Power supply control device

Abstract

The present disclosure relates to a power supply control device that includes multiple batteries and redundantly controls power supply. The redundant power supply ECU of the present invention detects a failure in the primary power supply from the first DC-DC converter. If a failure is detected during autonomous driving, the redundant power supply ECU controls the operation of predetermined secondary system components that generate inrush current via the secondary battery, regardless of any operational requests.

Description

Technical Field

[0001] The present disclosure relates to a power supply control device that includes a plurality of batteries and redundantly controls power supply. Background Art

[0002] Japanese Patent Publication No. 2019-146305 (Patent Document 1) proposes a power supply system comprising: a first battery connected to a first load; a second battery; a DCDC converter connecting the first battery to the second battery; and a connection switching unit including a first switch connecting the first battery to the second load, and a second switch connecting the second battery to the second load, the connection switching unit selectively switching between a first mode (manual driving mode) in which the first switch is closed and the second switch is opened, and a second mode (automatic driving mode) in which the first switch is opened and the second switch is closed.

[0003] In the technology described in Patent Document 1, when the main power supply fails in the second mode, the operation of the necessary load can be guaranteed by the secondary battery. However, since the backup voltage is determined by the flowing current value and time, there is still room for improvement in order to suppress the drop in the backup voltage. Summary of the Invention

[0004] The present disclosure has been made in consideration of the above circumstances, and provides a power supply control device capable of suppressing the voltage of a sub-battery from dropping below a predetermined guaranteed voltage and supplying power redundantly.

[0005] The power supply control device involved in the first form includes: a detection unit that detects a failure of the main power supply; and a control unit that controls the operation of a component supplied with power from a sub-battery in a manner that maintains a predetermined guaranteed voltage for a period longer than a predetermined required time when the above-mentioned failure is detected by the above-mentioned detection unit during automatic driving.

[0006] According to the first aspect, a main power supply failure is detected by the detection unit. Furthermore, when the detection unit detects a main power supply failure during autonomous driving, the control unit controls the operation of components supplied with power from the sub-battery so that a predetermined guaranteed voltage is maintained for a period exceeding a predetermined required time. This prevents the sub-battery voltage from dropping below the predetermined guaranteed voltage, allowing for redundant power supply.

[0007] Furthermore, in the second aspect, the control unit may be configured to control the operation of a predetermined component generating an inrush current via the sub-battery as operational control, regardless of an operation request. This allows the component generating the inrush current to be operated before the sub-battery voltage falls below the guaranteed voltage, thereby preventing the voltage from falling below the guaranteed voltage.

[0008] Furthermore, in the third aspect, the control unit may be configured to perform, as operational control, control to limit the power supply from the sub-battery to predetermined components that can be stopped mid-process. This can lengthen the time it takes for the voltage to fall below a predetermined guaranteed voltage, thereby preventing the voltage from falling below the guaranteed voltage within a predetermined time. In this case, in the fourth aspect, the control unit may be configured to limit the power supply after a predetermined time has elapsed or if the sub-battery voltage falls below a predetermined voltage.

[0009] Furthermore, in the fifth aspect, when the detection unit detects a failure of the main power supply during autonomous driving, the control unit controls the sub-battery to activate components generating inrush current, regardless of an operation request, and then controls the power supply from the sub-battery to predetermined components that can be stopped during operation. This allows the components generating inrush current to be activated before the sub-battery voltage falls below the guaranteed voltage, and the time required for the voltage to fall below the guaranteed voltage can be lengthened, thereby preventing the voltage from falling below the guaranteed voltage within a predetermined timeframe. In this case, in the sixth aspect, when the sub-battery voltage falls below the predetermined voltage after the sub-battery voltage has been activated, the control unit controls the power supply to be limited.

[0010] As described above, according to the present disclosure, it is possible to provide a power supply control device that can suppress the voltage of the sub-battery from dropping below a predetermined guaranteed voltage and can redundantly supply electric power. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 1 is a diagram showing a schematic configuration of a vehicle power supply system including the power supply control device according to the present embodiment (a state of power supply for autonomous driving).

[0012] Figure 2 This diagram shows a schematic configuration of a vehicle power supply system including the power supply control device according to the present embodiment (a state when a primary power supply failure occurs during autonomous driving).

[0013] Figure 3 This is a block diagram showing a specific example of a power supply configuration in the vehicle power supply system according to the present embodiment.

[0014] Figure 4 This is a block diagram showing a schematic configuration of CAN communication in the vehicle power supply system according to the present embodiment.

[0015] Figure 5This is a block diagram showing the hardware configuration of the driver assistance ECU, electric power steering ECU, brake ECU, and redundant power supply ECU.

[0016] Figure 6 This is a diagram for explaining voltage drop suppression control in the vehicle power supply system according to the first embodiment.

[0017] Figure 7 This is a flowchart showing an example of the flow of processing performed by the vehicle power supply system according to the first embodiment.

[0018] Figure 8 This is a diagram for explaining voltage drop suppression control in a vehicle power supply system according to the second embodiment.

[0019] Figure 9 This is a flowchart showing an example of the flow of processing performed by the vehicle power supply system according to the second embodiment.

[0020] Figure 10 This is a flowchart showing a modified example of the flow of processing performed by the vehicle power supply system according to the second embodiment.

[0021] Figure 11 This is a flowchart showing an example of the flow of processing performed by the vehicle power supply system according to the third embodiment.

[0022] Figure 12 This is a flowchart showing a modified example of the flow of processing performed by the vehicle power supply system according to the third embodiment. DETAILED DESCRIPTION

[0023] Hereinafter, an example of an embodiment of the present disclosure will be described in detail with reference to the drawings.

[0024] (First embodiment)

[0025] Figure 1 1 is a diagram showing a schematic configuration of a vehicle power supply system including the power supply control device according to the present embodiment (a state of power supply for autonomous driving). Figure 2 This figure shows the schematic configuration of a vehicle power supply system including the power supply control device according to this embodiment (in the case of a primary power supply failure during autonomous driving). Furthermore, as an example, the vehicle power supply system 10 according to this embodiment is described as being installed in a vehicle capable of switching between manual and autonomous driving.

[0026] The vehicle power supply system 10 according to the present embodiment includes a first DC-DC converter 12 , a main battery 14 , primary system components 16 , a redundant power supply control unit 18 , a sub-battery 20 , and secondary system components 22 .

[0027] The first DC-DC converter 12 converts DC power to voltages that can be supplied to the main battery 14, the primary system components 16, and the redundant power supply control unit 18, respectively, and supplies power thereto. In this embodiment, the first DC-DC converter 12 steps down DC power of a predetermined voltage to supply power to the main battery 14, the primary system components 16, and the redundant power supply control unit 18.

[0028] The main battery 14 is charged with the power supplied from the first DC-DC converter 12 , and can supply power to the primary system component 16 and the redundant power supply control unit 18 .

[0029] The primary system component 16 is a component mounted on the vehicle, and is driven by the DC power supplied from the first DC-DC converter 12 .

[0030] The redundant power supply control unit 18 includes a second DC-DC converter 24 , a redundant power supply ECU 26 , and switches 28 and 30 .

[0031] The second DC-DC converter 24 is driven by the first DC-DC converter 12 to convert the power into a voltage that can be supplied to the secondary system component 22 and the sub-battery 20 , and supplies power to each of them.

[0032] The redundant power supply ECU 26 controls the on / off switching of switches 28 and 30 to control the power supply for manual driving and automatic driving. Furthermore, during automatic driving, the redundant power supply ECU 26 monitors the primary power supply from the first DC-DC converter 12 for failures. If a primary power supply failure occurs, the redundant power supply ECU 26 controls the power supply to the secondary components 22. Furthermore, the redundant power supply ECU 26 functions as a detection unit.

[0033] In this embodiment, as the power supply control for automatic operation, Figure 1 As shown, the redundant power supply ECU 26 closes the switch 28 and opens the switch 30, thereby supplying power from the first DCDC converter 12 to the primary system component 16 and the secondary system component 22. On the other hand, in the case of a primary power failure during autonomous driving, Figure 2 As shown, the redundant power supply ECU 26 opens the switch 28 and closes the switch 30, thereby supplying power from the first DCDC converter 12 to the primary system component 16 and the second DCDC converter 24, and supplying power from the second DCDC converter 24 to the sub-battery 20 and the secondary system component 22. Figure 1 As shown, when the power from the first DC-DC converter 12 fails, power is supplied from the sub-battery 20 to the secondary system components 22 .

[0034] The secondary battery 20 is charged with power supplied from the second DC-DC converter 24 and supplies power to the secondary system components 22 required for fail-safe operation in the event of a power failure from the first DC-DC converter 12. Furthermore, the secondary battery 20 is a battery capable of guaranteeing a voltage equal to or higher than a predetermined guaranteed voltage.

[0035] The secondary system components 22 are components required for fail-safe operation of the vehicle, and are components driven to safely stop the vehicle when a power supply failure of the primary system occurs during automatic driving, for example.

[0036] Figure 3 1 is a block diagram showing a specific example of a power supply configuration in the vehicle power supply system 10 according to the present embodiment. Figure 3 The solid line indicates the primary power system supplied with electric power from the first DC-DC converter 12 , and the dotted line indicates the secondary power system supplied with electric power from the second DC-DC converter 24 or the sub-battery 20 .

[0037] As the respective components of the primary system component 16 and the secondary system component 22, Figure 3As shown, the vehicle is categorized into a control system 32, a surrounding monitoring system 34, a vehicle information detection system 36, an HMI (Human Machine Interface) system 42, a driving system 44, and other 46. Furthermore, each category includes primary system components 16 and secondary system components 22. During normal driving, the vehicle is driven by both the primary system components 16 and the secondary system components 22. In the event of a primary power failure, fail-safe driving is implemented using only the secondary system components 22. For example, the primary system components 16 and secondary system components of the control system 32 include a driving assistance ECU (Electronic Control Unit). Examples of the primary system components 16 of the surrounding monitoring system 34 include millimeter-wave radars and stereo cameras, while examples of the secondary system components 22 of the surrounding monitoring system 34 include lidars, telescopic cameras, positioning cameras, and map generation systems. Examples of the primary system components 16 of the vehicle information detection system 36 include yaw sensors, gyro sensors, and acceleration sensors. Examples of the secondary system components 22 of the vehicle information detection system 36 include map generation systems. Examples of the primary system components 16 and secondary system components 22 of the braking system 38 include actuators that drive the brakes. Specifically, they include motors that generate negative pressure for braking and solenoids that release the generated negative pressure to adjust the braking force. Examples of the primary system components 16 and secondary system components 22 of the steering system 40 include electric power steering actuators. Examples of the primary system components 16 and secondary system components 22 of the HMI system 42 include buzzers and signaling devices. Other primary system components 16 and secondary system components 22 may include components not described above.

[0038] Next, a configuration example of CAN (Controller Area Network) communication of the vehicle power supply system 10 according to the present embodiment will be described. Figure 4 This is a block diagram showing a schematic configuration of CAN communication in vehicle power supply system 10 according to the present embodiment.

[0039] The vehicle power supply system 10 according to this embodiment includes ECUs such as a driving assistance ECU 50, an electric power steering ECU 52, a brake ECU 54, and a redundant power supply ECU 26, connected via multiple CAN bus connections. Furthermore, other ECUs performing various other controls are also included, but their description is omitted here. While this embodiment illustrates an example of multiple CAN bus connections, this is not limiting and a single CAN bus connection is also possible.

[0040] The driving support ECU 50 performs switching control between manual driving and automatic driving, various controls during automatic driving, and the like.

[0041] The electric power steering ECU 52 controls the electric power steering by controlling the driving of a motor and the like.

[0042] The brake ECU 54 controls the motor that generates the negative pressure for braking and the solenoid that adjusts the braking force using the generated negative pressure. In addition, as a brake system, a safety valve plays the following role: when the negative pressure generated by the motor accumulates to a predetermined pressure or more, the negative pressure is released.

[0043] The driving assistance ECU 50 , the electric power steering ECU 52 , and the brake ECU 54 are each connected to the central gateway 48 via a first CAN 56 .

[0044] In addition, the redundant power supply ECU 26 is connected to the central gateway 48 via the second CAN 58 .

[0045] Furthermore, the driving support ECU 50 and the brake ECU 54 are connected to the third CAN 60 , and the driving support ECU 50 , the electric power steering ECU 52 , and the redundant power supply ECU 26 are connected to the fourth CAN 62 .

[0046] In this embodiment, in normal times when there is no failure in the primary power supply of the first DCDC converter 12, the redundant power supply ECU 26 is used as Figure 4 The path indicated by the dotted arrow transmits a braking instruction or the like to the brake ECU 54 . That is, the braking instruction or the like is transmitted to the brake ECU 54 via the second CAN 58 , the central gateway 48 , and the first CAN 56 .

[0047] On the other hand, when the primary power supply of the first DCDC converter 12 fails, the redundant power supply ECU 26 uses Figure 4 The path indicated by the dot-dash arrow transmits a braking instruction or the like to the brake ECU 54 . That is, the braking instruction or the like is transmitted to the brake ECU 54 via the fourth CAN 62 , the driving support ECU 50 , and the third CAN 60 .

[0048] Figure 5 1 is a block diagram showing the hardware configuration of the driving support ECU 50, the electric power steering ECU 52, the brake ECU 54, and the redundant power supply ECU 26. Since the ECUs have basically the same configuration, the redundant power supply ECU 26 will be described below as a representative example.

[0049] like Figure 6As shown, the redundant power supply ECU 26 is composed of a general microcomputer including a CPU (Central Processing Unit) 26A, a ROM (Read Only Memory) 26B, a RAM (Random Access Memory) 26C, a storage device 26D, an interface (I / F) 26E, and a bus 26F.

[0050] Redundant power supply ECU 26 executes power supply voltage drop suppression control described below by CPU 26A developing and executing programs stored in ROM 26B in RAM 26C. Other ECUs also execute various controls by having CPU develop and execute programs stored in ROM in RAM.

[0051] Here, the voltage drop suppression control in the vehicle power supply system 10 according to the present embodiment will be described.

[0052] The vehicle power supply system 10 according to the present embodiment has a fail-safe function in which power is supplied to the secondary component 22 from the secondary power supply when a failure occurs in the primary power supply by the first DCDC converter 12 .

[0053] In this embodiment, it is assumed that a component generating an inrush current exists in the secondary system component 22. As an example, the component generating an inrush current is a motor for generating a negative pressure for a brake, but other components may be used.

[0054] The fail-safe power supply is driven by the secondary battery 20 as the power supply of the secondary system. Therefore, if the power supply of the primary system fails, the voltage will gradually decrease over time. Figure 6 As shown in the upper diagram, if the motor is driven in a state where the voltage of the sub-battery 20 is reduced, there is a risk that an inrush current will be generated and the voltage will fall below a predetermined guaranteed voltage.

[0055] Therefore, in this embodiment, as a voltage drop suppression control, in the event of a primary system power failure, the redundant power supply ECU 26 controls the operating timing of the components that generate inrush current, regardless of the operation request, before the voltage of the secondary battery 20 drops. Specifically, regarding the control of the operating timing of the components that generate inrush current, in the event of a primary system power failure, the redundant power supply ECU 26 outputs an operation instruction to the brake ECU 54 for the secondary system components 22 that generate inrush current. As a result, Figure 6 As shown in the lower figure, the secondary system component 22 that generates the inrush current can be operated before the voltage of the sub-battery 20 drops, thereby preventing the voltage from falling below the guaranteed voltage.

[0056] Next, specific processing performed by vehicle power supply system 10 according to the present embodiment configured as described above will be described. Figure 7 1 is a flowchart showing an example of the process flow performed by the vehicle power supply system 10 according to the present embodiment. Figure 7 processing.

[0057] In step 100 , the redundant power supply ECU 26 switches the power supply to the automatic driving mode and moves to step 102 . Specifically, the redundant power supply ECU 26 opens the switch 28 of the redundant power supply control unit 18 and closes the switch 30 .

[0058] In step 102, the redundant power supply ECU 26 monitors a failure in the primary system power supply and proceeds to step 104. For example, the redundant power supply ECU 26 monitors the voltage input to the second DC-DC converter 24. Step 102 corresponds to an example of a detection unit.

[0059] In step 104, the redundant power supply ECU 26 determines whether a failure has occurred in the primary system power supply. This determination involves, for example, determining whether a voltage below a predetermined threshold value has persisted for a predetermined period of time or longer. If this determination is negative, the process proceeds to step 106; if it is positive, the process proceeds to step 110.

[0060] In step 106, the redundant power supply ECU 26 determines whether the mode has been switched to manual driving mode. This determination involves, for example, determining whether the redundant power supply ECU 26 has received an instruction to switch to manual driving mode from another ECU, such as the driving assistance ECU 50. If this determination is negative, the process returns to step 102 and repeats the above process. If the determination is positive, the process proceeds to step 108.

[0061] In step 108 , the redundant power supply ECU 26 switches the power supply to the manual driving mode and ends the series of processes. Specifically, the redundant power supply ECU 26 closes the switch 28 and the switch 30 of the redundant power supply control unit 18 .

[0062] On the other hand, in step 110, the redundant power supply ECU 26 sends a drive signal for the actuator generating the inrush current to the brake ECU 54. In this embodiment, when a power failure occurs in the primary system, as shown in FIG. Figure 4 As shown by the solid arrow, the drive signal cannot be sent from the redundant power supply ECU 26 to the brake ECU 54 via the central gateway. Figure 4As indicated by the dot-dash arrow, a driving signal is transmitted to the driving support ECU 50 via the fourth CAN 62 , and the driving support ECU 50 transmits a driving signal to the brake ECU 54 via the third CAN 60 .

[0063] In step 112, the brake ECU 54 instructs the motor generating the inrush current to drive and terminates the series of processing. This allows the secondary system components 22 generating the inrush current to operate without being affected by the operation request until the voltage of the sub-battery 20 falls below the guaranteed voltage, thereby preventing the voltage from falling below the guaranteed voltage. Step 112 corresponds to an example of a control unit.

[0064] (Second embodiment)

[0065] Next, a vehicle power supply system according to a second embodiment will be described. The vehicle power supply system according to this embodiment differs from the first embodiment only in voltage drop suppression control. Since the configuration is the same as the first embodiment, detailed description of the configuration will be omitted.

[0066] In this embodiment, as in the above embodiment, a fail-safe function of the power supply is also provided. The fail-safe power supply is driven by the secondary battery 20 as the power supply of the secondary system. Therefore, if the power supply of the primary system fails, the voltage will gradually decrease over time. Figure 8 As shown in the upper diagram, if the motor is driven in a state where the voltage of the sub-battery 20 is reduced, there is a risk that an inrush current will be generated and the voltage will fall below a predetermined guaranteed voltage.

[0067] Therefore, in this embodiment, the redundant power supply ECU 26 notifies the ECU connected to the load of the predetermined power limitation target of the primary system of the power failure. As a result, the ECU receiving the power failure notification limits the current flowing to the target secondary system component 22 or stops the operation, thereby Figure 8 As shown in the figure below, the voltage is suppressed to below the predetermined guaranteed voltage.

[0068] As an example of a load subject to power limitation, a secondary system component 22 related to user notification, such as a signaling device or a buzzer, may be applied. If sufficient time for the user to pay attention can be ensured even if notification is stopped during failsafe, notification is stopped.

[0069] As another example, after sufficient deceleration due to fail-safe operation, the cruising range becomes short and distant vehicle monitoring becomes unnecessary. Therefore, a telescopic camera or a light that illuminates distant areas for telescopic camera photography may be used.

[0070] As another example, the voltage drop may be suppressed by switching from high beam to low beam or the like.

[0071] Furthermore, as an example of an ECU to which a load that is a predetermined target for power limitation is connected, for example, the driving support ECU 50 is applied. In this case, the driving support ECU 50 corresponds to an example of a control unit.

[0072] Next, specific processing performed by vehicle power supply system 10 according to the present embodiment configured as described above will be described. Figure 9 : is a flowchart showing an example of the process flow performed by the vehicle power supply system 10 according to this embodiment. Figure 9 The treatment of Figure 7 The same processing is described with the same reference numerals. Figure 9 processing.

[0073] In step 100 , the redundant power supply ECU 26 switches the power supply to the automatic driving mode and moves to step 102 . Specifically, the redundant power supply ECU 26 opens the switch 28 of the redundant power supply control unit 18 and closes the switch 30 .

[0074] In step 102, the redundant power supply ECU 26 monitors a failure in the primary system power supply and proceeds to step 102. For example, the redundant power supply ECU 26 monitors the voltage input to the second DC-DC converter 24. Step 102 corresponds to an example of a detection unit.

[0075] In step 104, the redundant power supply ECU 26 determines whether a failure has occurred in the primary system power supply. This determination involves, for example, determining whether a voltage below a predetermined threshold value has persisted for a predetermined period of time or longer. If this determination is negative, the process proceeds to step 106; if it is positive, the process proceeds to step 114.

[0076] In step 106, the redundant power supply ECU 26 determines whether the mode has been switched to manual driving mode. This determination involves, for example, determining whether the redundant power supply ECU 26 has received an instruction to switch to manual driving mode from another ECU, such as the driving assistance ECU 50. If this determination is negative, the process returns to step 102 and repeats the above process. If the determination is positive, the process proceeds to step 108.

[0077] In step 108 , the redundant power supply ECU 26 switches the power supply to the manual driving mode and ends the series of processes. Specifically, the redundant power supply ECU 26 closes the switch 28 and the switch 30 of the redundant power supply control unit 18 .

[0078] On the other hand, in step 114 , the redundant power supply ECU 26 notifies the primary power supply failure determination result to the predetermined ECU to be subject to power limitation, and the process proceeds to step 116 .

[0079] In step 116, the ECU of the power restriction target determines whether a predetermined time has passed since the notification of the power failure determination result. The process waits until the determination result is positive, and then moves to step 118 if the determination result is positive. In addition, regarding steps 114 and 116, the redundant power supply ECU 26 may notify the predetermined power restriction target ECU of the power failure determination result after a predetermined time has passed since the detection of the power failure. Alternatively, steps 114 and 116 may be configured as follows: Figure 10 As in steps 115 and 117, the redundant power supply ECU 26 determines whether the voltage has become lower than a predetermined voltage greater than the guaranteed voltage. If it has become lower than the predetermined voltage, it notifies the ECU of the predetermined power limitation target of the primary power failure determination result.

[0080] In step 118, the ECU of the power restriction target implements power restriction to end a series of processing. That is, the ECU of the power restriction target limits the current to the predetermined target secondary system component 22 or stops the operation. Figure 8 As shown in the following figure, the time until the voltage drops below the guaranteed voltage can be lengthened, thereby preventing the voltage from falling below the guaranteed voltage within a predetermined time. In addition, step 118 corresponds to an example of a control unit.

[0081] (Third embodiment)

[0082] Next, a vehicle power supply system according to a third embodiment will be described. The vehicle power supply system according to this embodiment is a combination of the first and second embodiments, so only the processing flow will be described. Furthermore, while this embodiment describes an example in which the voltage drop suppression control of the first embodiment is performed before the voltage drop suppression control of the second embodiment, the voltage drop suppression control of the first embodiment may also be performed after the voltage drop suppression control of the second embodiment.

[0083] Figure 11 : is a flowchart showing an example of the process flow performed by the vehicle power supply system 10 according to this embodiment. Figure 11 The treatment of Figure 7 、 9 The same processing is described with the same reference numerals. Figure 11 processing.

[0084] In step 100 , the redundant power supply ECU 26 switches the power supply to the automatic driving mode and moves to step 102 . Specifically, the redundant power supply ECU 26 opens the switch 28 of the redundant power supply control unit 18 and closes the switch 30 .

[0085] In step 102, the redundant power supply ECU 26 monitors a failure in the primary system power supply and proceeds to step 102. For example, the redundant power supply ECU 26 monitors the voltage input to the second DC-DC converter 24. Step 102 corresponds to an example of a detection unit.

[0086] In step 104, the redundant power supply ECU 26 determines whether a failure has occurred in the primary system power supply. This determination involves, for example, determining whether a voltage below a predetermined threshold value has persisted for a predetermined period of time or longer. If this determination is negative, the process proceeds to step 106; if it is positive, the process proceeds to step 110.

[0087] In step 106, the redundant power supply ECU 26 determines whether the mode has been switched to manual driving mode. This determination involves, for example, determining whether the redundant power supply ECU 26 has received an instruction to switch to manual driving mode from another ECU, such as the driving assistance ECU 50. If this determination is negative, the process returns to step 102 and repeats the above process. If the determination is positive, the process proceeds to step 108.

[0088] In step 108 , the redundant power supply ECU 26 switches the power supply to the manual driving mode and ends the series of processes. Specifically, the redundant power supply ECU 26 closes the switch 28 and the switch 30 of the redundant power supply control unit 18 .

[0089] On the other hand, in step 110, the redundant power supply ECU 26 sends a drive signal for the actuator generating the inrush current to the brake ECU 54. In this embodiment, when a power failure occurs in the primary system, as shown in FIG. Figure 4 As shown by the solid arrow, the drive signal cannot be sent from the redundant power supply ECU 26 to the brake ECU 54 via the central gateway. Figure 4 As indicated by the dot-dash arrow, a driving signal is transmitted to the driving support ECU 50 via the fourth CAN 62 , and the driving support ECU 50 transmits a driving signal to the brake ECU 54 via the third CAN 60 .

[0090] In step 112, the brake ECU 54 instructs the motor generating the inrush current to drive and proceeds to step 114. This allows the secondary system component 22 generating the inrush current to operate without being affected by the operation request before the voltage of the sub-battery 20 drops, thereby preventing the voltage from falling below the guaranteed voltage.

[0091] In step 114 , redundant power supply ECU 26 notifies a predetermined ECU subject to power limitation of the primary power supply failure determination result and then proceeds to step 116 .

[0092] In step 116, the ECU of the power restriction target determines whether a predetermined time has passed since the notification of the power failure determination result. The process waits until the determination result is positive, and then moves to step 118 if the determination result is positive. In addition, regarding steps 114 and 116, the redundant power supply ECU 26 may notify the predetermined power restriction target ECU of the power failure determination result after a predetermined time has passed since the detection of the power failure. Alternatively, steps 114 and 116 may be configured as follows: Figure 12 As in steps 115 and 117, the redundant power supply ECU 26 determines whether the voltage has become lower than a predetermined voltage greater than the guaranteed voltage. If it has become lower than the predetermined voltage, it notifies the ECU of the predetermined power limitation target of the primary power failure determination result.

[0093] In step 118, the ECU targeted for power restriction implements power restriction and concludes the series of processes. Specifically, the ECU targeted for power restriction limits the current to the predetermined secondary system component 22 or ceases operation. This prolongs the time it takes for the voltage to fall below the predetermined guaranteed voltage, preventing the voltage from falling below the guaranteed voltage within the predetermined timeframe. Step 118 corresponds to an example of a control unit.

[0094] In addition, the vehicle power supply system 10 in each of the above-mentioned embodiments has delays such as fault judgment time and CAN communication from the time when the primary system power failure occurs to the time when the secondary system component 22 that generates the inrush current is driven, and to the time when power limitation is implemented. Therefore, a control design that takes delay into consideration is performed.

[0095] Furthermore, in the above-described embodiment, the vehicle power supply system 10 mounted on a vehicle is described as an example, but the present invention is not limited thereto and may be applied to power supply systems mounted on other devices.

[0096] In addition, the control performed by each ECU in the vehicle power supply system 10 in each of the above-mentioned embodiments has been described as software processing performed by executing a program, but is not limited to this. For example, processing may also be performed by hardware such as a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array). Alternatively, processing may be a combination of software and hardware. In the case of software processing, the program may be stored in various storage media for distribution.

[0097] Furthermore, the present disclosure is not limited to the above, and can of course be implemented with various modifications other than the above without departing from the spirit and scope of the present disclosure.

Claims

1. A power supply control device, wherein: The power control device comprises: a detection unit that detects a failure of the main power supply; and The control unit controls the operation of the component supplied with power from the sub-battery so as to maintain a predetermined guaranteed voltage for a period longer than a predetermined required time when the failure is detected by the detection unit during automatic driving.

2. The power supply control device according to claim 1, wherein: The control unit performs control to operate a predetermined component that generates an inrush current through the sub-battery as the operational control, regardless of an operation request.

3. The power supply control device according to claim 1 or 2, wherein: The control unit performs control to limit the supply of electric power from the sub-battery to a predetermined component that can be stopped midway as the operational control.

4. The power supply control device according to claim 3, wherein: The control unit performs control to limit the power supply after a predetermined time has elapsed or when the voltage of the sub-battery becomes a predetermined voltage or less.

5. The power supply control device according to claim 1, wherein: When the fault is detected by the detection unit during automatic driving, the control unit controls the components that generate inrush current to operate via the sub-battery regardless of an operation request, and then controls the power supply from the sub-battery to predetermined components that can be stopped midway.

6. The power supply control device according to claim 5, wherein: The control unit performs control to limit the power supply when the voltage of the sub-battery becomes lower than a predetermined voltage after the sub-battery is controlled to operate a component that generates an inrush current.

Images