On-board system and electricity-feed control method

Abstract

This on-board system is installed in a vehicle, and includes a first on-board device and a second on-board device for controlling a switch for switching, ON and OFF, the supply of power to a specific on-board instrument in the vehicle. The first on-board device outputs, to the switch, a first ON control signal which is a control signal for turning ON the switch. The second on-board device outputs, to the switch, a second ON control signal which is a control signal for turning ON the switch. The switch is turned ON under an OR condition of the first ON control signal and the second ON control signal.

Description

In-vehicle system and power supply control method

[0001] This application claims priority based on Japanese Patent Application No. 2024-121009 filed on July 26, 2024, and Japanese Patent Application No. 2025-48345 filed on March 24, 2025, the disclosures of which are incorporated herein in their entirety by reference.

[0002] Patent Document 1 (JP 2011-195101 A) discloses the following control device: That is, the control device is connected to a relay switch to which one or more loads are connected, receives as input an instruction signal instructing the on / off of the load and a status signal corresponding to the status of the load, and controls the relay switch based on the input signals. The control device includes a plurality of control units that output control signals for controlling the on / off of the relay switch, and the instruction signal and status signal, a forced-off signal instructing the relay switch to be forced off, and a signal indicating the on / off status of the relay switch are input to one of the plurality of control units, and some or all of the signal input to the one control unit and the control signal output by the one control unit are input to the other control units.

[0003] JP 2011-195101 A

[0004] The in-vehicle system of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a first in-vehicle device and a second in-vehicle device that control a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, wherein the first in-vehicle device outputs a first on control signal to the switch for turning on the switch, and the second in-vehicle device outputs a second on control signal to the switch for turning on the switch, and the switch turns on under an OR condition of the first on control signal and the second on control signal.

[0005] One aspect of the present disclosure can be realized not only as an in-vehicle system equipped with such a characteristic processing unit, but also as a program for causing a computer to execute such characteristic processing steps, or as a semiconductor integrated circuit that realizes part or all of the in-vehicle system.

[0006] FIG. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. FIG. 2 is a diagram illustrating an example of the configuration of an in-vehicle relay device according to an embodiment of the present disclosure. FIG. 3 is a diagram illustrating in detail the configuration of a portion of the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 4 is a diagram illustrating the on-control of each switch by the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 5 is a diagram illustrating an example of the configuration of a management device according to an embodiment of the present disclosure. FIG. 6 is a diagram illustrating the on-control of each switch by the management device according to an embodiment of the present disclosure. FIG. 7 is a diagram illustrating the off-control of a control switch by the in-vehicle relay device according to an embodiment of the present disclosure. FIG. 8 is a flowchart illustrating an example of an operation procedure when the in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 9 is a flowchart illustrating an example of an operation procedure when the in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 10 is a flowchart illustrating an example of an operation procedure when the in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 11 is a flowchart defining another example of an operational procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. FIG. 12 is a flowchart defining an example of an operational procedure when a management device according to an embodiment of the present disclosure controls each switch. FIG. 13 is a flowchart defining an example of an operational procedure when a management device according to an embodiment of the present disclosure controls each switch. FIG. 14 is a diagram illustrating an example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 15 is a diagram illustrating an example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 16 is a diagram illustrating another example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure. FIG. 17 is a diagram illustrating another example of a processing sequence of an in-vehicle relay device and in-vehicle equipment in an in-vehicle system according to an embodiment of the present disclosure.

[0007] 2. Description of the Related Art Conventionally, techniques have been developed for controlling a switch that switches on and off the supply of power to an in-vehicle device.

[0008] [Problem to be Solved by the Present Disclosure] For example, if an abnormality occurs in the device that controls the switch, the power supply to the in-vehicle device may be stopped, which may limit or stop the functions executed by the in-vehicle device.

[0009] The present disclosure has been made to solve the above-mentioned problems, and its purpose is to provide an in-vehicle system and a power supply control method that can suppress the restriction or suspension of functions executed by in-vehicle equipment.

[0010] [Effects of the Present Disclosure] According to the present disclosure, it is possible to prevent the restriction or suspension of functions executed by in-vehicle devices.

[0011] [Description of Embodiments of the Present Disclosure] First, the contents of the embodiments of the present disclosure will be listed and described. (1) An in-vehicle system according to an embodiment of the present disclosure is an in-vehicle system mounted on a vehicle, and includes a first in-vehicle device and a second in-vehicle device that control a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, wherein the first in-vehicle device outputs a first on-control signal to the switch for turning on the switch, and the second in-vehicle device outputs a second on-control signal to the switch for turning on the switch, and the switch is turned on under an OR condition of the first on-control signal and the second on-control signal.

[0012] With this configuration, even if an abnormality occurs in one of the first and second in-vehicle devices that control the switch, the switch can be turned on by a control signal output from the other device. In other words, the control for turning on the switch is made redundant, thereby reducing the possibility of power supply to a specific in-vehicle device being stopped. Therefore, it is possible to prevent the restriction or stop of functions executed by the in-vehicle device.

[0013] (2) In (1) above, the first in-vehicle device may output a first off control signal to the switch for turning off the switch, and the second in-vehicle device may output a second off control signal to the switch for turning off the switch, and the first off condition, which is the condition under which the first in-vehicle device outputs the first off control signal, may be different from the second off condition, which is the condition under which the second in-vehicle device outputs the second off control signal.

[0014] With this configuration, even if one of the first and second in-vehicle devices mistakenly determines that the conditions for turning the switch off have been met, the switch can continue to be turned on by the control signal output from the other device.Therefore, by making the control for turning on the switch redundant, the possibility of power supply to a specific in-vehicle device being stopped can be reduced.

[0015] (3) In the above (2), the first off condition may include a condition regarding the state of the specific in-vehicle device, and the second off condition may not include a condition regarding the state of the specific in-vehicle device.

[0016] With this configuration, for example, if a failure occurs in a particular in-vehicle device, it is possible to prevent both the first in-vehicle device and the second in-vehicle device from erroneously outputting an OFF control signal to the switch.

[0017] (4) In the above (3), the specific in-vehicle device may be an in-vehicle device that executes a function related to the running of the vehicle.

[0018] With this configuration, when a certain in-vehicle device is performing a function related to the vehicle's operation, the switch is turned off by an off control signal output from both the first in-vehicle device and the second in-vehicle device, preventing the power supply to the in-vehicle device from being stopped.

[0019] (5) In any of (1) to (4) above, the first on condition, which is the condition under which the first in-vehicle device outputs the first on control signal, may be different from the second on condition, which is the condition under which the second in-vehicle device outputs the second on control signal.

[0020] With this configuration, a control signal for turning on the switch can be output under a wider variety of conditions, so that the switch can be turned on more reliably.

[0021] (6) In any of (1) to (5) above, the in-vehicle system may further include a third in-vehicle device that controls a parking brake of the vehicle, and the third in-vehicle device may transition the parking brake from an on state to an off state when the first in-vehicle device outputs the first on control signal, the second in-vehicle device outputs the second on control signal, and a predetermined operation is performed in the vehicle.

[0022] With this configuration, when the vehicle's parking brake is transitioned from the on state to the off state, i.e., when the vehicle starts moving, the first on control signal or the second on control signal can be used to complete the transition of the switch to the on state.Therefore, by making the control for turning on the switch redundant, it is possible to reduce the possibility of power supply to specific on-board equipment, such as on-board equipment that performs necessary functions, being stopped while the vehicle is moving.

[0023] (7) In any of (1) to (6) above, the specific vehicle equipment may be a driving-related device that is a vehicle equipment that executes a function related to the driving of the vehicle, and the driving-related device may start executing the function when the vehicle is in a state where it can start driving and the state of the switch is in an on state by the first on control signal or the second on control signal.

[0024] With this configuration, functions of driving-related equipment such as on-board equipment that controls the vehicle's steering and on-board equipment that controls the vehicle's brakes can be executed before the parking brake is released, thereby preventing delays in the start of execution of these functions.

[0025] (8) In (7) above, the vehicle may be provided with a plurality of the driving-related devices, and some of the driving-related devices may start executing the function when the vehicle is in a state where it can start driving, the switch is in an on state by the first on control signal or the second on control signal, and the parking brake of the vehicle is in an off state.

[0026] For example, in some driving-related devices, the conditions for executing a function of the driving-related device may further include that the parking brake be in an off state. With the above-described configuration, the function can be executed more reliably.

[0027] (9) In (7) or (8) above, the first in-vehicle device may transmit to the driving-related equipment a driving end notification indicating that the vehicle is in a state to end driving or a request notification to request that execution of the function be stopped before outputting a first off control signal to the switch to turn off the switch, and the driving-related equipment may perform pre-processing to stop execution of the function before the power supply to the driving-related equipment is stopped when the driving end notification or the request notification is received from the first in-vehicle device and the second in-vehicle device outputs a second off control signal to turn off the switch.

[0028] With this configuration, preparations for stopping execution of a function related to vehicle driving can be made at an appropriate timing, for example, when the vehicle is stopped or parked, etc. Furthermore, by setting the condition for the driving-related device to make such preparations as receiving a driving end notification or request notification from the first in-vehicle device and outputting a second off control signal from the second in-vehicle device, it is possible to prevent the driving-related device from erroneously making such preparations, for example, when an abnormality occurs in one of the first and second in-vehicle devices while the vehicle is driving.

[0029] (10) In the above (9), the first vehicle-mounted device may output the first off control signal to the switch when the second vehicle-mounted device outputs the second off control signal and the driving-related equipment has performed the pre-processing.

[0030] With this configuration, when preparations are complete to stop the execution of a function related to the vehicle's driving, the switch state can be transitioned to the off state, thereby preventing the power supply to the vehicle equipment that executes that function from being stopped at an unintended time.

[0031] (11) In the above (9) or (10), the first in-vehicle device may include an OR circuit that outputs a signal indicating the logical sum of the first off control signal and the second off control signal to the switch, the second in-vehicle device may transmit the second off control signal to the first in-vehicle device, the first in-vehicle device may, when receiving the second off control signal from the second in-vehicle device, transmit a reception notification to the second in-vehicle device indicating that the second off control signal has been received, the second in-vehicle device may, when receiving the reception notification from the first in-vehicle device, transmit a completion notification to the driving-related equipment indicating that transmission of the second off control signal has been completed, and the driving-related equipment may perform the pre-processing when receiving the request notification from the first in-vehicle device and the completion notification from the second in-vehicle device.

[0032] In this way, by setting the receipt of a request notification and a completion notification from the first in-vehicle device and the second in-vehicle device, respectively, as a condition for the driving-related device to prepare to stop executing a function, the control for making the preparation can be made redundant, and therefore, if an abnormality occurs in one of the first in-vehicle device and the second in-vehicle device while the vehicle is traveling, it can be more reliably prevented that the driving-related device will erroneously make the preparation. Furthermore, if the completion notification does not arrive from the second in-vehicle device, it can be determined that a fault, such as a break in the signal line for outputting an OFF control signal from the second in-vehicle device to the first in-vehicle device, has occurred.

[0033] (12) In any of (7) to (11) above, the in-vehicle system may further include a third in-vehicle device that is an in-vehicle device that controls a parking brake of the vehicle, and the first in-vehicle device may include an OR circuit that outputs a signal indicating the logical sum of the first on-control signal and the second on-control signal to the switch, and the first in-vehicle device may transmit to the second in-vehicle device and the third in-vehicle device a driving start notification indicating that the vehicle is in a state where it can start driving, or an equipment status notification indicating that the driving-related equipment is in operation, and when the second in-vehicle device receives the driving start notification or the equipment status notification from the first in-vehicle device, it may transmit the second on-control signal to the first in-vehicle device, and the first in-vehicle device When the second on-vehicle device receives the second on-control signal from the second on-vehicle device, it may send a reception notification to the second on-vehicle device indicating that the second on-control signal has been received, and when the second on-vehicle device receives the reception notification from the first on-vehicle device, it may send an on-execution notification to the third on-vehicle device indicating that on-control of the switch will be executed using the second on-control signal, and when the parking brake is in an on-state, the third on-vehicle device may transition the parking brake from the on-state to the off-state when it receives the driving start notification or the equipment status notification from the first on-vehicle device and the on-execution notification from the second on-vehicle device and an operation to turn off the parking brake is performed in the vehicle.

[0034] In this way, by configuring the condition for transitioning the parking brake from the ON state to the OFF state by receiving a driving start notification or an equipment status notification from the first in-vehicle device, receiving an ON execution notification from the second in-vehicle device, and setting the operation of turning off the parking brake in the vehicle as the condition, the OFF control of the parking brake can be made redundant, so that if an abnormality occurs in one of the first in-vehicle device or the second in-vehicle device, the device controlling the parking brake can be prevented from erroneously performing the OFF control. Furthermore, if the ON execution notification does not arrive from the second in-vehicle device, it can be determined that a fault, such as a break, has occurred in the signal line for outputting the ON control signal from the second in-vehicle device to the first in-vehicle device.

[0035] (13) A power supply control method according to an embodiment of the present disclosure is a power supply control method for an in-vehicle system mounted on a vehicle, the in-vehicle system including a first in-vehicle device and a second in-vehicle device, the first in-vehicle device being an in-vehicle device that controls a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, the first in-vehicle device outputting a first on control signal to the switch for turning on the switch, the second in-vehicle device outputting a second on control signal to the switch for turning on the switch, and the switch turning on under an OR condition of the first on control signal and the second on control signal.

[0036] With this method, even if an abnormality occurs in one of the first and second in-vehicle devices that control the switch, the switch can be turned on by a control signal output from the other device. In other words, the control for turning on the switch is made redundant, thereby reducing the possibility of power supply to a specific in-vehicle device being stopped. Therefore, it is possible to prevent the restriction or stop of functions executed by the in-vehicle device.

[0037] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the drawings, identical or corresponding parts are designated by the same reference numerals, and their description will not be repeated. Furthermore, at least some of the embodiments described below may be combined in any manner.

[0038] [In-Vehicle System] Fig. 1 is a diagram illustrating an example of the configuration of an in-vehicle system according to an embodiment of the present disclosure. Referring to Fig. 1, the in-vehicle system 301 includes an in-vehicle relay device 101, an in-vehicle device group including a plurality of in-vehicle devices 201, and a power supply unit 51. The in-vehicle system 301 is mounted on a vehicle 1. The in-vehicle relay device 101 is an example of a first in-vehicle device.

[0039] The in-vehicle devices 201 include an in-vehicle ECU (Electronic Control Unit), an OTA (Over The Air) master, sensors, actuators, motors, a navigation device, a human-machine interface, and a camera. The in-vehicle ECUs include an autonomous driving ECU, an engine ECU, a body ECU, a verification ECU, a steering ECU, a parking brake ECU, and a TCU (Telematics Communication Unit).

[0040] The in-vehicle relay device 101 and the plurality of in-vehicle devices 201 constitute an in-vehicle network 401. The plurality of in-vehicle devices 201 are connected to the in-vehicle relay device 101 via a CAN bus 2 that conforms to the CAN (Controller Area Network) standard, for example.

[0041] 1, in-vehicle system 301 includes in-vehicle devices 201A, 201B, 201C, 201D, 201E, 201F, 201G, and 201H that are in-vehicle devices 201. Also, in the example shown in Fig. 1, CAN buses 2A, 2B, 2C, and 2D are provided as CAN bus 2.

[0042] In-vehicle devices 201A and 201B are connected to in-vehicle relay device 101 via CAN bus 2A. In-vehicle devices 201C and 201D are connected to in-vehicle relay device 101 via CAN bus 2B. In-vehicle devices 201E and 201F are connected to in-vehicle relay device 101 via CAN bus 2C. In-vehicle devices 201G and 201H are connected to in-vehicle relay device 101 via CAN bus 2D.

[0043] The in-vehicle relay device 101 performs a relay process for relaying frames transmitted and received between the in-vehicle devices 201 .

[0044] For example, each in-vehicle device 201 transmits a CAN frame including various information (described later) such as information for assisting the autonomous driving performed by the vehicle 1 and information used for entertainment, and a CAN-ID (Identifier) ​​indicating the type of data, to another in-vehicle device 201 or the in-vehicle relay device 101. The in-vehicle relay device 101 relays a CAN frame received from one in-vehicle device 201 to another in-vehicle device 201. The in-vehicle relay device 101 also creates a CAN frame including the various information and the CAN-ID, and transmits the created CAN frame to the destination in-vehicle device 201.

[0045] The in-vehicle system 301 is not limited to a configuration in which four CAN buses 2 are provided, but may be a configuration in which one, two, three, or five or more CAN buses 2 are provided.

[0046] Furthermore, the on-board relay device 101 and the on-board device 201 may be configured to communicate in accordance with a communication protocol such as CAN FD (CAN with Flexible Data Rate), Ethernet (registered trademark), FlexRay (registered trademark), MOST (Media Oriented System Transport) (registered trademark), LIN (Local Interconnect Network), and CXPI (Clock Extension Peripheral Interface) (registered trademark), instead of or in addition to communication in accordance with the CAN standard.

[0047] The vehicle relay device 101 and each vehicle device 201 communicate with each other to provide various services in the vehicle 1 .

[0048] Specifically, the in-vehicle network 401 provides services related to the operation of the vehicle 1, a service for updating various software used in the in-vehicle network 401 via OTA, a service for contactlessly charging the battery 71 installed in the vehicle 1, a service for detecting malfunctions in the vehicle 1, and a service for remotely operating the vehicle 1.

[0049] [Power Supply Unit] The power supply unit 51 supplies power to the vehicle 1. The power supply unit 51 includes a first power supply 61 and a second power supply 62. When a service is being executed, both the first power supply 61 and the second power supply 62 supply power to each device in the in-vehicle system 301. When the execution of the service is stopped, the second power supply 62 supplies power to each device in the in-vehicle system 301.

[0050] The first power source 61 is connected to the on-board relay device 101 via a power line 3. The second power source 62 is connected to the on-board relay device 101 via a power line 4. Each on-board device 201 is connected to the on-board relay device 101 via a power line 5. The power line 3 and the power line 5 are connected within the on-board relay device 101. The power line 4 and the power line 5 are connected within the on-board relay device 101.

[0051] The power supply unit 51 is not limited to a configuration including two power supplies, that is, the first power supply 61 and the second power supply 62, but may be a configuration including one power supply.

[0052] 1, power lines 5A, 5B, 5C, and 5D are provided as the power line 5. The on-board devices 201A and 201B are connected to the on-board relay device 101 via the power line 5A. The on-board devices 201C and 201D are connected to the on-board relay device 101 via the power line 5B. The on-board devices 201E and 201F are connected to the on-board relay device 101 via the power line 5C. The on-board devices 201G and 201H are connected to the on-board relay device 101 via the power line 5D.

[0053] For example, the first power supply 61 includes a battery 71 and a DC / DC converter 72. The battery 71 is a high-voltage battery such as a lithium-ion battery. The DC / DC converter 72, for example, steps down a DC voltage Va of the battery 71 to generate a DC voltage Vb. The DC / DC converter 72 then outputs the DC voltage Vb to the power supply line 3.

[0054] The second power supply 62 includes, for example, a low-voltage battery having a lower voltage than the battery 71 of the first power supply 61 .

[0055] [Control Switch] For example, the in-vehicle relay device 101 includes a control switch 91 that switches on / off the supply of power to a specific in-vehicle device 201 in the vehicle 1. The control switch 91 is, for example, a semiconductor switch. Note that, in Fig. 1, the control switch 91 is shown outside the in-vehicle relay device 101 for ease of understanding.

[0056] More specifically, for example, the control switch 91 switches on and off the supply of power to the in-vehicle devices 201 (hereinafter also referred to as "driving-related devices") that execute functions related to driving of the vehicle 1 (hereinafter also referred to as "driving-related functions"). Specifically, the driving-related devices include an EPS (Electric Power Steering) ECU, a steering ECU, an autonomous driving ECU, a foot brake ECU, an ABS (Anti-lock Braking System) ECU, and a parking brake ECU.

[0057] 1, a plurality of driving-related devices are provided in the vehicle 1. Specifically, the driving-related devices are in-vehicle devices 201F and 201H. The in-vehicle device 201F is a parking brake ECU, and the in-vehicle device 201H is an automatic driving ECU.

[0058] Hereinafter, the in-vehicle device 201F and the in-vehicle device 201H will also be referred to as the parking brake ECU 201F and the automatic driving ECU 201H, respectively. Hereinafter, an example will be described in which the control switch 91 switches between supplying and not supplying power to the automatic driving ECU 201H. The parking brake ECU 201F is an example of a third in-vehicle device.

[0059] [Power Switch] For example, the in-vehicle repeater 101 further includes a power switch 92. The power switch 92 is provided between the power supply unit 51 and the control switch 91. The power switch 92 is, for example, a semiconductor switch. Note that, in FIG. 1 , for ease of understanding, the power switch 92 is shown outside the in-vehicle repeater 101.

[0060] In the example shown in FIG. 1, the vehicle-mounted relay device 101 includes power switches 92A and 92B that are the power switch 92.

[0061] The power switch 92A switches the connection state between the first power source 61 and the control switch 91. In this embodiment, for example, the power switch 92A is in the ON state when a service is being executed and is in the OFF state when the execution of the service is stopped. The power switch 92B is always in the ON state.

[0062] [ON Control Signal] The in-vehicle relay device 101 outputs an ON control signal S11 for turning on the control switch 91 to the control switch 91. The in-vehicle device 201G outputs an ON control signal S21 for turning on the control switch 91 to the control switch 91 via the in-vehicle relay device 101. For example, each of the ON control signal S11 and the ON control signal S21 is a logically high level signal. The ON control signal S11 is an example of a first ON control signal, and the ON control signal S21 is an example of a second ON control signal.

[0063] In the following description, the in-vehicle device 201G is also referred to as a management device 201G. The management device 201G is, for example, a driving-related device. The management device 201G is an example of a second in-vehicle device.

[0064] Vehicle repeater 101 outputs an ON control signal S51 for turning on power switch 92A to power switch 92. Management device 201G outputs an ON control signal S61 for turning on power switch 92A to power switch 92A via vehicle repeater 101. For example, each of ON control signal S51 and ON control signal S61 is a logical high level signal.

[0065] Vehicle repeater 101 outputs an ON control signal S53 for turning on power switch 92B to power switch 92B. Management device 201G outputs an ON control signal S71 for turning on power switch 92B to power switch 92B via vehicle repeater 101. For example, each of ON control signal S53 and ON control signal S71 is a logical high level signal.

[0066] The power switch 92A is turned on under the OR condition of the ON control signal S51 and the ON control signal S61. The power switch 92B is turned on under the OR condition of the ON control signal S53 and the ON control signal S71. Details of the ON control of each power switch 92 will be described later.

[0067] Furthermore, the vehicle-mounted relay device 101 outputs a reset signal, which will be described later, to the management device 201G, and the management device 201G outputs the reset signal to the vehicle-mounted relay device 101.

[0068] For example, management device 201G is connected to in-vehicle relay device 101 via multiple signal lines 6. Hereinafter, each of the multiple signal lines 6 for transmitting various control signals output from management device 201G will also be referred to as signal line 6a. Also, each of the multiple signal lines 6 for transmitting a reset signal will also be referred to as signal line 6b. Note that management device 201G is not limited to a configuration in which it is connected to in-vehicle relay device 101 via multiple signal lines 6a, and it may also be configured in which it is connected to in-vehicle relay device 101 via a single signal line 6a.

[0069] 1, the in-vehicle devices 201A, 201B, 201C, and 201D are a body ECU, an occupant sensor, a buckle sensor, and a door opening / closing sensor, respectively. Hereinafter, the in-vehicle devices 201A, 201B, 201C, and 201D will also be referred to as the body ECU 201A, the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D.

[0070] [Occupant Sensor] For example, the occupant sensor 201B is a sensor that detects whether the driver is seated in the driver's seat of the vehicle 1 or whether the driver is leaving the driver's seat.

[0071] More specifically, for example, the occupant sensor 201B is a pressure sensor that measures a pressure P applied to the seat surface of the driver's seat. The occupant sensor 201B measures the pressure P, for example, periodically.

[0072] Then, the occupant sensor 201B detects whether or not a driver is seated in the driver's seat based on the measurement result of the pressure P, and performs a detection process D1 in which sensor information C1 indicating the detection result is transmitted to the body ECU 201A.

[0073] Specifically, for example, when the measurement value of the occupant sensor 201B is equal to or greater than a predetermined threshold value Th1, the occupant sensor 201B transmits to the body ECU 201A sensor information C1 indicating that the driver is seated in the driver's seat, including the measurement time ta of the measurement value.

[0074] On the other hand, for example, when the measurement value of the occupant sensor 201B is less than the threshold value Th1, the occupant sensor 201B transmits to the body ECU 201A sensor information C1 indicating that the driver has left the driver's seat, including the measurement time ta of the measurement value.

[0075] The occupant sensor 201B is not limited to a pressure sensor, but may be a camera that takes an image of the driver's seat, or the like.

[0076] [Buckle Sensor] The buckle sensor 201C is provided on the buckle of the driver's seat of the vehicle 1. The buckle sensor 201C periodically detects the state of the seat belt in the driver's seat and performs a detection process D2 in which sensor information C2 indicating the detection result and the detection time tb is transmitted to the body ECU 201A. For example, the buckle sensor 201C performs the detection process D2 at the same timing as the detection process D1 by the occupant sensor 201B.

[0077] Specifically, for example, when the tongue of the seat belt is engaged with the buckle, the buckle sensor 201C transmits sensor information C2 indicating that the seat belt is in a locked state as a detection result to the body ECU 201A.

[0078] On the other hand, for example, when the tongue of the seat belt is not fastened to the buckle, the buckle sensor 201C transmits sensor information C2 indicating that the seat belt is in an unlocked state as a detection result to the body ECU 201A.

[0079] The door sensor 201D periodically detects the state of the door at the driver's seat and transmits sensor information C3 indicating the detection result and the detection time tc to the body ECU 201A in a detection process D3. For example, the door sensor 201D performs the detection process D3 at the same timing as the detection process D1 by the occupant sensor 201B.

[0080] [Body ECU] Body ECU 201A outputs control signals to body-related devices such as door lock mechanisms, wipers, power windows, etc. Specifically, for example, body ECU 201A receives sensor information from each of occupant sensor 201B, buckle sensor 201C, and door open / close sensor 201D, and outputs control signals based on the received sensor information to the body-related devices.

[0081] In addition, the body ECU 201A creates a CAN frame (hereinafter also referred to as "frame F") that includes sensor information C1, sensor information C2, and sensor information C3 received from the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D, respectively.

[0082] As described above, the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D transmit the sensor information C1, the sensor information C2, and the sensor information C3, respectively, to the body ECU 201A, for example, periodically.

[0083] When the body ECU 201A receives sensor information C1, sensor information C2, and sensor information C3 from the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D, respectively, it stores the received sensor information C1, sensor information C2, and sensor information C3 in a memory unit not shown.

[0084] For example, when the processing timing Ta for creating a frame F arrives, the body ECU 201A acquires from the storage unit the sensor information C1, C2, and C3 accumulated during the period from the previous processing timing Ta to the current processing timing Ta, and creates a frame F including the acquired sensor information C1, C2, and C3. Then, the body ECU 201A transmits the created frame F to the in-vehicle relay device 101.

[0085] The body ECU 201A also performs a switch monitoring process to monitor the state of the brake pedal switch or the engine switch, and transmits switch monitoring information indicating the monitoring results of the switch monitoring process to the in-vehicle relay device 101. The body ECU 201A performs the switch monitoring process and transmits the switch monitoring information, for example, periodically.

[0086] 1, the in-vehicle device 201E is a verification ECU. Hereinafter, the in-vehicle device 201E will also be referred to as a verification ECU 201E.

[0087] For example, the verification ECU 201E is connected to an electronic key sensor (not shown) that can measure radio waves emitted from the electronic key. The electronic key sensor transmits the measurement results and key information indicating identification information (hereinafter also referred to as "key ID") contained in the radio waves to the verification ECU 201E. The key ID is an ID unique to each electronic key.

[0088] The verification ECU 201E stores the key ID in its storage unit. When the verification ECU 201E receives key information from the electronic key sensor, if the measurement results indicated by the received key information satisfy predetermined conditions and the key ID indicated by the key information matches the key ID stored in the storage unit, the verification ECU 201E transmits key verification information to the in-vehicle relay device 101, indicating that the electronic key is present near the vehicle 1 and that the key IDs match.

[0089] [Parking Brake ECU] The parking brake ECU 201F controls, for example, the parking brake of the vehicle 1. When activated, the parking brake ECU 201F broadcasts parking brake information indicating the state of the parking brake to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0090] [On-Vehicle Relay Device] Fig. 2 is a diagram illustrating an example of the configuration of an on-vehicle relay device according to an embodiment of the present disclosure. Referring to Fig. 2, the on-vehicle relay device 101 includes a relay unit 11, a processing unit 12, and a memory unit 13. The processing unit 12 includes a determination unit 21, a signal generation unit 22, a logic circuit unit 23, a notification unit 24, a monitoring unit 25, an abnormality processing unit 26, and a transition processing unit 27. One or both of the relay unit 11 and the processing unit 12 are realized, for example, by a processing circuit including one or more processors. The memory unit 13 is, for example, a non-volatile memory included in the processing circuit. The abnormality processing unit 26 is an example of a control unit, an example of a warning unit, and an example of a reset processing unit.

[0091] (Relay Unit) The relay unit 11 receives a CAN frame transmitted from a certain in-vehicle device 201. Then, the relay unit 11 checks whether the received CAN frame is a CAN frame that should be received by its own in-vehicle relay device 101.

[0092] The storage unit 13 stores, for example, a reception list L1 that indicates the CAN-IDs included in the CAN frames that should be received by the vehicle-mounted relay device 101. The reception list L1 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0093] When the relay unit 11 receives a CAN frame, it refers to the reception list in the storage unit 13 to check whether the CAN-ID included in the CAN frame is registered in the reception list L1.

[0094] For example, if the CAN-ID included in a received CAN frame is not registered in the reception list L1, the relay unit 11 discards the CAN frame.

[0095] On the other hand, relay unit 11 performs relay processing, for example, when the CAN-ID included in the received CAN frame is registered in reception list L1 and the destination of the CAN frame is in-vehicle device 201. Furthermore, relay unit 11 outputs the CAN frame to processing unit 12, for example, when the CAN-ID included in the received CAN frame is registered in reception list L1 and the destination of the CAN frame is its own in-vehicle relay device 101.

[0096] Specifically, for example, storage unit 13 stores a routing table indicating the correspondence between CAN-IDs, destination devices of CAN frames, and CAN buses 2 to which the destination devices are connected (hereinafter also referred to as "destination buses"). The routing table is registered in storage unit 13 by the manufacturer of vehicle 1, for example, when vehicle 1 is shipped.

[0097] For example, if the CAN-ID contained in the CAN frame received from the in-vehicle device 201 is registered in the reception list L1, the relay unit 11 checks the destination device corresponding to the CAN-ID by referring to the routing table in the memory unit 13.

[0098] When the relay unit 11 confirms that the destination device of the received CAN frame is the in-vehicle device 201, the relay unit 11 refers to the routing table to identify the destination bus corresponding to the destination device, and then outputs the received CAN frame to the identified destination bus.

[0099] On the other hand, when the relay unit 11 confirms that the destination device of the received CAN frame is its own in-vehicle relay device 101 , it outputs the CAN frame to the processing unit 12 .

[0100] (Determination Unit) For example, the determination unit 21 performs a determination process to determine the state of the vehicle 1. More specifically, for example, the determination unit 21 performs a determination process J1 to determine whether the vehicle 1 is in a state in which it can start traveling (hereinafter also referred to as a "traveling start state").

[0101] For example, when the verification of the electronic key by the verification ECU 201E is completed and the monitoring result indicated by the switch monitoring information B satisfies a predetermined condition, the determination unit 21 determines that the vehicle 1 is in a traveling start state.

[0102] More specifically, when the determination unit 21 receives key verification information from the verification ECU 201E via the relay unit 11, the determination unit 21 checks the monitoring results indicated by the switch monitoring information (hereinafter also referred to as "switch monitoring information B") received from the body ECU 201A via the relay unit 11 within a predetermined time period after receiving the key verification information. If the switch monitoring information B indicates that the brake switch or the engine switch is in the on state, the determination unit 21 determines that the vehicle 1 is in the running start state.

[0103] For example, when the determination unit 21 determines that the state of the vehicle 1 is the running start state, the determination unit 21 periodically broadcasts a running start notification indicating that the state of the vehicle 1 is the running start state to each in-vehicle device 201 via the relay unit 11. In addition, the determination unit 21 outputs the running start notification to the signal generation unit 22.

[0104] On the other hand, if the switch monitoring information B indicates that key matching information has not arrived from the matching ECU 201E, or if the brake switch or engine switch is in the off state, the judgment unit 21 judges that the vehicle 1 is not in the running start state.

[0105] 3 is a diagram illustrating in detail a portion of the configuration of the vehicle relay device according to the embodiment of the present disclosure. With reference to FIGS. 2 and 3, the signal generator 22 in the vehicle relay device 101 generates an ON control signal S11 based on the state of the vehicle 1 determined by the determination unit 21.

[0106] More specifically, for example, when the signal generating unit 22 receives a running start notification from the determining unit 21, that is, when the determining unit 21 determines that the state of the vehicle 1 is a running start state, the signal generating unit 22 generates the ON control signal S11. Then, the signal generating unit 22 outputs the generated ON control signal S11 to the logic circuit unit 23.

[0107] The logic circuit unit 23 receives an ON control signal S11 from the signal generating unit 22. The logic circuit unit 23 also receives an ON control signal S21 from the outside of the vehicle relay device 101, that is, from the management device 201G, via the signal line 6a.

[0108] For example, the logic circuit unit 23 includes OR gates 81, 82, and 83. The OR gate 81 outputs a gate signal S1 indicating the logical sum of the ON control signal S11 generated by the signal generating unit 22 and the ON control signal S21 received by the logic circuit unit 23 to the control switch 91. The OR gate 81 is an example of an OR circuit.

[0109] The OR gate 82 outputs a gate signal S3 indicating the logical sum of the ON control signal S51 and the ON control signal S61 to the power switch 92A. The OR gate 83 outputs a gate signal S5 indicating the logical sum of the ON control signal S53 and the ON control signal S71 to the power switch 92B.

[0110] FIG. 4 is a diagram for explaining the on-control of each switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0111] 3 and 4, when at least one of on control signal S51 and on control signal S61 is input to OR gate 82, a gate signal S3 of a logical high level is output from OR gate 82 to power switch 92A. When at least one of on control signal S53 and on control signal S71 is input to OR gate 83, a gate signal S5 of a logical high level is output from OR gate 83 to power switch 92B. In the example shown in FIG. 4, on control signals S51 and S53 are input to OR gates 82 and 83, respectively.

[0112] The power switch 92A is turned on when it receives a gate signal S3 of a logic high level from the OR gate 82, and the power switch 92B is turned on when it receives a gate signal S5 of a logic high level from the OR gate 83. As a result, the connection state between the first power supply 61 and the control switch 91 and the connection state between the second power supply 62 and the control switch 91 transition from an off state to an on state.

[0113] As described above, in this embodiment, the power switch 92B is always on. That is, the power switch 92B remains on even when the microcomputer mounted on the in-vehicle relay device 101 is in a sleep state. To maintain the power switch 92B in the on state, for example, an on-holding unit (not shown) is provided between the signal generating unit 22 and the OR gate 83 in the in-vehicle relay device 101. This reduces the dark current flowing through the power supply unit 51 when the ignition power of the vehicle 1 is off.

[0114] In order to keep the power switch 92B in the on state, the power switch 92B may be a normally-on switch.

[0115] When at least one of the on control signal S11 and the on control signal S21 is input to the OR gate 81, a gate signal S1 of a logic high level is output from the OR gate 81 to the control switch 91. In the example shown in FIG.

[0116] The control switch 91 is turned on when it receives a gate signal S1 of a logic high level from the OR gate 81. As a result, power from the power supply unit 51 is supplied to the automatic driving ECU 201H.

[0117] [Startup completion notification] Referring again to Figure 1, for example, when the state of the vehicle 1 is the driving start state and the state of the control switch 91 is turned on by the on control signal S11 or the on control signal S21, the automatic driving ECU 201H starts executing a driving-related function, specifically an automatic driving function.

[0118] More specifically, for example, when the control switch 91 is turned on while the vehicle 1 is in a driving start state, the autonomous driving ECU 201H is activated. Then, the autonomous driving ECU 201H starts executing the autonomous driving function. Furthermore, upon activation, the autonomous driving ECU 201H transmits an activation completion notification to the in-vehicle relay device 101, indicating that the autonomous driving ECU 201H has been activated.

[0119] The automatic driving ECU 201H may be configured to start executing the automatic driving function when the vehicle 1 is in a traveling start state, the control switch 91 is in an on state, and the parking brake is in an off state. In this case, when the control switch 91 is in an on state and the parking brake information received from the parking brake ECU 201F indicates that the parking brake is in an off state, the automatic driving ECU 201H is activated and starts executing the automatic driving function.

[0120] [Device status notification] Referring again to Figure 2, in the in-vehicle relay device 101, when the notification unit 24 receives a startup completion notification from the autonomous driving ECU 201H via the relay unit 11, it periodically broadcasts a device status notification indicating that the autonomous driving ECU 201H is operating to each in-vehicle device 201 via the relay unit 11.

[0121] [Management Device] FIG. 5 is a diagram illustrating an example of the configuration of a management device according to an embodiment of the present disclosure. Referring to FIG. 5, the management device 201G includes a communication unit 31, a processing unit 32, and a storage unit 33. The processing unit 32 includes a determination unit 41, a signal generation unit 42, a notification unit 43, a monitoring unit 44, an abnormality processing unit 45, and a transition processing unit 46. One or both of the communication unit 31 and the processing unit 32 are implemented, for example, by a processing circuit including one or more processors. The storage unit 33 is, for example, a non-volatile memory included in the processing circuit. The abnormality processing unit 45 is an example of a control unit, an example of a warning unit, and an example of a reset processing unit.

[0122] For example, the storage unit 33 stores a reception list L2 that indicates the CAN-IDs included in the CAN frames that the management device 201G should receive. The reception list L2 is registered in the storage unit 13 by the manufacturer of the vehicle 1, for example, when the vehicle 1 is shipped.

[0123] When the communication unit 31 receives a CAN frame from the in-vehicle relay device 101 or another in-vehicle device 201 other than the management device 201G, the communication unit 31 reads the reception list L2 in the storage unit 33. Then, by referring to the reception list L2, the communication unit 31 checks whether the CAN-ID included in the received CAN frame is registered in the reception list L2.

[0124] If the CAN-ID included in a received CAN frame is registered in the reception list L2, the communication unit 31 outputs the CAN frame to the processing unit 32. On the other hand, if the CAN-ID included in the received CAN frame is not registered in the reception list L2, the communication unit 31 discards the CAN frame.

[0125] The determination unit 41 determines the state of the vehicle 1. Specifically, for example, the determination unit 41 determines that the state of the vehicle 1 is a running start state by receiving a running start notification from the in-vehicle relay device 101 via the communication unit 31. Then, the determination unit 41 outputs the received running start notification to the signal generation unit 42.

[0126] The determination unit 41 further determines the state of the autonomous driving ECU 201H. Specifically, for example, when the determination unit 41 receives an equipment status notification from the in-vehicle relay device 101 via the communication unit 31, the determination unit 41 determines that the autonomous driving ECU 201H is operating. Then, the determination unit 41 outputs the received equipment status notification to the signal generation unit 42.

[0127] (Generation and output of ON control signals S21, S61, S71) For example, the second ON condition under which management device 201G outputs ON control signal S21 is different from the first ON condition under which in-vehicle relay device 101 outputs ON control signal S11. As described above, in-vehicle relay device 101 generates ON control signal S11 when it determines that the state of vehicle 1 is in the traveling start state. On the other hand, in response to receiving a device state notification from in-vehicle relay device 101, management device 201G generates ON control signals S21, S61, S71.

[0128] Specifically, for example, in the managed device 201G, when the signal generating section 42 receives a device state notification from the determining section 41, it generates the ON control signals S21, S61, and S71.

[0129] Then, the signal generating unit 42 outputs the generated ON control signals S21, S61, and S71 to the in-vehicle relay device 101. For example, the signal generating unit 42 outputs the ON control signals S21, S61, and S71 at the same timing to the in-vehicle relay device 101. Note that the signal generating unit 42 may output some of the ON control signals S21, S61, and S71 to the in-vehicle relay device 101 at a timing different from that of the other ON control signals.

[0130] Specifically, for example, when the signal generating unit 42 generates the ON control signal S21, it transmits the generated ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6a.

[0131] Furthermore, for example, when the signal generating unit 42 generates the ON control signals S61 and S71, it transmits the generated ON control signals S61 and S71 to the vehicle relay device 101 via the signal line 6a.

[0132]

[0063]

[0064]

[0065]

[0066]

[0067]

[0068]

[0069]

[0070]

[0071]

[0072]

[0073]

[0074]

[0075]

[0076]

[0077]

[0078]

[0079]

[0080]

[0079]

[0081]

[0082]

[0083]

[0084]

[0085]

[0086]

[0087]

[0088]

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098]

[0099]

[0099]

[0099]

[0099]

[0099] [010 ...099]

[0099]

[0099] [

[0133] 6, the logic circuit unit 23 in the vehicle-mounted relay device 101 receives the ON control signals S61 and S71 from the management device 201G via the signal line 6a shown in FIG. 2. The OR gate 82 in the logic circuit unit 23 outputs a gate signal S3 of a logical high level to the power switch 92A. The OR gate 83 in the logic circuit unit 23 outputs a gate signal S5 of a logical high level to the power switch 92B.

[0134] Power switch 92A is turned on when it receives gate signal S3 of a logic high level from OR gate 82, and power switch 92B is turned on when it receives gate signal S5 of a logic high level from OR gate 83.

[0135] Furthermore, when the logic circuit unit 23 receives the ON control signals S61 and S71 from the managed device 201G, it outputs to the notification unit 24 a switch ON notification N22 indicating that the ON control signals S61 and S71 have been received.

[0136] When the notification unit 24 receives the switch-on notification N22 from the logic circuit unit 23, it transmits the switch-on notification N22 to the managed device 201G via the relay unit 11.

[0137] (Turning on control switch 91) Furthermore, logic circuit unit 23 receives an on control signal S21 from management device 201G via signal line 6a. Then, OR gate 81 in logic circuit unit 23 outputs a gate signal S1 of a logic high level to control switch 91. OR gate 81 is an example of an OR circuit.

[0138] Control switch 91 turns on when it receives gate signal S1 of a logic high level from OR gate 81.

[0139] (Switch-on notifications N21, N22) Furthermore, when logic circuit unit 23 receives an on control signal S21 from managed device 201G, it outputs a switch-on notification N21 indicating that the on control signal S21 has been received from managed device 201G to notification unit 24. Switch-on notification N21 is an example of a reception notification.

[0140] When the notification unit 24 receives the switch-on notification N21 from the logic circuit unit 23, it transmits the switch-on notification N21 to the managed device 201G via the relay unit 11.

[0141] Furthermore, when the logic circuit unit 23 receives the on control signals S61, S71 from the management device 201G via the signal line 6a, it outputs a switch-on notification N22 to the notification unit 24 indicating that the on control signals S61, S71 have been received from the management device 201G.

[0142] When the notification unit 24 receives the switch-on notification N22 from the logic circuit unit 23, it transmits the switch-on notification N22 to the managed device 201G via the relay unit 11.

[0143] [ON Unconfirmed Notification] Referring again to Figure 5, in the management device 201G, the notification unit 43 broadcasts an ON Unconfirmed Notification, indicating that the execution of the ON control of the control switch 91 by the ON control signal S21, the ON control of the power switch 92A by the ON control signal S61, and the ON control of the power switch 92B by the ON control signal S71 is unconfirmed, to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201G, via the communication unit 31.

[0144] Specifically, the notification unit 43 broadcasts an on-unconfirmed notification to each of the other in-vehicle devices 201 and the in-vehicle relay device 101, for example periodically, until it receives a switch-on notification N21 from the in-vehicle relay device 101 via the communication unit 31.

[0145] [ON Completion Notification] Furthermore, when the notification unit 43 receives the switch-on notification N21 from the in-vehicle relay device 101 via the communication unit 31, the notification unit 43 broadcasts an ON completion notification indicating that ON control of the control switch 91 using the ON control signal S21 is being executed, i.e., that the execution of the ON control in the in-vehicle relay device 101 has been confirmed, to each of the other in-vehicle devices 201 other than its own management device 201G and the in-vehicle relay device 101 via the communication unit 31. The ON completion notification is an example of an ON execution notification.

[0146] [Parking brake off control] Referring again to Figure 1, for example, when the parking brake is in the on state, the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101, receives an on completion notification from the management device 201G, and an operation Q1 to turn the parking brake off is performed in the vehicle 1, then performs a parking brake release process to transition the parking brake from the on state to the off state.

[0147] More specifically, for example, the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification or an equipment status notification from the in-vehicle relay device 101, receives an ON completion notification from the management device 201G, and the driver of the vehicle 1 performs an operation Q1 of moving the shift lever to a position other than "parking." Below, an example will be described in which the parking brake ECU 201F performs the parking brake release process when it receives a driving start notification and an ON completion notification from the in-vehicle relay device 101 and the management device 201G, respectively, and the driver performs the operation Q1. Operation Q1 is, for example, an operation in which the driver of the vehicle 1 moves the shift lever to a position other than "parking."

[0148] Specifically, for example, a shift lever sensor (not shown) is connected to the parking brake ECU 201F. The shift lever sensor periodically detects the position of the shift lever and performs a detection process D4 to transmit sensor information C4 indicating the detection result to the parking brake ECU 201F.

[0149] When the parking brake ECU 201F receives the sensor information C4 from the shift lever sensor, the parking brake ECU 201F stores the received sensor information C4 in a storage unit.

[0150] For example, when the parking brake ECU 201F receives a driving start notification from the in-vehicle relay device 101, it acquires from the storage unit the sensor information C4 received during a period from when the driving start notification was received until a predetermined time has elapsed.

[0151] When the sensor information C4 acquired from the storage unit indicates a shift lever position other than "parking" as the detection result and the parking brake ECU 201F receives an ON completion notification from the management device 201G, the parking brake ECU 201F outputs an OFF control signal S32 to the parking brake to transition the parking brake to the OFF state. As a result, the parking brake transitions from the ON state to the OFF state.

[0152] [Parking Brake ON Control] For example, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state when it receives an ON completion notification from the management device 201G and a predetermined operation Q2 is performed in the vehicle 1. For example, the operation Q2 is an operation in which the driver moves the shift lever to the "parking" position.

[0153] More specifically, for example, after receiving an ON completion notification from the management device 201G, if the sensor information C4 received from the shift lever sensor indicates "parking" as the detection result, the parking brake ECU 201F outputs an ON control signal S31 to the parking brake to transition the parking brake to an ON state. As a result, the parking brake transitions from an OFF state to an ON state.

[0154] Then, the parking brake ECU 201F broadcasts to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 a brake-on notification indicating that the on control signal S31 has been output to the parking brake.

[0155] In addition, the parking brake ECU 201F is not limited to being configured to transition the parking brake from the off state to the on state when it receives an on completion notification from the management device 201G and operation Q2 is performed on the vehicle 1, but may also be configured to transition the parking brake from the off state to the on state when another operation is performed on the vehicle 1 instead of operation Q2.

[0156] In this case, for example, when the parking brake ECU 201F receives an ON completion notification from the management device 201G and at least two or more of the following operations are performed in the vehicle 1: operation Q3 in which the driver leaves the driver's seat; operation Q4 in which the driver unlocks the seat belt; and operation Q5 in which the driver unlocks the driver's door, the parking brake ECU 201F transitions the parking brake from the OFF state to the ON state.

[0157] 2, in the in-vehicle relay device 101, the determination unit 21 performs a determination process J2 to determine whether the vehicle 1 is in a state where it has finished traveling (hereinafter also referred to as a "traveling end state"). More specifically, for example, when the determination unit 21 receives a brake-on notification from the parking brake ECU 201F and operations Q3, Q4, and Q5 are performed in the vehicle 1, the determination unit 21 determines that the state of the vehicle 1 is in the traveling end state.

[0158] Specifically, for example, when the judgment unit 21 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11, it checks whether the sensor information C1, C2, and C3 contained in frame F (hereinafter also referred to as "frame F1") received from the body ECU 201A via the relay unit 11 within a predetermined time period after receiving the brake-on notification satisfy predetermined conditions.

[0159] For example, if frame F1 contains sensor information C1 indicating that the driver has left the seat, sensor information C2 indicating that the seat belt is in an unlocked state, and sensor information C3 indicating that the driver's door is in an open state, the judgment unit 21 judges that the state of vehicle 1 is in an end-of-travel state.

[0160] Then, the determination unit 21 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each in-vehicle device 201 via the relay unit 11. The determination unit 21 also outputs the driving end notification to the signal generation unit 22.

[0161] In addition, the judgment unit 21 may be configured to judge that the state of vehicle 1 is in the end-of-travel state when it receives a brake-on notification from the parking brake ECU 201F and any two of operations Q3, Q4, and Q5 are performed in vehicle 1.

[0162] [OFF transition request] For example, the in-vehicle relay device 101 transmits an OFF transition request to the autonomous driving ECU 201H to request that the execution of a driving-related function be stopped. The OFF transition request is an example of a request notification.

[0163] More specifically, for example, in the in-vehicle relay device 101, when the signal generating unit 22 receives a brake-on notification from the parking brake ECU 201F via the relay unit 11 and also receives a driving end notification from the judgment unit 21, it broadcasts an off transition request to each in-vehicle device 201 via the relay unit 11 before generating the off control signal S12.

[0164] [Notification of completion of preparation for stopping] Referring again to Figure 1, for example, when the autonomous driving ECU 201H receives a driving end notification or an off transition request from the vehicle relay device 101 and the management device 201G outputs an off control signal S22 described later, it performs pre-processing to stop the execution of the autonomous driving function before the power supply to the autonomous driving ECU 201H is stopped.

[0165] More specifically, for example, when the autonomous driving ECU 201H receives a driving end notification or an off transition request from the vehicle relay device 101 and also receives an off completion notification (described later) from the management device 201G, it performs predetermined pre-processing in preparation for stopping the execution of the autonomous driving function.

[0166] Specifically, for example, the autonomous driving ECU 201H includes a volatile memory that stores data indicating the processing content during execution of the autonomous driving function, and a non-volatile memory that is used in preprocessing.

[0167] When the autonomous driving ECU 201H receives a driving end notification from the vehicle relay device 101 and an off completion notification from the management device 201G, it performs a preprocessing process to back up the data stored in the volatile memory to the non-volatile memory.

[0168] Furthermore, for example, an actuator (not shown) is connected to the automatic driving ECU 201H. The automatic driving ECU 201H drives the actuator while the automatic driving function is being executed.

[0169] When the autonomous driving ECU 201H receives a driving end notification from the in-vehicle relay device 101 and an off completion notification from the management device 201G, it performs a process to stop the operation of the actuator as pre-processing.

[0170] Then, when the autonomous driving ECU 201H completes preparations to stop the execution of the autonomous driving function, it transmits a notification of completion of preparations to stop to the in-vehicle relay device 101.

[0171] 3 and 5 again, for example, management device 201G outputs an off control signal S22 to control switch 91 to turn off control switch 91. For example, off control signal S22 is a signal at a logical low level. On control signal S21 and off control signal S22 are output exclusively. Off control signal S22 is an example of a second off control signal.

[0172] For example, the condition under which the vehicle relay device 101 outputs the off control signal S12 (hereinafter also referred to as the "first off condition") is different from the condition under which the management device 201G outputs the off control signal S22 (hereinafter also referred to as the "second off condition").

[0173] More specifically, for example, the first off condition includes a condition related to the state of the automatic driving ECU 201H, and the second off condition does not include a condition related to the state of the automatic driving ECU 201H.

[0174] Specifically, for example, when the in-vehicle relay device 101 receives a stop preparation completion notification from the autonomous driving ECU 201H, it outputs an OFF control signal S12.

[0175] For example, in the management device 201G, when the signal generating unit 42 receives a brake-on notification from the parking brake ECU 201F via the communication unit 31 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 31, it decides to output an off control signal S22.

[0176] Then, the signal generating unit 42 generates an OFF control signal S22 and outputs the generated OFF control signal S22 to the vehicle-mounted relay device 101.

[0177] Specifically, for example, the signal generating unit 42 transmits the generated off control signal S22 to the vehicle relay device 101 via the signal line 6a.

[0178] [Switch-off notification N12] Referring again to Figures 2 and 3, in the vehicle relay device 101, when the logic circuit unit 23 receives an off control signal S22 from the management device 201G via the signal line 6a, it outputs a switch-off notification N12 to the notification unit 24 indicating that the off control signal S22 has been received.

[0179] When the notification unit 24 receives the switch-off notification N12 from the logic circuit unit 23, it transmits the switch-off notification N12 to the management device 201G via the relay unit 11.

[0180] [Off Unconfirmed Notification] Referring again to Figure 5, in the management device 201G, the notification unit 43 broadcasts an off unconfirmed notification, indicating that the off control of the control switch 91 by the off control signal S22 is unconfirmed, to each of the other in-vehicle devices 201 and in-vehicle relay devices 101 other than its own management device 201G, via the communication unit 31.

[0181] Specifically, during the period from when the notification unit 43 outputs the off control signal S22 to the vehicle relay device 101 to when it receives the switch off notification N12 from the vehicle relay device 101 via the communication unit 31, the notification unit 43 broadcasts an off unconfirmed notification to each other vehicle device 201 and the vehicle relay device 101, for example, periodically.

[0182] [Off completion notification] After outputting the off control signal S22 to the vehicle relay device 101, the notification unit 43 receives a switch off notification N12 from the vehicle relay device 101 and then sends an off completion notification to the autonomous driving ECU 201H indicating that the transmission of the off control signal S22 has been completed.

[0183] Specifically, when the notification unit 43 receives a switch-off notification N12 from the in-vehicle relay device 101 via the communication unit 31, the notification unit 43 broadcasts an off completion notification to the other in-vehicle devices 201 and the in-vehicle relay device 101 other than its own management device 201G via the communication unit 31. The notification unit 43 broadcasts the off completion notification to the other in-vehicle devices 201 and the in-vehicle relay device 101, for example, periodically.

[0184] 2 and 3 , for example, the in-vehicle relay device 101 outputs an off control signal S12 for turning off the control switch 91 to the control switch 91. The off control signal S12 is an example of a first off control signal.

[0185] More specifically, for example, when the management device 201G outputs an off control signal S22 and the autonomous driving ECU 201H performs preprocessing to stop the execution of the autonomous driving function, the vehicle relay device 101 outputs an off control signal S12 to the control switch 91.

[0186] Specifically, for example, in the in-vehicle relay device 101, the signal generating unit 22 generates an OFF control signal S12 when it receives a stop preparation completion notification from the autonomous driving ECU 201H via the relay unit 11. For example, the OFF control signal S12 is a signal of a logical low level.

[0187] Then, the signal generating section 22 outputs the generated OFF control signal S12 to the logic circuit section 23. The ON control signal S11 and the OFF control signal S12 are output exclusively.

[0188] (Turning the Control Switch 91 Off) FIG. 7 is a diagram for explaining turning off the control switch by the vehicle-mounted relay device according to the embodiment of the present disclosure.

[0189] Referring to Figure 7, for example, in the vehicle relay device 101, when the signal generation unit 22 receives a preparation completion notification from the autonomous driving ECU 201H via the relay unit 11, it outputs the generated off control signal S12 to the logic circuit unit 23.

[0190] When logic circuit unit 23 receives OFF control signal S12 from signal generating unit 22 and OFF control signal S22 from management device 201G, logic circuit unit 23 outputs gate signal S2 of a logic low level to control switch 91.

[0191] Specifically, when both the OFF control signal S12 and the OFF control signal S22 are input to the OR gate 81, the gate signal S2 of the logic low level is output from the OR gate 81 to the control switch 91.

[0192] The control switch 91 is turned off when it receives a gate signal S2 of a logical low level from the OR gate 81. This stops the supply of power to the automatic driving ECU 201H.

[0193] In addition to the control switch 91 that switches on / off the supply of power to the autonomous driving ECU 201H, the in-vehicle relay device 101 may be configured to include another control switch that switches on / off the supply of power to the management device 201G. In this case, the in-vehicle relay device 101 and the management device 201G switch on and off the other switch in the same way as the above-mentioned control switch 91 is switched on and off.

[0194] (Generation and Output of Off Control Signal S52) Referring again to FIGS. 2 and 3, for example, in the vehicle-mounted relay device 101, the signal generating unit 22 generates the off control signal S52 for turning off the power switch 92A.

[0195] More specifically, for example, the signal generating unit 22 generates the off control signal S52 when execution of various services is stopped in the in-vehicle network 401. For example, the off control signal S52 is a signal at a logic low level.

[0196] Specifically, for example, when the signal generating unit 22 receives a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 via the communication unit 31, the signal generating unit 22 determines that the execution of various services in the in-vehicle network 401 has stopped. In this case, the signal generating unit 22 generates an OFF control signal. Note that the signal generating unit 22 may be configured to determine that the execution of various services has stopped when the signal generating unit 22 receives a stop preparation completion notification from an in-vehicle ECU that controls the DC / DC converter 72 in the power supply unit 51.

[0197] Then, the signal generating section 22 outputs the generated OFF control signal S52 to the logic circuit section 23. The ON control signal S51 and the OFF control signal S52 are output exclusively.

[0198] 3 and 5, for example, in management device 201G, signal generation unit 42 generates off control signal S62 for turning off power switch 92A, and off control signal S72 for turning off power switch 92B. For example, off control signals S62 and S72 are signals of a logical low level.

[0199] More specifically, for example, when the signal generating unit 42 receives a brake-on notification from the parking brake ECU 201F via the communication unit 31 and also receives a driving end notification or an off transition request from the vehicle relay device 101 via the communication unit 31, it decides to output off control signals S62, S72.

[0200] Then, the signal generating unit 42 generates OFF control signals S62, S72 and transmits the generated OFF control signals S62, S72 to the in-vehicle relay device 101 via the signal line 6a. The ON control signal S61 and the OFF control signal S62 are output exclusively. The ON control signal S71 and the OFF control signal S72 are output exclusively.

[0201] (Switch-off notification N11) Referring again to Figure 7, in the vehicle relay device 101, when the logic circuit unit 23 receives the off control signals S62, S72 from the management device 201G via the signal line 6a, it outputs a switch-off notification N11 to the notification unit 24 indicating that the off control signals S62, S72 have been received from the management device 201G.

[0202] When the notification unit 24 receives the switch-off notification N11 from the logic circuit unit 23, it transmits the switch-off notification N11 to the management device 201G via the relay unit 11.

[0203] (Turning off the power switch 92A) Referring again to Figure 7, in the vehicle relay device 101, when the logic circuit unit 23 receives an off control signal S52 from the signal generation unit 22 and an off control signal S62 from the management device 201G, it outputs a gate signal S4 of a logical low level to the power switch 92A.

[0204] Specifically, for example, when both off control signal S52 and off control signal S62 are input to OR gate 82, gate signal S4 at a logic low level is output from OR gate 82 to power switch 92A.

[0205] Power switch 92A is turned off when it receives gate signal S4 of a logic low level from OR gate 82.

[0206] 1, 2 and 5, for example, when the state of management device 201G is normal, signal generation unit 42 in management device 201G outputs a status signal of logic high level to signal line 6. Furthermore, for example, when the state of management device 201G is abnormal, signal generation unit 42 outputs a status signal of logic low level to signal line 6.

[0207] For example, the monitoring unit 25 in the vehicle-mounted relay device 101 performs a monitoring process E1 for monitoring the state of the management device 201G.

[0208] More specifically, for example, when the monitoring unit 25 receives a status signal of a logical high level from the management device 201G via the signal line 6, it determines that the status of the management device 201G is normal.

[0209] On the other hand, for example, when monitoring unit 25 receives a status signal of a logical low level from managed device 201G via signal line 6, it determines that an abnormality has occurred in managed device 201G. Then, monitoring unit 25 outputs abnormality detection information M1 indicating that an abnormality has occurred in managed device 201G to abnormality processing unit 26. Note that monitoring unit 25 may be configured to monitor the status of managed device 201G using a watchdog timer instead of the status signal transmitted from managed device 201G.

[0210] (Output of Warning Information) For example, when the monitoring unit 25 determines that an abnormality has occurred in the managed device 201G, the abnormality processing unit 26 performs warning processing K1 to output warning information.

[0211] More specifically, for example, when the abnormality processing unit 26 receives abnormality detection information M1 from the monitoring unit 25, it transmits the abnormality detection information M1 as warning information to the in-vehicle devices 201 (hereinafter also referred to as "display devices") such as a navigation device and a meter in the in-vehicle network 401 via the relay unit 11.

[0212] For example, when the display device receives the abnormality detection information M1 from the in-vehicle relay device 101, the display device performs notification processing based on the received abnormality detection information M1. Specifically, for example, the display device displays the content indicated by the abnormality detection information M1 on its own display unit. Note that the abnormality processing unit 26 may be configured to notify the passengers of the vehicle 1 of the content indicated by the abnormality detection information M1 by a method other than displaying it on the display device, for example, by voice.

[0213] (Reset Signal Output) Furthermore, for example, when the monitoring unit 25 determines that an abnormality has occurred in the managed device 201G, the abnormality processing unit 26 performs reset processing R1 to reset the managed device 201G.

[0214] More specifically, when abnormality processing section 26 receives abnormality detection information M1 from monitoring section 25, it outputs a reset signal to signal line 6b to reset the microcomputer mounted on management device 201G, for example.

[0215] When the management device 201G receives a reset signal from the vehicle relay device 101 via the signal line 6b, it resets the microcomputer installed therein.

[0216] (Maintaining the parking brake in an on state) For example, the abnormality processing unit 26 performs parking brake on control G1 to maintain the parking brake in an on state when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts to travel. More specifically, for example, the abnormality processing unit 26 notifies the parking brake ECU 201F that the parking brake should be maintained in an on state when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts to travel.

[0217] Specifically, for example, when the abnormality processing unit 26 receives abnormality detection information M1 from the monitoring unit 25 before receiving a driving start notification from the judgment unit 21, the abnormality processing unit 26 transmits a brake request notification indicating that the parking brake should be maintained in an on state to the parking brake ECU 201F shown in FIG. 1 via the relay unit 11.

[0218] The parking brake ECU 201F maintains the parking brake in the ON state when it receives the brake request notification from the in-vehicle relay device 101. This prevents the vehicle 1 from starting to move when an abnormality occurs in the management device 201G.

[0219] (Transition to evacuation traveling mode) For example, when the monitoring unit 25 determines that an abnormality has occurred in the management device 201G while the vehicle 1 is traveling, the transition processing unit 27 performs transition processing A1 to transition a specific in-vehicle device 201 to an operation mode (hereinafter also referred to as an "evacuation traveling mode") for causing the vehicle 1 to travel evacuation. Below, a case will be described in which the transition processing unit 27 transitions the autonomous driving ECU 201H to the evacuation traveling mode.

[0220] For example, when abnormality processing unit 26 receives abnormality detection information M1 from monitoring unit 25, it notifies transition processing unit 27 that abnormality detection information M1 has been received from monitoring unit 25.

[0221] When the transition processing unit 27 receives the above notification from the abnormality processing unit 26, it transitions the autonomous driving ECU 201H to the evacuation traveling mode.

[0222] For example, the evacuation driving mode includes a guidance mode that guides the vehicle 1 to a safe place such as a road shoulder. Note that the evacuation driving mode may include other modes in addition to or instead of the guidance mode, such as a mode that restricts driving-related functions of the vehicle 1, such as an engine output value, a mode that notifies the driver of the vehicle 1 of the occurrence of an abnormality, and a mode that drives the vehicle 1 with the hazard lights turned on.

[0223] For example, the storage unit 13 stores the CAN-ID stored in the CAN frame transmitted to the autonomous driving ECU 201H by its own in-vehicle relay device 101. When the transition processing unit 27 receives the notification from the abnormality processing unit 26, it creates a CAN frame (hereinafter also referred to as a "transition request frame") that includes the CAN-ID of the autonomous driving ECU 201H stored in the storage unit 13 and an evacuation request notification W indicating a request to transition to the evacuation travel mode.

[0224] Then, the transition processing unit 27 transmits the created transition request frame to the autonomous driving ECU 201H via the relay unit 11.

[0225] When the autonomous driving ECU 201H receives a transition request frame from the in-vehicle relay device 101, it transitions to the evacuation travel mode in accordance with the evacuation request notification W included in the received transition request frame. Specifically, for example, the autonomous driving ECU 201H guides its own vehicle 1 to the shoulder of the road by autonomous driving in accordance with the evacuation request notification W.

[0226] It should be noted that in transition process A1, transition processing unit 27 is not limited to a configuration that transitions autonomous driving ECU 201H to the evacuation traveling mode, but may also be configured to transmit information indicating that vehicle 1 should transition to the evacuation traveling mode to a display device in in-vehicle network 401 via relay unit 11. In this case, when the display device receives the information from in-vehicle relay device 101, it displays the content indicated by the information on its own display unit.

[0227] [Monitoring by management device 201G] For example, when the state of the in-vehicle relay device 101 is normal, the signal generating unit 22 in the in-vehicle relay device 101 outputs a status signal of a logic high level to the signal line 6. Also, for example, when the state of the in-vehicle relay device 101 is abnormal, the signal generating unit 22 outputs a status signal of a logic low level to the signal line 6.

[0228] For example, the monitoring unit 44 in the management device 201G performs a monitoring process E2 for monitoring the state of the vehicle-mounted relay device 101.

[0229] More specifically, for example, when the monitoring unit 44 receives a status signal of a logical high level from the vehicle-mounted relay device 101 via the signal line 6, the monitoring unit 44 determines that the vehicle-mounted relay device 101 is in a normal state.

[0230] On the other hand, for example, when the monitoring unit 44 receives a status signal of a logical low level from the on-board relay device 101 via the signal line 6, it determines that the on-board relay device 101 is in an abnormal state. Then, the monitoring unit 44 outputs abnormality detection information M2 indicating that an abnormality has occurred in the on-board relay device 101 to the abnormality processing unit 45. Note that the monitoring unit 44 may be configured to monitor the status of the on-board relay device 101 using a watchdog timer instead of the status signal transmitted from the on-board relay device 101.

[0231] (Output of Warning Information) For example, when the monitoring unit 44 determines that an abnormality has occurred in the vehicle-mounted relay device 101, the abnormality processing unit 45 performs a warning process K2 to output warning information.

[0232] More specifically, for example, when the abnormality processing unit 45 receives the abnormality detection information M2 from the monitoring unit 44, it transmits the abnormality detection information M2 as warning information to a display device in the in-vehicle network 401 via the communication unit 31.

[0233] For example, when the display device receives the abnormality detection information M2 from the in-vehicle relay device 101, the display device performs notification processing based on the received abnormality detection information M2. Specifically, for example, the display device displays the content indicated by the abnormality detection information M2 on its own display unit. Note that the abnormality processing unit 45 may be configured to notify the passengers of the vehicle 1 of the content indicated by the abnormality detection information M2 by a method other than displaying it on the display device, for example, by voice.

[0234] (Reset Signal Output) Furthermore, for example, when the monitoring unit 44 determines that an abnormality has occurred in the vehicle-mounted relay device 101 , the abnormality processing unit 45 performs a reset process R2 to reset the vehicle-mounted relay device 101 .

[0235] More specifically, when the abnormality processing unit 45 receives the abnormality detection information from the monitoring unit 44, it outputs a reset signal to the signal line 6b to reset the microcomputer mounted on the vehicle relay device 101, for example.

[0236] When the vehicle-mounted relay device 101 receives the reset signal from the management device 201G via the signal line 6b, it resets the microcomputer installed in the vehicle-mounted relay device 101 to the initial state. Then, the management device 201G re-executes the program of the microcomputer stored in the memory unit 13.

[0237] (Maintaining the parking brake in an on state) For example, the abnormality processing unit 45 performs parking brake on control G2 to maintain the parking brake in an on state when the monitoring unit 44 determines that an abnormality has occurred in the in-vehicle relay device 101 before the vehicle 1 starts traveling. More specifically, for example, when the monitoring unit 44 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts traveling, the abnormality processing unit 45 notifies the parking brake ECU 201F that the parking brake should be maintained in an on state.

[0238] Specifically, for example, when the abnormality processing unit 45 receives abnormality detection information M2 from the monitoring unit 44 before receiving a driving start notification from the vehicle relay device 101 via the communication unit 31, the abnormality processing unit 45 transmits a brake request notification indicating that the parking brake should be maintained in an on state to the parking brake ECU 201F shown in Figure 1 via the communication unit 31.

[0239] When the parking brake ECU 201F receives a brake request notification from the management device 201G, the parking brake ECU 201F maintains the parking brake in the ON state. This prevents the vehicle 1 from starting to move when an abnormality occurs in the in-vehicle relay device 101.

[0240] (Transition to evacuation driving mode) For example, if the monitoring unit 44 determines that an abnormality has occurred in the vehicle relay device 101 while the vehicle 1 is driving, the transition processing unit 46 performs transition processing A2 to transition the autonomous driving ECU 201H to evacuation driving mode.

[0241] For example, when the abnormality processing unit 45 receives abnormality detection information M2 from the monitoring unit 44 after receiving a driving start notification from the vehicle relay device 101 via the communication unit 31, it notifies the transition processing unit 46 that it has received the abnormality detection information M2 from the monitoring unit 44.

[0242] When the transition processing unit 46 receives the above notification from the abnormality processing unit 45, it transitions the autonomous driving ECU 201H to the evacuation traveling mode.

[0243] For example, the storage unit 33 further stores the CAN-ID of the autonomous driving ECU 201H. When the transition processing unit 46 receives the notification from the abnormality processing unit 45, it creates the transition request frame, which is a CAN frame that includes the CAN-ID of the autonomous driving ECU 201H stored in the storage unit 33 and the evacuation request notification W. The transition processing unit 46 then transmits the created transition request frame to the autonomous driving ECU 201H via the communication unit 31.

[0244] When the autonomous driving ECU 201H receives a transition request frame from the in-vehicle relay device 101, it transitions to the evacuation travel mode in accordance with the evacuation request notification W included in the received transition request frame. Specifically, for example, the autonomous driving ECU 201H guides its own vehicle 1 to the shoulder of the road by autonomous driving in accordance with the evacuation request notification W.

[0245] It should be noted that in transition process A2, transition processing unit 46 is not limited to a configuration that transitions autonomous driving ECU 201H to the evacuation traveling mode, but may also be configured to transmit information indicating that vehicle 1 should transition to the evacuation traveling mode to a display device in in-vehicle network 401 via communication unit 31. In this case, when the display device receives the information from management device 201G, it displays content indicating the information on its own display unit.

[0246] [Operation Flow] Next, the operation flow of each device in the in-vehicle system 301 according to the embodiment of the present disclosure will be described with reference to the drawings.

[0247] 8, 9, and 10 are flowcharts showing an example of an operation procedure when an in-vehicle relay device according to an embodiment of the present disclosure controls each switch. Figures 8, 9, and 10 show the operation when the power switch 92 and the control switch 91 are turned on by the on-control signal S51 and the on-control signal S11, respectively, generated in the in-vehicle relay device 101.

[0248] 8, 9 and 10, first, the vehicle-mounted relay device 101 performs a monitoring process E1 for monitoring the management device 201G while in an activated state (step ST101).

[0249] Next, the in-vehicle relay device 101 waits for reception of key verification information from the verification ECU 201E (NO in step ST102).

[0250] Next, when the in-vehicle relay device 101 receives the key verification information from the verification ECU 201E (YES in step ST102), the in-vehicle relay device 101 waits for reception of switch monitoring information from the body ECU 201A (NO in step ST103).

[0251] Then, when the in-vehicle relay device 101 receives switch monitoring information B from the body ECU 201A within a predetermined time after receiving the key matching information from the matching ECU 201E (YES in step ST103), it uses the received switch monitoring information B to determine whether the state of the vehicle 1 is in a running start state (step ST104).

[0252] Then, if the switch monitoring information B received from the body ECU 201A indicates that the brake pedal switch or the engine switch is in the off state, the vehicle relay device 101 determines that the vehicle 1 is not in the running start state (NO in step ST104), and determines whether an abnormality has occurred in the management device 201G (step ST105).

[0253] Next, if the vehicle relay device 101 determines that an abnormality has occurred in the management device 201G before the vehicle 1 starts driving (YES in step ST105), it transmits abnormality detection information M1 indicating that an abnormality has occurred in the management device 201G to the parking brake ECU 201F (step ST106).

[0254] Next, the vehicle-mounted relay device 101 performs a warning process K1 to output the abnormality detection information M1 as warning information (step ST107).

[0255] Next, vehicle-mounted relay device 101 performs reset processing R1 to reset management device 201G. For example, as described above, vehicle-mounted relay device 101 outputs a reset signal to signal line 6b to reset the microcomputer mounted in management device 201G (step ST108).

[0256] On the other hand, if the vehicle relay device 101 determines that no abnormality has occurred in the management device 201G before the vehicle 1 starts driving (NO in step ST105), it waits to receive new key matching information from the matching ECU 201E (NO in step ST103).

[0257] Furthermore, if the switch monitoring information B received from the body ECU 201A indicates that the brake pedal switch or the engine switch is in the on state (YES in step ST104), the vehicle relay device 101 determines that the vehicle 1 is in the driving start state and broadcasts a driving start notification to each vehicle equipment 201 (step ST109).

[0258] Next, the signal generating unit 22 in the in-vehicle relay device 101 generates an ON control signal S51 for turning on the power switch 92A and an ON control signal S11 for turning on the control switch 91 (step ST110). Note that steps ST109 and ST110 may be executed in reverse order or in parallel.

[0259] Next, the in-vehicle repeater 101 turns on the power switch 92A. For example, as described above, in the in-vehicle repeater 101, the signal generating unit 22 outputs the generated on-control signals S51 and S53 to the logic circuit unit 23. Then, the OR gate 82 in the logic circuit unit 23 outputs the gate signal S3 of a logic high level to the power switch 92A (step ST111).

[0260] Next, the in-vehicle relay device 101 turns on the control switch 91. For example, as described above, the signal generation unit 22 outputs the generated on control signal S11 to the logic circuit unit 23. Then, the OR gate 81 in the logic circuit unit 23 outputs a gate signal S1 of a logical high level to the control switch 91 (step ST112). This starts the supply of power to the autonomous driving ECU 201H.

[0261] Next, the in-vehicle relay device 101 waits for reception of a startup completion notification from the autonomous driving ECU 201H (NO in step ST113).

[0262] Then, when the in-vehicle relay device 101 receives a startup completion notification from the autonomous driving ECU 201H (YES in step ST113), it broadcasts an equipment status notification indicating that the autonomous driving ECU 201H is operating to each in-vehicle device 201 (step ST114).

[0263] Next, the vehicle-mounted relay device 101 waits for reception of the ON control signals S21, S61, and S71 from the management device 201G (NO in step ST115).

[0264] Then, when the vehicle relay device 101 receives the on control signals S21, S61, and S71 from the management device 201G (YES in step ST115), it transmits a switch-on notification N21 indicating that the on control signal S21 has been received, and a switch-on notification N22 indicating that the on control signals S61 and S71 have been received, to the management device 201G (step ST116), and determines whether an abnormality has occurred in the management device 201G (step ST117).

[0265] If the vehicle relay device 101 determines that no abnormality has occurred in the management device 201G (NO in step ST117), it waits to receive a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201A (NO in step ST118).

[0266] Next, when the vehicle relay device 101 receives a brake-on notification from the parking brake ECU 201F and sensor monitoring information from the body ECU 201A (YES in step ST118), it determines whether the state of the vehicle 1 is in a driving end state based on the sensor information C1, C2, and C3 contained in the received sensor monitoring information (step ST119).

[0267] When the vehicle relay device 101 determines that the vehicle 1 is in the traveling end state (YES in step ST119), the vehicle relay device 101 broadcasts a traveling end notification to each vehicle-mounted device 201 (step ST120).

[0268] The in-vehicle relay device 101 also broadcasts an OFF transition request to each in-vehicle device 201 to request the suspension of the execution of the driving-related function (step ST121).

[0269] Next, the vehicle relay device 101 waits to receive from the management device 201G an off control signal S22 for turning off the control switch 91, and off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (NO in step ST122).

[0270] Then, when the vehicle relay device 101 receives the off control signals S22, S62, and S72 from the management device 201G (YES in step ST122), it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201G (step ST123).

[0271] Next, after transmitting the switch-off notifications N11 and N12 to the management device 201G, the in-vehicle relay device 101 waits for reception of a stop preparation completion notification from the autonomous driving ECU 201H (NO in step ST124).

[0272] Then, in the vehicle relay device 101, when the signal generation unit 22 receives a notification that stop preparation is complete from the autonomous driving ECU 201H (YES in step ST124), it generates an off control signal S12 to turn off the control switch 91 and outputs it to the logic circuit unit 23 (step ST125).

[0273] Next, the in-vehicle repeater 101 turns off the control switch 91. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 23 inputs both the off control signal S12 and the off control signal S22 to the OR gate 81. Then, the OR gate 81 outputs the gate signal S1 of a logical low level to the control switch 91 (step ST126).

[0274] Next, when the in-vehicle relay device 101 turns off the control switch 91, it waits for a stop preparation completion notification from all the in-vehicle ECUs in the in-vehicle network 401 (NO in step ST127).

[0275] Then, in the vehicle relay device 101, when the signal generation unit 22 receives a notification that stop preparation is complete from all vehicle ECUs in the vehicle network 401 (YES in step ST127), it generates an off control signal S52 for turning off the power switch 92A and outputs it to the logic circuit unit 23 (step ST128).

[0276] Next, the in-vehicle repeater 101 turns off the power switch 92A. For example, as described above, in the in-vehicle repeater 101, the logic circuit unit 23 inputs both the off control signal S52 and the off control signal S62 to the OR gate 81. Then, the OR gate 82 outputs the gate signal S4 of a logical low level to the power switch 92A (step ST129).

[0277] On the other hand, if the vehicle relay device 101 determines that the state of the vehicle 1 is not the end-of-travel state (NO in step ST119), it checks again whether an abnormality has occurred in the management device 201G (step ST117).

[0278] Furthermore, if the in-vehicle relay device 101 determines that an abnormality has occurred in the management device 201G after power supply to the autonomous driving ECU 201H has started (YES in step ST117), the in-vehicle relay device 101 performs transition processing A1 to transition the autonomous driving ECU 201H to the evacuation travel mode. For example, as described above, the in-vehicle relay device 101 transmits a transition request frame to the autonomous driving ECU 201H (step ST130).

[0279] Next, the vehicle-mounted relay device 101 performs a warning process K1 to output, as warning information, abnormality detection information M1 indicating that an abnormality has occurred in the management device 201G (step ST131).

[0280] Next, the vehicle relay device 101 performs a reset process R1 to reset the management device 201G (step ST132). Note that steps ST130, ST131, and ST132 may be executed in reverse order or in parallel.

[0281] 11 is a flowchart showing another example of an operation procedure when the vehicle relay device according to the embodiment of the present disclosure controls each switch, in which the power switch 92A, the power switch 92B, and the control switch 91 are turned on by the ON control signal S61, the ON control signal S71, and the ON control signal S21, respectively, generated by the management device 201G.

[0282] 11 , first, in-vehicle repeater 101 receives on-control signals S61 and S71 for turning on power switches 92A and 92B, respectively, from management device 201G via signal line 6a, and turns on power switches 92A and 92B. For example, as described above, in in-vehicle repeater 101, logic circuit unit 23 receives on-control signals S61 and S71 from management device 201G via signal line 6a. OR gate 82 in logic circuit unit 23 outputs gate signal S3 of a logical high level to power switch 92A. Also, OR gate 83 in logic circuit unit 23 outputs gate signal S5 of a logical high level to power switch 92B (step ST201).

[0283] Next, the vehicle-mounted relay device 101 transmits to the management device 201G a switch-on notification N22 indicating that the on-control signals S61 and S71 have been received from the management device 201G (step ST202).

[0284] Next, vehicle relay device 101 receives an ON control signal S21 for turning on control switch 91 from management device 201G via signal line 6a, and turns on control switch 91. For example, as described above, logic circuit unit 23 receives ON control signal S21 from management device 201G via signal line 6a. Then, OR gate 81 in logic circuit unit 23 outputs gate signal S1 of a logic high level to control switch 91 (step ST203).

[0285] Next, the vehicle-mounted relay device 101 transmits to the management device 201G a switch-on notification N21 indicating that the on-control signal S21 has been received from the management device 201G (step ST204).

[0286] 12 and 13 are flowcharts illustrating an example of an operation procedure when the management device according to the embodiment of the present disclosure controls each switch.

[0287] 12 and 13, first, the management device 201G performs a monitoring process E2 for monitoring the state of the vehicle-mounted relay device 101 while it is activated (step ST301).

[0288] Next, management device 201G determines whether or not vehicle 1 is in the traveling start state. For example, as described above, management device 201G determines whether or not vehicle 1 is in the traveling start state by checking whether or not a traveling start notification has been received from in-vehicle relay device 101 (step ST302).

[0289] If the management device 201G determines that the vehicle 1 is not in the traveling start state (NO in step ST302), it determines whether an abnormality has occurred in the vehicle relay device 101 (step ST303).

[0290] Next, if the management device 201G determines that an abnormality has occurred in the vehicle relay device 101 before the vehicle 1 starts moving (YES in step ST303), it performs warning processing K2 to output abnormality detection information M2 indicating that an abnormality has occurred in the vehicle relay device 101 as warning information (step ST304).

[0291] Next, the management device 201G transmits a brake request notification indicating that the parking brake should be maintained in the ON state to the parking brake ECU 201F (step ST305).

[0292] Next, management device 201G performs reset processing R2 to reset in-vehicle relay device 101. For example, as described above, management device 201G outputs a reset signal to signal line 6b to reset the microcomputer installed in in-vehicle relay device 101 (step ST306). Note that steps ST304, ST305, and ST306 may be executed in reverse order or in parallel.

[0293] On the other hand, if the management device 201G determines that no abnormality has occurred in the vehicle relay device 101 before the vehicle 1 starts moving (NO in step ST303), it again determines whether the state of the vehicle 1 is in the moving start state (step ST302).

[0294] Furthermore, when the management device 201G determines that the state of the vehicle 1 is the traveling start state (YES in step ST302), it waits for reception of a device state notification from the vehicle-mounted relay device 101 (NO in step ST307).

[0295] Then, when the management device 201G receives an equipment status notification from the vehicle-mounted relay device 101 (YES in step ST307), it generates on-control signals S61 and S71 for turning on the power switches 92A and 92B, respectively, and transmits the on-control signals S61 and S71 to the vehicle-mounted relay device 101 via signal line 6a (step ST308).

[0296] Next, the management device 201G generates an ON control signal S21 for turning on the control switch 91, and transmits the ON control signal S21 to the vehicle-mounted relay device 101 via the signal line 6a (step ST309).

[0297] Next, the management device 201G waits for reception of the switch-on notifications N21 and N22 from the vehicle-mounted relay device 101 (NO in step ST310).

[0298] Then, when the management device 201G receives switch-on notifications N21 and N22 from the vehicle-mounted relay device 101 (YES in step ST310), it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST311).

[0299] Next, after transmitting the ON control signal S21 to the vehicle-mounted relay device 101, the management device 201G determines whether or not an abnormality has occurred in the vehicle-mounted relay device 101 (step ST312).

[0300] Then, if the management device 201G determines that no abnormality has occurred in the vehicle relay device 101 (NO in step ST312), it waits to receive a brake-on notification from the parking brake ECU 201F and a driving end notification from the vehicle relay device 101 (NO in step ST313 and NO in step ST314).

[0301] Next, when the management device 201G receives a brake-on notification and a driving-end notification from the parking brake ECU 201F and the vehicle-mounted relay device 101, respectively (YES in step ST313 and YES in step ST314), it generates off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively, and transmits them to the vehicle-mounted relay device 101 via signal line 6a (step ST315).

[0302] Furthermore, management device 201G generates an OFF control signal S22 for turning OFF control switch 91 and transmits it to in-vehicle relay device 101 (step ST316).

[0303] Next, the management device 201G waits for reception of the switch-off notifications N11 and N12 from the vehicle-mounted relay device 101 (NO in step ST317).

[0304] Then, when the management device 201G receives the switch-off notification N11, N12 from the vehicle-mounted relay device 101 (YES in step ST317), it broadcasts an off-completion notification indicating that the transmission of the off control signal S22 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST318).

[0305] On the other hand, if the management device 201G determines that an abnormality has occurred in the in-vehicle relay device 101 after transmitting the ON control signal S21 (YES in step ST312), the management device 201G performs transition processing A2 to transition the autonomous driving ECU 201H to the evacuation travel mode. For example, as described above, the management device 201G transmits a transition request frame to the autonomous driving ECU 201H (step ST319).

[0306] Next, the management device 201G performs a warning process K2 to output abnormality detection information M2 indicating that an abnormality has occurred in the vehicle-mounted relay device 101 (step ST320).

[0307] Next, the management device 201G performs a reset process R2 (step ST321) to reset the vehicle-mounted relay device 101. Note that steps ST319, ST320, and ST321 may be executed in a reverse order or in parallel.

[0308] 14 and 15 are diagrams illustrating an example of a processing sequence of the in-vehicle relay device and the in-vehicle equipment in the in-vehicle system according to the embodiment of the present disclosure.

[0309] 14 and 15, first, the management device 201G broadcasts an OFF completion notification indicating that the OFF control signal S22 has been transmitted to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST401).

[0310] Furthermore, the verification ECU 201E transmits the key verification information to the in-vehicle relay device 101 (step ST402).

[0311] Furthermore, the body ECU 201A transmits switch monitoring information indicating the monitoring results of the states of the brake pedal switch and the engine switch to the in-vehicle relay device 101 (step ST403).

[0312] Next, when the in-vehicle relay device 101 receives the key verification information and the switch monitoring information from the verification ECU 201E and the body ECU 201A, respectively, it performs a determination process J1 to determine whether the vehicle 1 is in a running start state. Here, it is assumed that the in-vehicle relay device 101 determines that the vehicle 1 is in a running start state (step ST404).

[0313] Next, the vehicle relay device 101 broadcasts a travel start notification indicating that the state of the vehicle 1 is in a travel start state to each of the vehicle-mounted devices 201 (step ST405).

[0314] Next, the vehicle-mounted repeater 101 generates an ON control signal S11 for turning on the control switch 91. The vehicle-mounted repeater 101 also generates an ON control signal S51 for turning on the power switch 92A (step ST406).

[0315] Next, the in-vehicle relay device 101 turns on the power switches 92A and 92B using the OR gate 82 as described above. Also, the in-vehicle relay device 101 turns on the control switch 91 using the OR gate 81 as described above. This starts the supply of power to the autonomous driving ECU 201H (step ST407).

[0316] Next, the autonomous driving ECU 201H starts up (step ST408) and transmits a start-up completion notification indicating that the autonomous driving ECU 201H has started up to the in-vehicle relay device 101 (step ST409).

[0317] Next, the automatic driving ECU 201H starts executing the automatic driving function (step ST410). Note that steps ST409 and ST410 may be executed in reverse order, or may be executed in parallel.

[0318] Furthermore, when the in-vehicle relay device 101 receives a startup completion notification from the autonomous driving ECU 201H, it broadcasts an equipment status notification indicating that the autonomous driving ECU 201H is operating to each in-vehicle device 201 (step ST411).

[0319] In addition, the management device 201G receives an equipment status notification from the vehicle relay device 101 and generates on control signals S61 and S71 for turning on the power switches 92A and 92B, respectively, and an on control signal S21 for turning on the control switch 91 (step ST412).

[0320] Next, the management device 201G transmits the generated ON control signals S61, S71, S21 to the vehicle-mounted relay device 101 via the signal line 6a (step ST413).

[0321] Next, the management device 201G broadcasts an on-unconfirmed notification to each other in-vehicle device 201 and in-vehicle relay device 101 indicating that the on control of the control switch 91 using the on control signal S21, the on control of the power switch 92A using the on control signal S61, and the on control of the power switch 92B using the on control signal S71 have not been completed (step ST414).

[0322] Next, when the vehicle-mounted relay device 101 receives the ON control signal S21 from the management device 201G, it transmits a switch-on notification N21 indicating that the ON control signal S21 has been received to the management device 201G (step ST415).

[0323] Furthermore, when the vehicle relay device 101 receives the ON control signals S61 and S71 from the management device 201G, it transmits a switch-on notification N22 indicating that the ON control signals S61 and S71 have been received to the management device 201G (step ST416).

[0324] Next, when the management device 201G receives the switch-on notification N21 from the vehicle-mounted relay device 101, it broadcasts an on-completion notification indicating that the on control of the control switch 91 has been completed to each other vehicle-mounted device 201 and the vehicle-mounted relay device 101 (step ST417).

[0325] Next, when the parking brake ECU 201F receives a driving start notification or an equipment status notification from the vehicle relay device 101 and an on completion notification from the management device 201G, it performs a parking brake release process to transition the parking brake from the on state to the off state (step ST418).

[0326] 16 and 17 are diagrams illustrating another example of the processing sequence of the in-vehicle relay device and the in-vehicle device in the in-vehicle system according to the embodiment of the present disclosure.

[0327] 16 and 17, first, the management device 201G broadcasts an ON completion notification indicating that the ON control of the control switch 91 has been completed to each of the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST501).

[0328] In addition, the body ECU 201A transmits to the vehicle relay device 101 a frame F including sensor information C1, sensor information C2, and sensor information C3, which respectively indicate the detection results of the occupant sensor 201B, the buckle sensor 201C, and the door opening / closing sensor 201D while the vehicle 1 is moving (step ST502).

[0329] The parking brake ECU 201F also determines whether to transition the parking brake from the OFF state to the ON state. Here, it is assumed that the parking brake ECU 201F has received an ON completion notification from the management device 201G and has determined to transition the parking brake from the OFF state to the ON state because operation Q1 has been performed on the vehicle 1 (step ST503).

[0330] Next, the parking brake ECU 201F broadcasts a brake-on notification indicating that the parking brake has been switched to the on state to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST504).

[0331] Furthermore, the in-vehicle relay device 101 receives a frame F and a brake-on notification from the body ECU 201A and the parking brake ECU 201F, respectively, and performs a determination process J2 to determine whether the state of the vehicle 1 is in a traveling end state. Here, it is assumed that the in-vehicle relay device 101 determines that the state of the vehicle 1 is in a traveling end state (step ST505).

[0332] Next, the vehicle relay device 101 broadcasts a driving end notification indicating that the state of the vehicle 1 is in a driving end state to each vehicle-mounted device 201 (step ST506).

[0333] Furthermore, when the in-vehicle relay device 101 receives the brake-on notification from the parking brake ECU 201F, it broadcasts an OFF transition request to each in-vehicle device 201 before generating the OFF control signal S12 (step ST507).

[0334] Next, when the management device 201G receives a parking brake on notification from the parking brake ECU 201F and a driving end notification or an off transition request from the vehicle relay device 101, it generates an off control signal S22 for turning off the control switch 91, and off control signals S62 and S72 for turning off the power switches 92A and 92B, respectively (step ST508).

[0335] Next, the management device 201G broadcasts an OFF unconfirmed notification indicating that the OFF control of the control switch 91 by the OFF control signal S22 is unconfirmed to the other in-vehicle devices 201 and the in-vehicle relay device 101 (step ST509).

[0336] Next, the management device 201G transmits the generated OFF control signals S22, S62, and S72 to the vehicle-mounted relay device 101 via the signal line 6a (step ST510).

[0337] Next, when the vehicle relay device 101 receives the off control signals S22, S62, and S72 from the management device 201G, it transmits a switch-off notification N11 indicating that the off control signals S62 and S72 have been received, and a switch-off notification N12 indicating that the off control signal S22 has been received, to the management device 201G (step ST511).

[0338] Next, when the management device 201G receives switch-off notifications N11 and N12 from the vehicle-mounted relay device 101, it broadcasts an off-completion notification indicating that the off-control signals S22, S62, and S72 have been transmitted to each of the other vehicle-mounted devices 201 and the vehicle-mounted relay device 101 (step ST512).

[0339] Next, when the autonomous driving ECU 201H receives a driving end notification or an OFF transition request from the in-vehicle relay device 101 and an OFF completion notification from the management device 201G, it performs pre-processing to stop the execution of the autonomous driving function. For example, as described above, the autonomous driving ECU 201H performs predetermined pre-processing in preparation for stopping the execution of the autonomous driving function (step ST513).

[0340] Next, the autonomous driving ECU 201H transmits a stop preparation completion notification indicating that preparation for stopping the execution of the autonomous driving function has been completed to the in-vehicle relay device 101 (step ST514).

[0341] Next, when the in-vehicle relay device 101 receives the stop preparation completion notification from the autonomous driving ECU 201H, it generates the OFF control signal S12 (step ST515).

[0342] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S12, it turns OFF the control switch 91 using the OR gate 81 as described above (step ST516).

[0343] Next, the in-vehicle relay device 101 checks whether the execution of various services has been stopped in the in-vehicle network 401. For example, as described above, when the in-vehicle relay device 101 receives a notification that the preparation for stopping has been completed from all the in-vehicle ECUs in the in-vehicle network 401, the in-vehicle relay device 101 determines that the execution of various services has been stopped (step ST517).

[0344] Next, when the in-vehicle relay device 101 confirms that the execution of various services has been stopped, it generates an OFF control signal S52 (step ST518).

[0345] Next, when the vehicle-mounted relay device 101 generates the OFF control signal S52, it turns off the power switch 92A using the OR gate 82 as described above (step ST519).

[0346] In the in-vehicle system 301 according to the embodiment of the present disclosure, the control switch 91 and the power switches 92A and 92B are configured to be provided in the in-vehicle relay device 101, but this is not limited to this. Some or all of the control switch 91 and the power switches 92A and 92B may be configured to be provided outside the in-vehicle relay device 101.

[0347] Furthermore, in the in-vehicle relay device 101 according to the embodiment of the present disclosure, the logic circuit unit 23 is configured to include an OR gate 81, but this is not limited thereto. The logic circuit unit 23 may be configured to include a NAND gate instead of the OR gate 81. In this case, the signal generating unit 22 in the in-vehicle relay device 101 and the signal generating unit 42 in the management device 201G generate an ON control signal S11 and an ON control signal S21 at a logical low level, respectively. When at least one of the ON control signal S11 and the ON control signal S21 is input to the NAND gate, a gate signal at a logical high level is output from the NAND gate to the control switch 91. In other words, even when the logic circuit unit 23 includes a NAND gate, the control switch 91 turns on under the OR condition of the ON control signal S11 and the ON control signal S21.

[0348] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the first off condition under which the in-vehicle relay device 101 turns off the control switch 91 is different from the second off condition under which the management device 201G turns off the control switch 91, but this is not limited to this. The first off condition may be the same as the second off condition.

[0349] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the second off condition includes a condition related to the state of the parking brake of the vehicle 1, and the first off condition does not include a condition related to the state of the parking brake, but this is not limited to this. The second off condition may include a condition different from the condition related to the state of the parking brake, and the first off condition may not include the other condition.

[0350] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the first ON condition for the in-vehicle relay device 101 to turn on the control switch 91 is different from the second ON condition for the management device 201G to turn on the control switch 91, but this is not limited to this. The first ON condition may be the same as the second ON condition. In this case, when the state of the vehicle 1 is in a traveling start state, i.e., when the management device 201G receives a traveling start notification from the in-vehicle relay device 101, the management device 201G generates and outputs the ON control signal S21.

[0351] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the parking brake ECU 201F is configured to transition the parking brake from the ON state to the OFF state when the in-vehicle relay device 101 outputs the ON control signal S11, the management device 201G outputs the ON control signal S21, and the operation Q1 is performed on the vehicle 1, but this is not limited to this. The parking brake ECU 201F may also be configured to transition the parking brake from the ON state to the OFF state when other conditions are met.

[0352] In addition, in the in-vehicle system 301 according to the embodiment of the present disclosure, the control switch 91 is configured to switch on / off the supply of power to the driving-related equipment, but this is not limited to this. The control switch 91 may be configured to switch on / off the supply of power to other in-vehicle equipment 201 other than the driving-related equipment.

[0353] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the autonomous driving ECU 201H is configured to start executing the autonomous driving function when the vehicle 1 is in a driving start state and the control switch 91 is turned on by the ON control signal S11 or the ON control signal S21, but this is not limited to this. The autonomous driving ECU 201H may also be configured to start executing the autonomous driving function when other conditions are met.

[0354] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the autonomous driving ECU 201H is configured to perform pre-processing to stop the execution of the autonomous driving function when it receives a driving end notification or an OFF transition request notification from the in-vehicle relay device 101 and the management device 201G outputs the OFF control signal S22, but this is not limited to this. The autonomous driving ECU 201H may be configured not to perform the pre-processing if it is permitted not to perform processing such as saving data stored in volatile memory to non-volatile memory.

[0355] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the off control signal S22 when the management device 201G generates the off control signal S22 and the autonomous driving ECU 201H has performed preprocessing, but this is not limited to this. The in-vehicle relay device 101 may also be configured to generate the off control signal S12 when the management device 201G generates the off control signal S22, regardless of whether the autonomous driving ECU 201H has performed preprocessing.

[0356] Furthermore, in the in-vehicle system 301 according to the embodiment of the present disclosure, the in-vehicle relay device 101 is configured to generate the ON control signal S51 for turning on the power switch 92 when it is determined that the state of the vehicle 1 is in a traveling start state, but this is not limited to this. The in-vehicle relay device 101 may be configured to generate the ON control signal S51 when it is determined that the driver has entered the vehicle 1, specifically when the driver has performed an operation to unlock the door at the driver's seat, or when it is determined that the driver has sat in the driver's seat.

[0357] The above-described embodiments should be considered to be illustrative in all respects and not restrictive. The scope of the present invention is defined by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

[0358] Each process (each function) in the above-described embodiments is realized by a processing circuit including one or more processors. The processing circuit may be configured as an integrated circuit or the like that combines one or more memories, various analog circuits, and various digital circuits in addition to the one or more processors. The one or more memories store programs (instructions) that cause the one or more processors to execute each of the processes. The one or more processors may execute each of the processes according to the program read from the one or more memories, or may execute each of the processes according to a logic circuit designed in advance to execute each of the processes. The processor may be any of various processors suitable for computer control, such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and an ASIC (Application Specific Integrated Circuit). Note that the physically separated processors may cooperate with each other to execute the processes. For example, the processors installed in the physically separated computers may cooperate with each other via a network such as a LAN (Local Area Network), a WAN (Wide Area Network), or the Internet to execute the processes. The program may be installed into the memory from an external server device or the like via the network, or may be distributed in a state stored on a recording medium such as a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disc Read Only Memory), or a semiconductor memory, and then installed into the memory from the recording medium.

[0359] 1 Vehicle 2, 2A, 2B, 2C, 2D CAN bus 5, 5A, 5B, 5C, 5D Power line 6, 6a, 6b Signal line 11 Relay unit 12, 32 Processing unit 13, 33 Memory unit 21, 41 Determination unit 22, 42 Signal generation unit 23 Logic circuit unit 24, 43 Notification unit 25, 44 Monitoring unit 26, 45 Abnormality processing unit 27, 46 Transition processing unit 31 Communication unit 51 Power supply unit 61 First power supply 62 Second power supply 71 Battery 72 DC / DC converter 81, 82, 83 OR gate 91 Control switch 92, 92A, 92B Power switch 101 In-vehicle relay device 201 In-vehicle equipment 301 In-vehicle system 401 In-vehicle network

Claims

1. An in-vehicle system mounted on a vehicle, comprising a first in-vehicle device and a second in-vehicle device that control a switch that switches on / off the supply of power to a specific in-vehicle device in the vehicle, wherein the first in-vehicle device outputs a first on control signal to the switch for turning on the switch, and the second in-vehicle device outputs a second on control signal to the switch for turning on the switch, and the switch turns on under an OR condition of the first on control signal and the second on control signal.

2. The in-vehicle system described in claim 1, wherein the first in-vehicle device outputs a first off control signal to the switch for turning off the switch, and the second in-vehicle device outputs a second off control signal to the switch for turning off the switch, and a first off condition under which the first in-vehicle device outputs the first off control signal is different from a second off condition under which the second in-vehicle device outputs the second off control signal.

3. The in-vehicle system according to claim 2, wherein the first off condition includes a condition relating to the state of the specific in-vehicle device, and the second off condition does not include a condition relating to the state of the specific in-vehicle device.

4. The in-vehicle system according to claim 3, wherein the specific in-vehicle device is an in-vehicle device that executes a function related to the running of the vehicle.

5. An in-vehicle system according to any one of claims 1 to 4, wherein a first on condition, which is a condition under which the first in-vehicle device outputs the first on control signal, is different from a second on condition, which is a condition under which the second in-vehicle device outputs the second on control signal.

6. The in-vehicle system according to any one of claims 1 to 5, further comprising a third in-vehicle device that controls a parking brake of the vehicle, wherein the third in-vehicle device transitions the parking brake from an on state to an off state when the first in-vehicle device outputs the first on control signal, the second in-vehicle device outputs the second on control signal, and a predetermined operation is performed in the vehicle.

7. An in-vehicle system according to any one of claims 1 to 6, wherein the specific in-vehicle device is driving-related equipment that executes a function related to the driving of the vehicle, and the driving-related equipment starts executing the function when the vehicle is in a state where it can start driving and the state of the switch is turned on by the first on control signal or the second on control signal.

8. The vehicle is provided with a plurality of driving-related devices, and some of the driving-related devices start executing the function when the vehicle is in a state where it can start driving, the switch is in an on state by the first on control signal or the second on control signal, and the parking brake of the vehicle is in an off state.

9. The in-vehicle system described in claim 7 or claim 8, wherein the first in-vehicle device transmits to the driving-related equipment a driving end notification indicating that the vehicle is in a state to end driving or a request notification to request that execution of the function be stopped before outputting a first off control signal to the switch to turn off the switch, and the driving-related equipment performs pre-processing to stop execution of the function before the power supply to the driving-related equipment is stopped when it receives the driving end notification or the request notification from the first in-vehicle device and the second in-vehicle device outputs a second off control signal to turn off the switch.

10. The in-vehicle system described in claim 9, wherein the first in-vehicle device outputs the first off control signal to the switch when the second in-vehicle device outputs the second off control signal and the driving-related equipment has performed the pre-processing.

11. The first in-vehicle device is equipped with an OR circuit that outputs a signal indicating the logical sum of the first off control signal and the second off control signal to the switch; the second in-vehicle device transmits the second off control signal to the first in-vehicle device; when the first in-vehicle device receives the second off control signal from the second in-vehicle device, it transmits a reception notification to the second in-vehicle device indicating that it has received the second off control signal; when the second in-vehicle device receives the reception notification from the first in-vehicle device, it transmits a completion notification to the driving-related equipment indicating that it has completed transmitting the second off control signal; and when the driving-related equipment receives the request notification from the first in-vehicle device and the completion notification from the second in-vehicle device, it performs the pre-processing. An in-vehicle system as described in claim 9 or claim 10.

12. The in-vehicle system further includes a third in-vehicle device that is an in-vehicle device that controls the parking brake of the vehicle, the first in-vehicle device including an OR circuit that outputs a signal indicating the logical sum of the first on-control signal and the second on-control signal to the switch, the first in-vehicle device transmitting to the second in-vehicle device and the third in-vehicle device a driving start notification indicating that the vehicle is in a state where it can start driving, or an equipment status notification indicating that the driving-related equipment is in operation, the second in-vehicle device transmitting the second on-control signal to the first in-vehicle device when receiving the driving start notification or the equipment status notification from the first in-vehicle device, the first in-vehicle device transmitting a reception notification indicating that the second on-control signal has been received to the second in-vehicle device when receiving the second on-control signal from the second in-vehicle device, the second in-vehicle device transmitting an on-execution notification indicating that on-control of the switch using the second on-control signal is being executed to the third in-vehicle device when receiving the reception notification from the first in-vehicle device, 12. The in-vehicle system according to claim 7, wherein, when the parking brake is in an on state, the third in-vehicle device receives the driving start notification or the equipment status notification from the first in-vehicle device, receives the on execution notification from the second in-vehicle device, and when an operation to turn off the parking brake is performed in the vehicle, the third in-vehicle device transitions the parking brake from the on state to the off state.

13. A power supply control method for an in-vehicle system mounted on a vehicle, the in-vehicle system comprising a first in-vehicle device and a second in-vehicle device, the first in-vehicle device being an in-vehicle device that controls a switch that switches on / off the supply of power to specific in-vehicle equipment in the vehicle, the power supply control method including the steps of: the first in-vehicle device outputting a first on control signal to the switch for turning on the switch; the second in-vehicle device outputting a second on control signal to the switch for turning on the switch; and the switch turning on under an OR condition of the first on control signal and the second on control signal.

Images