Redundant system
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- NISSAN MOTOR CO LTD
- Filing Date
- 2024-11-12
- Publication Date
- 2026-05-21
Smart Images
Figure JP2024040191_21052026_PF_FP_ABST
Abstract
Description
Redundant System
[0001] The present invention relates to a redundant system.
[0002] Conventionally, technologies related to vehicle control systems have been known. The vehicle control system described in Patent Document 1 includes a central ECU having a self-diagnosis function and a zone ECU arranged in a predetermined zone of the vehicle. The zone ECU has a preliminary determination unit capable of determining whether to operate a brake lamp. When there is an abnormality in the central ECU or an abnormality in the communication state from the central ECU to the zone ECU, the preliminary determination unit determines whether to operate the brake lamp, and when operating the brake lamp, transmits an on signal to the brake lamp.
[0003] Japanese Unexamined Patent Application Publication No. 2021-20652
[0004] However, in the above vehicle control system, there is a problem that the signal system from the input of the command to turn on the brake lamp to the switch for switching the on / off of the brake lamp is not redundant.
[0005] The problem to be solved by the present invention is to provide a redundant system in which the signal system from the input of the command to turn on the stop lamp to the switch for switching the on / off of the stop lamp is redundant.
[0006] The present invention includes a main signal line that inputs a brake operation command and a determination command to a control unit and outputs a switching command from the control unit to an IPD, a first redundant signal line that inputs a brake operation command and outputs the brake operation command to a plurality through a latch circuit, and a second redundant signal line that inputs a determination command and outputs the determination command to the IPD through a latch circuit. When a defect occurs in the control unit, the above problem is solved by operating the latch circuit so that the stop lamp turns on or off according to the brake operation command or the determination command.
[0007] According to the present invention, the signal system from the input of the command to turn on the stop lamp to the switch for switching the on / off of the stop lamp can be made redundant.
[0008] Figure 1 is a block diagram of the vehicle control system according to this embodiment. Figure 2 is a block diagram of a modified vehicle control system according to this embodiment.
[0009] Hereinafter, embodiments of the ECU control system according to the present invention will be described with reference to the drawings.
[0010] Figure 1 is a block diagram of a vehicle control system including the redundant system 100 according to this embodiment. The redundant system 100 according to this embodiment is mounted on a vehicle and is a system that provides redundancy to the signal path from the input of a command to turn the stop lamps on or off to a switch to switch the stop lamps on or off.
[0011] The redundant system 100 is installed, for example, in a vehicle equipped with an autonomous driving control function. When an autonomous driving mode is selected in the vehicle, the ADCM (Autonomous Driving Control Module) that controls the vehicle's autonomous driving performs autonomous driving with driving assistance according to the driving assistance level. The driving assistance level is a level that indicates the degree of intervention when the driving assistance device assists the driving of the vehicle with the autonomous driving control function. The higher the driving assistance level, the lower the driver's contribution to the driving of the vehicle. Specifically, the driving assistance level can be set using definitions based on SAE J3016 of the Society of Automotive Engineers (SAE). For example, in driving assistance that achieves driving assistance level 2, the vehicle can be controlled in a mode in which the vehicle drives autonomously without the driver touching the steering wheel (also called hands-off mode). In hands-off mode, the driving assistance device performs some driving tasks on behalf of the driver. For example, when driving in hands-off mode, the driving assistance device operates the brakes to generate braking force in order to decelerate the vehicle according to the driving environment, etc. In this case, the stop lamps (brake lights) turn on when the vehicle brakes during autonomous driving. Onboard equipment related to basic vehicle driving functions, such as stop lamps, requires redundant functions to maintain their functionality even in the event of a failure of the onboard microcontroller or a malfunction in the wiring harness.
[0012] The stop lamps receive power from the battery via a drive circuit. The stop lamps also switch on and off in response to brake switch operation commands and braking force during autonomous driving. Therefore, the stop lamp control system includes a microcontroller that controls the stop lamps in response to brake switch operation commands, and another microcontroller that controls the stop lamps in response to braking force during autonomous driving. To provide redundancy to such a stop lamp operating system, for example, a redundant circuit (hereinafter also referred to as a fully redundant circuit) can be implemented by providing drive circuits and power supplies to multiple control microcontrollers.
[0013] However, a fully redundant circuit requires multiple power supplies, necessitating a pair of relays connecting the power supplies and the stop lamps, and thus increasing the length of the harness from the power supply to the stop lamps. Therefore, adopting a fully redundant circuit results in higher costs. The redundant system 100 according to this embodiment simplifies the redundant circuit and reduces costs.
[0014] As shown in Figure 1, the vehicle control system includes a battery 1, a brake switch (SW) 2, stop lamps 3 and 4, a judgment unit 90, and a redundant system 100. The onboard devices such as the brake SW2 and the ECU such as the judgment unit 90 included in the vehicle control system are connected by an in-vehicle communication network (signal line) such as CAN or LIN.
[0015] Battery 1 is a rechargeable battery, such as a lithium-ion battery, mounted in the vehicle. Brake SW2 outputs a brake operation command to turn the stop lamps on or off in conjunction with the operation of the brake pedal. When the user presses the brake pedal, brake SW2 outputs a brake operation command indicating that brake switch 2 is ON. When the user is not pressing the brake pedal, brake SW2 outputs a brake operation command indicating that brake switch 2 is OFF. Stop lamps 3 and 4 are installed on the left and right sides of the rear of the vehicle, respectively, to inform occupants of vehicles behind that the vehicle is braking. Stop lamps 3 and 4 operate on power supplied from battery 1. The thick lines shown in Figure 1 indicate the power supply lines from battery 1 to stop lamps 3 and 4.
[0016] The determination unit 90 is an ECU included in the chassis control module (CDM), which includes the braking system, steering system, etc. The determination unit 90 acquires a signal indicating the braking force during autonomous driving from the vehicle's autonomous driving control module (ADCM). The determination unit 90 determines whether the brakes are on or off based on the braking force during autonomous driving and outputs a determination command to the redundant system 100. The determination of whether the brakes are on or off by the determination unit 90 is linked to the on or off status of the stop lamps. The determination unit 90 is a unit that has some of the functions included in the CDM's ECU, and the CDM's ECU may have other functions in addition to the functions of the determination unit 90.
[0017] The redundant system 100 provides redundancy to the signal path from the input of the ON command to turn on the stop lamps 3 and 4 to the switch that toggles the stop lamps on and off. The ON command for stop lamps 3 and 4 input to the redundant system 100 corresponds to the ON command for the brake switch input from the brake SW2, and corresponds to the brake ON determination command input from the determination unit 90. The redundant system 100 is applied, for example, to a BCM (Body Control Module) that controls the functions of the entire vehicle body.
[0018] The redundant system 100 includes a relay 10, a control unit 20, IPDs 31-34, OR circuits 41-44, a latch circuit 45, and an OR circuit 46. The relay 10 is connected between the battery 1 and the IPDs 31-34 and switches between electrical conduction and interruption between the battery 1 and the multiple IPDs 31-34. The relay 10 switches on and off in response to control commands from the control unit 20.
[0019] The control unit 20 receives a brake operation command from the brake SW2 indicating whether the brake SW2 is on or off, and outputs a switching command corresponding to the brake operation command. The control unit 20 also receives a judgment command from the judgment unit 90 determining whether the stop lamps 3 and 4 are off, and outputs a switching command corresponding to the judgment command. The control unit 20 outputs switching commands corresponding to the brake operation command to the latch circuits 51 and 53. The control unit 20 also outputs switching commands corresponding to the judgment command to the latch circuits 52 and 54. The control unit 20 receives an ON command from the vehicle's power switch (also called the main switch or ignition switch) and turns on the relay 10 according to the ON command.
[0020] IPD31-34 are intelligent power devices, serving as an example of semiconductor switches. IPD31 and 33 are connected between the battery 1 and the stop lamp 3, switching the power supply from the battery 1 to the stop lamp 3 on and off. By connecting IPD31 and 33 in parallel between the battery 1 and the stop lamp 3, a redundant circuit is formed. For example, even if IPD31 malfunctions due to being stuck in the off position, IPD33 can be turned on, allowing power to be supplied from the battery 1 to the stop lamp 3.
[0021] IPDs 32 and 34 are connected between the battery 1 and the stop lamp 4, and switch the conduction and interruption of power from the battery 1 to the stop lamp 4. IPDs 32 and 34 form a redundant circuit by being connected in parallel between the battery 1 and the stop lamp 3. IPDs 31 to 34 are switched on and off based on the switching command of the control unit 20, the brake operation command of the brake SW2, and the determination command of the determination unit 90. Each control terminal of IPDs 31 to 34 is connected to the output terminals of the latch circuits 31 to 34. Note that IPDs 31 to 34 are not limited to semiconductor switches, but may be other switches or relays. IPDs 31 and 33 correspond to the "first switch" of the present invention, and IPDs 32 and 34 correspond to the "second switch" of the present invention.
[0022] OR circuits 41 to 44 output output signals to IPDs 31 to 34, respectively, to turn them on when the OR condition is met between the input from the control unit 20 and the input from the latch circuit 45. OR circuits 41 to 44 are provided to correspond to IPDs 31 to 34, and are connected between IPDs 31 to 34 and the control unit 20, and between IPDs 31 to 34 and the latch circuit 45.
[0023] The latch circuit 45 operates to turn the stop lamps 3 and 4 on or off in response to a brake operation command or a determination command from the determination unit 90 when the control unit 20 fails. The latch circuit 45 is connected between OR circuits 41 to 44 and OR circuit 46.
[0024] The latch circuit 45 has an AND circuit and outputs an ON command to turn on IPDs 31-34 when the AND condition of the two input values is met. Of the two input values, one input value is the command value of the brake operation command or the judgment command of the judgment unit 90. The other input value is the value of the signal (LIMP) that is input when the microcontroller malfunctions. In other words, one of the pair of input terminals of the latch circuit 45 is connected by a signal line to the output of the brake SW2 and the output of the judgment unit 90. The other input terminal of the pair of inputs of the latch circuit 45 is input with the signal (LIMP).
[0025] The signal (LIMP) is a signal issued by the hardware backup, a function of the in-vehicle control system, when a microcontroller malfunctions. The in-vehicle control system has a function to monitor the microcontroller within the system (a so-called watchdog). For example, if the control unit 20 malfunctions or stops for any reason (if the control unit 20 fails), the operation of the control unit 20 is forcibly stopped. The signal issued by the watchdog timer when the operation of the control unit 20 is forcibly stopped is input to the latch circuit 45 as LIMP.
[0026] When a signal (LIMP) is input to the latch circuit 45, the latch circuit 45 holds one of the pair of input values of the AND circuit in a state of "1". In other words, when the control unit 20 fails, the latch circuit 45 holds (sets) the other of the two input values of the latch circuit 45 in an input state of "1". As a result, when the control unit 20 fails, the latch circuit 45 maintains a state in which it can switch the stop lamps 3 and 4 on and off in response to a brake operation command for the stop lamps 3 and 4 or a determination command from the determination unit 90.
[0027] The OR circuit 46 outputs a signal indicating input state "1" when the OR condition is met between the input from the brake SW2 and the input from the determination unit 90. The OR circuit 46 is connected between the brake SW2 and the latch circuit 45, and between the determination unit 90 and the latch circuit 45.
[0028] The redundant system 100 comprises circuit elements including OR circuits 41-44, latch circuit 45, and OR 46, and signal lines to constitute the redundant circuit 200. The circuit configuration of the redundant circuit 200 will be described below. Signal line L1 connecting the brake SW2 and the control unit 20, and signal line L2 connecting the determination unit 90 and the control unit 20, have branch points P and Q. Branch signal lines L3 and L4 connect branch points P and Q to the OR circuit 46. Brake operation commands and determination commands from the determination unit 90 are transmitted to the control unit 20 via signal lines L1 and L2, and to the OR circuit 46 via branch signal lines L3 and L4. In other words, branch signal lines L3 and L4 become part of the signal lines for the redundant circuit.
[0029] The redundant circuit 200 includes a main signal line that transmits brake operation commands and judgment units 90 via the control unit 20, a first redundant signal line that transmits brake operation commands without going through the control unit 20, and a second redundant signal line that transmits judgment commands from the judgment unit 90 without going through the control unit 20. Each signal line will be described below.
[0030] When a brake operation command and a judgment command from the judgment unit 90 are input to the control unit 20, the control unit 20 outputs switching commands for IPDs 31-34 in accordance with the brake operation command and the judgment command from the judgment unit 90. The switching commands are output to IPDs 31-34 via OR circuits 41-44. In other words, the signal line through which the command flows in the order of branching points P and Q, signal lines L1 and L2, control unit 20, OR circuits 41-44, and the control terminals of IPDs 31-34 is the main signal line. In Figure 1, the line indicated by the solid arrow between branching points P and Q and IPDs 31-34 corresponds to the main signal line.
[0031] When a signal (LIMP) is input, and one of the AND conditions of the OR circuit 46 is in the SET state (held in input state "1"), and a brake operation command or a judgment command from the judgment unit 90 is input to the OR circuit 46, the brake operation command or judgment command is output to the IPD 31-34 via the latch circuit 45 and OR circuits 41-44. In other words, if the brake operation command or judgment command is a command to turn on the stop lamps 3 and 4, each command is converted into an ON command for the IPD 31-34 by the OR circuits 41-44 and input to the IPD 31-34. The signal line that carries the brake operation command in the order of branch point P, branch signal line L3, OR circuit 46, latch circuit 45, OR circuits 41-44, and the control terminals of the IPD 31-34 becomes the first redundant signal line for the brake operation command. Furthermore, the signal lines that transmit the decision command in the order of branch point Q, branch signal line L4, OR circuit 46, latch circuit 45, OR circuits 41-44, and the control terminals of IPD 31-34 become the second redundant signal lines for the decision command. In Figure 1, the lines indicated by dotted arrows between branch points P and Q and IPD 31-34 correspond to the first and second redundant signal lines.
[0032] Next, the circuit operation of the redundant circuit 200 will be explained. First, the circuit operation of the control unit 20 under normal conditions will be explained. Since the signal (LIMP) is not input to the latch circuit 45 and the AND condition of the latch circuit 45 is not met, the latch circuit 45 does not output the brake operation command and the determination command of the determination unit 90 to the OR circuits 41 to 44. The brake operation command or determination command is input to the control unit 20, and the control unit 20 determines whether or not a brake operation has been performed based on the brake operation command. The control unit 20 also determines whether or not to turn on the stop lamps 3 and 4 based on the braking force of the autonomous driving based on the determination command of the determination unit 90. If it is determined that a brake operation has been performed, or if it is determined that the stop lamps 3 and 4 should be turned on based on the braking force of the autonomous driving, an ON command to turn on IPDs 31 to 34 is output to the OR circuits 41 to 44. IPDs 31 to 34 are turned on by the ON command output from the OR circuits 41 to 44, and the stop lamps 3 and 4 are turned on.
[0033] The circuit operation when the control unit 20 fails will be explained. The signal (LIMP) is input to the latch circuit 45. A brake operation command or a judgment command from the judgment unit 90 is input to the latch circuit 45. When the AND condition of the latch circuit 45 is met, the latch circuit 45 outputs the brake operation command or judgment command to the OR circuits 41 to 44. If the brake operation command is a command to turn on the stop lamps 3 and 4, or if the judgment command is a command to turn on the stop lamps 3 and 4, then the IPDs 31 to 34 turn on, and the stop lamps 3 and 4 turn on. In this way, when the control unit 20 fails, the on and off of the stop lamps 3 and 4 can be switched according to the brake operation command or the judgment command from the judgment unit 90.
[0034] The circuit operation when the judgment unit 90 fails will be explained. Under normal conditions, the judgment unit 90 outputs a predetermined signal to the control unit 20. The predetermined signal may be transmitted periodically. The control unit 20 monitors the signal transmitted from the judgment unit 90. When the judgment unit 90 fails, the transmission of the signal from the judgment unit 90 to the control unit 20 is interrupted. The control unit 20 detects that the judgment unit 90 has failed by detecting that the transmission of the signal from the judgment unit 90 has been interrupted. If the control unit 20 has determined that the judgment unit 90 has failed, it does not output a switching signal corresponding to the judgment command to the OR circuits 41 to 44. Also, the signal (LIMP) is not input to the latch circuit 45. Therefore, when the judgment unit 90 fails, even if the judgment unit 90 incorrectly outputs a judgment command, the latch circuit 45 does not output a command to turn on the stop lamps 3 and 4 in response to the judgment command. In other words, when the determination unit 90 fails, the determination command is not input to the IPDs 31-34 via the main signal line or the second redundant signal line. On the other hand, the brake operation command is input to the control unit 20, and in response to the brake operation command, the control unit 20 outputs a switching command to the OR circuits 41-44 to turn on the IPDs 31-34, and the stop lamps 3 and 4 turn on. As a result, when the determination unit 90 fails, the stop lamps 3 and 4 can be switched on and off in response to the brake operation command.
[0035] As described above, the redundant system 100 according to this embodiment includes IPDs 31 and 33 connected between the battery 1 and the stop lamp 3, IPDs 32 and 34 connected between the battery 1 and the stop lamp 4, a control unit 20, and a redundant circuit 200 having a latch circuit 45. The control unit 20 receives a brake operation command, outputs a switching command corresponding to the brake operation command, receives a determination command from the determination unit 90 determining whether the stop lamps 3 and 4 are off and outputs a switching command corresponding to the determination command. The redundant circuit 200 includes a main signal line that receives the brake operation command and the determination command from the control unit 20 and outputs a switching command from the control unit 20 to the IPDs 31 to 34, a first redundant signal line that receives the brake operation command and outputs the brake operation command to the IPDs 31 and 33 via the latch circuit 45, and a second redundant signal line that receives the determination command and outputs the determination command to the IPDs 32 and 34 via the latch circuit 45. Furthermore, the latch circuit 45 operates so that the stop lamps 3 and 4 turn on or off in response to a brake operation command or a judgment command when the control unit 20 fails. This makes the signal system from the input command to turn on the stop lamps to the switch that switches the stop lamps on and off redundant. Since the redundant circuit 200 does not require a configuration that separates the power supply system, redundant functionality can be achieved with a simple circuit configuration, thus reducing costs. In addition, when the control unit 20 fails, the on / off state of the stop lamps 3 and 4 switches in response to a brake operation command or a judgment command, so the stop lamps 3 and 4 are not always on, preventing the battery 1 from running out of capacity.
[0036] In this embodiment, the latch circuit 45 outputs an ON command to turn on IPDs 31 to 34 when the AND condition of the two input values is met. One of the two input values is a command value for a brake operation command or a judgment command, and when the control unit 20 fails, the other input value is held in the input state. This allows the stop lamps 3 and 4 to be switched on and off in response to a brake operation command or a judgment command from the judgment unit 90 when the control unit 20 fails.
[0037] Furthermore, in this embodiment, the control unit 20 does not output a switching command corresponding to the judgment command when the judgment unit 90 fails. The control unit 20 outputs a switching command corresponding to the judgment command when the judgment unit 90 is functioning normally. This prevents the stop lamps 3 and 4 from being incorrectly switched on and off if the judgment unit 90 fails and erroneously outputs a judgment command to the control unit 20.
[0038] Furthermore, in this embodiment, the latch circuit 45 does not output a command to turn on the stop lamps 3 and 4 in response to a judgment command when the determination unit 90 fails. The latch circuit 45 also does not output a switching command in response to a judgment command when the determination unit 90 is functioning normally. This prevents the stop lamps 3 and 4 from being incorrectly switched on and off if the determination unit 90 fails and mistakenly outputs a judgment command to the latch circuit 45.
[0039] As a modification of this embodiment, the redundant circuit 200 included in the redundant system 100 may have a circuit configuration as shown in Figure 2. Figure 2 is a block diagram of a vehicle control system including the redundant system 100 according to a modification of this embodiment. The redundant system 100 includes a relay 10, a control unit 20, IPDs 31 to 34, and latch circuits 51 to 54. The latch circuits 51 and 52 output output signals to IPDs 31 and 32, respectively, to turn on IPDs 31 and 32 when an AND condition is met between the input from the control unit 20 and the input of a brake operation command. The latch circuits 53 and 54 also output output signals to IPDs 33 and 34, respectively, to turn on IPDs 33 and 34 when an AND condition is met between the input from the control unit 20 and the input of a determination command from the determination unit 90. The latch circuits 51 to 54 are provided to correspond to IPDs 31 to 34, respectively, and are connected between IPDs 31 to 34 and the control unit 20.
[0040] The latch circuits 51-54 have AND circuits and output an ON command to turn on IPDs 31-34 when the AND condition of two input values is met. Of the two input values, one input value is the command value of a brake operation command or a determination command from the determination unit 90. The other input value is the command value of a switching command from the control unit 20.
[0041] When a brake operation command is input to the redundant circuit 200, the control unit 20 outputs switching commands corresponding to the brake operation command to the latch circuits 51 and 52. The brake operation command is also input to the latch circuits 51 and 52 from branch point P through branch signal line L3. When the AND condition of the latch circuits 51 and 52 is met, the latch circuits 51 and 52 output commands to turn on the IPD 31 and 32.
[0042] When the determination command of the determination unit 90 is input to the redundant circuit 200, the control unit 20 outputs a switching command according to the brake operation command to the latch circuits 53 and 54. Also, the brake operation command is input to the latch circuits 53 and 54 through the branch signal line L4 from the branch point Q. When the AND conditions of the latch circuits 53 and 54 are satisfied, the latch circuits 53 and 54 output a command to turn on the IPDs 33 and 34.
[0043] Also, when the control unit 20 fails, the signal (LIMP) is input to the latch circuits 51 to 54. When the signal (LIMP) is input to the latch circuits 51 to 54, the latch circuits 51 to 54 hold, in the "1" input state (SET state), the input value of the pair of input values of the AND circuit that receives the switching command of the control unit 20. As a result, the latch circuits 51 to 54 maintain a state where they can switch the stop lamps 3 and 4 on and off according to the brake operation command of the stop lamps 3 and 4 or the determination command of the determination unit 90 when the control unit 20 fails.
[0044] The signal lines included in the redundant circuit 200 will be described. The signal lines through which commands flow in the order of the branch points P and Q, the signal lines L1 and L2, the control unit 20, the latch circuits 51 to 54, and the control terminals of the IPDs 31 to 34 become the main signal lines. In FIG. 2, the lines indicated by solid arrows between the branch points P and Q and the IPDs 31 and 32 correspond to the main signal lines. Also, the signal lines through which the brake operation command flows in the order of the branch point P, the branch signal line L3, the latch circuits 51 and 52, and the control terminals of the IPDs 31 and 32 become the first redundant signal lines for the brake operation command. Further, the signal lines through which the determination command flows in the order of the branch point Q, the branch signal line L4, the latch circuits 53 and 54, and the control terminals of the IPDs 32 and 34 become the second redundant signal lines for the determination command. In FIG. 2, the lines indicated by dotted arrows between the branch points P and Q and the IPDs 31 to 34 correspond to the first and second redundant signal lines.
[0045] Next, the circuit operation of the redundant circuit 200 will be explained. First, the circuit operation of the control unit 20 under normal conditions will be explained. A brake operation command or a judgment command is input to the control unit 20, and the control unit 20 outputs a switching command to the latch circuits 51 to 54 to turn on the IPDs 31 to 34 in response to the brake operation command or judgment command. The brake operation command or judgment command is also input to the latch circuits 51 to 54 through the first and second redundant signal lines. When the AND condition of the latch circuits 51 to 54 is met, the latch circuits 51 to 54 output an ON command to the IPDs 31 to 34 to turn them on. The IPDs 31 to 34 are turned on by the ON command output from the latch circuits 51 to 54, and the stop lamps 3 and 4 turn on.
[0046] The circuit operation when the control unit 20 fails will be explained. The signal (LIMP) is input to latch circuits 51-54. Latch circuits 51-54 set one of the pair of input values of the AND circuit to the input state. When the control unit 20 fails, the control unit 20 becomes high impedance to protect the microcontroller through a watchdog monitoring function or an internal protection function of the control unit. The brake operation command or judgment command is input to latch circuits 51-54 through the first and second redundant signal lines. When the AND condition of latch circuits 51-54 is met, latch circuits 51-54 output an ON command to IPDs 31-34 to turn on IPDs 31-34. IPDs 31-34 turn on due to the ON command output from latch circuits 51-54, and stop lamps 3 and 4 turn on. This allows the stop lamps 3 and 4 to be switched on and off in response to a brake operation command or a judgment command from the judgment unit 90 when the control unit 20 fails.
[0047] The circuit operation in case of a failure of the determination unit 90 will be described. The control unit 20 determines the failure of the determination unit 90 by detecting that the transmission of the signal from the determination unit 90 has stopped. When the control unit 20 determines the failure of the determination unit 90, it does not output a switching signal corresponding to the determination command to the latch circuits 51 to 54 according to the determination command. Also, the signal (LIMP) is not input to the latch circuits 51 to 54. Therefore, when the determination unit 90 fails, even if the determination unit 90 erroneously outputs a determination command, the latch circuits 51 to 54 do not output a command to turn on the stop lamps 3 and 4 according to the determination command. That is, when the determination unit 90 fails, the determination command is not input to the latch circuits 51 to 54 through the main signal line or the second redundant signal line.
[0048] On the other hand, the brake operation command is input to the control unit 20, and the control unit 20 outputs a switching command to turn on the IPDs 31 to 34 to the latch circuits 51 to 54 according to the brake operation command. The brake operation command or the determination command is input to the latch circuits 51 to 54 through the first and second redundant signal lines. When the AND condition of the latch circuits 51 to 54 is satisfied, the latch circuits 51 to 54 output an on command to turn on the IPDs 31 to 34 to the IPDs 31 to 34. The IPDs 31 to 34 are turned on by the on command output from the latch circuits 51 to 54, and the stop lamps 3 and 4 are turned on. Thereby, when the determination unit 90 fails, the on and off of the stop lamps 3 and 4 can be switched according to the brake operation command.
[0049] When the determination unit 90 fails, the latch circuits 51 to 54 do not output a command to turn on the stop lamps 3 and 4 according to the determination command, similar to the latch circuit 45 shown in FIG. 1. When the determination unit 90 is normal, the latch circuits 51 to 54 output a command to turn on the IPDs 31 to 34 on the condition that the AND condition is satisfied. On the other hand, the latch circuit 45 shown in FIG. 1 does not output a switching command corresponding to the determination command even when the determination unit 90 of the determination unit 90 is normal.
[0050] In this embodiment, IPDs 31 to 34 are connected in parallel to form a redundant circuit, but it is not necessary to configure IPDs 31 to 34 as a redundant circuit. For example, IPDs 33 and 34 may be omitted from the redundant circuit 200 shown in Figure 1.
[0051] 1 Battery 2 Brake switch (SW) 3, 4 Stop lamp 10 Relay 20 Control unit 31-34 Latch circuit 41-44 OR circuit 45 Latch circuit 46 OR circuit 51-54 Latch circuit 90 Judgment unit 100 Redundant system 200 Redundant circuit
Claims
1. A first switch connected between the battery and the stop lamp, which switches the conduction and interruption of power from the battery to the stop lamp; a second switch connected between the battery and the stop lamp, which switches the conduction and interruption of power from the battery to the stop lamp; a control unit that outputs a switching command to switch the first switch and the second switch on and off; and a redundant circuit having a latch circuit, wherein the control unit receives a brake operation command indicating the on / off status of the brake switch, outputs the switching command corresponding to the brake operation command, receives a determination command from a determination unit that determines whether the stop lamp is on or off according to the braking force of the autonomous driving of the vehicle, which determines whether the stop lamp is on or off, and outputs the switching command corresponding to the determination command, wherein the redundant circuit includes a main signal line that receives the brake operation command and the determination command from the control unit and outputs the switching command from the control unit to the first switch and the second switch, and a first redundant signal line that receives the brake operation command and outputs the brake operation command to the first switch via the latch circuit, The system includes a second redundant signal line that receives the determination command and outputs the determination command to the second switch via the latch circuit, wherein the latch circuit operates to turn the stop lamp on or off in response to the brake operation command or the determination command when the control unit fails.
2. A redundant system according to claim 1, wherein the latch circuit outputs an ON command to turn on the first switch and the second switch when the AND condition of two input values is satisfied, one of the two input values is the command value of the brake operation command or the determination command, and the redundant system holds the other of the two input values in the input state when the control unit fails.
3. A redundant system according to claim 1 or 2, wherein the control unit does not output the switching command corresponding to the determination command when the determination unit fails.
4. A redundant system according to claim 1, wherein the latch circuit does not output a command to turn on the stop lamp in response to the determination command when the determination unit fails.