0057] The power switch 93A is turned on under the OR condition of the ON control signal S51 and the ON control signal S61. The power switch 93B is turned on under the OR condition of the ON control signal S53 and the ON control signal S71. Details of the ON control of each power switch 93 will be described later.

[0058] For example, management device 201H is connected to in-vehicle repeater 101 via a plurality of signal lines. Hereinafter, each of the plurality of signal lines for transmitting various control signals output from management device 201H is also referred to as signal line 6. Note that management device 201H is not limited to a configuration in which it is connected to in-vehicle repeater 101 via a plurality of signal lines 6, and it may also be configured in which it is connected to in-vehicle repeater 101 via a single signal line 6.

[0059] 1, the in-vehicle devices 201B, 201C, 201D, and 201E are a body ECU, an occupant sensor, a buckle sensor, and a door opening / closing sensor, respectively. Hereinafter, the in-vehicle devices 201B, 201C, 201D, and 201E will also be referred to as the body ECU 201B, the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E.

[0060] [Occupant Sensor] For example, the occupant sensor 201C is a sensor that detects whether the driver is seated in the driver's seat of the vehicle 1 or whether the driver is leaving the driver's seat.

[0061] More specifically, for example, the occupant sensor 201C is a pressure sensor that measures a pressure P applied to the seat surface of the driver's seat. The occupant sensor 201C measures the pressure P, for example, periodically.

[0062] Then, the occupant sensor 201C detects whether or not a driver is seated in the driver's seat based on the measurement result of the pressure P, and performs a detection process D1 in which sensor information C1 indicating the detection result is transmitted to the body ECU 201B.

[0063] Specifically, for example, when the measurement value of the occupant sensor 201C is equal to or greater than a predetermined threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver is seated in the driver's seat, including the measurement time ta of the measurement value.

[0064] On the other hand, for example, when the measurement value of the occupant sensor 201C is less than the threshold value Th1, the occupant sensor 201C transmits to the body ECU 201B sensor information C1 indicating that the driver has left the driver's seat, including the measurement time ta of the measurement value.

[0065] The occupant sensor 201C is not limited to a pressure sensor, but may be a camera that takes an image of the driver's seat, or the like.

[0066] [Buckle Sensor] The buckle sensor 201D is provided on the buckle of the driver's seat of the vehicle 1. The buckle sensor 201D periodically detects the state of the seat belt in the driver's seat and performs a detection process D2 in which sensor information C2 indicating the detection result and the detection time tb is transmitted to the body ECU 201B. For example, the buckle sensor 201D performs the detection process D2 at the same timing as the detection process D1 by the occupant sensor 201C.

[0067] Specifically, for example, when the tongue of the seat belt is connected to the buckle, the buckle sensor 201D transmits sensor information C2 indicating that the seat belt is in a locked state as a detection result to the body ECU 201B.

[0068] On the other hand, for example, when the tongue of the seat belt is not fastened to the buckle, the buckle sensor 201D transmits sensor information C2 indicating that the seat belt is in the unlocked state as a detection result to the body ECU 201B.

[0069] The door sensor 201E periodically detects the state of the door at the driver's seat, and transmits sensor information C3 indicating the detection result and the detection time tc to the body ECU 201B in a detection process D3. For example, the door sensor 201E performs the detection process D3 at the same timing as the detection process D1 performed by the occupant sensor 201C.

[0070] [Body ECU] Body ECU 201B outputs control signals to body-related devices such as door lock mechanisms, wipers, power windows, etc. Specifically, for example, body ECU 201B receives sensor information from each of occupant sensor 201C, buckle sensor 201D, and door open / close sensor 201E, and outputs control signals based on the received sensor information to the body-related devices.

[0071] In addition, the body ECU 201B creates a CAN frame (hereinafter also referred to as "frame F") that includes sensor information C1, sensor information C2, and sensor information C3 received from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively.

[0072] As described above, the occupant sensor 201C, the buckle sensor 201D, and the door open / close sensor 201E transmit the sensor information C1, the sensor information C2, and the sensor information C3, respectively, to the body ECU 201B, for example, periodically.

[0073] When the body ECU 201B receives sensor information C1, sensor information C2, and sensor information C3 from the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E, respectively, it stores the received sensor information C1, sensor information C2, and sensor information C3 in a memory unit not shown.

[0074] For example, when the processing timing Ta for creating a frame F arrives, the body ECU 201B acquires from the storage unit the sensor information C1, C2, and C3 accumulated during the period from the previous processing timing Ta to the current processing timing Ta, and creates a frame F including the acquired sensor information C1, C2, and C3. Then, the body ECU 201B transmits the created frame F to the in-vehicle relay device 101.

[0075] The body ECU 201B also performs a switch monitoring process to monitor the state of the brake pedal switch or the engine switch, and transmits switch monitoring information indicating the monitoring results of the switch monitoring process to the in-vehicle relay device 101. The body ECU 201B performs the switch monitoring process and transmits the switch monitoring information, for example, periodically.

[0076] 1, the in-vehicle device 201A is a verification ECU. Hereinafter, the in-vehicle device 201A will also be referred to as a verification ECU 201A.

[0077] For example, the verification ECU 201A is connected to an electronic key sensor (not shown) that can measure radio waves emitted from the electronic key. The electronic key sensor transmits key information indicating the measurement results and identification information (hereinafter also referred to as "key ID") contained in the radio waves to the verification ECU 201A. The key ID is unique to each electronic key.

[0078] The verification ECU 201A stores the key ID in its storage unit. When the verification ECU 201A receives key information from the electronic key sensor, if the measurement results indicated by the received key information satisfy a predetermined condition and the key ID indicated by the key information matches the key ID stored in the storage unit, the verification ECU 201A transmits key verification information to the in-vehicle relay device 101, indicating that the electronic key is present near the vehicle 1 and that the key IDs match.

[0079] [Parking Brake ECU] The parking brake ECU 201F controls, for example, the parking brake of the vehicle 1. When activated, the parking brake ECU 201F broadcasts parking brake information indicating the state of the parking brake to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0080] [Second Switch 92] For example, the in-vehicle relay device 101 further includes a second switch 92 that switches on / off the supply of power to other in-vehicle devices 201 (hereinafter also referred to as "non-driving-related devices") other than the driving-related devices. The second switch 92 is, for example, a semiconductor switch. The second switch 92 is an example of a second control switch. Note that, for ease of understanding, FIG. 1 shows the second switch 92 outside the in-vehicle relay device 101. Also, the term "second" does not imply a priority order.

[0081] 1, the non-driving-related devices are the verification ECU 201A, the body ECU 201B, the occupant sensor 201C, the buckle sensor 201D, the door opening / closing sensor 201E, and the management device 201H. Hereinafter, an example will be described in which the second switch 92 switches between supplying and not supplying power to the door opening / closing sensor 201E.

[0082] The in-vehicle relay device 101 is not limited to having one second switch 92 , and may be configured to have a plurality of second switches 92 .

[0083] [On-Vehicle Relay Device] Fig. 2 is a diagram illustrating an example of the configuration of an on-vehicle relay device according to an embodiment of the present disclosure. Referring to Fig. 2, the on-vehicle relay device 101 includes a relay unit 11, a processing unit 12, and a storage unit 13. The processing unit 12 includes a power management unit 21, a determination unit 22, a notification unit 23, a signal generation unit 24, a logic circuit unit 25, a plurality of first monitoring units 26, a second monitoring unit 27, and a plurality of third monitoring units 28. One or both of the relay unit 11 and the processing unit 12 are realized, for example, by a processing circuit including one or more processors. The storage unit 13 is, for example, a non-volatile memory included in the processing circuit. The logic circuit unit 25 is an example of an input unit.

[0084] (Relay Unit) The relay unit 11 receives a CAN frame transmitted from a certain in-vehicle device 201. Then, the relay unit 11 checks whether the received CAN frame is a CAN frame that should be received by its own in-vehicle relay device 101.

[0085] The storage unit 13 stores, for example, a reception list L1 that indicates the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list L1 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0086] When the relay unit 11 receives a CAN frame, it refers to the reception list in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0087] For example, if the CAN-ID included in a received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0088] On the other hand, if the CAN-ID included in the received CAN frame is registered in the reception list L1 and the destination of the CAN frame is the in-vehicle device 201, the relay unit 11 performs relay processing.

[0089] Specifically, for example, storage unit 13 stores a routing table indicating the correspondence between CAN-IDs, destination devices of CAN frames, and CAN buses 2 to which the destination devices are connected (hereinafter also referred to as "destination buses"). The routing table is registered in storage unit 13 by the manufacturer of vehicle 1, for example, when vehicle 1 is shipped.

[0090] For example, if the CAN-ID contained in the CAN frame received from the in-vehicle device 201 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0091] When the relay unit 11 confirms that the destination device of the received CAN frame is the in-vehicle device 201, the relay unit 11 refers to the routing table to identify the destination bus corresponding to the destination device, and then outputs the received CAN frame to the identified destination bus.

[0092] On the other hand, when the relay unit 11 confirms that the destination device of the received CAN frame is its own in-vehicle relay device 101 , it outputs the CAN frame to the processing unit 12 .

[0093] 1 , in the in-vehicle system 301, for example, if an abnormality occurs in a device that controls the first switch 91 that switches on and off the supply of power to the driving-related device, the power supply to the driving-related device may be stopped. In this case, there is a possibility that the driving-related functions executed by the driving-related device may be limited or stopped.

[0094] Furthermore, if an abnormality such as a short to the power supply, a ground fault, an overvoltage, or an overcurrent occurs in the driving-related equipment, the power supply unit 10, or the power lines 5 connected to the driving-related equipment, a further abnormality such as a drop or rise in the power supply voltage supplied to the driving-related equipment may occur. Therefore, when an abnormality occurs in the vehicle 1, it is necessary to suppress the effect of the abnormality.

[0095] Therefore, the in-vehicle system 301 according to the embodiment of the present disclosure solves the above problem by the following configuration and operation.

[0096] 2 again, in the on-vehicle relay device 101, for example, the determination unit 22 performs a determination process to determine the state of the vehicle 1. More specifically, for example, the determination unit 22 performs a determination process J1 to determine whether the vehicle 1 is in a state in which it can start traveling (hereinafter also referred to as a "traveling start state").

[0097] For example, when the verification of the electronic key by the verification ECU 201A is completed and the monitoring result indicated by the switch monitoring information B satisfies a predetermined condition, the determination unit 22 determines that the vehicle 1 is in a traveling start state.

[0098] More specifically, when the determination unit 22 receives the key verification information from the verification ECU 201A via the relay unit 11, the determination unit 22 checks the monitoring result indicated by the switch monitoring information (hereinafter also referred to as "switch monitoring information B") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the key verification information. If the switch monitoring information B indicates that the brake switch or the engine switch is in the on state, the determination unit 22 determines that the vehicle 1 is in the running start state.

[0099] For example, when the determination unit 22 determines that the state of the vehicle 1 is a running start state, the determination unit 22 periodically broadcasts a running start notification indicating that the state of the vehicle 1 is a running start state to each in-vehicle device 201 via the relay unit 11. The determination unit 22 also outputs the running start notification to the signal generation unit 24, the first monitoring units 26A and 26B, and the second monitoring unit 27.

[0100] On the other hand, if the switch monitoring information B indicates that key matching information has not arrived from the matching ECU 201A or that the brake switch or engine switch is in the off state, the judgment unit 22 judges that the vehicle 1 is not in the running start state.

[0101] 2 and 3, the signal generating unit 24 in the vehicle relay device 101 generates the ON control signal S11 based on the state of the vehicle 1 determined by the determining unit 22.

[0102] More specifically, for example, when the signal generating unit 24 receives a running start notification from the determining unit 22, that is, when the determining unit 22 determines that the vehicle 1 is in a running start state, the signal generating unit 24 generates the ON control signal S11. Then, the signal generating unit 24 outputs the generated ON control signal S11 to the logic circuit unit 25.

[0103] The logic circuit unit 25 receives an ON control signal S11 from the signal generating unit 24. The logic circuit unit 25 also receives an ON control signal S21 via the signal line 6 from outside the vehicle relay device 101, that is, from the management device 201H.

[0104] The logic circuit unit 25 includes a plurality of OR gates 71 and a plurality of AND gates 81. In the example shown in Fig. 3, the logic circuit unit 25 includes OR gates 71A and 71B which are the plurality of OR gates 71, and AND gates 81A and 81B which are the plurality of AND gates 81.

[0105] [First Monitoring Unit] Fig. 4 is a diagram illustrating an example of the configuration of a first monitoring unit in an in-vehicle relay device according to an embodiment of the present disclosure. Referring to Fig. 4, a first monitoring unit 26 is provided for each first switch 91. The first monitoring unit 26A includes a first measuring unit 31A and a first control unit 32A. The first monitoring unit 26B includes a first measuring unit 31B and a first control unit 32B.

[0106] (First Measurement Unit) The first measurement unit 31A and the first measurement unit 31B perform a measurement process H1 related to the first switch 91. More specifically, the first measurement unit 31A and the first measurement unit 31B perform measurements related to the first switch 91A and the first switch 91B, respectively.

[0107] Specifically, for example, first measurement unit 31A and first measurement unit 31B measure a current U1 flowing between the input terminal of power switch 93A and the output terminal of first switch 91A, and a current U2 flowing between the drain and source of first switch 91B, respectively. First measurement unit 31A and first measurement unit 31B perform measurement process H1, for example, periodically. Note that first measurement unit 31A and first measurement unit 31B may also be configured to measure a voltage V1 between the input terminal of power switch 93A and the output terminal of first switch 91A, and a voltage V2 between the drain and source of first switch 91B, respectively.

[0108] The first measurement unit 31A then outputs measurement result information M1 indicating the measurement result K1 to the first control unit 32A. The first measurement unit 31B also outputs measurement result information M2 indicating the measurement result K2 to the first control unit 32B.

[0109] (First Control Unit) Referring to FIGS. 3 and 4, the first control unit 32A determines the state of the first switch 91A based on the measurement result K1 of the first measurement unit 31A.

[0110] More specifically, for example, if the measurement result K1 indicated by the measurement result information M1 received from the first measurement unit 31A satisfies a predetermined condition W1, the first control unit 32A determines that the state of the first switch 91A is normal. In this case, the first control unit 32A generates a control signal E1 at a logically high level. The first control unit 32A then outputs the generated control signal E1 to the logic circuit unit 25. For example, if the first measurement unit 31A measures the current U1, the predetermined condition W1 is that the measurement result K1 is less than a predetermined threshold value Th11. Note that if the first measurement unit 31A measures the voltage V1, the predetermined condition W1 may also be that the measurement result K1 is within a predetermined range.

[0111] On the other hand, if the measurement result K1 indicated by the measurement result information M1 received from the first measurement unit 31A does not satisfy the predetermined condition W1, the first control unit 32A determines that the state of the first switch 91A is abnormal. In this case, the first control unit 32A generates a control signal E3 of a logical low level. The first control unit 32A then outputs the generated control signal E3 to the logic circuit unit 25. The control signals E1 and E3 are output exclusively.

[0112] Furthermore, when first control unit 32A receives a driving start notification from determination unit 22 or a power-on completion notification (described later) from management device 201H, first control unit 32A generates a control signal E1 of a logical high level. Then, first control unit 32A outputs the generated control signal E1 to logic circuit unit 25.

[0113] The first control unit 32B determines the state of the first switch 91B based on the measurement result K2 of the first measurement unit 31B.

[0114] More specifically, for example, if the measurement result K2 indicated by the measurement result information M2 received from the first measurement unit 31B satisfies a predetermined condition W2, the first control unit 32B determines that the state of the first switch 91B is normal. In this case, the first control unit 32B generates a control signal E2 at a logically high level. The first control unit 32B then outputs the generated control signal E2 to the logic circuit unit 25. For example, when the first measurement unit 31B measures a current U2, the predetermined condition W2 is that the measurement result K2 is less than a predetermined threshold value Th12. Note that when the first measurement unit 31B measures a voltage V2, the predetermined condition W2 may be that the measurement result K2 is within a predetermined range.

[0115] On the other hand, if the measurement result K2 indicated by the measurement result information M2 received from the first measurement unit 31B does not satisfy the predetermined condition W2, the first control unit 32B determines that the state of the first switch 91B is abnormal. In this case, the first control unit 32B generates a control signal E4 of a logical low level. The first control unit 32B then outputs the generated control signal E4 to the logic circuit unit 25. The control signals E2 and E4 are output exclusively.

[0116] Furthermore, when first control unit 32B receives a driving start notification from determination unit 22 or a power-on completion notification (described later) from management device 201H, first control unit 32B generates a control signal E2 of a logical high level. Then, first control unit 32B outputs the generated control signal E2 to logic circuit unit 25.

[0117] 5 is a diagram illustrating in detail a portion of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to FIG. 5, in the in-vehicle relay device 101, the logic circuit unit 25 further includes a plurality of OR gates 72 and a plurality of AND gates 73. In the example illustrated in FIG. 5, the logic circuit unit 25 includes OR gates 72A and 72B, which are the plurality of OR gates 72, and a plurality of AND gates 73A and 73B, which are the plurality of AND gates 73.

[0118] [Third Monitoring Unit] Fig. 6 is a diagram illustrating an example of the configuration of a third monitoring unit in an in-vehicle relay device according to an embodiment of the present disclosure. Referring to Fig. 6, a third monitoring unit 28 is provided for each power switch 93. Third monitoring unit 28A includes a third measurement unit 35A and a third control unit 36A. Third monitoring unit 28B includes a third measurement unit 35B and a third control unit 36B.

[0119] (Third Measurement Unit) The first measurement unit 31A and the first measurement unit 31B perform measurement processing H3 related to the power switch 93. More specifically, the third measurement unit 35A and the third measurement unit 35B perform measurements related to the power switch 93A and the power switch 93B, respectively.

[0120] Specifically, for example, the third measurement unit 35A and the third measurement unit 35B measure a current U3 flowing between the drain and source of the power switch 93A and a current U4 flowing between the drain and source of the power switch 93B, respectively. The third measurement unit 35A and the third measurement unit 35B perform a measurement process H3, for example, periodically. Note that the third measurement unit 35A and the third measurement unit 35B may be configured to measure a voltage V3 between the drain and source of the power switch 93A and a voltage V4 between the drain and source of the power switch 93B, respectively.

[0121] The third measurement unit 35A then outputs measurement result information M5 indicating the measurement result K5 to the third control unit 36A. The third measurement unit 35B also outputs measurement result information M6 indicating the measurement result K6 to the third control unit 36B.

[0122] (Third Control Unit) The third control unit 36A determines the state of the power switch 93A based on the measurement result K5 of the third measurement unit 35A.

[0123] More specifically, for example, if the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A satisfies a predetermined condition W5, the third control unit 36A determines that the power switch 93A is in a normal state. In this case, the third control unit 36A generates a control signal E7 at a logically high level. The third control unit 36A then outputs the generated control signal E7 to the logic circuit unit 25. For example, when the third measurement unit 35A measures the current U3, the predetermined condition W5 is that the measurement result K5 is less than a predetermined threshold Th21. Note that when the third measurement unit 35A measures the voltage V3, the predetermined condition W5 may also be that the measurement result K5 is within a predetermined range.

[0124] On the other hand, if the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A does not satisfy the predetermined condition W5, the third control unit 36A determines that the state of the power switch 93A is abnormal. In this case, the third control unit 36A generates a control signal E9 at a logical low level. The third control unit 36A then outputs the generated control signal E9 to the logic circuit unit 25. The control signals E7 and E9 are output exclusively.

[0125] The third control unit 36B determines the state of the power switch 93B based on the measurement result K6 of the third measurement unit 35B.

[0126] More specifically, for example, if the measurement result K6 indicated by the measurement result information M6 received from the third measurement unit 35B satisfies a predetermined condition W6, the third control unit 36B determines that the power switch 93B is in a normal state. In this case, the third control unit 36B generates a control signal E8 at a logically high level. The third control unit 36B then outputs the generated control signal E8 to the logic circuit unit 25. For example, when the third measurement unit 35B measures the current U4, the predetermined condition W6 is that the measurement result K6 is less than a predetermined threshold value Th22. Note that when the third measurement unit 35B measures the voltage V2, the predetermined condition W6 may also be that the measurement result K6 is within a predetermined range.

[0127] On the other hand, if the measurement result K6 indicated by the measurement result information M6 received from the third measurement unit 35B does not satisfy the predetermined condition W6, the third control unit 36B determines that the state of the power switch 93B is abnormal. In this case, the third control unit 36B generates a control signal E10 at a logical low level. The third control unit 36B then outputs the generated control signal E10 to the logic circuit unit 25. The control signals E8 and E10 are output exclusively.

[0128] [ON Control of Each Switch by the Vehicle-Mounted Relay Device 101] (ON Control of the First Switch 91) FIG. 7 is a diagram for explaining ON control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0129] 7, when at least one of ON control signal S11 and ON control signal S21 is input to OR gate 71A, gate signal G1 at a logic high level is output from OR gate 71A to AND gate 81A.

[0130] When gate signal G1 at a logic high level and control signal E1 at a logic high level are input to AND gate 81A, gate signal A1 at a logic high level is output from AND gate 81A to first switch 91A.

[0131] The first switch 91A is turned on when it receives a gate signal A1 of a logic high level from the AND gate 81A, thereby supplying power from the power supply unit 10 to the automatic driving ECU 201G.

[0132] When at least one of ON control signal S11 and ON control signal S21 is input to OR gate 71B, gate signal G2 at a logic high level is output from OR gate 71B to AND gate 81B.

[0133] When gate signal G2 at a logic high level and control signal E2 at a logic high level are input to AND gate 81B, gate signal A2 at a logic high level is output from AND gate 81B to first switch 91B.

[0134] The first switch 91B is turned on when it receives a gate signal A2 of a logic high level from the AND gate 81B, thereby supplying power from the power supply unit 10 to the automatic driving ECU 201J.

[0135] (On Control of Power Supply Switch 93) FIG. 8 is a diagram for explaining on control of the power supply switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0136] Referring to FIG. 8, when at least one of ON control signal S51 and ON control signal S61 is input to OR gate 72A, gate signal G5 at a logic high level is output from OR gate 72A.

[0137] When gate signal G5 of a logic high level and control signal E7 of a logic high level are input to AND gate 73A, gate signal A7 of a logic high level is output from AND gate 73A to power switch 93A.

[0138] Furthermore, when at least one of ON control signal S53 and ON control signal S71 is input to OR gate 72B, gate signal G7 at a logic high level is output from OR gate 72B.

[0139] When gate signal G7 at a logic high level and control signal E8 at a logic high level are input to AND gate 73B, gate signal A8 at a logic high level is output from AND gate 73B to power switch 93B.

[0140] The power switch 93A is turned on when it receives a gate signal A7 of a logic high level from the AND gate 73A. The power switch 93B is turned on when it receives a gate signal A8 of a logic high level from the AND gate 73B. As a result, the connection state between the first power supply 61 and the first switch 91 and the connection state between the second power supply 62 and the first switch 91 transition from the off state to the on state.

[0141] As described above, in this embodiment, the power switch 93B is always on. That is, the power switch 93B remains on even when the microcomputer mounted on the vehicle relay device 101 is in a sleep state. To maintain the power switch 93B in the on state, for example, an on-holding unit (not shown) is provided between the signal generating unit 24 and the AND gate 73B in the vehicle relay device 101. This reduces the dark current flowing through the power supply unit 10 when the ignition power of the vehicle 1 is off.

[0142] In order to keep the power switch 93B in the on state, the power switch 93B may be a normally-on switch.

[0143] [Startup completion notification] Referring again to Figure 1, for example, when the state of the vehicle 1 is in the driving start state and the state of the first switch 91 is in the on state by the on control signal S11 or the on control signal S21, the automatic driving ECU 201G, 201J starts executing a driving-related function, specifically an automatic driving function.

[0144] More specifically, the autonomous driving ECUs 201G and 201J are activated when the first switches 91A and 91B are turned on while the vehicle 1 is in the driving start state. The autonomous driving ECUs 201G and 201J then start executing the autonomous driving function. Furthermore, upon activation, the autonomous driving ECUs 201G and 201J transmit activation completion notifications N1 to the in-vehicle relay device 101, indicating that they have been activated.

[0145] The automatic driving ECUs 201G, 201J may be configured to start executing the automatic driving function when the vehicle 1 is in a traveling start state, the first switch 91 is in an on state, and the parking brake is in an off state. In this case, when the first switch 91 is in an on state and the parking brake information received from the parking brake ECU 201F indicates that the parking brake is in an off state, the automatic driving ECUs 201G, 201J are activated and start executing the automatic driving function.

[0146] [Device status notification] Referring again to Figure 2, in the vehicle relay device 101, when the notification unit 23 receives a startup completion notification N1 from the autonomous driving ECUs 201G, 201J via the relay unit 11, it periodically broadcasts a device status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each vehicle device 201 via the relay unit 11.

[0147] [Management Device] Fig. 9 is a diagram showing an example of the configuration of an in-vehicle device according to an embodiment of the present disclosure, Fig. 9 shows the configuration of a management device 201H.

[0148] 9, management device 201H includes a communication unit 41, a processing unit 42, and a storage unit 43. Processing unit 42 includes a determination unit 51, a signal generation unit 52, and a notification unit 53. One or both of communication unit 41 and processing unit 42 are realized, for example, by a processing circuit including one or more processors. Storage unit 43 is, for example, a non-volatile memory included in the processing circuit.

[0149] For example, the storage unit 43 stores a reception list L2 that indicates the CAN-IDs included in the CAN frames that the management device 201H should receive. The reception list L2 is registered in the storage unit 43 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0150] When the communication unit 41 receives a CAN frame from the in-vehicle relay device 101 or another in-vehicle device 201 other than the management device 201H, it reads out the reception list L2 in the storage unit 43. Then, by referring to the reception list L2, the communication unit 41 checks whether the CAN-ID included in the received CAN frame is registered in the reception list L2.

[0151] If the CAN-ID included in a received CAN frame is registered in the reception list L2, the communication unit 41 outputs the CAN frame to the processing unit 12. On the other hand, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the communication unit 41 discards the CAN frame.

[0152] The determination unit 51 determines the states of the autonomous driving ECUs 201G and 201J. Specifically, for example, when the determination unit 51 receives an equipment status notification from the in-vehicle relay device 101 via the communication unit 41, the determination unit 51 determines that the autonomous driving ECU 201G or the autonomous driving ECU 201J is operating. Then, the determination unit 51 outputs the received equipment status notification to the signal generation unit 52.

[0153] (Generation and output of ON control signals S21, S61, S71) For example, the second ON condition under which management device 201H outputs ON control signal S21 is different from the first ON condition under which in-vehicle relay device 101 outputs ON control signal S11. As described above, in-vehicle relay device 101 generates ON control signal S11 when it determines that the state of vehicle 1 is in the traveling start state. On the other hand, in response to receiving a device state notification from in-vehicle relay device 101, management device 201H generates ON control signals S21, S61, S71.

[0154] Specifically, for example, in managed device 201H, when signal generating section 52 receives a device state notification from determining section 51, it generates ON control signals S21, S61, S71.

[0155] Then, the signal generating unit 52 outputs the generated ON control signals S21, S61, and S71 to the in-vehicle relay device 101. For example, the signal generating unit 52 outputs the ON control signals S21, S61, and S71 at the same timing to the in-vehicle relay device 101. Note that the signal generating unit 52 may output some of the ON control signals S21, S61, and S71 to the in-vehicle relay device 101 at a timing different from that of the other ON control signals.

[0156] Specifically, for example, when the signal generating unit 52 generates the ON control signal S21, the signal generating unit 52 transmits the generated ON control signal S21 to the vehicle relay device 101 via the signal line 6.

[0157] Furthermore, for example, when the signal generating unit 52 generates the ON control signals S61 and S71, it transmits the generated ON control signals S61 and S71 to the vehicle relay device 101 via the signal line 6.

[0158] [ON Control of Each Switch by Management Device 201H] (ON Control of Power Supply Switch 93) Referring again to Fig. 8, logic circuit unit 25 in on-vehicle relay device 101 receives ON control signals S61, S71 from management device 201H via signal line 6 shown in Fig. 2. OR gate 72A in logic circuit unit 25 then outputs gate signal S3 of a logical high level to power supply switch 93A. Furthermore, OR gate 72B in logic circuit unit 25 outputs gate signal S5 of a logical high level to power supply switch 93B.

[0159] Power switch 93A is turned on when it receives gate signal S3 of a logic high level from OR gate 72A, and power switch 93B is turned on when it receives gate signal S5 of a logic high level from OR gate 72B.

[0160] Furthermore, when the logic circuit unit 25 receives the ON control signals S61 and S71 from the managed device 201H, it outputs to the notification unit 23 a switch ON notification N22 indicating that the ON control signals S61 and S71 have been received.

[0161] When the notification unit 23 receives the switch-on notification N22 from the logic circuit unit 25, it transmits the switch-on notification N22 to the managed device 201H via the relay unit 11.

[0162] 7 again, in the vehicle-mounted relay device 101, the logic circuit unit 25 receives the ON control signal S21 from the management device 201H via the signal line 6. Then, the OR gate 71A in the logic circuit unit 25 outputs a gate signal G1 of a logical high level to the first switch 91A. Furthermore, the OR gate 71B in the logic circuit unit 25 outputs a gate signal G2 of a logical high level to the first switch 91B.

[0163] (Switch-on Notifications N21, N22) Furthermore, when the logic circuit unit 25 receives the on control signal S21 from the managed device 201H, it outputs to the notification unit 23 a switch-on notification N21 indicating that the on control signal S21 has been received from the managed device 201H.

[0164] When the notification unit 23 receives the switch-on notification N21 from the logic circuit unit 25, it transmits the switch-on notification N21 to the managed device 201H via the relay unit 11.

[0165] Furthermore, when the logic circuit unit 25 receives the on control signals S61, S71 from the management device 201H via the signal line 6a, it outputs a switch-on notification N22 to the notification unit 23 indicating that the on control signals S61, S71 have been received from the management device 201H.

[0166] When the notification unit 23 receives the switch-on notification N22 from the logic circuit unit 25, it transmits the switch-on notification N22 to the managed device 201H via the relay unit 11.

[0167] [ON Unconfirmed Notification] Referring again to Figure 9, in the management device 201H, the notification unit 53 broadcasts an ON Unconfirmed Notification, indicating that the execution of the ON control of the first switch 91 by the ON control signal S21, the ON control of the power switch 93A by the ON control signal S61, and the ON control of the power switch 93B by the ON control signal S71 is unconfirmed, to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201H, via the communication unit 41.

[0168] Specifically, the notification unit 53 broadcasts an on-unconfirmed notification to each of the other in-vehicle devices 201 and the in-vehicle relay device 101, for example periodically, until it receives a switch-on notification N21 from the in-vehicle relay device 101 via the communication unit 41.

[0169] [On completion notification] Furthermore, when the notification unit 53 receives a switch-on notification N21 from the vehicle-mounted relay device 101 via the communication unit 41, it broadcasts an on completion notification to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 other than its own management device 201H via the communication unit 41, indicating that on control of the first switch 91 is being executed using the on control signal S21, i.e., that the execution of the on control in the vehicle-mounted relay device 101 has been confirmed.

[0170] [Parking brake off control] Referring again to Figure 1, for example, when the parking brake is in the on state, the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101, receives an on completion notification from the management device 201H, and an operation Q1 to turn the parking brake off is performed in the vehicle 1, the parking brake ECU 201F performs a parking brake release process to transition the parking brake from the on state to the off state.

[0171] The following describes an example of how the parking brake ECU 201F performs parking brake release processing when it receives a driving start notification and an on completion notification from the in-vehicle relay device 101 and the management device 201H, respectively, and the driver performs operation Q1. Operation Q1 is, for example, an operation in which the driver of the vehicle 1 moves the shift lever to a position other than "parking."

[0172] Specifically, for example, a shift lever sensor (not shown) is connected to the parking brake ECU 201F. The shift lever sensor periodically detects the position of the shift lever and performs a detection process D4 to transmit sensor information C4 indicating the detection result to the parking brake ECU 201F.

[0173] When the parking brake ECU 201F receives the sensor information C4 from the shift lever sensor, the parking brake ECU 201F stores the received sensor information C4 in a storage unit.

[0174] For example, when the parking brake ECU 201F receives a driving start notification from the in-vehicle relay device 101, it acquires from the storage unit the sensor information C4 received during a period from when the driving start notification was received until a predetermined time has elapsed.

[0175] When the sensor information C4 acquired from the storage unit indicates a shift lever position other than "parking" as the detection result and the parking brake ECU 201F receives an ON completion notification from the management device 201H, the parking brake ECU 201F outputs an OFF control signal S32 to the parking brake to transition the parking brake to the OFF state. As a result, the parking brake transitions from the ON state to the OFF state.

[0176] [Parking Brake ON Control] For example, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state when it receives an ON completion notification from the management device 201H and a predetermined operation Q2 is performed in the vehicle 1. For example, the operation Q2 is an operation in which the driver moves the shift lever to the "parking" position.

[0177] More specifically, for example, after receiving an ON completion notification from the management device 201H, if the sensor information C4 received from the shift lever sensor indicates "parking" as the detection result, the parking brake ECU 201F outputs an ON control signal S31 to the parking brake to transition the parking brake to an ON state. As a result, the parking brake transitions from an OFF state to an ON state.

[0178] Then, the parking brake ECU 201F broadcasts to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 a brake-on notification indicating that the on control signal S31 has been output to the parking brake.

[0179] In addition, the parking brake ECU 201F is not limited to being configured to transition the parking brake from an OFF state to an ON state when it receives an ON completion notification from the management device 201H and operation Q2 is performed on the vehicle 1, but may also be configured to transition the parking brake from an OFF state to an ON state when another operation is performed on the vehicle 1 instead of operation Q2.

[0180] In this case, for example, when the parking brake ECU 201F receives an ON completion notification from the management device 201H and at least two or more of the following operations are performed in the vehicle 1: operation Q3 in which the driver leaves the driver's seat; operation Q4 in which the driver unlocks the seat belt; and operation Q5 in which the driver unlocks the driver's door, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state.

[0181] 2 , in the in-vehicle relay device 101, the determination unit 22 performs a determination process J2 to determine whether the vehicle 1 is in a state where it has finished traveling (hereinafter also referred to as a "traveling end state"). More specifically, for example, when the determination unit 22 receives a brake-on notification from the parking brake ECU 201F and operations Q3, Q4, and Q5 are performed in the vehicle 1, the determination unit 22 determines that the state of the vehicle 1 is in the traveling end state.

[0182] Specifically, when the judgment unit 22 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11, it checks whether the sensor information C1, C2, and C3 contained in frame F (hereinafter also referred to as "frame F1") received from the body ECU 201B via the relay unit 11 within a predetermined time period after receiving the brake-on notification satisfy predetermined conditions.

[0183] For example, if frame F1 contains sensor information C1 indicating that the driver has left the seat, sensor information C2 indicating that the seat belt is in an unlocked state, and sensor information C3 indicating that the driver's door is in an open state, the judgment unit 22 judges that the state of vehicle 1 is in an end-of-travel state.

[0184] Then, the determination unit 22 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each in-vehicle device 201 via the relay unit 11. The determination unit 22 also outputs the driving end notification to the signal generation unit 24.

[0185] In addition, the judgment unit 22 may be configured to judge that the state of vehicle 1 is in a driving end state when it receives a brake-on notification from the parking brake ECU 201F and any two of operations Q3, Q4, and Q5 are performed in vehicle 1.

[0186] [OFF transition request] For example, the in-vehicle relay device 101 transmits an OFF transition request to the autonomous driving ECUs 201G and 201J to request the stopping of the execution of the driving-related functions.

[0187] More specifically, for example, in the in-vehicle relay device 101, when the signal generating unit 24 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11 and also receives a driving end notification from the judgment unit 22, it broadcasts an off transition request to each in-vehicle device 201 via the relay unit 11 before generating the off control signal S12.

[0188] [Notification of completion of preparation for stopping] Referring again to Figure 1, for example, when the autonomous driving ECUs 201G and 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and the management device 201H outputs the off control signal S22 described later, they perform pre-processing to stop the execution of the autonomous driving function before the power supply to the autonomous driving ECUs 201G and 201J is stopped.

[0189] More specifically, for example, when the autonomous driving ECUs 201G and 201J receive a driving end notification or an off transition request from the vehicle relay device 101 and also receive an off completion notification (described later) from the management device 201H, they perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function.

[0190] Specifically, for example, the autonomous driving ECUs 201G, 201J include a volatile memory that stores data indicating the processing content during execution of the autonomous driving function, and a non-volatile memory that is used in preprocessing.

[0191] When the autonomous driving ECUs 201G and 201J receive a driving end notification from the vehicle relay device 101 and an off completion notification from the management device 201H, they perform a preprocessing process to back up the data stored in the volatile memory to the non-volatile memory.

[0192] Furthermore, for example, actuators (not shown) are connected to the autonomous driving ECUs 201G and 201J. The autonomous driving ECUs 201G and 201J drive the actuators while the autonomous driving function is being executed.

[0193] When the autonomous driving ECUs 201G and 201J receive a driving end notification from the in-vehicle relay device 101 and an off completion notification from the management device 201H, they perform a process to stop the operation of the actuator as pre-processing.

[0194] Then, when the autonomous driving ECUs 201G, 201J have completed preparations to stop the execution of the autonomous driving function, they transmit a notification of completion of preparations to stop to the in-vehicle relay device 101.

[0195] 3 and 9 , for example, management device 201H outputs an off control signal S22 to first switch 91 to turn off first switch 91. For example, off control signal S22 is a signal at a logical low level. On control signal S21 and off control signal S22 are output exclusively. Off control signal S22 is an example of a sixth control signal.

[0196] For example, the conditions under which the vehicle relay device 101 outputs the off control signal S12 (hereinafter also referred to as the "first off condition") are different from the conditions under which the management device 201H outputs the off control signal S22 (hereinafter also referred to as the "second off condition").

[0197] More specifically, for example, the first off condition includes a condition related to the state of the automatic driving ECUs 201G, 201J. The second off condition does not include a condition related to the state of the automatic driving ECUs 201G, 201J.

[0198] Specifically, for example, when the in-vehicle relay device 101 receives a stop preparation completion notification from the autonomous driving ECUs 201G and 201J, it outputs an OFF control signal S12.

[0199] For example, in the management device 201H, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output an off control signal S22.

[0200] Then, the signal generating unit 52 generates an OFF control signal S22 and outputs the generated OFF control signal S22 to the vehicle-mounted relay device 101.

[0201] Specifically, for example, the signal generating unit 52 transmits the generated OFF control signal S22 to the vehicle relay device 101 via the signal line 6.

[0202] 2 again, in the in-vehicle relay device 101, the logic circuit unit 25 receives the off control signal S22 from outside the in-vehicle system 301, specifically from the management device 201H. More specifically, the logic circuit unit 25 receives the off control signal S22 from the management device 201H via the signal line 6.

[0203] When the logic circuit unit 25 receives the off control signal S22, it outputs to the notification unit 23 a switch off notification N12 indicating that the off control signal S22 has been received.

[0204] When the notification unit 23 receives the switch-off notification N12 from the logic circuit unit 25, it transmits the switch-off notification N12 to the management device 201H via the relay unit 11.

[0205] [Off Unconfirmed Notification] Referring again to Figure 9, in the management device 201H, the notification unit 53 broadcasts an off unconfirmed notification indicating that the off control of the first switch 91 by the off control signal S22 is unconfirmed via the communication unit 41 to each of the other in-vehicle devices 201 and in-vehicle relay device 101 other than its own management device 201H.

[0206] Specifically, during the period from when the notification unit 53 outputs the off control signal S22 to the vehicle relay device 101 to when it receives the switch-off notification N12 from the vehicle relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off-unconfirmed notification to each other vehicle device 201 and the vehicle relay device 101, for example, periodically.

[0207] [Off completion notification] After outputting the off control signal S22 to the vehicle relay device 101, the notification unit 53 receives a switch off notification N12 from the vehicle relay device 101 and then transmits an off completion notification to the autonomous driving ECUs 201G, 201J indicating that the transmission of the off control signal S22 has been completed.

[0208] Specifically, when the notification unit 53 receives the switch-off notification N12 from the in-vehicle relay device 101 via the communication unit 41, the notification unit 53 broadcasts an off completion notification to the other in-vehicle devices 201 and the in-vehicle relay device 101 other than its own management device 201H via the communication unit 41. The notification unit 53 broadcasts the off completion notification to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0209] [Off Control of Each Switch] (Generation and Output of Off Control Signal S12) FIG. 10 is a diagram for explaining an example of off control of the first switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0210] 10 , for example, the in-vehicle relay device 101 outputs an OFF control signal S12 to the first switch 91 to turn off the first switch 91. The OFF control signal S12 is an example of a first OFF control signal. The OFF control signal S12 is an example of a fifth control signal.

[0211] More specifically, for example, when the management device 201H outputs an off control signal S22 and the autonomous driving ECUs 201G and 201J perform preprocessing to stop the execution of the autonomous driving function, the vehicle relay device 101 outputs an off control signal S12 to the first switch 91.

[0212] More specifically, for example, in the in-vehicle relay device 101, the signal generating unit 24 generates an OFF control signal S12 when it receives a stop preparation completion notification from the autonomous driving ECUs 201G, 201J via the relay unit 11. For example, the OFF control signal S12 is a signal of a logical low level.

[0213] (Turning Off First Switch 91A) When the logic circuit unit 25 receives the off control signal S12 from the signal generating unit 24 and the off control signal S22 from the management device 201H, it outputs a gate signal of a logic low level to each first switch 91.

[0214] Specifically, when both OFF control signal S12 and OFF control signal S22 are input to OR gate 71A, gate signal G3 at a logic low level is output from OR gate 71A to AND gate 81A.

[0215] When gate signal G3 at a logic low level is input to AND gate 81A, gate signal A3 at a logic low level is output from AND gate 81A to first switch 91A.

[0216] The first switch 91A is turned off when it receives a gate signal A3 of a logical low level from the AND gate 81A, thereby stopping the supply of power to the automatic driving ECU 201G.

[0217] When both the OFF control signal S12 and the OFF control signal S22 are input to OR gate 71B, gate signal G4 at a logic low level is output from OR gate 71B to AND gate 81B.

[0218] When gate signal G4 at a logic low level is input to AND gate 81B, gate signal A4 at a logic low level is output from AND gate 81B to first switch 91B.

[0219] The first switch 91B is turned off when it receives a gate signal A3 of a logical low level from the AND gate 81B, thereby stopping the supply of power to the automatic driving ECU 201J.

[0220] (Generation and Output of OFF Control Signal S52) Fig. 11 is a diagram for explaining an example of OFF control of the power switch by the in-vehicle relay device according to the embodiment of the present disclosure. Fig. 11 shows an example of OFF control of the power switch 93A by the in-vehicle relay device 101.

[0221] 2 and 11, for example, in the vehicle-mounted relay device 101, the signal generating unit 24 generates an OFF control signal S52 for turning off the power switch 93A.

[0222] More specifically, for example, the signal generating unit 24 generates the OFF control signal S52 when the execution of various services in the in-vehicle network 401 is stopped. For example, the OFF control signal S52 is a signal at a logic low level.

[0223] More specifically, for example, when the signal generating unit 24 receives a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 via the communication unit 41, the signal generating unit 24 determines that the execution of various services in the in-vehicle network 401 has stopped. In this case, the signal generating unit 52 generates an OFF control signal. Note that the signal generating unit 24 may be configured to determine that the execution of various services has stopped when the signal generating unit 24 receives a stop preparation completion notification from the in-vehicle ECU that controls the DC / DC converter 61b in the power supply unit 10.

[0224] Then, the signal generating section 24 outputs the generated OFF control signal S52 to the logic circuit section 25. The ON control signal S51 and the OFF control signal S52 are output exclusively.

[0225] 9 and 11, for example, in management device 201H, signal generation unit 52 generates off control signal S62 for turning off power switch 93A, and off control signal S72 for turning off power switch 93B. For example, off control signals S62 and S72 are signals of a logical low level.

[0226] More specifically, for example, when the signal generating unit 52 receives a brake-on notification from the parking brake ECU 201F via the communication unit 41 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 41, it decides to output off control signals S62, S72.

[0227] Then, the signal generating unit 52 generates OFF control signals S62 and S72 and transmits the generated OFF control signals S62 and S72 to the in-vehicle relay device 101 via the signal line 6a. The ON control signal S61 and the OFF control signal S62 are output exclusively. The ON control signal S71 and the OFF control signal S72 are output exclusively.

[0228] (Switch-off notification N11) Referring again to Figure 2, in the vehicle relay device 101, when the logic circuit unit 25 receives the off control signals S62, S72 from the management device 201H via the signal line 6a, it outputs a switch-off notification N11 to the notification unit 23 indicating that the off control signals S62, S72 have been received from the management device 201H.

[0229] When the notification unit 23 receives the switch-off notification N11 from the logic circuit unit 25, it transmits the switch-off notification N11 to the management device 201H via the relay unit 11.

[0230] (Turning off the power switch 93A) In the vehicle relay device 101, when the logic circuit unit 25 receives an off control signal S52 from the signal generating unit 24 and an off control signal S62 from the management device 201H, it outputs a gate signal G4 of a logical low level to the power switch 93A.

[0231] Specifically, for example, when both OFF control signal S52 and OFF control signal S62 are input to OR gate 72A, gate signal G6 at a logic low level is output from OR gate 72A to AND gate 73A.

[0232] When gate signal G6 at a logic low level is input to AND gate 73A, gate signal A9 at a logic low level is output from AND gate 73A to power switch 93A.

[0233] Power switch 93A is turned off when it receives gate signal A9 of a logic low level from AND gate 73A.

[0234] [ON Control Signal S31] Fig. 12 is a diagram illustrating in detail a partial configuration of an in-vehicle relay device according to an embodiment of the present disclosure. Referring to Fig. 12, for example, the signal generating unit 24 in the in-vehicle relay device 101 generates an ON control signal S31 for turning on the second switch 92 based on the state of the vehicle 1 determined by the determining unit 22. The ON control signal S31 is a signal with a logical high level. The ON control signal S31 is an example of a third control signal.

[0235] More specifically, for example, when the signal generating unit 24 receives a running start notification from the determining unit 22, the signal generating unit 24 generates an ON control signal S31. Then, the signal generating unit 24 outputs the generated ON control signal S31 to the logic circuit unit 25.

[0236] 13 is a diagram illustrating an example of the configuration of a second monitoring unit in the vehicle-mounted relay device according to the embodiment of the present disclosure. Referring to FIG. 13, the second monitoring unit 27 includes a second measurement unit 33 and a second control unit 34.

[0237] (Second Measuring Unit) For example, the second measuring unit 33 is provided in correspondence with the second switch 92 and performs a measuring process H2 related to the second switch 92 .

[0238] More specifically, for example, the second measurement unit 33 measures the current flowing between the drain and source of the second switch 92. The second measurement unit 33 performs a measurement process H2, for example, periodically. Then, the second measurement unit 33 outputs measurement result information M3 indicating a measurement result K3 to the second control unit 34.

[0239] (Second Control Unit) Referring to FIGS. 12 and 13, the second control unit 34 determines the state of the second switch 92 based on the measurement result K3 of the second measurement unit 33.

[0240] More specifically, for example, if the measurement result K3 indicated by the measurement result information M3 received from the second measurement unit 33 is less than the threshold value Th13, the second control unit 34 determines that the state of the second switch 92 is abnormal. In this case, the second control unit 34 generates a control signal E5 of a logical high level. The second control unit 34 then outputs the generated control signal E5 to the logic circuit unit 25.

[0241] On the other hand, if the measurement result K3 indicated by the measurement result information M3 received from the second measurement unit 33 is equal to or greater than the predetermined threshold value Th13, the second control unit 34 determines that the state of the second switch 92 is normal. In this case, the second control unit 34 generates a control signal E6 of a logically low level. The second control unit 34 then outputs the generated control signal E6 to the logic circuit unit 25. The control signals E5 and E6 are output exclusively.

[0242] [ON Control of Second Switch] FIG. 14 is a diagram for explaining ON control of the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0243] 14, for example, second switch 92 is turned on by an ON control signal S31 generated by signal generating unit 24.

[0244] More specifically, as described above, when the second control unit 34 determines that the state of the second switch 92 is normal, the second control unit 34 generates the control signal E6 of a logical low level. Then, the second control unit 34 outputs the generated control signal E6 to the logic circuit unit 25.

[0245] Logic circuit section 25 further includes an AND gate 82 and a NOT gate 83. When control signal E6 is input to NOT gate 83, a gate signal T11 of a logic high level is output from NOT gate 83 to AND gate 82.

[0246] When ON control signal S31 and gate signal T11 are input to AND gate 82, gate signal A5 at a logic high level is output from AND gate 82 to second switch 92.

[0247] Second switch 92 is turned on when it receives gate signal A5 of a logic high level from AND gate 82. As a result, power from power supply unit 10 is supplied to door open / close sensor 201E.

[0248] [Turning Off the Second Switch] FIG. 15 is a diagram for explaining the turning off control of the second switch performed by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0249] 15 , for example, when signal generating unit 24 receives a driving end notification from determination unit 22, it generates off control signal S32. For example, off control signal S32 is a signal at a logical low level. Off control signal S32 is an example of a fourth control signal.

[0250] Then, the signal generating section 24 outputs the generated OFF control signal S32 to the logic circuit section 25. The ON control signal S31 and the OFF control signal S32 are output exclusively.

[0251] For example, the second switch 92 is turned off by an off control signal S32 generated by the signal generating unit 24.

[0252] More specifically, when the OFF control signal S32 and the gate signal T11 are input to the AND gate 82 in the logic circuit section 25, the gate signal A6 at a logic low level is output from the AND gate 82 to the second switch 92.

[0253] Second switch 92 is turned off when it receives gate signal A6 of a logic low level from AND gate 82. This stops the supply of power to door open / close sensor 201E.

[0254] [When an abnormality occurs in the first switch 91] Fig. 16 is a diagram for explaining another example of the off control of the first switch by the vehicle relay device according to the embodiment of the present disclosure. Fig. 16 is a diagram for explaining the off control of the first switch 91A when an abnormality occurs in the first switch 91A.

[0255] 16, the first control unit 32A turns off the first switch 91A based on the measurement result K1 of the first measurement unit 31A, regardless of the OR condition for turning on the corresponding first switch 91A.

[0256] More specifically, as described above, the first control unit 32A outputs a control signal E3 of a logical low level to the logic circuit unit 25 when the measurement result K1 indicated by the measurement result information M1 received from the first measurement unit 31A is less than the threshold value Th11.

[0257] When control signal E3 is input to AND gate 81A in logic circuit section 25, gate signal A3 at a logic low level is output to first switch 91A regardless of the gate signal from OR gate 71A.

[0258] The first switch 91A turns off when it receives a gate signal A3 of a logical low level from the AND gate 81A. This stops the power supply to the autonomous driving ECU 201G. This makes it possible to cut off the power supply to the location where the abnormality has occurred and to prevent voltage increases or decreases in other on-board devices 201 other than the autonomous driving ECU 201G. Therefore, when a device in the on-board network 401 controls a specific on-board device 201, that control can be performed normally.

[0259] Furthermore, as described above, the in-vehicle system 301 includes multiple driving-related devices, specifically two autonomous driving ECUs 201G and 201J. As a result, even after an abnormality occurs in one of the multiple first switches 91 connected to the multiple driving-related devices, the driving-related function can be provided by the driving-related device connected to the other first switch 91 in the in-vehicle network 401. In the example shown in FIG. 16 , even if an abnormality occurs in the first switch 91A to which the autonomous driving ECU 201G is connected, the autonomous driving function can be provided by the autonomous driving ECU 201J connected to the first switch 91B.

[0260] [When an Abnormality Occurs in the Second Switch 92] FIG. 17 is a diagram for explaining another example of the off control of the second switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0261] Referring to Figure 17, for example, the second control unit 34 turns off the second switch 92 based on the measurement result K3 of the second measurement unit 33, regardless of the on control signal S31 and the off control signal S32 generated by the signal generation unit 24.

[0262] More specifically, as described above, if the measurement result K3 indicated by the measurement result information M3 received from the second measurement unit 33 is less than the threshold value Th13, the second control unit 34 outputs a control signal E5 of a logical high level to the logic circuit unit 25.

[0263] When the control signal E5 is input to the NOT gate 83 in the logic circuit unit 25, a gate signal T12 of a logic low level is output to the AND gate 82. When the gate signal T12 is input to the AND gate 82, a gate signal A6 of a logic low level is output to the second switch 92, regardless of the control signal from the signal generating unit 24.

[0264] The second switch 92 is turned off when it receives the gate signal A6 of the logic low level from the AND gate 82. This stops the power supply to the verification ECU 201A.

[0265] [When an abnormality occurs in the power switch 93] Fig. 18 is a diagram for explaining another example of the power switch off control by the vehicle relay device according to the embodiment of the present disclosure. Fig. 18 is a diagram for explaining the power switch off control when an abnormality occurs in the power switch 93A.

[0266] Referring to FIG. 18, the third control unit 36A turns off the power switch 93A based on the measurement result K5 of the third measurement unit 35A, regardless of the OR condition for turning on the power switch 93A.

[0267] More specifically, as described above, the third control unit 36A outputs a control signal E9 of a logical low level to the logic circuit unit 25 when the measurement result K5 indicated by the measurement result information M5 received from the third measurement unit 35A satisfies a predetermined condition W5.

[0268] When control signal E9 is input to AND gate 73A in logic circuit section 25, gate signal A9 at a logic low level is output to power switch 93A regardless of the gate signal from OR gate 72A.

[0269] The power switch 93A is turned off when it receives a gate signal A9 of a logical low level from the AND gate 73A, thereby stopping the supply of power to the automatic driving ECU 201G.

[0270] [Operation Flow] Next, the operation flow of the in-vehicle relay device 101 and the in-vehicle device 201 in the in-vehicle system 301 according to the embodiment of the present disclosure will be described with reference to the drawings.

[0271] 19, 20, and 21 are flowcharts showing an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. 19, 20, and 21 show an operation when the in-vehicle relay device 101 turns on the first switches 91A, 91B, and the second switch 92 using the on control signal S11 and the on control signal S31, respectively, when the first switches 91A, 91B, and the second switch 92 are in normal states.

[0272] 19, 20 and 21, first, the vehicle-mounted relay device 101 generates a control signal E1 and a control signal E2 at a logical high level (step ST101).

[0273] Next, the second control unit 34 in the vehicle relay device 101 generates a control signal E5 at a logical low level (step ST102). Note that steps ST101 and ST102 may be executed in reverse order or in parallel.

[0274] Next, the in-vehicle relay device 101 waits for reception of key verification information from the verification ECU 201A (NO in step ST103).

[0275] Next, when the in-vehicle relay device 101 receives the key verification information from the verification ECU 201A (YES in step ST103), the in-vehicle relay device 101 waits for reception of the switch monitoring information B from the body ECU 201B (NO in step ST104).

[0276] Then, when the in-vehicle relay device 101 receives switch monitoring information B from the body ECU 201B within a predetermined time after receiving the key matching information from the matching ECU 201A (YES in step ST104), it uses the received switch monitoring information B to determine whether the state of the vehicle 1 is in a running start state (step ST105).

[0277] If the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the off state, the vehicle relay device 101 determines that the vehicle 1 is not in a running start state (NO in step ST105) and waits to receive new switch monitoring information B from the body ECU 201B (NO in step ST104).

[0278] On the other hand, if the switch monitoring information B received from the body ECU 201B indicates that the brake pedal switch or the engine switch is in the on state, it is determined that the vehicle 1 is in the driving start state (YES in step ST105), and a driving start notification is broadcast to each in-vehicle device 201 (step ST106).

[0279] Next, the signal generating unit 24 in the vehicle relay device 101 generates an on control signal S11 for turning on each first switch 91, an on control signal S31 for turning on the second switch 92, and an on control signal S51 for turning on the power switch 93A (step ST107).

[0280] Next, the in-vehicle repeater 101 turns on the power switch 93A. For example, as described above, in the in-vehicle repeater 101, the signal generating unit 24 outputs the generated on control signal S51 to the logic circuit unit 25. Then, the OR gate 72A in the logic circuit unit 25 outputs the gate signal G3 of a logic high level to the power switch 93A (step ST108).

[0281] Next, the in-vehicle relay device 101 turns on the first switches 91A and 91B. For example, as described above, the signal generating unit 24, the first control unit 32A, and the first control unit 32B output the ON control signal S11, the control signal E1 at a logical high level, and the control signal E2 at a logical high level to the logic circuit unit 25. Then, the AND gate 81A and the AND gate 81B in the logic circuit unit 25 output gate signals at a logical high level to the first switches 91A and 91B, respectively (step ST109). This starts the supply of power to the autonomous driving ECUs 201G and 201J.

[0282] Next, the in-vehicle relay device 101 turns on the second switch 92. For example, as described above, the signal generating unit 24 and the second control unit 34 output the ON control signal S31 and the control signal E6 of a logically low level, respectively, to the logic circuit unit 25. When the control signal E6 of a logically low level is input to the NOT gate 83, the NOT gate 83 outputs a gate signal T11 of a logically high level to the AND gate 82. When the ON control signal S31 and the gate signal T11 of a logically high level are input to the AND gate 82, the AND gate 82 outputs a gate signal A5 of a logically high level to the second switch 92 (step ST110). This starts the supply of power to the door opening / closing sensor 201E.

[0283] Next, the in-vehicle relay device 101 waits for reception of the start-up completion notification N1 from the autonomous driving ECUs 201G and 201J (NO in step ST111).

[0284] Next, when the in-vehicle relay device 101 receives a startup completion notification N1 from the autonomous driving ECUs 201G, 201J (YES in step ST111), it broadcasts an equipment status notification indicating that the autonomous driving ECUs 201G, 201J are operating to each in-vehicle device 201 (step ST112).

[0285] Next, the vehicle-mounted relay device 101 waits for reception of the ON control signals S21, S61, and S71 from the management device 201H (NO in step ST113).

[0286] Then, when the vehicle relay device 101 receives the on control signals S21, S61, and S71 from the management device 201H (YES in step ST113), it transmits a switch-on notification N21 indicating that the on control signal S21 has been received, and a switch-on notification N22 indicating that the on control signals S61 and S71 have been received, to the management device 201H (step ST114), and waits to receive a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (NO in step ST115).

[0287] Next, when the vehicle relay device 101 receives a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201B (YES in step ST115), it determines whether the state of the vehicle 1 is in a driving end state based on the sensor information C1, C2, and C3 contained in the received sensor monitoring information (step ST116).

[0288] When the vehicle relay device 101 determines that the state of the vehicle 1 is the traveling end state (YES in step ST116), the vehicle relay device 101 broadcasts a traveling end notification to each vehicle-mounted device 201 (step ST117).

[0289] The in-vehicle relay device 101 also broadcasts an OFF transition request to each in-vehicle device 201 to request the suspension of the execution of the driving-related functions (step ST118).

[0290] Next, the vehicle relay device 101 waits to receive an off control signal S22 for turning off the first switches 91A and 91B, and off control signals S62 and S72 for turning off the power switches 93A and 93B, respectively, from the management device 201H (NO in step ST119).

[0291] Then, when the vehicle relay device 101 receives the off control signals S22, S62, and S72 from the management device 201H (YES in step ST119), it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201H (step ST120).

[0292] Next, after transmitting the switch-off notifications N11 and N12 to the management device 201H, the in-vehicle relay device 101 waits for reception of a stop preparation completion notification from the autonomous driving ECUs 201G and 201J (NO in step ST121).

[0293] Next, in the vehicle relay device 101, when the signal generation unit 24 receives a notification that stop preparation is complete from the autonomous driving ECUs 201G and 201J via the management device 201H (YES in step ST121), it generates an off control signal S12 for turning off the first switches 91A and 91B and outputs it to the logic circuit unit 25 (step ST122).

[0294] Next, the in-vehicle relay device 101 turns off the first switches 91A and 91B. For example, as described above, the logic circuit unit 25 receives the off control signal S22 from the management device 201H via the signal line 6. Furthermore, upon receiving a stop preparation completion notification from the autonomous driving ECUs 201G and 201J, the signal generating unit 24 outputs the off control signal S12 to the logic circuit unit 25. Then, the AND gate 81A and the AND gate 81B in the logic circuit unit 25 output gate signals of a logical low level to the first switches 91A and 91B, respectively (step ST123).

[0295] Next, when the in-vehicle relay device 101 turns off the first switch 91, it waits for a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 (NO in step ST124).

[0296] Then, in the vehicle relay device 101, when the signal generation unit 24 receives a notification that stop preparation is complete from all vehicle ECUs in the vehicle network 401 (YES in step ST124), it generates an off control signal S52 for turning off the power switch 93A and outputs it to the logic circuit unit 25 (step ST125).

[0297] Next, in-vehicle repeater 101 turns off power switch 93A. For example, as described above, in in-vehicle repeater 101, logic circuit unit 25 inputs both off control signal S52 and off control signal S62 to OR gate 72A. Then, OR gate 72A outputs gate signal S6 of a logical low level to power switch 93A (step ST126).

[0298] 22 is a flowchart showing another example of an operation procedure when the vehicle relay device according to the embodiment of the present disclosure controls each switch, in which the power switch 93A, the power switch 93B, and the first switch 91 are turned on by the ON control signal S61, the ON control signal S71, and the ON control signal S21, respectively, generated by the management device 201H.

[0299] 22 , first, in-vehicle relay device 101 receives on-control signals S61 and S71 for turning on power switches 93A and 93B, respectively, from management device 201H via signal line 6, and turns on power switches 93A and 93B. For example, as described above, in in-vehicle relay device 101, logic circuit unit 25 receives on-control signals S61 and S71 from management device 201H via signal line 6a. Third control unit 36A and third control unit 36B output the control signals E7 and E8, which they respectively generate, at a logic high level, to logic circuit unit 25. AND gate 73A in logic circuit unit 25 then outputs gate signal A7 at a logic high level to power switch 93A. AND gate 73B in logic circuit unit 25 then outputs gate signal A8 at a logic high level to power switch 93B (step ST201).

[0300] Next, the vehicle-mounted relay device 101 transmits to the management device 201H a switch-on notification N22 indicating that the on-control signals S61 and S71 have been received from the management device 201H (step ST202).

[0301] Next, vehicle relay device 101 receives an ON control signal S21 for turning on first switches 91A and 91B from management device 201H via signal line 6, and turns on first switches 91A and 91B. For example, as described above, logic circuit unit 25 receives ON control signal S21 from management device 201H via signal line 6. Furthermore, first control unit 32A and first control unit 32B output the control signal E1 and control signal E2 of a logical high level that they have generated, respectively, to logic circuit unit 25. Then, AND gate 81A and AND gate 81B in logic circuit unit 25 output gate signal A1 and gate signal A2 of a logical high level to first switch 91A and first switch 91B, respectively (step ST203).

[0302] Next, the vehicle-mounted relay device 101 transmits to the management device 201H a switch-on notification N21 indicating that the on-control signal S21 has been received from the management device 201H (step ST204).

[0303] 23 and 24 are flowcharts illustrating an example of an operation procedure when the in-vehicle relay device 101 performs measurement processing on the first switch 91A, the first switch 91B, and the second switch 92.

[0304] 23 and 24, first, the first measurement unit 31A, the first measurement unit 31B, and the second measurement unit 33 in the vehicle-mounted relay device 101 perform measurements on the first switch 91A, the first switch 91B, and the second switch 92, respectively (step ST301).

[0305] Next, first measuring unit 31A, first measuring unit 31B, and second measuring unit 33 output measurement result information to first control unit 32A, first control unit 32B, and second control unit 34, respectively (step ST302).

[0306] Next, the first control unit 32A checks whether the measurement result K1 indicated by the measurement result information received from the first measuring unit 31A is equal to or greater than the threshold value Th11 (step ST303).

[0307] If the measurement result K1 is less than the threshold value Th11 (NO in step ST303), the first control unit 32A determines that the state of the first switch 91A is abnormal (step ST304).

[0308] Next, first control unit 32A generates control signal E3 at a logically low level, and outputs the generated control signal E3 to logic circuit unit 25 (step ST305).

[0309] Next, the in-vehicle relay device 101 turns off the first switch 91A. For example, as described above, when the control signal E3 at a logically low level is input to the AND gate 81A in the logic circuit unit 25, the gate signal A3 at a logically low level is output to the first switch 91A (step ST306). This stops the power supply to the autonomous driving ECU 201G.

[0310] On the other hand, if the measurement result K1 is equal to or greater than the threshold value Th11 (YES in step ST303), the first control unit 32A determines that the state of the first switch 91A is normal (step ST307).

[0311] Next, first control unit 32A generates control signal E1 at a logical high level, and outputs the generated control signal E1 to logic circuit unit 25 (step ST308).

[0312] Next, first control unit 32B checks whether measurement result K2 indicated by the measurement result information received from first measuring unit 31B is equal to or greater than threshold value Th12 (step ST309).

[0313] If the measurement result K2 is less than the threshold value Th12 (NO in step ST309), the first control unit 32B determines that the state of the first switch 91B is abnormal (step ST310).

[0314] Next, the first control unit 32B generates a control signal E4 at a logically low level, and outputs the generated control signal E4 to the logic circuit unit 25 (step ST311).

[0315] Next, the in-vehicle relay device 101 turns off the first switch 91B. For example, as described above, when the control signal E4 at a logically low level is input to the AND gate 81B in the logic circuit unit 25, the gate signal A4 at a logically low level is output to the first switch 91B (step ST312). This stops the power supply to the autonomous driving ECU 201J.

[0316] On the other hand, if the measurement result K2 is equal to or greater than the threshold value Th12 (YES in step ST309), the first control unit 32B determines that the state of the first switch 91B is normal (step ST313).

[0317] Next, first control unit 32B generates control signal E2 at a logical high level, and outputs the generated control signal E2 to logic circuit unit 25 (step ST314).

[0318] Next, the second control unit 34 checks whether the measurement result K3 indicated by the measurement result information received from the second measuring unit 33 is equal to or greater than the threshold value Th13 (step ST315).

[0319] If the measurement result K3 is less than the threshold value Th13 (NO in step ST315), the second control unit 34 determines that the state of the second switch 92 is abnormal (step ST316).

[0320] Next, the second control unit 34 generates a control signal E6 at a logically low level, and outputs the generated control signal E6 to the logic circuit unit 25 (step ST317).

[0321] Next, the in-vehicle relay device 101 turns off the second switch 92. For example, as described above, when the control signal E6 at a logically low level is input to the AND gate 82 in the logic circuit unit 25, the gate signal A6 at a logically low level is output to the second switch 92 (step ST318). This stops the power supply to the door open / close sensor 201E.

[0322] On the other hand, if the measurement result K3 is equal to or greater than the threshold value Th13 (YES in step ST315), the second control unit 34 determines that the state of the second switch 92 is normal (step ST319).

[0323] Next, second control unit 34 generates control signal E5 at a logical high level, and outputs the generated control signal E5 to logic circuit unit 25 (step ST320).

[0324] 25 and 26 are diagrams illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0325] 25 and 26, first, the management device 201H broadcasts an OFF completion notification indicating that the OFF control signal S22 has been transmitted to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST401).

[0326] Furthermore, the vehicle-mounted relay device 101 generates control signals E1 and E2 at a logically high level (step ST402).

[0327] Furthermore, the verification ECU 201A transmits the key verification information to the in-vehicle relay device 101 (step ST403).

[0328] Furthermore, the body ECU 201B transmits switch monitoring information indicating the monitoring results of the states of the brake pedal switch and the engine switch to the in-vehicle relay device 101 (step ST404).

[0329] Next, when the in-vehicle relay device 101 receives the key verification information and the switch monitoring information from the verification ECU 201A and the body ECU 201B, respectively, it performs a determination process J1 to determine whether the vehicle 1 is in a running start state. Here, it is assumed that the in-vehicle relay device 101 determines that the vehicle 1 is in a running start state (step ST405).

[0330] Next, the vehicle relay device 101 broadcasts a travel start notification indicating that the state of the vehicle 1 is in a travel start state to each vehicle-mounted device 201 (step ST406).

[0331] Next, the in-vehicle repeater 101 generates an ON control signal S11 for turning on the first switches 91A and 91B. The in-vehicle repeater 101 also generates ON control signals S51 and S53 for turning on the power switches 93A and 93B, respectively (step ST407).

[0332] Next, the in-vehicle relay device 101 turns on the power switches 93A and 93B using the OR gates 72A and 72B and the AND gates 73A and 73B as described above. The in-vehicle relay device 101 also turns on the first switches 91A and 91B using the OR gates 71A and 71B and the AND gates 81A and 81B as described above. This starts the supply of power to the autonomous driving ECUs 201G and 201J (step ST408).

[0333] Next, the autonomous driving ECUs 201G, 201J start up (step ST409) and transmit a start-up completion notification N1 indicating that they have started up to the in-vehicle relay device 101 (step ST410).

[0334] Next, the automatic driving ECUs 201G, 201J start executing the automatic driving function (step ST411). Note that steps ST410 and ST411 may be executed in reverse order or in parallel.

[0335] Furthermore, when the in-vehicle relay device 101 receives the startup completion notification N1 from the autonomous driving ECUs 201G, 201J, it broadcasts to each in-vehicle device 201 an equipment status notification indicating that the autonomous driving ECUs 201G, 201J are operating (step ST412).

[0336] In addition, the management device 201H receives an equipment status notification from the vehicle relay device 101 and generates on control signals S61 and S71 for turning on the power switches 93A and 93B, respectively, and an on control signal S21 for turning on the first switches 91A and 91B (step ST413).

[0337] Next, management device 201H transmits the generated ON control signals S61, S71, S21 to vehicle-mounted relay device 101 via signal line 6 (step ST414).

[0338] Next, the management device 201H broadcasts an on-uncertainty notification to each other in-vehicle device 201 and in-vehicle relay device 101 indicating that the execution of the on control of the first switch 91 by the on control signal S21, the on control of the power switch 93A by the on control signal S61, and the on control of the power switch 93B by the on control signal S71 is undetermined (step ST415).

[0339] Next, when the vehicle-mounted relay device 101 receives the ON control signal S21 from the management device 201H, it transmits a switch-on notification N21 indicating that the ON control signal S21 has been received to the management device 201H (step ST416).

[0340] Furthermore, when the vehicle relay device 101 receives the ON control signals S61 and S71 from the management device 201H, it transmits a switch-on notification N22 indicating that the ON control signals S61 and S71 have been received to the management device 201H (step ST417).

[0341] Next, when the management device 201H receives the switch-on notification N21 from the vehicle-mounted relay device 101, it broadcasts an on-completion notification indicating that the on control of the first switch 91 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST418).

[0342] Next, the parking brake ECU 201F receives the OFF completion notification, the ON unconfirmed notification, and the ON completion notification from the management device 201H, and performs a parking brake release process to transition the parking brake from the ON state to the OFF state (step ST419).

[0343] 27 and 28 are diagrams illustrating another example of the processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0344] 27 and 28, first, the management device 201H broadcasts an ON completion notification indicating that the ON control of the first switches 91A, 91B has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST501).

[0345] In addition, the body ECU 201B transmits to the vehicle relay device 101 a frame F including sensor information C1, sensor information C2, and sensor information C3, which respectively indicate the detection results of the occupant sensor 201C, the buckle sensor 201D, and the door opening / closing sensor 201E while the vehicle 1 is traveling (step ST502).

[0346] The parking brake ECU 201F also determines whether to transition the parking brake from the OFF state to the ON state. Here, it is assumed that the parking brake ECU 201F has received an ON completion notification from the management device 201H and has determined to transition the parking brake from the OFF state to the ON state because operation Q1 has been performed on the vehicle 1 (step ST503).

[0347] Next, the parking brake ECU 201F broadcasts a brake-on notification indicating that the parking brake has been switched to the on state to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST504).

[0348] Furthermore, the in-vehicle relay device 101 receives a frame F and a brake-on notification from the body ECU 201B and the parking brake ECU 201F, respectively, and performs a determination process J2 to determine whether the state of the vehicle 1 is in a traveling end state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling end state (step ST505).

[0349] Next, the vehicle relay device 101 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each vehicle-mounted device 201 (step ST506).

[0350] Furthermore, when the in-vehicle relay device 101 receives the brake-on notification from the parking brake ECU 201F, it broadcasts an OFF transition request to each in-vehicle device 201 before generating the OFF control signal S12 (step ST507).

[0351] Next, when the management device 201H receives a parking brake on notification from the parking brake ECU 201F and a driving end notification or an off transition request from the vehicle relay device 101, it generates an off control signal S22 for turning off the first switch 91, and off control signals S62 and S72 for turning off the power switches 93A and 93B, respectively (step ST508).

[0352] Next, the management device 201H broadcasts an OFF unconfirmed notification indicating that the OFF control of the first switch 91 by the OFF control signal S22 is unconfirmed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST509).

[0353] Next, management device 201H transmits the generated OFF control signals S22, S62, and S72 to vehicle-mounted relay device 101 via signal line 6 (step ST510).

[0354] Next, when the vehicle relay device 101 receives the off control signals S22, S62, and S72 from the management device 201H, it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201H (step ST511).

[0355] Next, when the management device 201H receives switch-off notifications N11 and N12 from the vehicle-mounted relay device 101, it broadcasts an off-completion notification indicating that the off-control signals S22, S62, and S72 have been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST512).

[0356] Next, when the autonomous driving ECUs 201G and 201J receive a driving end notification or an OFF transition request from the in-vehicle relay device 101 and an OFF completion notification from the management device 201H, they perform pre-processing to stop the execution of the autonomous driving function. For example, as described above, the autonomous driving ECUs 201G and 201J perform predetermined pre-processing in preparation for stopping the execution of the autonomous driving function (step ST513).

[0357] Next, the autonomous driving ECUs 201G, 201J transmit a stop preparation completion notification to the in-vehicle relay device 101 indicating that preparations for stopping the execution of the autonomous driving function have been completed (step ST514).

[0358] Next, when the in-vehicle relay device 101 receives the stop preparation completion notification from the autonomous driving ECUs 201G and 201J, it generates the OFF control signal S12 (step ST515).

[0359] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S12, it turns off the first switch 91 using the OR gate 71 and the AND gate 81 as described above (step ST516).

[0360] Next, the in-vehicle relay device 101 checks whether the execution of various services has been stopped in the in-vehicle network 401. For example, as described above, when the in-vehicle relay device 101 receives a notification that the preparation for stopping has been completed from all the in-vehicle ECUs in the in-vehicle network 401, the in-vehicle relay device 101 determines that the execution of various services has been stopped (step ST517).

[0361] Next, when the in-vehicle relay device 101 confirms that the execution of various services has been stopped, it generates an OFF control signal S52 (step ST518).

[0362] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S52, it turns off the power switch 93A using the OR gate 72A and the AND gate 73A as described above (step ST519).

[0363] In the in-vehicle system 301 according to the embodiment of the present disclosure, the first switch 91, the second switch 92, and the power switches 93A and 93B are configured to be provided in the in-vehicle relay device 101, but this is not limited to this. Some or all of the first switches 91A and 91B, the second switch 92, and the power switches 93A and 93B may be configured to be provided outside the in-vehicle relay device 101.

[0364] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to include the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34, but this is not limited thereto. A device other than the in-vehicle relay device 101 may be configured to include some or all of the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34. Furthermore, a plurality of devices may be configured to include the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34 as an in-vehicle power supply control system. For example, the in-vehicle relay device 101 may be configured to include some of the units of the first measurement units 31A and 31B, the first control units 32A and 32B, the second measurement unit 33, and the second control unit 34, and a device other than the in-vehicle relay device 101 may be configured to include the remaining units.

[0365] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the logic circuit unit 25 is configured to include an OR gate 71, but this is not limited thereto. The logic circuit unit 25 may be configured to include a NAND gate instead of the OR gate 71. In this case, the signal generating unit 24 in the in-vehicle relay device 101 and the signal generating unit 52 in the management device 201H generate an ON control signal S11 and an ON control signal S21 at a logical low level, respectively. When at least one of the ON control signal S11 and the ON control signal S21 is input to the NAND gate, a gate signal at a logical high level is output from the NAND gate to the first switch 91. In other words, even when the logic circuit unit 25 includes a NAND gate, the first switch 91 turns on under the OR condition of the ON control signal S11 and the ON control signal S21.

[0366] Furthermore, although the in-vehicle relay device 101 according to the embodiment of the present disclosure is configured to include the second switch 92 that is turned on and off by the on control signal S31 and the off control signal S32 generated by the signal generating unit 24, this is not limited to this. The in-vehicle relay device 101 may be configured not to include the second switch 92. In this case, the in-vehicle relay device 101 does not include the second monitoring unit 27.

[0367] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to perform measurements on the second switch 92 and turn off the second switch 92 based on the measurement results regardless of the ON control signal S31 and the OFF control signal S32, but this is not limited thereto. The in-vehicle relay device 101 may also be configured not to perform measurements on the second switch 92.

[0368] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S11 using a condition different from the condition under which the ON control signal S21 is generated, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S11 using the same condition as the condition under which the ON control signal S21 is generated.

[0369] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S11 using a determination criterion J1 that is different from the determination criterion J2 used by the management device 201H to generate the ON control signal S21, but this is not limited to this. The in-vehicle relay device 101 may also be configured to generate the ON control signal S11 using the same determination criterion as the determination criterion J2.

[0370] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the judgment criterion J2 used in the generation of the ON control signal S21 by the management device 201H includes a criterion related to the state of the parking brake of the vehicle 1, and the judgment criterion J1 used in the judgment process by the in-vehicle relay device 101 does not include a criterion related to the state of the parking brake, but this is not limited to this. The judgment criterion J2 may include a criterion other than the criterion related to the state of the parking brake, and the judgment criterion J1 may not include the other criterion.

[0371] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the off control signal S12 using conditions different from those for the off control signal S22, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the off control signal S12 using the same conditions as those for generating the off control signal S22.

[0372] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0373] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or may execute each of the processes according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet to execute the processes. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed into the memory from the recording medium.

[0374] The above description includes the following additional features: [Supplementary Note 1] An on-board power supply control system mounted on a vehicle, the on-board power supply control system comprising: a plurality of first control switches that switch on / off power supply to on-board devices in the vehicle; a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switches; and a processing circuit, the processing circuit generates a first control signal for turning on each of the first control switches, and receives a second control signal for turning on each of the first control switches from outside the on-board power supply control system, each of the first control switches is turned on based on an OR condition of the generated first control signal and the second control signal, and the processing circuit further turns off a corresponding one of the first control switches based on a measurement result of the first measurement unit, regardless of the OR condition.

[0375] REFERENCE SIGNS LIST 1 vehicle 2, 2A, 2B, 2C, 2D CAN bus 5, 5A, 5B, 5C, 5D power line 6 signal line 10 power supply unit 11 relay unit 12, 42 processing unit 13, 43 memory unit 21 power supply management unit 22, 51 determination unit 23, 53 notification unit 24, 52 signal generation unit 25 logic circuit unit 26, 26A, 26B first monitoring unit 27 second monitoring unit 28, 28A, 28B third monitoring unit 31A, 31B first measurement unit 32A, 32B first control unit 33 second measurement unit 34 second control unit 35A, 35B third measurement unit 36A, 36B third control unit 41 communication unit 61 first power supply 61a battery 61b DC / DC converter 62 second power supply 71, 71A, 71B, 72, 72A, 72B OR gate 73, 73A, 73B, 81, 81A, 81B, 82 AND gate 83 NOT gate 91, 91A, 91B First switch 92 Second switch 93, 93A, 93B Power switch 101 In-vehicle relay device 201A Verification ECU 201B Body ECU 201C Occupant sensor 201D Buckle sensor 201E Door opening / closing sensor 201F Parking brake ECU 201G, 201J Automatic driving ECU 201H Management device 301 In-vehicle system 401 In-vehicle network

Claims

1. An on-board power supply control system mounted on a vehicle, comprising: a plurality of first control switches that switch on / off the supply of power to on-board equipment in the vehicle; a signal generation unit that generates a first control signal to turn on each of the first control switches; and an input unit that receives a second control signal to turn on each of the first control switches from outside the on-board power supply control system, wherein each of the first control switches is turned on under an OR condition of the first control signal generated by the signal generation unit and the second control signal received by the input unit, and the on-board power supply control system further comprises: a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switch; and a first control unit that turns off the corresponding first control switch based on the measurement results of the first measurement units, regardless of the OR condition.

2. The in-vehicle power supply control system according to claim 1, further comprising: a second control switch that is turned on and off by a third control signal and a fourth control signal generated by the signal generating unit, respectively; a second measuring unit that is provided corresponding to the second control switch and performs measurements related to the second control switch; and a second control unit that turns off the second control switch based on the measurement results of the second measuring unit, regardless of the third control signal and the fourth control signal.

3. The in-vehicle power supply control system according to claim 1 or 2, wherein the signal generating unit generates the first control signal using a condition different from the condition under which the second control signal is generated.

4. The vehicle power supply control system according to any one of claims 1 to 3, further comprising a judgment unit that judges the state of the vehicle, the signal generation unit generates the first control signal based on the state judged by the judgment unit, and the second control signal is generated using a judgment criterion different from the judgment criterion for the state used by the signal generation unit to generate the first control signal.

5. An on-board power supply control system as described in claim 4, wherein the criteria used to generate the second control signal include criteria relating to the state of the parking brake of the vehicle, and the criteria used to generate the first control signal do not include criteria relating to the state of the parking brake.

6. An on-board power supply control system as described in any one of claims 1 to 5, wherein the signal generating unit further generates a fifth control signal for turning off each of the first control switches, the input unit further receives a sixth control signal for turning off each of the first control switches from outside the on-board power supply control system, and the signal generating unit generates the sixth control signal using conditions different from the conditions under which the fifth control signal is generated.

7. A switch control method in an on-board power supply control system mounted on a vehicle, wherein the on-board power supply control system comprises: a plurality of first control switches that switch on / off the supply of power to a first on-board device in the vehicle; and a plurality of first measurement units that are provided for each of the first control switches and perform measurements related to the first control switches, the switch control method comprising: a step of generating a first control signal for turning on each of the first control switches; a step of receiving a second control signal for turning on each of the first control switches from outside the on-board power supply control system; a step of turning on each of the first control switches based on an OR condition of the generated first control signal and the second control signal; and a step of turning off the corresponding first control switch based on the measurement results of the first measurement units, regardless of the OR condition.

Images