Electronic control device and in-vehicle device

1. An electronic control unit, comprising:

at least three microcomputers capable of receiving sensing data from a plurality of sensors, the at least three microcomputers comprising a first microcomputer, a second microcomputer, and a third microcomputer;

at least three failure detectors configured to detect a failure of at least one or more sensors of the plurality of sensors and a failure of one or more microcomputers of the at least three microcomputers, the at least three failure detectors comprising a first failure detector associated with the first microcomputer, a second failure detector associated with the second microcomputer, and a third failure detector associated with the third microcomputer;

a mode selector configured to select a normal operation mode or a fallback operation mode in accordance with a detection result by the at least three failure detectors, the mode selector configured to select the fallback operation mode when Ii) the first failure detector detects the failure of the at least one or more sensors of the plurality of sensors, (ii) the second failure detector detects the failure of the first microcomputer, and (iii) the third failure detector detects the failure of the first microcomputer; and

a sensor selector configured to select a sensor of the plurality of sensors based on the failure detected by the at least three failure detectors or a surrounding situation of an own vehicle calculated from the sensing data,

wherein any of the second microcomputer or the third microcomputer generates, in the fallback operation mode, a drive signal for operating an actuator using the sensing data received from the sensor selected by the sensor selector, and transmits the drive signal to the actuator.

2. The electronic control unit according to claim 1 ,

wherein, in the fallback operation mode, at least one of the second microcomputer or the third microcomputer receives the sensing data in an ordered time series in which the at least one of the second microcomputer or the third microcomputer receives the sensing data from (i) a first sensor of the plurality of sensors for a first time period and (ii) a second sensor of the plurality of sensors for a second time period, the second time period following the first time period.

3. The electronic control unit according to claim 2 ,

wherein in a case of the fallback operation mode,

while the sensor selector selects, in the ordered time series, the sensor to be selected, and

any of the second microcomputer or the third microcomputer generates the drive signal and stops the own vehicle at a safe position.

4. The electronic control unit according to claim 1 , comprising:

a memory that stores the detection result.

5. The electronic control unit according to claim 4 ,

wherein the at least three failure detectors detects a failure of a power supply, a communicator, or the memory that are connected to the first microcomputer, and

the memory stores a detection result of the power supply, the communicator, or the memory.

6. The electronic control unit according to claim 5 ,

wherein, in response to detecting a failure among the at least three microcomputers, the second microcomputer generates and transmits a control signal that gives an instruction to start/stop the power supply, the communicator, or the memory connected to the first microcomputer.

7. The electronic control unit according to claim 5 , comprising:

a plurality of the memories,

wherein each of the memories stores the detection result of the corresponding microcomputer, and

a power supply of each of the memories is common to the microcomputer to be stored.

8. The electronic control unit according to claim 1 ,

wherein, in response to detecting a failure among the at least three microcomputers, the second microcomputer generates and transmits a control signal that gives an instruction to start/stop the first microcomputer.

9. The electronic control unit according to claim 8 ,

wherein the first microcomputer in which the failure has been detected restarts with a failure part of the first microcomputer excluded based on the detection result, the failure part corresponding to the failure detected in association with the first microcomputer.

10. The electronic control unit according to claim 1 , wherein the actuator is a first actuator associated with the third microcomputer, and wherein any of the second microcomputer or the third microcomputer generates, in the fallback operation mode, a stop signal for stopping operation of a second actuator associated with the second microcomputer, and transmits the stop signal to the second actuator.

11. A vehicle-mounted system, comprising:

a plurality of sensors;

a plurality of actuators; and

an electronic control unit,

wherein the electronic control unit includes:

at least three microcomputers capable of receiving sensing data from the plurality of sensors, the at least three microcomputers comprising a first microcomputer, a second microcomputer, and a third microcomputer,

at least three failure detectors configured to detect a failure of at least one or more sensors of the plurality of sensors or one and a failure of more microcomputers of the at least three microcomputers, the at least three failure detectors comprising a first failure detector associated with the first microcomputer, a second failure detector associated with the second microcomputer, and a third failure detector associated with the third microcomputer,

a mode selector configured to select a normal operation mode or a fallback operation mode in accordance with a detection result by the at least three failure detectors, the mode selector configured to select the fallback operation mode when Ii) the first failure detector detects the failure of the at least one or more sensors of the plurality of sensors, (ii) the second failure detector detects the failure of the first microcomputer, and (iii) the third failure detector detects the failure of the first microcomputer, and

a sensor selector configured to select a sensor of the plurality of sensors based on the failure detected by the at least three failure detectors or a surrounding situation of an own vehicle calculated from the sensing data, and

any of the second microcomputer or the third microcomputer generates, in the fallback operation mode, a drive signal for operating an actuator using the sensing data received from the sensor selected by the sensor selector, and transmits the drive signal to the actuator.

12. The vehicle-mounted system according to claim 11 ,

wherein, in the fallback operation mode, at least one of the second microcomputer or the third microcomputer receives the sensing data in an ordered time series in which the at least one of the second microcomputer or the third microcomputer receives the sensing data from (i) a first sensor of the plurality of sensors for a first time period and (ii) a second sensor of the plurality of sensors for a second time period, the second time period following the first time period.

13. The vehicle-mounted system according to claim 12 ,

wherein in a case of the fallback operation mode,

while the sensor selector selects, in the ordered time series, the sensor to be selected, and

any of the second microcomputer or the third microcomputer generates the drive signal and stops the own vehicle at a safe position.

14. The vehicle-mounted system according to claim 11 , comprising:

a memory that stores the detection result.

15. The vehicle-mounted system according to claim 11 , wherein the actuator is a first actuator associated with the third microcomputer, and wherein any of the second microcomputer or the third microcomputer generates, in the fallback operation mode, a stop signal for stopping operation of a second actuator associated with the second microcomputer, and transmits the stop signal to the second actuator.