JP5983168B2 - Fail-safe device and fail-safe system - Google Patents

Description

  The present invention relates to a fail-safe device and a fail-safe system.

  2. Description of the Related Art Conventionally, a technique for arranging an electronic circuit of an electronic device in a shield case made of a conductive metal that shields noise is known in order to prevent adverse effects on the electronic device due to external noise such as electromagnetic waves.

  For example, in Patent Document 1, a shield structure is formed in a box shape composed of six shield surfaces, a metal substrate on which electronic components are mounted is defined as one surface of the shield structure, and a shield surface opposite to the metal plate is provided. It is disclosed that a part of the mother board constitutes and a frame-shaped shield frame made of a conductive material constitutes the other four shield surfaces.

JP 2007-27304 A

  However, in the technique disclosed in Patent Document 1, when the external noise is not completely shielded by the shield surface, the electronic circuit may malfunction due to the influence of external noise. As a result, an electronic device including the electronic circuit also malfunctions, and there is a risk that a user who uses the electronic device has a problem.

  The present invention has been made in view of the above-described conventional problems, and its purpose is to cause a user's malfunction due to malfunction of an electronic device even when the malfunction of the electronic device is likely to occur due to external noise. It is an object of the present invention to provide a fail-safe device and a fail-safe system that can be made difficult.

According to a first aspect of the fail-safe device, an electric field applied to an electronic device (2, 3) mounted on a vehicle, a magnetic field applied to the electronic device, a signal line (21), a power supply line, or a ground line. Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device Threshold determination unit, a plurality of threshold values are set, the fail-safe unit, depending on whether it is determined that it is any threshold or more of the plurality of threshold threshold decision unit, one of the type and degree of fail-safe process It is characterized by changing.
According to a second aspect of the fail-safe device, an electric field applied to an electronic device (2, 3) mounted on a vehicle, a magnetic field applied to the electronic device, a signal line (21), a power supply line, or a ground line. Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device Threshold determination unit and the fail-safe unit is characterized in that it is shielded by the shield member (103, 104) for shielding electromagnetic noise foreign.
According to a third aspect of the fail-safe device, an electric field applied to an electronic device (2, 3) mounted on a vehicle, a magnetic field applied to the electronic device, a signal line (21), a power supply line, and a ground line. Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device Failsafe unit, when it is determined that the external noise is greater than or equal to the threshold in the threshold determination unit, the warning device which performs warning to the user of the vehicle (5), performs a fail-safe process of outputting a control signal for causing a warning It is characterized by that.
According to a fourth aspect of the fail-safe device, the electric field applied to the electronic device (2, 3) mounted on the vehicle, the magnetic field applied to the electronic device, the signal line (21), the power supply line, and the ground line are used. Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device Failsafe unit, when it is determined that the external noise is greater than or equal to the threshold in the threshold determination unit, a behavior control device for controlling the behavior of the vehicle (6), vehicle stop, deceleration, and re-start of the temporary post stop It is characterized by performing fail-safe processing for outputting a control signal for performing any of the prohibitions .
A fifth invention according to the fail-safe device, via any of the electric field applied to the electronic device mounted on a vehicle (2, 3), the magnetic field applied to the electronic device, the signal line (21) and the power supply line and a ground line Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device Failsafe part is a part of a drive recorder for recording information at the time of collision of the vehicle, when recording information at the time of collision of the vehicle, the external noise detected by the sensor unit in a predetermined period before and after collision or collision It is characterized by recording information about the state.
According to a sixth aspect of the fail-safe device, an electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, a signal line (21), a power supply line, or a ground line. Sensor units (11a, 11b, 11a, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11b, 11c, 11b 11c), a threshold determination unit (13a, 13b, 13c) that determines whether or not the external noise detected by the sensor unit is equal to or greater than a threshold, and a threshold determination unit that determines that the external noise is equal to or greater than the threshold , and a fail-safe unit that performs fail-safe processing is a process for dealing with malfunction of the electronic device (13a, 13b, 13c), provided independently of the electronic device It is one where the target for detecting external noise provided with a plurality of different sensor units, the threshold determination unit, based on the detection result of the external noise in the plurality of sensor units, or external noise is greater than or equal to a threshold It is characterized by determining whether or not.
Moreover, 7th invention which concerns on a fail safe system contains the vehicle-mounted system (101) mounted in a vehicle, and the center (10), and a vehicle-mounted system is the fail safe in any one of 1st- 6th invention. And a position detector (8) for detecting the current position of the vehicle, and a vehicle side communication device (9) for communicating with the center. The center includes a center side communication device (41) for communicating with the vehicle. The vehicle-mounted system associates the determination result in the threshold determination unit of the fail-safe device with the current position of the vehicle at the time when the determination result is obtained, detected by the position detector, from the vehicle-side communication device to the center. And the center electronically identifies the point where the external noise is above the threshold based on the information obtained from the in-vehicle system of the plurality of vehicles and the current position of the vehicle at the time when the determination results were obtained. Corresponds to map location Only, is characterized in that to deliver information about the location on the electronic map was correspondence from the center side communication device to the vehicle.
An eighth invention according to the fail-safe system includes an in-vehicle system (101) mounted on a vehicle and a center (10), and the in-vehicle system is an electric field applied to an electronic device (2, 3) mounted on the vehicle. , A magnetic field applied to the electronic device, a current input to or output from the electronic device via any one of the signal line (21), the power supply line, and the ground line, and an input to the electronic device or output from the electronic device A sensor unit (11a, 11b, 11c) that detects external noise for the electronic device by detecting one of the voltages, and a threshold determination unit that determines whether the external noise detected by the sensor unit is equal to or greater than a threshold value ( 13a, 13b, 13c) and a fail-safe process that is a process for dealing with a malfunction of the electronic device when the threshold determination unit determines that the external noise is greater than or equal to the threshold. Performing a fail-safe section (13a, 13b, 13c), a fail-safe device that is provided independently of the electronic device, a position detector for detecting a current position of the vehicle (8), communicates with the center of performing Vehicle-side communication device (9), the center includes a center-side communication device (41) that communicates with the vehicle, and the vehicle-mounted system includes a determination result in the threshold determination unit of the fail-safe device and a position detector. The detected vehicle is associated with the current position of the vehicle at the time when the determination result is obtained, and is transmitted from the vehicle-side communication device to the center. The center receives the determination result and the determination result obtained from the in-vehicle system of a plurality of vehicles. Based on the information on the current position of the vehicle at the time of acquisition, the point where the external noise is equal to or greater than the threshold is associated with the position on the electronic map, and information on the position on the electronic map where the association is performed Center side communication equipment It is characterized in that the delivery from the vehicle.

  According to this, when the external noise is equal to or greater than the threshold value, the fail-safe process for dealing with the malfunction of the electronic device is performed in the fail-safe unit, so that the malfunction of the electronic device is likely to occur due to the influence of the external noise. Even in such a case, processing for dealing with malfunction of the electronic device is performed. Therefore, it is possible to prevent malfunction of the electronic device by fail-safe processing, or to reduce the malfunction of the user due to the malfunction when the malfunction of the electronic device occurs. As a result, even when a malfunction of the electronic device is likely to occur due to the influence of external noise, it is possible to make it difficult for the user to malfunction due to the malfunction of the electronic device.

1 is a diagram illustrating an example of a schematic configuration of an in-vehicle system 100. FIG. It is a block diagram which shows an example of a schematic structure of the fail safe apparatus for ECUs 1a. It is a schematic diagram which shows an example at the time of applying a current sensor to the noise detection sensor 11a. (A)-(c) is a schematic diagram which shows an example at the time of applying an electric field sensor to the noise detection sensor 11a. (A) And (b) is a schematic diagram which shows the example at the time of applying a magnetic field sensor to the noise detection sensor 11a. It is a schematic diagram which shows an example at the time of applying a voltage sensor to the noise detection sensor 11a. It is a circuit diagram which shows the specific example of the sensor signal processing circuit 14a. (A) is a top view which shows the PALAP board | substrate which incorporated the noise detection sensor 11a and the sensor signal processing circuit 14a, (b) is the II-II sectional view taken on the line of Fig.8 (a). It is a block diagram which shows an example of a schematic structure of the fail safe apparatus for sensors 1b. It is a block diagram which shows an example of schematic structure of the fail safe apparatus for vehicles 1c. 2 is a block diagram illustrating an example of a schematic configuration of a failsafe system 200. FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(Embodiment 1)
An in-vehicle system 100 shown in FIG. 1 is mounted on a vehicle and includes an ECU fail-safe device 1a, a sensor fail-safe device 1b, and a vehicle fail-safe device 1c. The ECU fail-safe device 1 a is provided in the ECU 2, and the sensor fail-safe device 1 b is provided in the sensor 3.

  The ECU 2 is an electronic control unit (Electronic Control Unit) for controlling the vehicle. The sensor 3 is a sensor that detects information related to the behavior and state of the vehicle used for control by the ECU 2. Both the ECU 2 and the sensor 3 include an electronic circuit and a connector that connects the electronic circuit and an external signal line.

  In the example of the present embodiment, the ECU 2 and the sensor 3 will be described as being connected by an in-vehicle LAN 4 that complies with a communication protocol such as CAN (controller area network). In the present embodiment, for convenience, only the ECU 2 and the sensor 3 are shown as electronic devices connected to the in-vehicle LAN 4, but it is assumed that other in-vehicle electronic devices are also connected to the in-vehicle LAN 4.

  First, the configuration of the ECU fail-safe device 1a will be described with reference to FIG. As shown in FIG. 2, the ECU fail-safe device 1a includes a noise detection sensor 11a, a noise quantification circuit 12, and a device control signal output circuit 13a. The noise quantification circuit 12 and the device control signal output circuit 13a constitute a sensor signal processing circuit 14a.

  The noise detection sensor 11a is a current sensor that detects a current supplied to the ECU 2 through, for example, the connector described above. The noise detection sensor 11a corresponds to a sensor unit in the claims. Here, an example in which the current sensor is applied to the noise detection sensor 11a will be described with reference to FIG.

  As a current sensor, for example, a configuration using a known current sensor made of a Rogowski coil may be used. FIG. 3 shows an example in which a current sensor made of a Rogowski coil is used. The alternating current supplied from the signal line 21 outside the ECU 2 to the wiring on the board 23 of the ECU 2 via the connector 22 is detected by a Rogowski coil as the noise detection sensor 11a. The alternating current detected by the Rogowski coil is output to the noise quantification circuit 12.

  The noise detection sensor 11a is not limited to the above-described current sensor, but an electric field sensor that detects an electric field applied to the ECU 2 (in other words, an electric field in the space around the ECU 2), and a magnetic field applied to the ECU 2 (in other words, a magnetic field in the space around the ECU 2). It may be a magnetic field sensor for detecting the voltage, a voltage sensor for detecting a voltage supplied to the ECU 2 via the connector, or the like.

  The current sensor and the voltage sensor are not limited to detecting the current and voltage supplied from the signal line 21 to the ECU 2 via the connector, but detect the current and voltage supplied (input) to the ECU 2 from the power line. It may be one that detects a current or voltage output from the ECU 2 to the ground (GND) line.

  The electric field sensor may be configured using a known monopole antenna, dipole antenna, EO probe, or the like. Here, the example at the time of applying an electric field sensor to the noise detection sensor 11a is shown using FIG. 4 (a)-FIG.4 (c). 4A is a schematic diagram showing the top surface of the substrate 23 of the ECU 2, FIG. 4B is a schematic diagram showing the bottom surface of the substrate 23 of the ECU 2, and FIG. 4C is a schematic diagram showing the bottom surface of the substrate 23 of the ECU 2. It is. 4A to 4C show an example in which a monopole antenna that detects an electric field component is used as an electric field sensor.

  The noise detection sensor 11a as a monopole antenna is mounted so as to be connected to the sensor signal processing circuit 14a by a wiring pattern (see B in FIG. 4A) of the board 23 of the ECU 2. Specifically, the monopole antenna is provided so as to penetrate from the lower surface to the upper surface so as to protrude from the upper surface of the substrate 23, and is soldered to the solid GND (see the hatched portion in FIG. 4C) on the lower surface of the substrate 23. (See C in FIG. 4B). Since the antenna element of the monopole antenna only needs to detect a strong electric field, it may be about 10 mm. The electric field component (electric field component signal wave) detected by the monopole antenna is output to the noise quantification circuit 12.

  As the magnetic field sensor, a known loop antenna (for example, a shielded loop antenna) or an MR element may be used. Here, an example in which the magnetic field sensor is applied to the noise detection sensor 11a will be described with reference to FIGS. 5 (a) and 5 (b). FIG. 5A is a schematic diagram showing the upper surface of the substrate 23 of the ECU 2, and FIG. 5B is a schematic diagram showing the lower surface of the substrate 23 of the ECU 2. 5A and 5B show an example in which a loop antenna that detects a magnetic field component is used as a magnetic field sensor.

  The noise detection sensor 11a as a loop antenna is mounted as a wiring pattern of the board 23 of the ECU 2. The wiring pattern is provided so as to be connected to the sensor signal processing circuit 14a (see FIG. 5A). A solid GND (see the shaded area in FIG. 5B) is provided on the lower surface of the substrate 23. However, the GND is provided on the lower surface of the loop antenna because the magnetic field is canceled by eddy currents when GND exists. It is not done. Since the loop antenna only needs to detect a strong electric field, the loop diameter may be about 10 mm. The magnetic field component (magnetic field component signal wave) detected by the loop antenna is output to the noise quantification circuit 12.

  For example, the voltage sensor may be configured to use a known voltage measurement circuit. As the voltage measurement circuit, for example, a configuration using a noise quantification circuit 12 shown in FIG. Here, an example in which the voltage sensor is applied to the noise detection sensor 11a will be described with reference to FIG. FIG. 6 shows an example in which the voltage measurement circuit is used as a voltage sensor. The voltage measurement circuit as the noise detection sensor 11a detects the voltage supplied from the signal line 21 outside the ECU 2 to the wiring on the board 23 of the ECU 2 via the connector 22. The AC voltage detected by the voltage measurement circuit is output to the noise quantification circuit 12.

  As described above, various sensors such as a current sensor, a voltage sensor, an electric field sensor, and a magnetic field sensor can be used as the noise detection sensor 11a. However, in the present embodiment, a current sensor including a Rogowski coil is used. The following explanation is given by way of example.

  Returning to FIG. 2, the noise quantification circuit 12 converts the AC signal (AC current in this example) output from the noise detection sensor 11a into a DC signal (DC current in this example) corresponding to the strength of the AC signal. To do. As an example, as shown in FIG. 7, a simple circuit composed of a resistor (see R3 and R4 in FIG. 7), a diode (see D1 in FIG. 7), and a capacitor (see C2 in FIG. 7) is used. That's fine. In addition, TP1 and TP2 in FIG. 7 have shown the terminal connected with a Rogowski coil.

  When a voltage sensor is used as the noise detection sensor 11a, the AC voltage detected by the noise detection sensor 11a is converted into a DC voltage by the noise quantification circuit 12. When an electric field sensor is used as the noise detection sensor 11a, the electric field component detected by the noise detection sensor 11a is converted into an amplitude component from which the phase component is removed by the noise quantification circuit 12. Further, when a magnetic field sensor is used as the noise detection sensor 11a, the magnetic field component detected by the noise detection sensor 11a is converted into an amplitude component from which the phase component is removed by the noise quantification circuit 12.

  The noise quantification circuit 12 may be a half-wave rectifier circuit composed of a diode and a capacitor (capacitor), or includes an AD conversion circuit and an arithmetic circuit. After AD conversion in the AD converter circuit, the arithmetic circuit The structure which converts into a direct-current signal by the calculation of may be sufficient.

  The device control signal output circuit 13a converts the DC signal converted by the noise quantification circuit 12 into a signal corresponding to the intensity of the DC signal. Specifically, when the intensity of the DC signal exceeds a predetermined threshold value, fail-safe processing is performed to output a control signal for giving a warning to the user to the notification device 5. The device control signal output circuit 13a corresponds to a threshold value determination unit and a fail safe unit.

  The predetermined threshold here is a value that can be arbitrarily set, and sets a value of a DC signal corresponding to a noise intensity that is known to cause malfunction of the ECU 2, the sensor 3, and other electronic devices. What is necessary is just composition. The fail-safe process is a process for dealing with malfunctions of in-vehicle electronic devices such as the ECU 2 and the sensor 3.

  As an example, as shown in FIG. 7, a simple circuit comprising a resistor (see R1 and R2 in FIG. 7), a diode (see D2 in FIG. 7), a capacitor (see C1 in FIG. 7), and a comparator (OP1 in FIG. 7). A configuration that uses a simple circuit may be used.

  In the present embodiment, the following description will be given by taking as an example the case where a simple circuit as shown in FIG. 7 is used as the device control signal output circuit 13a. However, the device control signal output circuit 13a is a microcomputer (MPU). ) May be used. The MPU of the ECU 2 may be configured to function as the device control signal output circuit 13a.

  Further, when the noise quantification circuit 12 is configured by an AD conversion circuit and an arithmetic circuit as described above, the above threshold determination in the device control signal output circuit 13a may also be performed by the arithmetic circuit.

  The notification device 5 to which a control signal for giving a warning to the user is input issues a warning to the user according to the control signal. As the notification device 5, for example, a display device, an audio output device, an illumination device such as an LED, a vibration generator provided in a steering wheel, a seat, or the like can be used. This notification device 5 corresponds to a warning device in claims.

  In the case of a display device, a warning that informs the user of the possibility of a malfunction in a function performed by the ECU 2 or a function executed on the basis of a signal from the ECU 2 or a method for coping with the malfunction is displayed. A warning indicating that the external noise is large may be given. In the case of an audio output device, the warning as described above may be performed by voice. In the case of a lighting device, a warning may be given by lighting. In the case of a vibration generator, a warning may be given by generating a vibration.

  According to this, since the user can receive a warning, when the malfunction of the ECU 2 is likely to occur due to the influence of external noise, the user can take measures for the malfunction, and the user's trouble due to the malfunction Can be made difficult to occur.

  In this embodiment, although the structure which outputs the control signal which performs the warning to a user from the apparatus control signal output circuit 13a to the alerting | reporting device 5 was shown, it does not necessarily restrict to this. For example, when the intensity of the DC signal exceeds a predetermined threshold, the device control signal output circuit 13a outputs and records the intensity in an electrically rewritable nonvolatile memory such as an EEPROM of the ECU 2. Good. In the case of recording the intensity of the DC signal, the time stamp (that is, time information) when the DC signal having the intensity is detected may be recorded. The non-volatile memory of the ECU 2 corresponds to the recording device of the claims.

  In addition, when recording the DC signal intensity, the position information of the vehicle when the DC signal with the intensity detected by a position detector (not shown) is detected is also recorded together with or instead of the time information. It is good also as a structure.

  According to this, since the intensity of the DC signal when the predetermined threshold value is exceeded can be recorded, when a malfunction of the ECU 2 actually occurs due to the influence of external noise, the cause of the malfunction based on the record Can be analyzed. Therefore, even when a malfunction occurs, it is possible to suppress a problem that requires time and effort to find the cause of the malfunction. Therefore, it becomes possible to make it difficult for the user to have a problem due to the malfunction of the ECU 2.

  Further, when the intensity of the DC signal exceeds a predetermined threshold value, a control signal that causes the in-vehicle LAN 4 to output a signal (hereinafter referred to as a fail signal) indicating that the ECU 2 may be malfunctioning is provided as a device control signal. The output circuit 13a may output the fail signal by outputting it to the MPU of the ECU 2. The fail signal may be a signal indicating that the intensity of the DC signal (that is, external noise) exceeds a predetermined threshold, for example. In addition, when the strength of the DC signal does not exceed the predetermined threshold, a control signal that causes the in-vehicle LAN 4 to output a signal indicating that the strength of the DC signal (that is, external noise) does not exceed the predetermined threshold is provided. The control signal output circuit 13a may be configured to output to the MPU of the ECU 2.

  According to this, ECUs other than the ECU 2 (hereinafter referred to as other ECUs) connected to the in-vehicle LAN 4 can receive the fail signal of the ECU 2. Therefore, when another ECU that performs control using the signal from the ECU 2 receives the fail signal, the control using the signal from the ECU 2 is not performed or the control is switched to the control that does not use the signal from the ECU 2. Thus, it is possible to suppress problems due to malfunction of the ECU 2. As a result, it is possible to make it difficult for the user to malfunction due to the malfunction of the ECU 2.

  In addition, when the intensity of the DC signal exceeds a predetermined threshold, the device control signal output circuit 13a outputs a control signal for stopping the output of the signal from the ECU 2 to the in-vehicle LAN 4 to the MPU of the ECU 2, It is good also as a structure which stops the output of the signal from ECU2 to vehicle-mounted LAN4.

  According to this, when the malfunction of the ECU 2 is likely to occur due to the influence of external noise, the output of the signal from the ECU 2 to the in-vehicle LAN 4 is stopped. Therefore, the malfunction of the ECU 2 in another ECU that performs control using the signal from the ECU 2 It becomes possible to suppress the trouble caused by. As a result, it is possible to make it difficult for the user to malfunction due to the malfunction of the ECU 2.

  Further, when the intensity of the DC signal exceeds a predetermined threshold value, a control signal for changing the signal transmission method from the ECU 2 to the in-vehicle LAN 4 to a transmission method that is less susceptible to external noise is provided as a device control signal output circuit. It is good also as a structure which changes the delivery method because 13a outputs to MPU of ECU2.

  As a change to a transmission method that is less susceptible to external noise, for example, the output can be increased so that the external noise is buried, converted to a frequency other than external noise, the idle time is increased, or the communication speed is decreased. Can be mentioned.

  According to this, when the signal output from the ECU 2 to the in-vehicle LAN 4 is easily affected by the external noise, the transmission method is changed to be less susceptible to the influence of the external noise. It is possible to suppress problems caused by malfunction of the ECU 2 in the ECU. As a result, it is possible to make it difficult for the user to malfunction due to the malfunction of the ECU 2.

  Furthermore, when the intensity of the DC signal exceeds a predetermined threshold value, the device control signal output circuit 13a outputs to the MPU of the ECU 2 a control signal for switching to the control mode without using a signal from the outside of the ECU 2. Thus, the ECU 2 may be configured to perform control without using a signal from the outside of the ECU 2. In this case, the ECU 2 can switch between a mode in which control is performed using a signal input from outside and a mode in which control is performed without using a signal input from outside.

  According to this, when an abnormality occurs in a signal input from the outside due to the influence of external noise, the ECU 2 switches to a mode in which control is performed without using a signal from the outside of the ECU 2, and thus an abnormality occurs. It is possible to suppress problems caused by using external signals. As a result, it is possible to make it difficult for the user to malfunction due to the malfunction of the ECU 2.

  In addition, when the ECU 2 performs control using an analog signal input from an electronic device such as a sensor connected with a Zika line, and the DC signal intensity exceeds a predetermined threshold value In addition, the analog signal may be processed by causing the device control signal output circuit 13a to output a control signal for performing processing for reducing the influence of external noise to the MPU of the ECU 2.

Examples of processing that reduces the influence of external noise include averaging such as moving average of analog signals that are input sequentially, retry, filtering to exclude abnormal values, etc. If the analog signal input from the outside has an abnormality due to the influence, processing to reduce the influence of external noise is performed, so it is possible to suppress problems caused by using the external analog signal in which the abnormality has occurred become. As a result, it is possible to make it difficult for the user to malfunction due to malfunction of the ECU 2.

  The sensor signal processing circuit 14a including the noise quantification circuit 12 and the device control signal output circuit 13a is preferably shielded by a shield member that shields external electromagnetic noise. As the shield member, a conductive material such as metal may be used. For example, the shield member may be shielded by surrounding the sensor signal processing circuit 14a.

  In particular, the sensor signal processing circuit 14a is built in a PALAP (registered trademark) board, which is a multilayer circuit board, and the outer layer of the PALAP board and the serial connection via in the stacking direction are used as a shield member for the sensor signal processing circuit 14a. Is preferred. In addition, when it can be built in, it is preferable that the noise detection sensor 11a is also built in the PALAP substrate. The PALAP substrate is a multilayer circuit substrate manufactured by a well-known collective heat press known as PALAP (Patterned Prepreg Lay Up Process).

  Here, with reference to FIG. 8A and FIG. 8B, the structure in which the noise detection sensor 11a as the Rogowski coil and the sensor signal processing circuit 14a are built in the PALAP substrate will be described. . FIG. 8A is a top view showing the PALAP substrate having the structure, and FIG. 8B is a cross-sectional view taken along the line II-II in FIG.

  In FIG. 8B, although the detailed structure is not shown for convenience, the PALAP substrate includes an insulating layer made of a thermoplastic resin base material and a wiring layer in which a wiring pattern is formed on the base material. Are alternately laminated and manufactured by a well-known collective heat press. Specifically, the noise detection sensor 11a as a Rogowski coil and the sensor signal processing circuit 14a are also composed of the wiring layer, and are built into the PALAP substrate by producing a PALAP substrate by batch hot pressing. It is like that.

  The outer skin layer 104 on the upper surface and the lower surface of the PALAP substrate is GND, and this outer skin layer 104 is against the external electromagnetic noise from the stacking direction of the PALAP substrate for the noise detection sensor 11a and the sensor signal processing circuit 14a. It functions as a shield member.

  A serial connection via 103 filled with metal is provided in the stacking direction of the PALAP substrate. The serial connection via 103 is provided so as to surround the outer periphery of the noise detection sensor 11a and the sensor signal processing circuit 14a in the direction orthogonal to the stacking direction. Thereby, the serial connection via 103 functions as a shield member for the external electromagnetic noise from the direction orthogonal to the stacking direction for the noise detection sensor 11a and the sensor signal processing circuit 14a.

  According to the above configuration, since the noise detection sensor 11a and the sensor signal processing circuit 14a are shielded from external electromagnetic noise by the shield member, erroneous detection by the noise detection sensor 11a due to external electromagnetic noise and the sensor signal processing circuit 14a. Can be prevented from malfunctioning.

  As the casing of the ECU, resin is used instead of metal for weight reduction. Therefore, there is a demand for avoiding the use of a shield member that covers the entire ECU with metal as means for dealing with malfunction of the ECU due to external noise such as external electromagnetic noise.

  On the other hand, according to the configuration of the first embodiment, when the intensity of the DC signal detected by the noise detection sensor 11a is equal to or greater than the threshold (that is, the external noise is equal to or greater than the threshold), it corresponds to the malfunction of the electronic device. By performing the fail-safe process for this purpose, it is possible to cope with a malfunction of the ECU 2. Therefore, even if a shield member that covers the entire ECU 2 with a metal is not used, it is possible to make it difficult for the user to malfunction due to the malfunction of the ECU 2. become. In addition, the use of a shield member can be limited to using a shield member that shields the noise detection sensor 11a and the sensor signal processing circuit 14a as described above.

  Next, the configuration of the sensor fail-safe device 1b will be described with reference to FIG. As shown in FIG. 9, the sensor fail-safe device 1b includes a noise detection sensor 11b, a noise quantification circuit 12, and a device control signal output circuit 13b. In addition, the noise quantification circuit 12 and the device control signal output circuit 13b constitute a sensor signal processing circuit 14b.

  The noise detection sensor 11b is the same as the noise detection sensor 11a described above. The noise detection sensor 11b may be any of the above-described current sensor, electric field sensor, magnetic field sensor, and voltage sensor. The noise detection sensor 11b corresponds to a sensor unit in the claims.

  The noise quantification circuit 12 of the sensor fail-safe device 1b is the same as the noise quantification circuit 12 of the ECU fail-safe device 1a. The device control signal output circuit 13b of the sensor fail-safe device 1b has the same configuration as the device control signal output circuit 13a shown in FIG. 7, for example.

  The device control signal output circuit 13b outputs a control signal for stopping the output of the signal from the sensor 3 to the in-vehicle LAN 4 when the intensity of the DC signal converted by the noise quantification circuit 12 exceeds a predetermined threshold. The signal output circuit 13a outputs to the controller 31 of the sensor 3 to stop the signal output from the sensor 3 to the in-vehicle LAN 4.

  According to this, since the output of the signal from the sensor 3 to the in-vehicle LAN 4 is stopped when the malfunction of the sensor 3 is likely to occur due to the influence of external noise, the sensor in the ECU that performs control using the signal from the sensor 3 It is possible to suppress problems due to malfunction 3. As a result, it is possible to make it difficult for the user to cause a malfunction due to the malfunction of the sensor 3.

  In addition, the device control signal output circuit 13b sends a control signal that gives a warning to the user in the same manner as the device control signal output circuit 13a when the intensity of the DC signal exceeds a predetermined threshold value. Or a fail signal indicating that the sensor 3 may be malfunctioning, or a transmission method that is less susceptible to external noise.

  The difference from the case of the device control signal output circuit 13a is that the output destination of the control signal is from the MPU of the ECU 2 to the controller 31 of the sensor 3. The effect is the same except that it is possible to make it difficult for the malfunction of the sensor 3 to be caused by the malfunction of the sensor 3 instead of the malfunction of the ECU 2.

  Also, the sensor signal processing circuit 14b is preferably shielded by a shield member that shields external electromagnetic noise as in the sensor signal processing circuit 14a described above.

  Next, the configuration of the vehicle fail-safe device 1c will be described with reference to FIG. As shown in FIG. 10, the vehicle fail-safe device 1c includes a noise detection sensor 11c, a noise quantification circuit 12, and a device control signal output circuit 13c. The noise quantification circuit 12 and the device control signal output circuit 13c constitute a sensor signal processing circuit 14c.

  The noise detection sensor 11c is the same as the noise detection sensor 11a described above. The noise detection sensor 11c may be any of the above-described current sensor, electric field sensor, magnetic field sensor, and voltage sensor. The noise detection sensor 11c corresponds to a sensor unit in the claims.

  The noise quantifying circuit 12 of the vehicle fail-safe device 1c is the same as the noise quantifying circuit 12 of the ECU fail-safe device 1a. The device control signal output circuit 13c of the vehicle fail-safe device 1c has the same configuration as the device control signal output circuit 13a shown in FIG. 7, for example.

  The device control signal output circuit 13c is a control signal for temporarily prohibiting vehicle deceleration, stopping, or restart after stopping when the intensity of the DC signal converted by the noise quantification circuit 12 exceeds a predetermined threshold. Is output to the behavior control ECU 6 that controls the behavior of the vehicle. The behavior control ECU 6 corresponds to the behavior control device of the claims.

  Examples of the behavior control ECU 6 include a VSC_ECU and a brake ECU that control a brake actuator that applies a braking force to the vehicle. When a VSC_ECU or a brake ECU is used as the behavior control ECU 6, the brake actuator may be controlled in accordance with a control signal input from the device control signal output circuit 13c to decelerate or stop the vehicle.

  As the behavior control ECU 6, an ENG_ECU that controls the throttle actuator can also be used. In the case of using ENG_ECU as the behavior control ECU 6, a configuration may be adopted in which deceleration is performed by controlling the throttle actuator according to a control signal input from the device control signal output circuit 13c to generate an engine brake.

  In addition, the behavior control ECU 6 includes an immobilizer ECU that prohibits starting of the vehicle. When an immobilizer ECU is used as the behavior control ECU 6, it may be configured to temporarily prohibit the start of the vehicle in accordance with a control signal input from the device control signal output circuit 13c. The temporary prohibition of the restart may be performed for a predetermined time or until the intensity of the DC signal converted by the noise quantification circuit 12 falls below a predetermined threshold.

  According to this, when the vehicle-mounted electronic device is likely to malfunction due to the influence of external noise, the vehicle is decelerated, stopped, or temporarily restarted after the vehicle is stopped. It is possible to stop before the electronic device malfunctions, or to stop quickly when the in-vehicle electronic device malfunctions. As a result, it is possible to make it difficult for a user to have a problem due to a malfunction of the in-vehicle electronic device.

  Furthermore, when the intensity of the DC signal exceeds a predetermined threshold, the device control signal output circuit 13c may output the intensity to the recording device 7 that records information and record it. In the case of recording the intensity of the DC signal, the time stamp (that is, time information) when the DC signal having the intensity is detected may be recorded. The recording device 7 is an electrically rewritable nonvolatile memory.

  In addition, when recording the DC signal intensity, the position information of the vehicle when the DC signal with the intensity detected by a position detector (not shown) is detected is also recorded together with or instead of the time information. It is good also as a structure.

  According to this, since the intensity of the DC signal when the predetermined threshold value is exceeded can be recorded, when the malfunction of the in-vehicle electronic device actually occurs due to the influence of external noise, The cause of malfunction can be analyzed. Therefore, even when a malfunction occurs, it is possible to suppress a problem that requires time and effort to find the cause of the malfunction. Therefore, it becomes possible to make it difficult for a user to have a problem due to a malfunction of the in-vehicle electronic device.

  In addition, the device control signal output circuit 13b may be configured to output a control signal for giving a warning to the user to the notification device 5 when the intensity of the DC signal exceeds a predetermined threshold. The notification device 5 to which a control signal for giving a warning to the user is input issues a warning to the user according to the control signal.

  In the case where the notification device 5 is a display device, a warning that informs the possibility of malfunction of the vehicle due to external noise, a warning that prompts deceleration or stopping, or that the external noise is large is displayed by displaying text or images. A warning may be given. In the case of an audio output device, the warning as described above may be performed by voice. In the case of a lighting device, a warning may be given by lighting, and in the case of a vibration generator, a warning may be given by generating a vibration.

  According to this, since the user can receive a warning, when the malfunction of the in-vehicle electronic device is likely to occur due to the influence of external noise, the user can take measures for the malfunction. It becomes possible to make it difficult for a user to have a problem.

  Note that the sensor signal processing circuit 14c is also preferably shielded by a shielding member that shields external electromagnetic noise as in the sensor signal processing circuit 14a described above.

  Further, the present invention may be applied to a known drive recorder that records information at the time of a vehicle collision. For example, the vehicle fail-safe device 1c is incorporated in a drive recorder. When a vehicle image is recorded in the memory of the drive recorder in the event of a vehicle collision, such as a camera image or vehicle speed for a predetermined period before and after the collision time, the noise detection sensor 11c is used at the time of the collision or the predetermined period. Information about the detected external noise and the intensity of the DC signal converted by the noise quantification circuit 12 may be recorded in the memory. According to this, it becomes possible to easily know the state of external noise at the time of a vehicle collision.

  In addition, when the intensity of the DC signal (limited to the current detected by the current sensor and the voltage detected by the voltage sensor) exceeds a predetermined threshold, the device control signal output circuits 13a and 13b receive the noise detection sensors 11a and 11b. It is good also as a structure which suppresses the influence of external noise by outputting the signal of the reverse phase (for example, the same amplitude reverse phase) with the detected alternating current signal to vehicle-mounted LAN4. The AC signal referred to here is limited to the AC current detected by the noise detection sensors 11a and 11b as current sensors and the AC voltage detected by the noise detection sensors 11a and 11b as voltage sensors.

  In the present embodiment, the configuration in which one threshold value is used for threshold determination is shown, but the present invention is not limited to this. For example, it is good also as a structure which uses the threshold value of a several step for threshold value determination. In this case, it is preferable to set a threshold value for each strength at which the degree of malfunction is assumed, assuming that the degree of malfunction of electronic devices such as the ECU 2 and the sensor 3 varies depending on the intensity of external noise. And it is preferable to change the control signal to be output according to which threshold value of the threshold values in a plurality of stages is exceeded.

  As an example, when there is a threshold value in two stages, a control signal for giving a warning to the user is output to the notification device 5 when the first threshold value is exceeded, and a second signal larger than the first value is output. What is necessary is just to set it as the structure which outputs to the behavior control ECU6 the control signal which performs temporary prohibition of the deceleration of a vehicle, stopping, and the restart after stopping after the threshold is exceeded. Note that the degree of fail-safe processing, such as changing the volume of a warning, is not limited to the configuration in which the type of fail-safe processing is changed according to which threshold value of a plurality of levels is exceeded as in the above example. It is good also as a structure which changes.

  In the present embodiment, the ECU fail-safe device 1a, the sensor fail-safe device 1b, and the vehicle fail-safe device 1c are configured to include one sensor for detecting external noise. Not exclusively.

  For example, two or more of four types of sensors (that is, an electric field sensor, a magnetic field sensor, a current sensor, and a voltage sensor) with different detection targets for detecting external noise are used as the ECU fail-safe device 1a, sensor It is good also as a structure with which the fail safe apparatus 1b for vehicles and the fail safe apparatus 1c for vehicles are equipped. And it is good also as a structure which improves the detection precision of an external noise and the determination precision of a threshold value based on each detection result in these 2 or more types of sensors.

  There are two types of sensors: electric field sensors and magnetic field sensors that detect noise in space, and current sensors and voltage sensors that detect noise input from lines such as signal lines. When used, in addition to external noise, there is a possibility that noises such as ECUs and motors in the vehicle are mixed. Therefore, the external noise detected by the current sensor or voltage sensor is large even though both the electric field sensor and magnetic field sensor are used, and the external noise detected by the electric field sensor and magnetic field sensor is low. In such a case, it may be determined that the level of the external noise is low by determining the influence of the noise source in the vehicle.

  As an example, even if the external noise detected by the current sensor or voltage sensor is equal to or greater than the threshold value for the current sensor or voltage sensor for the threshold determination described above, the external noise detected by the electric field sensor or magnetic field sensor is If it is not equal to or greater than the threshold value for the determination electric field sensor or magnetic field sensor, it may be determined that the external noise is not equal to or greater than the threshold value, and the subsequent processing is performed in the same manner as described above.

  In addition, in the present embodiment, the threshold value determination is performed and the control signal is output when the threshold value is exceeded. However, the present invention is not limited to this. For example, the device control signal output circuits 13a, 13b, and 13c may be configured to perform fail-safe processing with an intensity according to the magnitude of a signal (analog signal) output from the noise quantification circuit 12.

  As an example, as the analog signal output from the noise quantification circuit 12 increases, the volume of a warning output from the sound output device serving as the notification device 5 increases, or the vibration generated from the vibration generation device serving as the notification device 5. For example, the period may be shortened. Therefore, the noise quantification circuit 12 corresponds to a noise corresponding output unit.

(Embodiment 2)
The present invention is not limited to the above-described first embodiment, and the following second embodiment is also included in the technical scope of the present invention. Hereinafter, Embodiment 2 will be described with reference to the drawings. As shown in FIG. 11, the failsafe system 200 includes a center 10 and an in-vehicle system 101 mounted on each of a plurality of vehicles. For convenience of explanation, members having the same functions as those shown in the drawings used in the description of the above-described embodiment are denoted by the same reference numerals, and description thereof is omitted.

  The center 10 includes a server, and includes a center side communication device 41, a center side control device 42, and a map database (DB) 43. The center 10 may be composed of a single server or may be composed of a plurality of servers.

  The center side communication device 41 communicates with the vehicle side communication device 9 via a communication network such as a wireless base station or the Internet. The center-side control device 42 is configured around a known microcomputer including a CPU, a ROM, a RAM, an I / O, a bus line connecting these components, and the like. Various processes are performed in accordance with programs stored in the ROM or the like. The map DB 43 stores electronic map data.

  Subsequently, the in-vehicle system 101 includes a vehicle fail-safe device 1c, a position detector 8, and a vehicle-side communication device 9. In the present embodiment, a configuration including the vehicle fail-safe device 1c is shown as an example, but the configuration is not necessarily limited thereto, and a configuration using the ECU fail-safe device 1a or the sensor fail-safe device 1b instead of the vehicle fail-safe device 1c. It is good.

  The position detector 8 is a geomagnetic sensor that detects geomagnetism, a gyroscope that detects angular velocity around the vertical direction of the host vehicle, a distance sensor that detects the moving distance of the host vehicle, and a current position of the vehicle based on radio waves from a satellite. Based on information obtained from each sensor such as a GPS receiver for GPS (global positioning system) for detecting the vehicle, the current position of the vehicle is detected sequentially (for example, every 100 msec). Further, the position detector 8 outputs the detected current position information to the vehicle side communication device 9. In addition, what is necessary is just to represent the present position of the own vehicle by a coordinate (latitude / longitude).

  Since these sensors have errors of different properties, they are configured to be used while being complemented by a plurality of sensors. Depending on the accuracy of each sensor, the position detector 8 may be configured as a part of the above, or a sensor other than the above may be used.

  The vehicle-side communication device 9 communicates with the center-side communication device 41 via a communication network such as a wireless base station or the Internet. The vehicle-side communication device 9 may be a communication module such as a DCM (data communication module) that performs telematics communication using a mobile phone network, or a narrow area communication (DSRC) used in an ETC (registered trademark) system or the like. ), Radio wave beacon and optical beacon techniques used in VICS (registered trademark) or the like may be used. In addition, a 700 MHz band radio wave or a 5.9 GHz band radio wave may be used.

  Next, the overall processing flow in the failsafe system 200 will be described. First, in the in-vehicle system 101, when the intensity of the DC signal converted by the noise quantification circuit 12 exceeds a predetermined threshold in the device control signal output circuit 13c of the vehicle fail-safe device 1c, for example, Information on the strength (that is, information on the strength of the external noise) is output to the vehicle-side communication device 9.

  In the vehicle-side communication device 9 to which the DC signal strength information is input from the vehicle fail-safe device 1c, for example, the vehicle current position information input from the position detector 8 at the same time and the DC signal strength information. Are linked (associated) and transmitted to the center side communication device 41. The information on the strength of the DC signal and the current position information of the vehicle that are linked and transmitted from the vehicle side communication device 9 to the center side communication device 41 are hereinafter referred to as external noise generation data.

  The center side communication device 41 that has received the external noise occurrence data sends the received external noise occurrence data to the center side control device 42. Based on the electronic map data stored in the map DB 43 and the received external noise generation data, the center-side control device 42 displays the point indicated by the current position information of the vehicle included in the external noise generation data on the electronic map. To map. That is, the point where the intensity of the external noise is equal to or greater than the threshold is associated with the position on the electronic map. The electronic map data subjected to the above mapping is stored in the map DB 43.

  In the center 10, the external noise occurrence data transmitted from the in-vehicle systems 101 of a plurality of vehicles are mapped on the electronic map by integrating the external noise occurrence data of the plurality of vehicles. And the center side control apparatus 42 of the center 10 delivers the electronic map data which performed the said mapping from the center side communication apparatus 41 toward the vehicle side communication apparatus 9 of each vehicle.

  The mapping is not limited to associating a point (hereinafter referred to as a noise detection point) indicated by the current position information of the vehicle included in the external noise occurrence data on the electronic map. For example, a circle with a predetermined radius centered on the noise detection point may be superimposed and displayed. Further, the hue, saturation, and brightness of the circle may be changed in a plurality of stages according to the intensity indicated by the DC signal intensity information included in the external noise generation data.

  Further, the mesh on the electronic map including the noise detection point may be highlighted with a specific color. Furthermore, the hue, saturation, and lightness of the mesh may be changed in a plurality of stages according to the strength indicated by the DC signal strength information included in the external noise generation data.

  In addition, it is good also as a structure which changes the hue, saturation, and brightness of a mesh in several steps according to the density of the noise detection point in the mesh on an electronic map.

  According to this, in the vehicle that has received the distribution of the electronic map data subjected to the mapping, it is possible to display an electronic map indicating a point where the intensity of the external noise is greater than or equal to a threshold value on a display such as a navigation device, for example. become. Therefore, the occupant can predict a point where the intensity of the external noise is high on a route where the vehicle has never traveled, and can travel while avoiding a point where the intensity of the external noise is estimated to be large.

  Further, instead of distributing the mapped electronic map data from the center side communication device 41, the coordinates of the points where the intensity of the external noise is greater than or equal to the threshold accumulated in the center 10 may be distributed to each vehicle. .

  Even in this case, in the vehicle that has received the distribution of the coordinates, an electronic map indicating a point where the intensity of the external noise is equal to or greater than the threshold can be displayed on a display such as a navigation device. Therefore, the occupant can predict a point where the intensity of the external noise is high on a route where the vehicle has never traveled, and can travel while avoiding a point where the intensity of the external noise is estimated to be large.

  The present invention is not limited to the above-described embodiments, and various modifications can be made within the scope of the claims, and the technical means disclosed in different embodiments can be appropriately combined. Such embodiments are also included in the technical scope of the present invention.

1a ECU fail-safe device (fail-safe device), 1b sensor fail-safe device (fail-safe device), 1c vehicle fail-safe device (fail-safe device), 2 ECU (electronic device), 3 sensor (electronic device), 11a, 11b, 11c Noise detection sensor (sensor unit), 12 Noise quantification circuit 12 (noise corresponding output unit), 13a, 13b, 13c Device control signal output circuit (threshold judgment unit, fail safe unit), 21 Signal line

Claims (19)

An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
The threshold determination unit is set with a plurality of thresholds,
The fail-safe unit is configured to change one of the types and degrees of the fail-safe processing according to which threshold of the plurality of thresholds is determined by the threshold determination unit. apparatus. An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
The fail-safe device, wherein the threshold value determination unit and the fail-safe unit are shielded by a shield member (103, 104) that shields external electromagnetic noise. In claim 1,
The fail-safe device, wherein the threshold value determination unit and the fail-safe unit are shielded by a shield member (103, 104) that shields external electromagnetic noise. In claim 2 or 3,
The threshold judgment unit and the fail safe unit are formed in a multilayer circuit board in which insulating layers and wiring layers are alternately stacked, and a skin layer (104) and a serial connection via (103) in the stacking direction serve as a shield. A fail-safe device that is built in and uses the outer skin layer and the serially connected via in the stacking direction as a shield member for the threshold value determination unit and the fail-safe unit. An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
The fail-safe unit outputs a control signal that causes the warning device (5) that issues a warning to the user of the vehicle when the threshold determination unit determines that the external noise is greater than or equal to the threshold. A fail-safe device that performs safe processing. In any one of Claims 1-4,
The fail-safe unit outputs a control signal that causes the warning device (5) that issues a warning to the user of the vehicle when the threshold determination unit determines that the external noise is greater than or equal to the threshold. A fail-safe device that performs safe processing. In any one of Claims 1-6,
The fail-safe unit performs fail-related recording on the recording device (2, 7) that records information when the threshold determination unit determines that the external noise is equal to or greater than the threshold. A fail-safe device that performs safe processing. In any one of Claims 1-6,
When the threshold determination unit determines that the external noise is equal to or greater than the threshold, the fail-safe unit records the information regarding the external noise determined to be equal to or greater than the threshold to the recording device (2, 7) that records information; A fail-safe apparatus that performs fail-safe processing for recording at least one of position information indicating a position where an external noise is detected and time information indicating a time when the external noise is detected. An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
The fail-safe unit determines whether the vehicle has stopped, decelerated, and stopped after the threshold determination unit determines that the external noise is greater than or equal to the threshold, to the behavior control device (6) that controls the behavior of the vehicle. A fail-safe device for performing a fail-safe process for outputting a control signal for temporarily prohibiting restart. In claim 9,
The fail-safe unit performs fail-related recording on the recording device (2, 7) that records information when the threshold determination unit determines that the external noise is equal to or greater than the threshold. A fail-safe device that performs safe processing. In claim 9,
When the threshold determination unit determines that the external noise is equal to or greater than the threshold, the fail-safe unit records the information regarding the external noise determined to be equal to or greater than the threshold to the recording device (2, 7) that records information; A fail-safe apparatus that performs fail-safe processing for recording at least one of position information indicating a position where an external noise is detected and time information indicating a time when the external noise is detected. In any one of Claims 1-8,
The fail-safe unit determines whether the vehicle has stopped, decelerated, and stopped after the threshold determination unit determines that the external noise is greater than or equal to the threshold, to the behavior control device (6) that controls the behavior of the vehicle. A fail-safe device for performing a fail-safe process for outputting a control signal for temporarily prohibiting restart. An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
The fail safe unit is a part of a drive recorder that records information at the time of the vehicle collision, and is detected by the sensor unit at the time of the collision or a predetermined period before and after the collision when the information is recorded at the time of the vehicle collision. A fail-safe device for recording information on the state of external noise. In any one of claims 1 to 12
The fail safe unit is a part of a drive recorder that records information at the time of the vehicle collision, and is detected by the sensor unit at the time of the collision or a predetermined period before and after the collision when the information is recorded at the time of the vehicle collision. A fail-safe device for recording information on the state of external noise. An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold;
Provided independently of the electronic device;
A plurality of the sensor units having different detection targets for detecting the external noise,
The fail-safe apparatus, wherein the threshold determination unit determines whether or not the external noise is greater than or equal to a threshold based on detection results of the external noise at the plurality of sensor units. In any one of claims 1 to 14
A plurality of the sensor units having different detection targets for detecting the external noise,
The fail-safe apparatus, wherein the threshold determination unit determines whether or not the external noise is greater than or equal to a threshold based on detection results of the external noise at the plurality of sensor units. In claim 15 or 16 ,
The threshold determination unit
Detecting the external noise for the electronic device by detecting the current or the voltage Even if the external noise detected by the sensor unit is greater than or equal to a threshold value, the electric field or the magnetic field is detected by detecting the electric field or the magnetic field. A fail-safe device characterized in that, when the external noise detected by the sensor unit for detecting external noise is not equal to or greater than a threshold, it is determined that the external noise is not equal to or greater than the threshold. An in-vehicle system (101) mounted on a vehicle;
A center (10),
The in-vehicle system is
The fail-safe device according to any one of claims 1 to 17 ,
A position detector (8) for detecting the current position of the vehicle;
A vehicle side communication device (9) for communicating with the center,
The center is
A center side communication device (41) for communicating with the vehicle;
The in-vehicle system associates the determination result at the threshold determination unit of the fail-safe device with the current position of the vehicle at the time when the determination result is obtained, detected by the position detector, and the center side from the vehicle-side communication device. To
The center determines a point where the external noise is equal to or greater than the threshold based on information on the determination result obtained from the in-vehicle system of a plurality of vehicles and the current position of the vehicle at the time when the determination result is obtained. A fail-safe system characterized by associating with a position on an electronic map and distributing information about the position on the electronic map to which the association has been made from the center side communication device to the vehicle. An in-vehicle system (101) mounted on a vehicle;
A center (10),
The in-vehicle system is
An electric field applied to the electronic device (2, 3) mounted on the vehicle, a magnetic field applied to the electronic device, an input to the electronic device via any one of the signal line (21), a power supply line, and a ground line, or the electronic device Sensor units (11a, 11b, 11c) for detecting external noise with respect to the electronic device by detecting either the current output from and the voltage input to or output from the electronic device;
A threshold determination unit (13a, 13b, 13c) for determining whether or not the external noise detected by the sensor unit is greater than or equal to a threshold;
A fail-safe unit (13a, 13b, 13c) that performs a fail-safe process, which is a process for dealing with a malfunction of the electronic device, when the threshold determination unit determines that the external noise is equal to or greater than the threshold ; a fail-safe device that is provided independently of said electronic device,
A position detector (8) for detecting the current position of the vehicle;
A vehicle side communication device (9) for communicating with the center,
The center is
A center side communication device (41) for communicating with the vehicle;
The in-vehicle system associates the determination result at the threshold determination unit of the fail-safe device with the current position of the vehicle at the time when the determination result is obtained, detected by the position detector, and the center side from the vehicle-side communication device. To
The center determines a point where the external noise is equal to or greater than the threshold based on information on the determination result obtained from the in-vehicle system of a plurality of vehicles and the current position of the vehicle at the time when the determination result is obtained. A fail-safe system characterized by associating with a position on an electronic map and distributing information about the position on the electronic map to which the association has been made from the center side communication device to the vehicle.

Images