Power supply control device and power supply control program

Abstract

To provide a power supply control device and a power supply control program which can check whether or not a load switch is disconnected as expected during fail-safe control.SOLUTION: A power supply control device according to an embodiment comprises load switches, a controller, and a reduction circuit. The load switches can supply and cutoff supplying electric power respectively to a plurality of loads from a first power supply and a second power supply. The controller supplies the electric power from the second power supply to the plurality of loads when the first power supply is failed, and disconnects the load switch that supplies the electric power to a low-priority one of the loads, along with voltage reduction of the second power supply. The reduction circuit reduces voltage of the second power supply as a time elapses. The controller has a diagnosing mode, and upon coming into the diagnosing mode, operates the reduction circuit and checks whether or not the load switch, which supplies electricity to the low-priority one of the loads, is disconnected as the reduction circuit reduces the voltage of the second power supply.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The disclosed embodiments relate to a power supply control device and a power supply control program. [Background technology]

[0002] A redundant power supply system performs fail-safe control by supplying power to multiple loads from a backup power supply in the event of a main power supply failure. However, the remaining charge of the backup power supply is limited.

[0003] For this reason, in a redundant power supply system, priorities are set for multiple loads, and as the remaining charge of the backup power supply decreases during fail-safe control, the load switch that supplies power to the load with the lower priority is shut off (see, for example, Patent Document 1). This allows the redundant power supply system to suppress the decrease in the remaining charge of the backup power supply. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2023-42332 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in this prior art, it is not possible to know whether the load switch will be turned off as expected during fail-safe control when a power failure actually occurs.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a power supply control device and a power supply control program that can check whether a load switch is turned off as expected during fail-safe control. [Means for solving the problem]

[0007] A power supply control device according to an embodiment includes a load switch, a controller, and a reduction circuit. The load switch is capable of supplying and cutting off power to each of a plurality of loads from a first power source and a second power source. The controller supplies power to the plurality of loads from the second power source when the first power source fails, and cuts off the load switch supplying power to a lower priority load as the voltage of the second power source drops. The reduction circuit reduces the voltage of the second power source over time. The controller has a diagnostic mode, and when in the diagnostic mode, activates the reduction circuit to check whether the load switch supplying power to a lower priority load will be cut off as the voltage of the second power source drops due to the reduction circuit. [Effects of the Invention]

[0008] In the diagnostic mode, the power supply control device and the power supply control program according to the embodiment reduce the voltage of the second power supply, and then check whether the load switch is turned off as expected after reproducing a state in which the remaining charge of the second power supply is reduced during fail-safe control. This allows the power supply control device and the power supply control program according to the embodiment to check whether the load switch is turned off as expected during fail-safe control. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram illustrating an example of the configuration of a power supply control device according to the first embodiment. [Figure 2] FIG. 2 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 3] FIG. 3 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 4] FIG. 4 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 5] FIG. 5 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 6]FIG. 6 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 7] FIG. 7 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 8] FIG. 8 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the control mode. [Figure 9] FIG. 9 is an explanatory diagram of the operation of the power supply control device according to the first embodiment in the diagnostic mode. [Figure 10] FIG. 10 is a flowchart showing an example of processing executed by the controller according to the first embodiment in the diagnostic mode. [Figure 11] FIG. 11 is a flowchart showing an example of processing executed by the controller according to the first embodiment in the control mode. [Figure 12] FIG. 12 is a flowchart showing an example of processing executed by the controller according to the first embodiment in the control mode. [Figure 13] FIG. 13 is a flowchart showing an example of processing executed by the controller according to the first embodiment in the control mode. [Figure 14] FIG. 14 is an explanatory diagram of the configuration of a power supply control device according to the second embodiment and its operation in the control mode. [Figure 15] FIG. 15 is an explanatory diagram of the configuration of a power supply control device according to the second embodiment and its operation in the control mode. [Figure 16] FIG. 16 is an explanatory diagram of the operation of the power supply control device according to the second embodiment in the diagnostic mode. [Figure 17] FIG. 17 is an explanatory diagram of the operation of the power supply control device according to the second embodiment in the diagnostic mode. [Figure 18] FIG. 18 is an explanatory diagram of the operation of the power supply control device according to the second embodiment in the diagnostic mode. [Figure 19] FIG. 19 is a flowchart showing an example of processing executed by the controller according to the second embodiment in the diagnostic mode. [Figure 20]FIG. 20 is a flowchart showing an example of processing executed by the controller according to the second embodiment in the diagnostic mode. [Figure 21] FIG. 21 is a flowchart showing an example of processing executed by the controller according to the second embodiment in the control mode. [Figure 22] FIG. 22 is a flowchart showing an example of processing executed by the controller according to the second embodiment in the control mode. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a power supply control device and a power supply control program will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below. The following description will be given using an example of a power supply control device that is installed in a vehicle with an autonomous driving function and supplies power to a load, but the power supply control device according to the embodiment may also be installed in a vehicle that does not have an autonomous driving function. Furthermore, the power supply control device according to the embodiment may also be installed in something other than a vehicle.

[0011] In addition, although the following description will be given of a case where the vehicle in which the power supply control device is installed is an electric vehicle or a hybrid vehicle, the vehicle in which the power supply control device is installed may also be an engine vehicle that runs on an internal combustion engine.

[0012] 1. First Embodiment 1-1. Power supply control device configuration 1 is an explanatory diagram showing an example of the configuration of a power supply control device 1 according to the first embodiment. The power supply control device 1 according to the first embodiment is connected to a first power source 10, a DC / DC converter 11 (hereinafter referred to as "DCDC11"), first to fourth loads 101 to 104, and an automatic driving control device 100.

[0013] The first power source 10 is, for example, a lead battery. However, the first power source 10 may be any secondary battery other than a lead battery. The first power source 10 is a main power source that mainly supplies power to the first to fourth loads 101 to 104, etc.

[0014] The DCDC 11 is connected to a high-voltage battery 12. The high-voltage battery 12 is a vehicle drive battery that supplies power to a motor that runs the vehicle. The high-voltage battery 12 is, for example, a lithium-ion battery. The DCDC 11 steps down the voltage of the high-voltage battery 12 to charge the first power source 10, charge the second power source 20 (described later), and supply power to the first to fourth loads 101 to 104.

[0015] When the DCDC 11 is mounted on an engine vehicle, it is connected to an alternator that converts regenerative energy of the vehicle into electric power to generate electricity, and transforms and outputs the input voltage input from the generator.

[0016] The first load 101 includes devices used when autonomous driving is performed and devices not involved in the execution of autonomous driving. Devices used when autonomous driving is performed include, for example, an electric steering system, an electric braking system, radar, an in-vehicle camera, exterior lamps (hazard lamps, headlights, brake lights, etc.), interior lamps (warning lights, etc.), etc. Devices not involved in the execution of autonomous driving include, for example, an air conditioner, power windows, an A / V (audio / video) system, an outlet inside the vehicle, an outlet outside the vehicle, etc.

[0017] The second to fourth loads 102 to 104 include devices related to the execution of autonomous driving. The second load 102 includes, for example, the device that is most important in autonomous driving, in other words, the device with the highest priority. For example, the second load 102 includes an electric steering device and an electric braking device.

[0018] The third load 103 includes a device having the next highest priority in autonomous driving after the second load 102. The third load 103 includes, for example, a radar and an on-board camera. The fourth load 104 includes a device having the next highest priority in autonomous driving after the third load 103. The fourth load 104 includes, for example, exterior lamps (hazard lamps, headlights, brake lights, etc.).

[0019] Therefore, in the following description, the second load 102 will be described as the load with the highest priority, the third load 103 as the load with the second highest priority, and the fourth load 104 as the load with the third highest priority. Note that there may also be loads with priorities lower than the fourth highest.

[0020] These second to fourth loads 102 to 104 are backup loads that execute fail-safe control of the automatic operation control in the event of a failure such as a ground fault in the first system 110, which will be described later. The priorities of the second to fourth loads 102 to 104 are stored in a storage area of ​​the power supply control device 1.

[0021] The automatic driving control device 100 is a control device that controls automatic driving of a vehicle by operating first to fourth loads 101 to 104. The automatic driving control device 100 can perform fail-safe control of the automatic driving control by operating the first load 101 or any of the second to fourth loads 102 to 104.

[0022] When a ground fault occurs in the first system 110 or the second system 120 described below, the automatic driving control device 100 executes fail-safe control of the automatic driving control using the system in which the ground fault does not occur. The fail-safe control of the automatic driving control is a control that automatically drives the vehicle to evacuate to a safe place. The automatic driving control device 100 operates by receiving power from the first power source 10 and the second power source 20.

[0023] The power supply control device 1 is supplied with power from an externally provided first power supply 10. The power supply control device 1 can supply the power supplied from the externally provided first power supply 10 to first to fourth loads 101-104.

[0024] The power supply control device 1 includes a first system 110 and a second system 120. The first system 110 is a system capable of supplying power from a first power source 10 to a first load 101. The second system 120 is a system capable of supplying power from a second power source 20 (described later) to second to fourth loads 102 to 104.

[0025] The first system 110 and the second system 120 are connected by an inter-system line 130. The inter-system line 130 is provided with an inter-system switch 45 that can connect and disconnect the first system 110 and the second system 120.

[0026] The power supply control device 1 includes a second power supply 20, a plurality of switches 41-46, first to fifth voltage sensors 51-55, a controller 3, and a voltage reduction circuit 6. The second power supply 20 is, for example, a lithium ion battery. The second power supply 20 is a backup power supply in case the first power supply 10 is unable to supply power. Note that the second power supply 20 may be any secondary battery other than a lithium ion battery.

[0027] The multiple switches 41 to 46 include a first load switch 41, a second load switch 42, a third load switch 43, a fourth load switch 44, the inter-system switch 45 described above, and a battery switch 46. The inter-system switch 45 is provided on the inter-system line 130. The inter-system switch 45 is a switch that can connect and disconnect the first system 110 and the second system 120.

[0028] The first load switch 41 is provided between the first load 101 and the inter-system line 130 and the first system 110, which are closer to the first system 110 than the inter-system switch 45. The first load switch 41 is a switch that can supply and cut off power to the first load 101.

[0029] The second load switch 42 is provided between the inter-system line 130, which is closer to the second system 120 than the inter-system switch 45, and the second load 102. The second load switch 42 is a switch that can supply and cut off power to the second load 102.

[0030] The third load switch 43 is provided between the inter-system line 130, which is closer to the second system 120 than the inter-system switch 45, and the third load 103. The third load switch 43 is a switch that can supply and cut off power to the third load 103.

[0031] The fourth load switch 44 is provided between the fourth load 104 and the inter-system line 130, which is closer to the second system 120 than the inter-system switch 45. The fourth load switch 44 is a switch that can supply and cut off power to the fourth load 104. The battery switch 46 is provided between the second power source 20 and the second system 120. The battery switch 46 is a switch that can connect and cut off the second power source 20 and the second system 120.

[0032] The first voltage sensor 51 is provided in the first system 110. The first voltage sensor 51 detects the voltage of the first system 110 and outputs the detection result to the controller 3. The second voltage sensor 52 is provided in the second system 120. The second voltage sensor 52 detects the voltage of the second system 120 and outputs the detection result to the controller 3.

[0033] The third voltage sensor 53 is provided between the second load switch 42 and the second load 102. The third voltage sensor 53 detects the voltage supplied to the second load 102 and outputs the detection result to the controller 3. The fourth voltage sensor 54 is provided between the third load switch 43 and the third load 103. The fourth voltage sensor 54 detects the voltage supplied to the third load 103 and outputs the detection result to the controller 3. The fifth voltage sensor 55 is provided between the fourth load switch 44 and the fourth load 104. The fifth voltage sensor 55 detects the voltage supplied to the fourth load 104 and outputs the detection result to the controller 3.

[0034] The reduction circuit 6 includes a series circuit of a discharge switch 61 and a discharge resistor 62, which is a discharge resistor, connected between the second system 120, which is a power supply path, and ground. Specifically, the reduction circuit 6 includes the discharge switch 61 connected to the second system 120, and the discharge resistor 62 connected between the discharge switch 61 and ground. Note that the discharge switch 61 may also be connected between the discharge resistor 62 and ground. The reduction circuit 6 is a circuit that reduces the voltage of the second power supply 20 over time. The reduction circuit 6 is a circuit that operates in a diagnostic mode, which will be described later. The operation of the reduction circuit 6 and the effects of the reduction circuit 6 will be described later with reference to FIG. 9.

[0035] The controller 3 includes a microcomputer having a CPU (Central Processing Unit), ROM (Read Only Memory), RAM (Random Access Memory), etc., and various other circuits. The controller 3 may also be configured with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0036] The controller 3 controls the operations of the first to fourth load switches 41 to 44, the inter-system switch 45, the battery switch 46, and the voltage drop circuit 6 by having the CPU execute a power control program stored in the ROM using the RAM as a work area. The power control program may be stored in a storage device from the outside via a communication line or the like.

[0037] The controller 3 operates by receiving power from the first power source 10 and the second power source 20. That is, the controller 3 can operate by receiving power from the first power source 10 or the second power source 20.

[0038] The controller 3 has a diagnostic mode and a control mode. The diagnostic mode is an operation mode in which the controller 3 checks whether the load switch operates normally when, for example, the vehicle's ignition switch (hereinafter referred to as "IG") is turned on. The control mode is an operation mode in which the controller 3 controls the power supply control device 1 when the check in the diagnostic mode shows that there is no problem with the load switch and the vehicle then starts running.

[0039] ≪1-2. Control mode operation≫ The operation of the power supply control device 1 in the control mode will be described with reference to Figures 2 to 8. Figures 2 to 8 are explanatory diagrams of the operation of the power supply control device 1 in the control mode according to the first embodiment.

[0040] In the following description, a failure of the first power source 10 is assumed to be a ground fault in the first system 110, more specifically, a ground fault at a connection point between the power supply control device 1 and the first load 101. A failure of the second power source 20 is assumed to be a ground fault in the second system 120, more specifically, a ground fault at a connection point between the power supply control device 1 and any of the second to fourth loads 102 to 104.

[0041] In the control mode, under normal circumstances when there is no failure in the first power source 10 and the second power source 20, the controller 3 turns on the first to fourth load switches 41 to 44 and the inter-system switch 45, and turns off the battery switch 46 and the discharge switch 61, as shown in Fig. 2. This causes power to be supplied from the first power source 10 to the first to fourth loads 101 to 104.

[0042] Thereafter, the controller 3 monitors whether a ground fault has occurred in the first system 110 or the second system 120. Specifically, when a ground fault occurs in the first system 110 or the second system 120, a large current flows toward the ground fault point, causing the voltage of the first system 110 (hereinafter referred to as "first system voltage V1") and the voltage of the second system 120 (hereinafter referred to as "second system voltage V2") to fall below the ground fault threshold.

[0043] Therefore, when the detection result (first system voltage V1 and second system voltage V2) input from the first voltage sensor 51 or the second voltage sensor 52 becomes below the ground fault threshold, the controller 3 provisionally determines that a ground fault has occurred in the first system 110 or the second system 120.

[0044] When the controller 3 provisionally determines that a ground fault has occurred, it pre-shuts off the inter-system switch 45 and turns on the battery switch 46, as shown in Fig. 3. This cuts off the connection between the first system 110 and the second system 120, and power is supplied to the first system 110 from the first power source 10, and to the second system 120 from the second power source 20. Thereafter, the controller 3 makes a final determination as to whether a ground fault has occurred in the first system 110 or the second system 120.

[0045] At this time, if a ground fault occurs in the second system 120, the second system voltage V2 remains below the ground fault threshold even when the inter-system switch 45 is turned off. On the other hand, the first system voltage V1 returns to a normal value higher than the ground fault threshold when the inter-system switch 45 is turned off.

[0046] Furthermore, if a ground fault occurs in the first system 110, the first system voltage V1 remains below the ground fault threshold even if the inter-system switch 45 is turned off. On the other hand, the second system voltage V2 returns to a normal value higher than the ground fault threshold when the inter-system switch 45 is turned off.

[0047] Therefore, when the second system voltage V2 remains equal to or lower than the ground fault threshold for a predetermined time after the inter-system switch 45 is turned off, the controller 3 officially determines that a ground fault has occurred in the second system 120. Furthermore, when the first system voltage V1 remains equal to or lower than the ground fault threshold for a predetermined time after the inter-system switch 45 is turned off, the controller 3 officially determines that a ground fault has occurred in the first system 110.

[0048] If the first system voltage V1 and the second system voltage V2 remain higher than the ground fault threshold for a predetermined time after the inter-system switch 45 is turned off, the controller 3 determines that this is a transient voltage drop due to an overload or the like and that no ground fault has occurred. In this case, the controller 3 turns the inter-system switch 45 back on and turns the battery switch 46 off again, returning the state of the power supply control device 1 to the normal state shown in FIG. 2.

[0049] As shown in Figure 4, for example, if the controller 3 determines that a ground fault 200 has occurred at the connection point between the power supply control device 1 and the second load 102 and that a ground fault 200 has occurred in the second system 120, the controller 3 shuts off the battery switch 46.

[0050] Furthermore, the controller 3 turns off the second to fourth load switches 42 to 44. Then, the controller 3 notifies the automatic driving control device 100 that a ground fault 200 has occurred in the second system 120 and that the second to fourth loads 102 to 104 cannot be used.

[0051] As a result, the automatic driving control device 100 operates the first load 101 using power supplied from the first power source 10 to the first load 101, and performs fail-safe control to cause the vehicle to evacuate and stop in a safe place.

[0052] Furthermore, when the controller 3 determines that the ground fault 200 has occurred in the second system 120, it is also possible to identify the location of the ground fault 200. For example, when the ground fault 200 occurs at the connection point between the power supply control device 1 and the second load 102 (see FIG. 4), the controller 3 shuts off any one of the second to fourth load switches 42 to 44 one by one from the pre-shutdown state shown in FIG.

[0053] In other words, the controller 3 sequentially performs control to shut off only the second load switch 42 from the pre-shutdown state shown in Figure 3, control to shut off only the third load switch 43 from the pre-shutdown state, and control to shut off only the fourth load switch 44 from the pre-shutdown state.

[0054] In this case, when the load switch is turned off and the second system voltage V2 returns to a normal value, the controller 3 can identify the connection point between the load connected to the load switch and the power supply control device 1 as the location where the ground fault 200 has occurred.

[0055] 5, for example, when the controller 3 identifies the connection point between the second load 102 and the power supply control device 1 as the location of the ground fault 200, it turns off the battery switch 46, turns on the inter-system switch 45, and turns off the second load switch 42. This allows the automatic driving control device 100 to operate the first load 101, the third load 103, and the fourth load 104 with power supplied from the first power source 10, thereby performing fail-safe control.

[0056] Furthermore, as shown in Fig. 6, when the controller 3 determines that a ground fault 200 has occurred in the first system 110, it shuts off the first load switch 41 from the pre-shutoff state shown in Fig. 3. Then, the controller 3 notifies the automatic driving control device 100 that a ground fault 200 has occurred in the first system 110 and that the first load 101 cannot be used.

[0057] As a result, the automatic driving control device 100 operates the second to fourth loads 102 to 104 using the power supplied from the second power source 20 to the second to fourth loads 102 to 104, and performs fail-safe control to cause the vehicle to evacuate and stop in a safe place.

[0058] If a ground fault 200 occurs between the power supply control device 1 and the first load 101 in the first system 110, the controller 3 determines that a ground fault has occurred in the first system 110, but if the first load switch 41 is turned off, the first system 110 is separated from the location of the ground fault. As a result, the first system voltage V1 detected by the first voltage sensor 51 returns to a normal state. In this case, the controller 3 may supply power from the first power source 10 to the second to fourth loads 102 to 104 by re-connecting the inter-system switch 45 with the first load switch 41 turned off and turning off the battery switch 46 again.

[0059] On the other hand, if a ground fault in the first system 110 occurs between the first power source 10 and the power supply control device 1, the first system voltage V1 will be equal to or lower than the ground fault threshold even if the controller 3 cuts off the first load switch 41 while keeping the inter-system switch 45 cut off. Therefore, in this case, the controller 3 cuts off the inter-system switch 45 and the first load switch 41, and turns on the battery switch 46, causing the second power source 20 to supply power to the second to fourth loads 102 to 104.

[0060] However, the remaining charge of the second power source 20 is limited. For this reason, it is desirable to conserve the remaining battery power of the second power source 20 during evacuation travel. For this reason, when the first power source 10 fails, the controller 3 causes the second power source 20 to supply power to multiple loads, and as the voltage of the second power source 20 drops, the controller 3 shuts off the load switch that supplies power to a low-priority load.

[0061] For example, as shown in FIG. 6, when the voltage of the second power supply 20 is equal to or higher than a first threshold value (hereinafter referred to as "TH1"), the controller 3 does not turn off the second to fourth load switches 42 to 44, and supplies power from the second power supply 20 to the second to fourth loads 102 to 104.

[0062] 7, when the voltage of the second power supply 20 falls below TH1, the controller 3 shuts off the fourth load switch 44 that supplies power to the fourth load 104, which has the third lowest priority. This allows the controller 3 to conserve the power that would otherwise be consumed by the fourth load 104.

[0063] 8, when the voltage of the second power supply 20 falls below a second threshold (hereinafter referred to as "TH2") that is lower than TH1, the controller 3 further shuts off the third load switch 43 that supplies power to the third load 103, which has the second lowest priority after the fourth load 104. This allows the controller 3 to conserve the power consumed by the third load 103 and the fourth load 104.

[0064] In this way, in the power supply control device 1, it is necessary to be able to shut off the third load switch 43 and the fourth load switch 44 as expected and reliably during fail-safe control in the event of a failure of the first power supply 10, in order to preserve the remaining charge of the second power supply 20.

[0065] Therefore, before the IG is turned on and the vehicle starts to run, the controller 3 goes into a diagnostic mode, activates the reduction circuit 6, and checks whether the load switch that supplies power to a low-priority load is cut off as the voltage of the second power supply 20 is reduced by the reduction circuit 6.

[0066] <1-3. Diagnostic mode operation> The operation of the power supply control device 1 in the diagnostic mode will be described with reference to Fig. 9. Fig. 9 is an explanatory diagram of the operation of the power supply control device 1 in the diagnostic mode according to the first embodiment.

[0067] 9, when IG is turned on, the controller 3 turns off the first load switch 41 and the inter-system switch 45. Then, the controller 3 turns on the second to fourth load switches 42 to 44, the battery switch 46, and the discharge switch 61 of the reducing circuit 6, thereby activating the reducing circuit 6.

[0068] The reduction circuit 6 is a discharge circuit that is provided in a power supply path from the second power supply 20 to the loads, and discharges the second power supply 20. Therefore, the second to fourth loads 102 to 104 are not operating and do not consume power, but power is discharged from the second power supply 20 to ground via the discharge resistor 62 of the reduction circuit 6, so that the power of the second power supply 20 is consumed and the voltage of the second power supply 20 gradually decreases.

[0069] In this way, the reduction circuit 6 operates to reproduce a fail-safe control situation in which, when the IG is turned on, the first power source 10 fails, power is supplied to the load from the second power source 20, and the voltage of the second power source 20 gradually decreases over time.

[0070] The reduction circuit 6 may be configured to include a constant current circuit instead of the discharge resistor 62. In this case, when the reduction circuit 6 is activated, it can discharge a constant current from the second power supply 20 to ground via the constant current circuit.

[0071] As a result, the reduction circuit 6 can reproduce a fail-safe control situation in which, when the IG is turned on, the first power supply 10 fails, power is supplied to the load from the second power supply 20, and the voltage of the second power supply 20 gradually decreases over time, just as in the case where the discharge resistor 62 is provided.

[0072] When the voltage of the second power supply 20 is equal to or higher than TH1, the controller 3 maintains the conduction state without turning off the second to fourth load switches 42 to 44, as shown in Fig. 9. Then, when the voltage of the second power supply 20 becomes lower than TH1, the controller 3 turns off the fourth load switch 44.

[0073] At this time, if no voltage is detected by the fifth voltage sensor 55, the controller 3 determines that the fourth load switch 44 has been normally shut off. On the other hand, if a voltage is detected by the fifth voltage sensor 55, the controller 3 determines that an abnormality has occurred because the fourth load switch 44 is stuck on, the fifth voltage sensor 55 is broken, or there is a control abnormality in the controller 3.

[0074] If the controller 3 determines that an abnormality has occurred, it notifies the automatic driving control device 100 of the prohibition of automatic driving. This allows the controller 3 to prevent the start of automatic driving despite the fourth load switch 44 being stuck on, the fifth voltage sensor 55 failing, or a control abnormality in the controller 3.

[0075] If the controller 3 determines that the fourth load switch 44 has been normally turned off, and then when the voltage of the second power supply 20 becomes less than TH2, the controller 3 turns off the third load switch 43 while keeping the fourth load switch 44 turned off.

[0076] At this time, if no voltage is detected by the fourth voltage sensor 54, the controller 3 determines that the third load switch 43 has been normally shut off. On the other hand, if a voltage is detected by the fourth voltage sensor 54, the controller 3 determines that an abnormality has occurred because the third load switch 43 is stuck on, the fourth voltage sensor 54 is broken, or there is a control abnormality in the controller 3.

[0077] If the controller 3 determines that an abnormality has occurred, it notifies the automatic driving control device 100 of the prohibition of automatic driving. This allows the controller 3 to prevent the start of automatic driving despite the third load switch 44 being stuck on, the fourth voltage sensor 54 failing, or a control abnormality in the controller 3.

[0078] In this way, the controller 3 can check whether the load switch is turned off as expected during fail-safe control.

[0079] In addition, when the voltage of the second power supply 20 falls below TH1 due to the operation of the reduction circuit 6, the controller 3 performs control to cut off the load switch that supplies power to a low priority load, and checks whether the load switch is cut off.

[0080] This allows the controller 3 to check the load switch that has a lower priority than other loads and is more likely to be shut off during fail-safe control than other load switches, giving priority to checking the other load switches.

[0081] The above-mentioned TH1 and TH2 may each have a range of values. In this case, when the voltage of the second power supply 20 drops to a value within the threshold range due to the operation of the reduction circuit 6, the controller 3 controls to cut off the load switch that supplies power to the low-priority load, and checks whether the load switch is cut off.

[0082] As a result, even if there is variation in the detection accuracy of the second system voltage V2 by the second voltage sensor 52, the controller 3 can check with a certain level of accuracy or higher whether the load switch is turned off as expected.

[0083] <1-4. Diagnostic Processing> Next, a process executed by the controller 3 in the diagnostic mode will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of a process executed by the controller 3 in the diagnostic mode according to the first embodiment. When the IG is turned on, the controller 3 enters the diagnostic mode and starts the diagnostic process shown in Fig. 10.

[0084] When the controller 3 starts the process, it turns off the first load switch 41 and the inter-system switch 45, and turns on the second to fourth load switches 42 to 44, the battery switch 46, and the discharge switch 61 (step S101). This allows the controller 3 to supply power from the second power supply 20 to the second to fourth loads 102 to 104, while discharging the power from the second power supply 20 to the ground via the voltage reducing circuit 6.

[0085] Next, the controller 3 determines whether or not the voltage of the second power supply 20 is less than TH1 based on the detection result of the voltage input from the second voltage sensor 52 (step S102). If the controller 3 determines that the voltage of the second power supply 20 is equal to or greater than TH1, that is, is not less than TH1 (step S102, No), the controller 3 repeats the determination of step S102 until the voltage of the second power supply 20 becomes less than TH1.

[0086] When the controller 3 determines that the voltage of the second power supply 20 is lower than TH1 (Yes in step S102), it turns off the fourth load switch 44 (step S103). Next, the controller 3 determines whether or not the fourth load switch 44 has been turned off based on the voltage detected by the fifth voltage sensor 55 (step S104).

[0087] If no voltage is detected by the fifth voltage sensor 55, the controller 3 determines that the fourth load switch 44 has been successfully turned off. If a voltage is detected by the fifth voltage sensor 55, the controller 3 determines that the fourth load switch 44 has not been successfully turned off.

[0088] When it is determined that the fourth load switch 44 has not been turned off (step S104, No), the controller 3 notifies the automatic driving control device 100 of the prohibition of automatic driving (step S108), and ends the diagnosis process.

[0089] Furthermore, if the controller 3 determines that the fourth load switch 44 has been turned off (step S104, Yes), it determines whether the voltage of the second power source 20 is less than TH2 based on the voltage detection result input from the second voltage sensor 52 (step S105).

[0090] If the controller 3 determines that the voltage of the second power supply 20 is equal to or higher than TH2, that is, not less than TH2 (No in step S105), the controller 3 repeats the determination in step S105 until the voltage of the second power supply 20 becomes less than TH2.

[0091] When the controller 3 determines that the voltage of the second power supply 20 is lower than TH2 (Yes in step S105), the controller 3 turns off the third load switch 43 (step S106). Next, the controller 3 determines whether or not the third load switch 43 has been turned off based on the voltage detected by the fourth voltage sensor 54 (step S107).

[0092] If no voltage is detected by the fourth voltage sensor 54, the controller 3 determines that the third load switch 43 has been successfully turned off. If a voltage is detected by the fourth voltage sensor 54, the controller 3 determines that the third load switch 43 has not been successfully turned off.

[0093] When it is determined that the third load switch 43 has not been turned off (step S107, No), the controller 3 notifies the automatic driving control device 100 of the prohibition of automatic driving (step S108), and ends the diagnosis process.

[0094] Furthermore, if the controller 3 determines that the third load switch 43 has been turned off (Yes in step S107), the controller 3 ends the diagnostic process. After the diagnostic process ends, the controller 3 enters the control mode.

[0095] 1-5. Control Processing Next, the process executed by the controller 3 in the control mode will be described with reference to Fig. 11 to Fig. 13. Fig. 11 to Fig. 13 are flowcharts showing an example of the process executed by the controller 3 in the control mode according to the first embodiment.

[0096] When the controller 3 enters the control mode, it starts the control process shown in Fig. 11. When the controller 3 starts the control process, it turns on the first to fourth load switches 41 to 44 and the inter-system switch 45, and turns off the battery switch 46 and the discharge switch 61 (step S201).

[0097] Next, the controller 3 determines whether or not a ground fault 200 has occurred in the first system 110 or the second system 120 based on the detection result of the first voltage sensor 51 or the second voltage sensor 52 (step S202).

[0098] The controller 3 determines that a ground fault 200 has occurred when the voltage of the first system 110 or the second system 120 detected by the first voltage sensor 51 or the second voltage sensor 52 becomes equal to or lower than the ground fault threshold value.

[0099] The controller 3 determines that a ground fault 200 has not occurred when the voltage of the first system 110 or the second system 120 detected by the first voltage sensor 51 or the second voltage sensor 52 is greater than the ground fault threshold value.

[0100] If the controller 3 determines that the ground fault 200 has not occurred (step S202, No), it repeats the determination process of step S202 until the IG is turned off. If the controller 3 determines that the ground fault 200 has occurred (step S202, Yes), it turns off the inter-system switch 45 and turns on the battery switch 46 (step S203).

[0101] Next, the controller 3 determines whether or not a ground fault 200 has occurred in the second system 120 (step S204). The controller 3 determines that a ground fault 200 has occurred in the second system 120 if the second system voltage V2 does not become higher than the ground fault threshold value even after a predetermined time has elapsed since the inter-system switch 45 was turned off and the battery switch 46 was turned on.

[0102] Furthermore, if the second system voltage V2 remains higher than the ground fault threshold for a predetermined time after the inter-system switch 45 is turned off and the battery switch 46 is turned on, the controller 3 determines that the ground fault 200 in the second system 120 has not occurred.

[0103] If the controller 3 determines that the ground fault 200 is in the second system 120 (step S204, Yes), it executes fail-safe control by the first power source 10 (step S205) and ends the control process. An example of the fail-safe control by the first power source 10 will be described later with reference to FIG.

[0104] Furthermore, when the controller 3 determines that the ground fault 200 is not in the second system 120 (step S204, No), it determines whether the ground fault 200 is in the first system 110 (step S206). If the first system voltage V1 does not become higher than the ground fault threshold value even after a predetermined time has elapsed since the inter-system switch 45 was turned off and the battery switch 46 was turned on, the controller 3 determines that the ground fault 200 is in the first system 110.

[0105] Furthermore, if the first system voltage V1 remains higher than the ground fault threshold for a predetermined time after the inter-system switch 45 is turned off and the battery switch 46 is turned on, the controller 3 determines that the ground fault 200 in the first system 110 has not occurred.

[0106] When the controller 3 determines that the ground fault 200 has occurred in the first system 110 (step S206, Yes), it executes fail-safe control by the second power source 20 (step S207) and ends the control process. An example of the fail-safe control by the second power source 20 will be described later with reference to FIG.

[0107] Furthermore, if the controller 3 determines that there is no ground fault 200 in the first system 110 (step S206, No), it turns on the inter-system switch 45, turns off the battery switch 46 (step S208), and moves the process to step S202. In other words, if the controller 3 determines that there is no ground fault 200 in the first system 110 or the second system 120, it returns the state of the power supply control device 1 to the normal state shown in FIG.

[0108] Next, an example of fail-safe control by the first power source 10 will be described with reference to Fig. 12. As shown in Fig. 12, when the controller 3 starts fail-safe control by the first power source 10, it turns off the battery switch 46 (step S301) and executes a ground fault location identification process (step S302).

[0109] When the ground fault location identification process is started, as described above, the controller 3 cuts off one by one of the second to fourth load switches 42 to 44 from the pre-shutdown state (see FIG. 3). Specifically, the controller 3 sequentially performs control to cut off only the second load switch 42 from the pre-shutdown state, control to cut off only the third load switch 43 from the pre-shutdown state, and control to cut off only the fourth load switch 44 from the pre-shutdown state.

[0110] Then, when the load switch is turned off and the second system voltage V2 returns to a normal value, the connection point between the load connected to the load switch and the power supply control device 1 is identified as the location (ground fault location) of the ground fault 200. Next, the controller 3 turns off the load switch at the identified ground fault location (step S303), and determines whether or not the evacuation traveling has been completed (step S304).

[0111] For example, the controller 3 determines that the evacuation traveling is completed when it receives a notification of the completion of the evacuation traveling from the automatic driving control device 100. Furthermore, the controller 3 determines that the evacuation traveling is not completed when it does not receive a notification of the completion of the evacuation traveling from the automatic driving control device 100.

[0112] If the controller 3 determines that the evacuation traveling has not been completed (step S304, No), it repeats the determination process of step S304 until the evacuation traveling is completed. On the other hand, if the controller 3 determines that the evacuation traveling has been completed (step S304, Yes), it ends the fail-safe control by the first power source 10.

[0113] Next, an example of fail-safe control by the second power supply 20 will be described with reference to Fig. 13. As shown in Fig. 13, when the fail-safe control by the second power supply 20 is started, the controller 3 determines whether or not the evacuation traveling has been completed (step S401).

[0114] For example, the controller 3 determines that the evacuation traveling is completed when it receives a notification of the completion of the evacuation traveling from the automatic driving control device 100. Furthermore, the controller 3 determines that the evacuation traveling is not completed when it does not receive a notification of the completion of the evacuation traveling from the automatic driving control device 100.

[0115] When the controller 3 determines that the evacuation traveling has not been completed (step S401, No), the controller 3 determines whether or not the voltage of the second power source 20 is less than TH1 (step S402) based on the detection result of the second voltage sensor 52. When the controller 3 determines that the voltage of the second power source 20 is equal to or greater than TH1, that is, the voltage of the second power source 20 is not less than TH1 (step S402, No), the controller 3 shifts the processing to step S401.

[0116] Furthermore, if the controller 3 determines that the voltage of the second power supply 20 is less than TH1 (step S402, Yes), it turns off the fourth load switch 44 (step S403). Next, the controller 3 determines whether the voltage of the second power supply 20 is less than TH2 based on the detection result of the second voltage sensor 52 (step S404). If the controller 3 determines that the voltage of the second power supply 20 is equal to or greater than TH2, that is, is not less than TH2 (step S404, No), it returns the process to step S401.

[0117] Furthermore, when the controller 3 determines that the voltage of the second power supply 20 is lower than TH2 (step S404, Yes), it turns off the third load switch 43 (step S405) and moves the process to step S401. Furthermore, when the controller 3 determines that the evacuation traveling is completed (step S401, Yes), it ends the fail-safe control by the second power supply 20.

[0118] 2. Second Embodiment 2-1. Configuration of power supply control device according to second embodiment and operation in control mode Next, the configuration and control mode operation of a power supply control device 1A according to a second embodiment will be described with reference to Figures 14 and 15. Figures 14 and 15 are explanatory diagrams of the configuration and control mode operation of a power supply control device 1A according to the second embodiment.

[0119] As shown in FIG. 14, the power supply control device 1A according to the second embodiment has a different configuration of the reduction circuit 6A from the reduction circuit 6 according to the first embodiment, but the other configurations are the same as those of the power supply control device 1 according to the first embodiment.

[0120] For this reason, in the following, among the components of the power supply control device 1A of the second embodiment, those components that are identical to the configuration of the power supply control device 1 of the first embodiment will be assigned the same symbols as those assigned to the power supply control device 1 of the first embodiment, and duplicate explanations will be omitted.

[0121] The voltage reduction circuit 6A includes a capacitor 63, a discharge switch 64, and a discharge resistor 65. The capacitor 63 is connected between the second system 120, which is a power supply path that supplies power from the second power supply 20 to the load, and ground. The discharge switch 64 and the discharge resistor 65 form a series circuit and are connected in parallel to the capacitor 63. Specifically, the discharge switch 64 is connected to a connection line that connects the capacitor 63 and the second system 120. The discharge resistor 65 is connected between the discharge switch 64 and ground. Note that the discharge switch 64 may also be connected between the discharge resistor 65 and ground.

[0122] In the control mode, during normal operation when there is no ground fault 200 in the first system 110 or the second system 120, the controller 3 turns on the first to fourth load switches 41 to 44 and the inter-system switch 45, and turns off the battery switch 46 and the discharge switch 64, as shown in Fig. 14. This causes power to be supplied from the first power source 10 to the first to fourth load switches 41 to 44, and the capacitor 63 of the voltage drop circuit 6A is charged by the power of the first power source 10.

[0123] Thereafter, when the controller 3 detects a ground fault 200 in the first system 110 or the second system 120, it pre-shuts off the inter-system switch 45 as shown in Fig. 15. Then, similar to the first embodiment, the controller 3 determines whether the ground fault 200 is in the first system 110 or the second system 120, based on the first system voltage V1 and the second system voltage V2.

[0124] At this time, if the first system voltage V1 supplied from the first power source 10 to the first load 101 remains higher than the ground fault threshold for a predetermined time, the controller 3 officially determines that there is no ground fault 200 in the first system 110. Furthermore, if the first system voltage V1 supplied from the first power source 10 to the first load 101 does not become higher than the ground fault threshold even after the predetermined time has elapsed, the controller 3 officially determines that there is a ground fault 200 in the first system 110.

[0125] Furthermore, if the second system voltage V2 supplied from the capacitor 63 of the voltage reduction circuit 6A to the second system 120 remains higher than the ground fault threshold for a predetermined time, the controller 3 makes a final determination that there is no ground fault 200 in the second system 120. Furthermore, if the second system voltage V2 supplied from the capacitor 63 of the voltage reduction circuit 6A to the second system 120 does not become higher than the ground fault threshold even after the predetermined time has elapsed, the controller 3 makes a final determination that there is a ground fault 200 in the second system 120.

[0126] If the controller 3 determines that there is a ground fault 200 in the first system 110, it performs fail-safe control by turning on the battery switch 46 and turning off the discharge switch 64, thereby supplying power from the second power source 20 to the second to fourth loads 102 to 104, as in the first embodiment.

[0127] In this way, the controller 3 according to the second embodiment can make a final determination as to whether or not a ground fault 200 has occurred in the second system 120 by using the power stored in the capacitor 63 of the voltage reduction circuit 6A, without using the power of the second power source 20. This allows the power supply control device 1A to reduce power consumption of the second power source 20.

[0128] ≪2-2. Operation in diagnostic mode≫ Next, the operation of the power supply control device 1A according to the second embodiment in a diagnostic mode will be described with reference to Figures 16 to 18. Figures 16 to 18 are explanatory diagrams of the operation of the power supply control device 1A according to the second embodiment in a diagnostic mode. In the diagnostic mode, the power supply control device 1A uses the power charged in the capacitor 63 of the voltage drop circuit 6A, rather than the power of the second power supply 20, when checking the operation of the third and fourth load switches 43 to 44.

[0129] 16, when IG is turned on, the controller 3 turns off the first to fourth load switches 41 to 44, the inter-system switch 45, and the discharge switch 64 of the voltage reducing circuit 6A, and turns on the battery switch 46. This charges the capacitor 63.

[0130] The power supply control device 1A can also use the power of the first power supply 10 to charge the capacitor 63. In this case, as shown in Fig. 17, when the IG is turned on, the controller 3 turns off the first to fourth load switches 41 to 44, the battery switch 46, and the discharge switch 64, and turns on the inter-system switch 45. This charges the capacitor 63.

[0131] Then, the controller 3 checks the operation of the third to fourth load switches 43 to 44 using the power charged in the capacitor 63. Specifically, as shown in Fig. 18, when checking the operation of the third to fourth load switches 43 to 44, the controller 3 changes from the state shown in Fig. 16 and Fig. 17 to a state where the second to fourth load switches 42 to 44 and the discharge switch 64 are conductive and the battery switch 46 is cut off.

[0132] As a result, power is supplied from capacitor 63 to second to fourth loads 102 to 104. At this time, second to fourth loads 102 to 104 are not operating and therefore do not consume power, but because discharge switch 64 is conductive, capacitor 63 discharges to ground via discharge resistor 65. As a result, the voltage of capacitor 63 gradually decreases from above TH1, to below TH1, to below TH2.

[0133] The controller 3 maintains the second to fourth load switches 42 to 44 in a conductive state while the voltage supplied from the capacitor 63 to the second system 120 is equal to or greater than TH1. Thereafter, when the voltage supplied from the capacitor 63 to the second system 120 becomes less than TH1, the controller 3 performs control to turn off the fourth load switch 44 and determines whether the fourth load switch 44 has been normally turned off.

[0134] Furthermore, when the voltage supplied from the capacitor 63 to the second system 120 becomes lower than TH2, the controller 3 performs control to turn off the third load switch 43, and determines whether the third load switch 43 has been turned off normally.

[0135] In this way, the power supply control device 1A according to the second embodiment uses the power charged in the capacitor 63 of the reduction circuit 6A when checking the operation of the third and fourth load switches 43-44 in the diagnostic mode, thereby reducing the power consumption of the second power supply 20.

[0136] 2-3. Diagnostic Processing Next, an example of processing executed by the controller 3 according to the second embodiment in the diagnostic mode will be described with reference to Fig. 19 and Fig. 20. Fig. 19 and Fig. 20 are flowcharts showing an example of processing executed by the controller 3 according to the second embodiment in the diagnostic mode. When the controller 3 performs the operations shown in Fig. 16 and Fig. 18, the controller 3 starts the diagnostic processing shown in Fig. 19 when the IG is turned on.

[0137] When the controller 3 starts the diagnostic process, it turns off the first to fourth load switches 41 to 44, the inter-system switch 45, and the discharge switch 64, and turns on the battery switch 46 (step S501). As a result, the power supply control device 1A enters the state shown in FIG. 16, and the capacitor 63 is charged.

[0138] Next, the controller 3 turns on the second to fourth switches 42 to 44, turns off the battery switch 46, and turns on the discharge switch 64 (step S502). This puts the power supply control device 1A in the state shown in Fig. 18. Thereafter, the controller 3 executes the processes of steps S102 to S108 shown in Fig. 10 to check the operation of the third and fourth load switches 43 to 44, and then ends the diagnostic process.

[0139] 17 and 18, when IG is turned on, the controller 3 starts the diagnostic process shown in Fig. 20. When the diagnostic process starts, the controller 3 turns off the first to fourth load switches 41 to 44, the battery switch 46, and the discharge switch 64, and turns on the inter-system switch 45 (step S601). This puts the power supply control device 1A into the state shown in Fig. 17, and the capacitor 63 is charged.

[0140] Next, the controller 3 turns off the inter-system switch 45 and turns on the second to fourth switches 42 to 44 and the discharge switch 64 (step S602). This puts the power supply control device 1A in the state shown in Fig. 18. Thereafter, the controller 3 executes the processes of steps S102 to S108 shown in Fig. 10 to check the operation of the third and fourth load switches 43 to 44, and then ends the diagnostic process.

[0141] 2-4. Control Processing Next, an example of processing executed by the controller 3 according to the second embodiment in the control mode will be described with reference to Fig. 21 and Fig. 22. Fig. 21 and Fig. 22 are flowcharts showing an example of processing executed by the controller 3 according to the second embodiment in the control mode.

[0142] As shown in FIG. 21, in the process executed by the controller 3 according to the second embodiment in the control mode, the processes of steps S203A and S207A are different from those of steps S203 and S207 shown in FIG.

[0143] Specifically, when the controller 3 according to the second embodiment detects a ground fault 200 in the first system 110 or the second system 120 in step S202 (Yes in step S202), the controller 3 uses the power of the capacitor 63, rather than the second power source 20, for the main determination of the ground fault system. Therefore, in step S203A, the controller 3 pre-shuts off the inter-system switch 45 without turning on the battery switch 46.

[0144] However, if the controller 3 determines that the ground fault 200 is in the first system 110 in the main determination of the ground fault 200 (step S206, Yes), there is a risk that the charging power of the capacitor 63 will be insufficient, so fail-safe control using the power of the second power source 20 is desirable.

[0145] Therefore, in step S207A, the controller 3 executes fail-safe control using the second power supply 20, which is different from that in the first embodiment. Specifically, as shown in Fig. 22, when the controller 3 starts the fail-safe control in step S207A, it turns on the battery switch 46 (step S400).

[0146] This enables the controller 3 to perform fail-safe control using the second power supply 20. Thereafter, the controller 3 executes the processes of steps S401 to S405 shown in FIG.

[0147] 3. Modifications In the above embodiment, the operation check of the third and fourth load switches 43-44 is performed every time the IG is turned on, but this is just one example, and the operation check may be performed every predetermined period, for example, once every two or three trips. Also, the controller 3 may be configured to change the frequency of the operation check depending on the priority of the load switches.

[0148] In this case, the controller 3 performs an operation check on the fourth load switch 44, which has the third lowest priority, in other words, the fourth load switch 44 which is most frequently cut off during fail-safe control, every time the IG is turned on (for each trip).

[0149] The controller 3 then periodically checks the operation of the third load switch 43, which has a higher priority than the fourth load switch 44 and is less frequently shut off during fail-safe control, for example, once every two or three trips. This allows the power supply control device 1, 1A to periodically check the operation and quickly transition to the control mode after turning on the IG.

[0150] In addition, in the above embodiment, the controller 3 controls the load switch to be turned off in the diagnostic mode, and when voltage is no longer supplied to the load, it is determined that the load switch has been turned off normally, but this is just one example.

[0151] When a current sensor is provided between each load switch and each load, the controller 3 may be configured to control the load switch to be turned off in the diagnostic mode, and determine that the load switch has been turned off normally when current is no longer supplied to the load.

[0152] Furthermore, when each load communicates with an arbitrary control device via a Controller Area Network (CAN), the controller 3 may check the operation of the load switch based on the CAN communication status of the load. In this case, the controller 3 may be configured to control the load switch to be turned off in a diagnostic mode, and determine that the load switch has been turned off normally when the CAN communication of the load is interrupted.

[0153] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0154] 1.1A Power Supply Control Device 3 Controller 6,6A drop circuit 10 1st power supply 11 DCDC 12 High-voltage battery 20 2nd power supply 41~44 1st to 4th load switches 45 Intersystem switch 46 Battery switch 51-55 1st to 5th voltage sensors 61,64 Discharge switch 62,65 Discharge resistor 63 Capacitor 100 Automatic driving control device 101~104 1st~4th load 110 1st system 120 2nd system 130 Intersystem Line 200 Earth fault V1 1st system voltage V2 Second system voltage

Claims

1. a load switch capable of supplying and cutting off power from the first power source and the second power source to each of a plurality of loads; a controller that supplies power from the second power source to the plurality of loads when the first power source fails, and that cuts off the load switch that supplies power to a load with a lower priority when a voltage drop occurs in the second power source; a reduction circuit that reduces the voltage of the second power supply over time; Equipped with The controller has a diagnostic mode, and when the diagnostic mode is entered, the controller activates the reduction circuit and checks whether the load switch supplying power to a low priority load is cut off in response to a voltage drop of the second power supply caused by the reduction circuit. Power control device.

2. The reduction circuit is a discharge circuit that is provided in a power supply path from the second power source to the load and that discharges the second power source. The power supply control device according to claim 1 .

3. The reduction circuit a series circuit of a discharge switch and a resistor connected between the power supply path and ground; Contains The power supply control device according to claim 2 .

4. The reduction circuit a series circuit of a discharge switch and a constant current circuit connected between the power supply path and ground; Contains The power supply control device according to claim 2 .

5. The reduction circuit a capacitor connected between the power supply path and ground; a series circuit of a discharge switch and a resistor connected in parallel with the capacitor; Contains The power supply control device according to claim 2 .

6. an inter-system switch capable of connecting and disconnecting a first system that supplies power from the first power source to the plurality of loads and a second system that supplies power from the second power source to the plurality of loads; The controller charging the capacitor by the first power source or the second power source in a normal state when there is no failure in the first system or the second system; When a failure of the first system or the second system is detected, the inter-system switch is shut off, power is supplied from the capacitor to the second system, and whether or not there is a failure of the second system is determined based on the voltage of the second system. The power supply control device according to claim 5 .

7. It is installed in vehicles capable of autonomous driving, The controller In the diagnostic mode, if the load switch that supplies power to a low-priority load is not turned off due to a voltage drop of the second power supply caused by the drop circuit, automatic driving is prohibited. The power supply control device according to claim 1 .

8. The controller When the voltage of the second power supply becomes lower than a threshold due to the operation of the reduction circuit, the load switch that supplies power to a low priority load is controlled to be turned off, and it is checked whether the load switch is turned off. The power supply control device according to claim 1 .

9. The controller When the voltage of the second power supply drops to a value within a threshold range due to the operation of the drop circuit, the load switch that supplies power to a low priority load is controlled to be cut off, and it is checked whether the load switch is cut off. The power supply control device according to claim 1 .

10. a load switch capable of supplying and cutting off power from the first power source and the second power source to each of a plurality of loads; a controller that supplies power from the second power source to the plurality of loads when the first power source fails, and that cuts off the load switch that supplies power to a load with a lower priority when a voltage drop occurs in the second power source; a reduction circuit that reduces the voltage of the second power supply over time; The controller having a diagnostic mode of the power supply control device When the diagnostic mode is entered, the step of activating the reduction circuit and checking whether the load switch supplying power to a low priority load is cut off in response to a voltage drop of the second power supply caused by the reduction circuit is executed. Power control program.

Images