JP7654432B2 - Control device and control method - Google Patents

Description

The disclosed embodiments relate to a control device and a control method.

Conventionally, there is a power supply system that is provided with a first power source and a second power source so that, even if a power failure occurs while the vehicle is traveling in an autonomous driving mode, the vehicle can be driven to a safe location and stopped. If a ground fault occurs in one of the power supply systems, the other power supply system supplies power to the on-board equipment (load) for autonomous driving, allowing the vehicle to be driven to a safe location (see, for example, Patent Document 1).

JP 2018-182864 A

However, in the case of a power failure, conventional power supply systems uniformly stop autonomous driving and send the vehicle to an evacuation drive even if the system is able to supply enough power to the load for evacuation drive, reducing the opportunities for autonomous driving.

One aspect of the embodiment has been made in consideration of the above, and aims to provide a control device and a control method that can prevent a decrease in opportunities for autonomous driving while ensuring safety.

The control device according to one aspect of the embodiment includes a first system, a second system, an inter-system switch, a determination unit, a control unit, and a fail-safe unit. The first system supplies power from a first power source to a first load for automatic driving. The second system supplies power from a second power source to a second load for automatic driving. The inter-system switch is provided in a connection path connecting the first system and the second system, and is capable of connecting and disconnecting the connection path. The determination unit detects the occurrence of a break or a ground fault in the first system and the second system, and identifies the location of the break or the ground fault. The control unit permits or prohibits continuation of automatic driving according to the location identified by the determination unit. The fail-safe unit transitions to evacuation driving when the determination unit detects the occurrence of the break or the ground fault during automatic driving and the control unit prohibits continuation of automatic driving.

The control device and control method according to one aspect of the embodiment have the effect of preventing a decrease in opportunities for autonomous driving while ensuring safety.

FIG. 1 is an explanatory diagram illustrating an example of the configuration of a control device according to an embodiment. FIG. 2 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 3 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 4 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 5 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 6 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 7 is an explanatory diagram illustrating an example of the operation of the control device according to the embodiment. FIG. 8 is a flowchart illustrating an example of a process executed by the control device according to the embodiment.

Embodiments of a control device and a determination method will be described in detail below with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. The following describes an example of a control device that is installed in a vehicle with an autonomous driving function and supplies power to a load, but the control device according to the embodiment may also be installed in a vehicle that does not have an autonomous driving function.

In the following, we will explain the case where the vehicle in which the control device is installed is an electric vehicle or a hybrid vehicle, but the vehicle in which the control device is installed may also be an engine vehicle that runs on an internal combustion engine.

[1. Configuration of the control device]
Fig. 1 is an explanatory diagram showing a configuration example of a control device according to an embodiment. As shown in Fig. 1, the control device 1 according to the embodiment is connected to a first power source 10, a first load 101, a general load 102, a second load 103, and an automatic driving control device 100. The control device 1 includes a first system 110 that supplies power from the first power source 10 to the first load 101 and the general load 102, and a second system 120 that supplies power from a second power source 20 (described later) to the second load 103.

The first load 101 includes a load for autonomous driving. For example, the first load 101 includes a steering motor, an electric brake device, an in-vehicle camera, a radar, and the like that operate during autonomous driving. The general load 102 includes, for example, a display, an air conditioner, an audio device, a video device, various lights, and the like.

The second load 103 has the same functions as the first load 101. The second load 103 includes devices that operate during autonomous driving, such as a steering motor, an electric brake device, an in-vehicle camera, and a radar. The first load 101, the general load 102, and the second load 103 operate using power supplied from the control device 1. The autonomous driving control device 100 is a device that controls the autonomous driving of a vehicle by operating the first load 101 or the second load 103.

The first power source 10 includes a DC/DC converter (hereinafter referred to as "DC/DC11") and a lead battery (hereinafter referred to as "PbB12"). Note that the battery of the first power source 10 may be any secondary battery other than PbB12.

The DC/DC 11 is connected to a generator and a high-voltage battery with a higher voltage than the PbB 12, and steps down the voltage of the generator and the high-voltage battery and outputs it to the first system 110. The generator is, for example, an alternator that converts the kinetic energy of a traveling vehicle into electricity to generate electricity. The high-voltage battery is, for example, a battery for driving the vehicle that is installed in an electric vehicle or a hybrid vehicle.

When the first power source 10 is installed in an engine vehicle, an alternator (generator) is provided instead of the DC/DC 11. The DC/DC 11 charges the PbB 12, supplies power to the first load 101 and the general load 102, supplies power to the second load 103, and charges the second power source 20 described below.

The control device 1 includes a second power source 20, an inter-system switch 41, a first switch 42, a second switch 43, a third switch 44, a determination unit 31, a control unit 32, and a fail-safe unit 33. The control device 1 further includes current sensors 51, 52, 53, 54, 55, and 56, and a voltage sensor 57.

The second power source 20 is a backup power source in case the first power source 10 is unable to supply power. The second power source 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). Note that the battery of the second power source 20 may be any secondary battery other than LiB21.

The inter-system switch 41 is provided in the connection path 130 that connects the first system 110 and the second system 120, and is a switch that can connect and disconnect the connection path 130. The first switch 42 is a switch that can connect and disconnect the second load power supply path 140 that connects between the connection point P of the connection path 130 and the second system 120 and the second load 103, at the end of the second load power supply path 140 on the side of the connection point P.

The second switch 43 is a switch that can connect and disconnect the second load power supply path 140 at the end of the second load power supply path 140 on the second load 103 side. The third switch 44 is a switch that can connect and disconnect the bypass path 150 that bypasses the second load power supply path 140 and supplies power from the connection path 130 to the second load 103.

The current sensor 51 detects the value of the current supplied to the first load 101 and outputs the detection result to the identification unit 31. The current sensor 52 detects the value of the current supplied to the general load 102 and outputs the detection result to the identification unit 31. The current sensor 53 detects the value of the current flowing in the second load power supply path 140 and outputs the detection result to the identification unit 31.

The current sensor 54 detects the value of the current supplied to the second load 103 and outputs the detection result to the identification unit 31. The current sensor 55 detects the value of the current flowing through the power supply path between the inter-system switch 41 and the connection point P and outputs the detection result to the identification unit 31.

The current sensor 56 detects the current value of the current flowing between the first power source 10 and the connection point P1 between the connection path 130 and the first system 110, and outputs the detection result to the identification unit 31. The voltage sensor 57 detects the voltage value of the power supply path between the inter-system switch 41 and the connection point P, and outputs the detection result to the identification unit 31.

The specific unit 31, the control unit 32, and the fail-safe unit 33 include a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and various other circuits. Note that the specific unit 31, the control unit 32, and the fail-safe unit 33 may be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

The identification unit 31 detects the occurrence of a break or ground fault in the first system 110 and the second system 120 and identifies the location of the break or ground fault by having the CPU execute a program stored in the ROM using the RAM as a working area. The identification unit 31 identifies the location of the break or ground fault based on the detection results input from the current sensors 51, 52, 53, 54, and 55 and the voltage sensor 57. The method of identifying the location of the break or ground fault by the identification unit 31 will be described later with reference to FIG. 2.

The control unit 32 performs on/off control of the inter-system switch 41, the first switch 42, the second switch 43, and the third switch 44 by executing a program stored in the ROM by the CPU using the RAM as a working area. The on/off control of each switch by the control unit 32 will be described later with reference to Figures 2 to 8.

Furthermore, the control unit 32 permits or prohibits continuation of the automatic operation depending on the location of the disconnection or ground fault identified by the identification unit 31. For example, even if a disconnection or ground fault occurs in the first system 110 or the second system 120, the control unit 32 permits continuation of the automatic operation if the location of the disconnection or ground fault is a location where the first power source 10 can be backed up by the second power source 20.

This allows the control device 1 to prevent a decrease in opportunities for automatic operation while ensuring safety. Furthermore, if the location of the disconnection or ground fault is a location where the second power source 20 cannot back up the first power source 10, the control unit 32 prohibits continuation of automatic operation. This allows the control device 1 to ensure safety.

The fail-safe unit 33 outputs a command to the automatic driving control device 100 to transition to evacuation driving when the identification unit 31 detects a disconnection or ground fault during automatic driving and the control unit 32 prohibits continuation of automatic driving.

Next, the operation of the control device 1 will be described with reference to Figures 2 to 8. In Figures 2 to 8, in order to facilitate understanding of the operation of the control device 1, the identification unit 31, the control unit 32, the fail-safe unit 33, and the control signal lines indicated by dashed or dotted arrows in Figure 1 are omitted.

[2. Normal operation of the control device]
In normal operation when no break or ground fault occurs in the first system 110 and the second system 120, the control unit 32 turns on the inter-system switch 41, the first switch 42, and the second switch 43, and turns off the third switch 44, as shown in Fig. 2. This allows the control device 1 to supply power from the first power source 10 to the first load 101, the general load 102, and the second load 103.

The identification unit 31 normally monitors whether a disconnection or a ground fault has occurred in the first system 110 or the second system 120. Specifically, the identification unit 31 monitors whether a disconnection or a ground fault has occurred upstream of the first load 101 in the power supply path of the first system 110, that is, in section A-1 from the first power source 10 to the first load 101.

The identifying unit 31 also monitors whether an open circuit or a ground fault has occurred in section A-2 downstream of the first load 101 in the power supply path of the first system 110. The identifying unit 31 also monitors whether an open circuit or a ground fault has occurred in section B between the inter-system switch 41 and the second system 120. The identifying unit 31 also monitors whether an open circuit or a ground fault has occurred in section C between the first switch 42 and the second switch 43, which constitute the second load power supply path 140.

Below, we will explain an example of the operation of the control device 1 when a break or ground fault occurs in the above-mentioned sections A-1, A-2, B, and C.

[3. When a ground fault or disconnection occurs in section A-1, or when a ground fault occurs in section A-2]
2 , when a ground fault occurs in the first system 110 or the second system 120, an overcurrent flows to the ground fault point, so that the current value detected by the current sensor 55 increases and the current values detected by the current sensors 51, 52, 53, 54, and 56 decrease. Specifically, when a ground fault occurs in the first system 110, an overcurrent flows through the current sensor 55 from the second system 120 toward the first system 110, and when a ground fault occurs in the second system 120, an overcurrent flows through the current sensor 55 from the first system 110 toward the second system 120. On the other hand, the current flowing through the current sensors 51, 52, 53, 54, and 56 becomes zero.

Therefore, when the detection result of the current sensor 55 is equal to or greater than the first ground fault threshold for the current value, the identification unit 31 determines that a ground fault has occurred in the first system 110 or the second system 120. When the detection result of the current sensor 55 is equal to or greater than the first ground fault threshold for the current value and the detection result of at least one of the current sensors 51, 52, 53, 54, and 56 is equal to or less than the second ground fault threshold for the current value, the identification unit 31 may be configured to determine that a ground fault has occurred in the first system 110 or the second system 120.

The first ground fault threshold is a threshold for detecting an overcurrent, and is a value larger than the current that flows when the first load 101 and the second load 103 are driven under normal circumstances (hereinafter referred to as the "normal current"). The second ground fault threshold is a threshold for detecting that no current is flowing, and is a value smaller than the normal current. When the identification unit 31 determines that a ground fault has occurred, the control unit 32 shuts off the system switch 41, as shown in FIG. 3.

In addition, the identification unit 31 may determine that a ground fault has occurred in the first system 110 or the second system 120 when the voltage detected by the voltage sensor 57, instead of the current sensor 55, drops below a threshold value.

At this time, if a ground fault 201 occurs in section A-1 or section A-2, the current from the first power source 10 does not flow to the current sensors 51, 52, and 56, so the detection results of the current sensors 51, 52, and 56 remain below the second ground fault threshold for the current value. On the other hand, because power is supplied to the second system 120 from the second power source 20, the detection results of the current sensors 53 and 54 become higher than the second ground fault threshold for the current value.

Therefore, after the inter-system switch 41 is cut off, if the detection results of the current sensors 51, 52, and 56 are equal to or lower than the second ground fault threshold for the current value and the detection results of the current sensors 53 and 54 are higher than the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section A-1 or section A-2.

In addition, when a break 202 occurs between the first power source 10 and connection point P1 in section A-1 during normal operation as shown in FIG. 2, the detection result of the current sensor 56 becomes equal to or lower than the second ground fault threshold, and the detection results of the current sensors 51 and 52 become equal to or higher than the second ground fault threshold and equal to or lower than the first ground fault threshold.

In addition, when a break 202 occurs between connection point P1 in section A-1 and the first load 101 during normal operation as shown in Figure 2, the detection result of current sensor 56 becomes greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold, and current sensors 51 and 52 become less than or equal to the second ground fault threshold.

The identifying unit 31 determines that a break has occurred when the detection result of the current sensor 56 becomes equal to or less than the second ground fault threshold and the detection results of the current sensors 51 and 52 become equal to or greater than the second ground fault threshold and equal to or less than the first ground fault threshold, or when the detection result of the current sensor 56 becomes equal to or greater than the second ground fault threshold and equal to or less than the first ground fault threshold and the current sensors 51 and 52 become equal to or less than the second ground fault threshold, and identifies the location of the break 202 as section A-1. When the identifying unit 31 detects a break, it shuts off the system switch 41.

When the location of the disconnection 202 identified by the identification unit 31 is in section A-1, or when the location of the earth fault 201 identified by the identification unit 31 is in section A-1 or A-2, the control unit 32 prohibits continuation of automatic operation with the inter-system switch 41 shut off, and causes the power of the second power source 20 to be supplied to the second load 103.

When the identification unit 31 detects the disconnection 202, the power of the second power source 20 may be supplied to the first load 101 and the second load 103 without shutting off the inter-system switch 41, but the power of the second power source 20 will run out correspondingly sooner. Therefore, when the identification unit 31 detects the disconnection 202, it is desirable to shut off the inter-system switch 41.

The fail-safe unit 33 outputs a command to the automatic driving control device 100 to shift to evacuation driving when the identification unit 31 detects the occurrence of a disconnection 202 or a ground fault 201 during automatic driving and the control unit 32 prohibits continuation of automatic driving. This allows the automatic driving control device 100 to evacuate the vehicle to a safe place and stop the vehicle when a power failure occurs in the first system 110.

[4. If a break occurs in section A-2]
4, when a break 202 occurs in section A-2 during normal operation, power is supplied from the first power source 10 to the first load 101, but power is not supplied to the general load 102. Therefore, when the detection result of the current sensor 51 is a normal value (greater than or equal to the second ground fault threshold and less than or equal to the first ground fault threshold) and the detection result of the current sensor 52 is less than or equal to the second ground fault threshold, the identifying unit 31 identifies that the break 202 has occurred and that the location where the break 202 has occurred is section A-2.

At this time, current is being supplied to the first load 101 and the second load 103, which are necessary for automatic driving. Therefore, if the location of the break 202 is section A-2, the control unit 32 allows the continuation of automatic driving. This allows the control device 1 to continue automatic driving even if the break 202 occurs in section A-2, so that it is possible to prevent a decrease in opportunities for automatic driving while ensuring safety.

[5. If a break or ground fault occurs in section B]
When the detection result of the voltage sensor 57 becomes equal to or less than the ground fault threshold for the voltage value, the identifying unit 31 determines that a ground fault has occurred somewhere inside the control device 1. Note that the identifying unit 31 may determine that a ground fault has occurred somewhere inside the control device 1 when the detection result of at least one of the current sensors 51, 52, 53, 54, 56 becomes equal to or less than a second ground fault threshold for the current value, or when the detection result of the current sensor 55 becomes equal to or more than a first ground fault threshold for the current value. When it is determined that a ground fault has occurred, the control unit 32 shuts off the inter-system switch 41 as shown in FIG. 5 .

Then, when the detection results of the current sensors 51, 52, and 56 become higher than the second ground fault threshold value for the current value, the identification unit 31 determines that a ground fault has not occurred in the first system 110, but has occurred in section B or section C. Next, the control unit 32 turns off the first switch 42 and the second switch 43, and turns on the third switch 44.

As a result, if the detection values of the current sensors 54, 55 become higher than the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section C, and if the detection values of the current sensors 54, 55 are still equal to or lower than the second ground fault threshold for the current value, the identification unit 31 identifies the location of the ground fault 201 as section B.

In addition, when the detection result of the current sensor 55 during normal operation is equal to or less than the second ground fault threshold value, and the detection results of the current sensors 53 and 54 are equivalent to the detection results during normal operation (equal to or greater than the second ground fault threshold value and equal to or less than the first ground fault threshold value), the identification unit 31 identifies the location where the break 202 has occurred as section B.

Furthermore, when the detection result of the current sensor 53 during normal operation is equal to or lower than the second ground fault threshold, the identification unit 31 determines that the break 202 has occurred in section B or section C. The control unit 32 then turns off the first switch 42 and the second switch 43, and turns on the third switch 44. As a result, when the detection results of the current sensors 54 and 55 are equivalent to the detection results during normal operation, the identification unit 31 identifies the location of the break 202 as section C.

When the break 202 or ground fault 201 occurs in section B, the control unit 32 prohibits continuation of automatic operation by turning off the inter-system switch 41. The fail-safe unit 33 then outputs a command to the automatic operation control device 100 to switch from automatic operation to manual operation. This allows the control device 1 to continue driving in manual operation using the power of the first power source 10.

[6. If a ground fault occurs in section C]
When the location of the ground fault 201 is identified as section C by the above-mentioned method, the control unit 32 turns off the first switch 42 and the second switch 43 and turns on the third switch 44, as shown in FIG.

As a result, even if a power failure occurs in the first system 110, the control device 1 can ensure a backup state in which the inter-system switch 41 is shut off and power can be supplied from the second power source 20 to the second load 103 via the third switch 44. Therefore, the control unit 32 allows the continuation of automatic operation. As a result, the control device 1 can continue automatic operation even if a ground fault 201 occurs in section C, so that it is possible to prevent a decrease in opportunities for automatic operation while ensuring safety.

[7. If a break occurs in section C]
When the location of the disconnection 202 is identified as section C by the above-mentioned method, the control unit 32 turns on the third switch 44 as shown in Fig. 7. This allows the control device 1 to ensure a backup state by the second power source 20, similar to the case where the ground fault 201 occurs in section C.

Therefore, the control unit 32 allows the continuation of the automatic driving. This allows the control device 1 to continue the automatic driving even if a disconnection 202 occurs in section C, so that it is possible to prevent a decrease in opportunities for automatic driving while ensuring safety.

[8. Processing performed by the control device]
Next, a process executed by the control device according to the embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of a process executed by the control device according to the embodiment. The control device 1 repeatedly executes the process shown in Fig. 8 during normal operation when no power failure has occurred.

Specifically, as shown in FIG. 8, the identification unit 31 determines whether or not a break 202 or a ground fault 201 has occurred (step S101). If the identification unit 31 determines that a break 202 or a ground fault 201 has not occurred (step S101, No), the identification unit 31 ends the process and starts the process again from step S101.

When the identification unit 31 determines that the disconnection 202 or the ground fault 201 has occurred (step S101, Yes), the identification unit 31 identifies the location of the disconnection 202 or the ground fault 201 (step S102). After that, the control unit 32 determines whether the location of the disconnection 202 or the ground fault 201 has been identified as section A-1, or whether the location of the ground fault 201 has been identified as section A-2 (step S103).

When the control unit 32 determines that the location of the disconnection 202 or the earth fault 201 is identified as section A-1, or that the location of the earth fault 201 is identified as section A-2 (step S103, Yes), it turns off the inter-system switch 41 (step S104) and prohibits automatic driving (step S105). After that, the fail-safe unit 33 transitions to evacuation driving (step S106) and ends the process.

In addition, if the control unit 32 determines that the location of the break 202 or the ground fault 201 has not been identified as section A-1, or that the location of the ground fault 201 has not been identified as section A-2 (step S103, No), it determines whether the location of the break 202 has been identified as section A-2 (step S107).

If the control unit 32 determines that the location of the break 202 has been identified as section A-2 (step S107, Yes), it allows the automatic operation to continue (step S108) and ends the process. If the control unit 32 determines that the location of the break 202 has not been identified as section A-2 (step S107, No), it determines whether the location of the break 202 or the ground fault 201 has been identified as section B (step S109).

When the control unit 32 determines that the location of the disconnection 202 or the ground fault 201 is identified as section B (step S109, Yes), it turns off the inter-system switch 41 (step S110) and prohibits continuation of the automatic operation (step S111). After that, the fail-safe unit 33 transitions to manual operation (step S112) and ends the process.

If the control unit 32 determines that the location of the disconnection 202 or the ground fault 201 has not been identified as section B (step S109, No), it determines whether the location of the ground fault 201 has been identified as section C (step S113).

When the control unit 32 determines that the location of the ground fault 201 has been identified as section C (step S113, Yes), it turns off the first switch 42 and the second switch 43, turns on the third switch 44 (step S114), permits automatic operation (step S115), and ends the process.

If the control unit 32 determines that the location of the ground fault 201 has not been identified as section C (step S113, No), it determines that the location of the disconnection 202 has been identified as section C (step S116), turns on the third switch 44 (step S117), permits automatic operation (step S115), and ends the process.

Further advantages and modifications may readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof.

1 Control device 10 First power source 11 DC/DC
12 PbB
20 Second power supply 21 LiB
31 Identification unit 32 Control unit 33 Fail-safe unit 41 Inter-system switch 42 First switch 43 Second switch 44 Third switch 51, 52, 53, 54, 55, 56 Current sensor 57 Voltage sensor 100 Automatic driving control device 101 First load 102 General load 103 Second load 110 First system 120 Second system 130 Connection path 140 Second load power supply path 150 Bypass path

Claims (9)

a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects an occurrence of a disconnection or a ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault has occurred;
A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit;
a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit ,
The control unit is
When the location of the disconnection or the ground fault is upstream of the first load in the power supply path of the first system, the system switch is shut off and continuation of the automatic operation is prohibited.
A control device comprising: The control unit is
2. The control device according to claim 1, characterized in that if the location of the ground fault is downstream of the first load in the power supply path of the first system, or if the location of the disconnection or the ground fault is between the inter-system switch and the second system, the control device prohibits continuation of automatic operation with the inter-system switch being turned off . a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects an occurrence of a disconnection or a ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault has occurred;
A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit;
a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and
Equipped with
The control unit is
and permitting continuation of automatic operation when the location of the disconnection is downstream of the first load in the power supply path of the first system. a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects an occurrence of a disconnection or a ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault has occurred;
A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit;
a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and
Equipped with
The control unit is
when the location of the ground fault is downstream of the first load in the power supply path of the first system, the control device prohibits continuation of automatic operation with the inter-system switch being turned off. a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects an occurrence of a disconnection or a ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault has occurred;
A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit;
a fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and
Equipped with
The control unit is
When the location of the disconnection or the ground fault is between the inter-system switch and the second system, the inter-system switch is shut off and continuation of the automatic operation is prohibited,
The fail-safe unit includes:
A control device characterized by shifting from automatic operation to manual operation. a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
an inter-system switch provided in a connection path connecting the first system and the second system and capable of connecting and disconnecting the connection path;
an identification unit that detects an occurrence of a disconnection or a ground fault in the first system and the second system and identifies a location where the disconnection or the ground fault has occurred;
A control unit that permits or prohibits continuation of the autonomous driving depending on the occurrence location identified by the identification unit;
A fail-safe unit that transitions to evacuation driving when the occurrence of the disconnection or the ground fault is detected by the identification unit during autonomous driving and continuation of the autonomous driving is prohibited by the control unit; and
a first switch capable of connecting and disconnecting the connection path and a second load power supply path connecting a connection point of the second system and the second load at an end of the second load power supply path on the side of the connection point;
a second switch capable of connecting and disconnecting the second load power supply path at an end of the second load power supply path on the second load side;
a third switch capable of connecting and disconnecting a bypass path that bypasses the second load power supply path and supplies power from the connection path to the second load,
The control unit is
during normal operation when the identification unit does not detect the occurrence of the disconnection or the ground fault, the control device turns on the inter-system switch, the first switch, and the second switch, and turns off the third switch. The control unit is
7. The control device according to claim 6, wherein, when the ground fault occurs in the second load power supply path, the first switch and the second switch are turned off and the third switch is turned on to allow automatic operation to continue. The control unit is
8. The control device according to claim 6, wherein, when the disconnection occurs in the second load power supply path, the control device allows continuation of automatic operation with the third switch in a conductive state. a first system that supplies power from a first power source to a first load for automatic operation;
a second system that supplies power from the second power source to a second load for automatic operation;
a system-to -system switch that is provided in a connection path that connects the first system and the second system and is capable of connecting and disconnecting the connection path,
Detecting an occurrence of a break or a ground fault in the first system and the second system, and identifying a location where the break or the ground fault has occurred;
Permitting or prohibiting continuation of the autonomous driving according to the identified occurrence location;
When the occurrence of the disconnection or the ground fault is detected during the automatic driving and the continuation of the automatic driving is prohibited, transitioning to an evacuation driving mode ;
When the location of the disconnection or the ground fault is upstream of the first load in the power supply path of the first system, the inter-system switch is shut off and continuation of the automatic operation is prohibited.
A control method comprising:

Images