Motor control device and motor control system

Abstract

The invention provides a motor control device and a motor control system which can realize low cost on the basis of redundancy. The motor control device includes a first motor drive unit, a second motor drive unit, a first control unit, a second control unit, and a third control unit. A first control unit acquires a detection value of a first rotation sensor that detects a rotational position of a brake motor, and monitors a phase current of a second motor drive unit. The second control unit acquires a detection value of a second rotation sensor that detects the rotational position of the brake motor, and monitors the phase current of the first motor drive unit. The third control unit acquires a detection value of a third rotation sensor that detects the rotational position of the brake motor, and monitors the phase current of the first motor drive unit and the phase current of the second motor drive unit.

Description

Technical Field

[0001] The present disclosure relates to a motor control device and a motor control system. Background Art

[0002] Patent Document 1 discloses that in order to maintain the function of electric power steering (Power Steering) in accordance with requirements such as autonomous driving and functional safety of a vehicle, a motor drive control system is provided in two for redundancy.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2016-171664 Summary of the invention

[0006] Problems to be solved by the invention

[0007] In redundant motor drive control as in Patent Document 1, in order to reliably detect abnormality in each own system, each system needs to have a built-in function capable of self-diagnosing the abnormality detection function, which may increase costs.

[0008] One object of the present invention is to provide a motor control device and a motor control system that can achieve cost reduction after redundant operation.

[0009] Means for solving problems

[0010] The present invention is preferably a motor control device, comprising: a first motor drive unit, which drives a motor; a second motor drive unit, which drives the motor; a first control unit, which is a first control unit connected to the first motor drive unit, obtains a detection value of a first rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the second motor drive unit; a second control unit, which is a second control unit connected to the second motor drive unit, obtains a detection value of a second rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the first motor drive unit; and a third control unit, which obtains a detection value of a third rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the first motor drive unit and the phase current of the second motor drive unit.

[0011] In addition, the present invention is preferably a motor control system, comprising: a motor; a motor controller, which controls the motor, and the motor controller comprises: a first motor drive unit, which drives the motor; a second motor drive unit, which drives the motor; a first control unit, which is a first control unit connected to the first motor drive unit, obtains a detection value of a first rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the second motor drive unit; a second control unit, which is a second control unit connected to the second motor drive unit, obtains a detection value of a second rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the first motor drive unit; and a third control unit, which obtains a detection value of a third rotation position detection unit that detects the rotation position of the motor, and monitors the phase current of the first motor drive unit and the phase current of the second motor drive unit; and a vehicle controller, which is connected to the first control unit, the second control unit, and the third control unit.

[0012] According to one embodiment of the present invention, it is possible to achieve cost reduction by providing redundancy. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a block diagram showing a motor control device and a motor control system according to an embodiment.

[0014] Figure 2 It is a block diagram showing a first control unit (M_ECU_1), a third control unit (S_ECU), a second control unit (M_ECU_2), a first logic circuit (LC), a first motor drive unit, and the like.

[0015] Figure 3 It is a block diagram showing the second control unit (M_ECU_2), the third control unit (S_ECU), the first control unit (M_ECU_1), the second logic circuit (LC), the second motor drive unit, and the like.

[0016] Figure 4 This is a characteristic line diagram showing an example of a time change (waveform) of a phase current (U phase, V phase, W phase) by the first motor driving unit or the second motor driving unit.

[0017] Figure 5 It is a flowchart showing the processing (current monitoring processing) performed in the first control unit (M_ECU_1), the second control unit (M_ECU_2), and the third control unit (S_ECU).

[0018] Figure 6This is an explanatory diagram (truth table) showing the relationship between the outputs (L, H) of the first control unit (ECU1), the second control unit (ECU2), and the third control unit (SensECU) and the states (L: OFF, H: ON) of the first fail-safe relay (ECU1_FS relay) and the second fail-safe relay (ECU2_FS relay). DETAILED DESCRIPTION

[0019] Hereinafter, a case where the motor control device and the motor control system according to the embodiment are mounted on a four-wheel vehicle will be described as an example with reference to the accompanying drawings. Figure 5 Each step in the flowchart shown is denoted by a symbol “S” (eg, step 1 = “ S1 ”).

[0020] exist Figure 1 In the embodiment, the motor control system 1 mounted on the vehicle (car) includes a brake motor 2 as a motor, a motor control device 7 as a motor controller, and a host control device 33 as a vehicle controller (vehicle controller). In the embodiment, the host control device 33 corresponds to an integrated controller that determines the motion control of the vehicle. Hereinafter, the host control device 33 is referred to as the integrated control device 33.

[0021] The brake motor 2 controls (drives) an electric brake mechanism (not shown) that applies a braking force to the vehicle. The electric brake mechanism corresponds to, for example, an electric disc brake having an electric caliper that presses a brake pad against a disc rotor through the brake motor 2 as an electric motor. The brake motor 2 includes a stator 3 as a stator and a rotor 4 that is a permanent magnet rotor rotatably arranged in the center of the stator 3. The rotor 4 of the brake motor 2 is connected to a rotating shaft of a rotation-to-linear motion conversion mechanism not shown, for example. The rotation of the brake motor 2 (rotor 4) is converted into a linear motion by the rotation-to-linear motion conversion mechanism, so that the brake pad of the electric brake mechanism approaches and separates from the disc rotor.

[0022] In order to ensure redundancy, the brake motor 2 has two winding groups 5 and 6. That is, the brake motor 2 is configured as a three-phase synchronous motor, which has a first winding group 5 composed of three-phase windings U1, V1, and W1 connected in star shape, and a second winding group 6 composed of three-phase windings U2, V2, and W2 connected in star shape. In other words, the brake motor 2 is configured as a six-phase motor as a three-phase double winding (a six-phase motor that generates torque with two systems of three-phase coils for one rotor 4). The first winding group 5 and the second winding group 6 are provided on the stator 3 in a mutually insulated state.

[0023] In addition, the electric brake mechanism (electric brake) is not limited to the electric disc brake. For example, an electric drum brake with an electric cylinder can be used, and the electric cylinder applies braking force by pressing the brake shoe against the brake drum through an electric motor. In addition, the electric brake mechanism (electric brake) can also use a hydraulic disc brake with an electric motor (a hydraulic disc brake with an electric parking brake function) or a cable puller type electric parking brake that operates (applies) the parking brake by pulling the cable with an electric motor. That is, as long as the electric brake (electric brake mechanism) is a structure that can press (push) the friction member (brake pad, brake shoe) against the rotating member (rotor, brake drum) based on the drive of the electric motor (electric actuator), and apply and release the braking force (maintain and release the pressing force), various electric brakes (electric brake mechanisms) can be used.

[0024] The motor control device 7 as a motor controller controls the brake motor 2 as a motor. More specifically, the motor control device 7 drives and controls the windings U1, V1, W1 of the first winding group 5 and the windings U2, V2, W2 of the second winding group 6 of the brake motor 2. To this end, the motor control device 7 includes a first drive control system (a first motor drive unit 8, a first control unit 9) for drive and control of the first winding group 5 (U1, V1, W1), and a second drive control system (a second motor drive unit 10, a second control unit 11) for drive and control of the second winding group 6 (U2, V2, W2).

[0025] That is, the motor control device 7 includes: a first motor drive unit 8; a first control unit 9; a second motor drive unit 10; and a second control unit 11. In addition, the motor control device 7 includes a third control unit 41 described later. In addition, the first drive control system of the motor control device 7 is also referred to as, for example, a "primary channel", "first control unit 9 side", or "ECU1 side". In addition, the second drive control system of the motor control device 7 is also referred to as, for example, a "secondary channel", "second control unit 11 side", or "ECU2 side".

[0026] The first motor drive unit 8 drives the brake motor 2. The first motor drive unit 8 includes, for example, a first inverter circuit 8A as a first bridge circuit unit and a first fault protection relay 8B as a first relay unit. The first motor drive unit 8 is connected to a first power source 29 of the vehicle such as a power storage device (battery) via a first DC power line 17. In this case, the first power source 29 (first DC power line 17) is connected to the first inverter circuit 8A via the first fault protection relay 8B of the first motor drive unit 8. In addition, the first fault protection relay 8B will be described later. In addition, the first motor drive unit 8 (first inverter circuit 8A) is connected to each winding U1, V1, and W1 of the first winding group 5 of the brake motor 2 via the U1 phase power line 18, the V1 phase power line 19, and the W1 phase power line 20. Furthermore, the first motor drive unit 8 (first inverter circuit 8A) is connected to the first control unit 9 via the first signal line 25.

[0027] The first inverter circuit 8A is composed of a plurality of switching elements such as transistors, field effect transistors (FETs), insulated gate bipolar transistors (IGBTs), etc. For example, the first inverter circuit 8A corresponds to an inverter (three-phase bridge inverter) composed of six FETs. The on / off of each switching element of the first inverter circuit 8A is controlled based on a command signal (such as a pulse signal) from the first control unit 9. When the brake motor 2 is driven, the first inverter circuit 8A generates three-phase (U-phase, V-phase, W-phase) AC power from DC power based on the command signal from the first control unit 9, and supplies the AC power to the first winding group 5 (each winding U1, V1, W1) of the brake motor 2.

[0028] The first control unit 9 is connected to the first motor drive unit 8. The first control unit 9 is also called an ECU (Electronic Control Unit), and is composed of a microcomputer that serves as an arithmetic circuit (CPU). The first control unit 9 corresponds to the first motor ECU (M_ECU_1). The first control unit 9 includes, for example, a power circuit (Power Management IC), a microcomputer (Micro Controller), a driver circuit (Pre Driver), and a regulator (Reg). The first control unit 9 is connected to the first power supply 29 of the vehicle via the first DC power line 17, and is connected to the first motor drive unit 8 via the first signal line 25. The first control unit 9 drives (forward rotation, reverse rotation) the brake motor 2 by controlling (switch control, more specifically, PWM control) the first motor drive unit 8 (first inverter circuit 8A).

[0029] The first control unit 9 is connected to a first rotation sensor 15 for feedback control of the rotation of the rotor 4 of the brake motor 2. The first rotation sensor 15 as a first rotation position detection unit detects the rotation position (for example, the rotation angle) of the rotor 4 of the brake motor 2. In addition, a vehicle data bus 31 serving as a communication line is connected to the first control unit 9. The vehicle data bus 31 constitutes, for example, a CAN (Controller Area Network) as a communication network mounted on the vehicle body. A large number of electronic devices mounted on the vehicle, such as the motor control device 7, the integrated control device 33 described later, the suspension control device (not shown), the steering control device (not shown), and other various ECUs perform multiple communications within the vehicle with each other through the vehicle data bus 31. As a communication standard, various communication standards such as CAN (Classic CAN) and CAN FD (CAN with Flexible Data Rate) can be adopted.

[0030] The second motor drive unit 10 also drives the brake motor 2 in the same manner as the first motor drive unit 8. The second motor drive unit 10 includes, for example, a second inverter circuit 10A as a second bridge circuit unit and a second fail-safe relay 10B as a second relay unit. The second motor drive unit 10 is connected to a second power source 30 of the vehicle such as a power storage device (battery) via a second DC power line 21. In this case, the second power source 30 (second DC power line 21) is connected to the second inverter circuit 10A via the second fail-safe relay 10B of the second motor drive unit 10. The second fail-safe relay 10B will also be described later. In addition, the second motor drive unit 10 (second inverter circuit 10A) is connected to each winding U2, V2, and W2 of the second winding group 6 of the brake motor 2 via the U2 phase power line 22, the V2 phase power line 23, and the W2 phase power line 24. The second power source 30 is a power source different from the first power source 29 connected to the first motor drive unit 8 and the first control unit 9 (a power source of a different system). In this way, by providing a dual system for the supply path of power supply, redundancy is ensured. Furthermore, the second motor drive unit 10 (second inverter circuit 10A) is connected to the second control unit 11 via the second signal line 27 .

[0031] The second inverter circuit 10A is also composed of a plurality of switching elements such as transistors, field effect transistors (FETs), insulated gate bipolar transistors (IGBTs), etc. For example, the second inverter circuit 10A corresponds to an inverter (three-phase bridge inverter) composed of six FETs. The on / off of each switching element of the second inverter circuit 10A is controlled based on a command signal (e.g., a pulse signal) from the second control unit 11. When the brake motor 2 is driven, the second inverter circuit 10A generates three-phase (U-phase, V-phase, W-phase) AC power from DC power based on the command signal from the second control unit 11, and supplies the AC power to the second winding group 6 (each winding U2, V2, W2) of the brake motor 2.

[0032] The second control unit 11 is connected to the second motor drive unit 10. The second control unit 11 is also called an ECU (Electronic Control Unit), and is composed of a microcomputer that serves as an arithmetic circuit (CPU). The second control unit 11 corresponds to the second motor ECU (M_ECU_2). The second control unit 11 includes, for example, a power circuit (Power Management IC), a microcomputer (Micro Controller), a driver circuit (Pre Driver), and a regulator (Reg). The second control unit 11 is connected to the second power supply 30 of the vehicle via a second DC power line 21, and is connected to the second motor drive unit 10 via a second signal line 27. The second control unit 11 drives (forward rotation, reverse rotation) the brake motor 2 by controlling (switch control, more specifically, PWM control) the second motor drive unit 10 (second inverter circuit 10A).

[0033] The second control unit 11 is connected to a second rotation sensor 16 for performing feedback control on the rotation of the rotor 4 of the brake motor 2. The second rotation sensor 16 as a second rotation position detection unit detects the rotation position (for example, rotation angle) of the rotor 4 of the brake motor 2. The second rotation sensor 16 is also a rotation sensor different from the first rotation sensor 15 connected to the first control unit 9. Thus, redundancy is ensured. In addition, the vehicle data bus 31 is connected to the second control unit 11 in the same manner as the first control unit 9. In addition, the second control unit 11 is connected to the first control unit 9 via a communication line 34 (CPU-to-CPU communication line).

[0034] Although not shown in the figure, the regulator (Reg) of the first control unit 9 is connected to the first rotation sensor 15, the first logic circuit 43 described later, and the first phase current monitoring circuit 35 described later. Thus, power is supplied to the first rotation sensor 15, the first logic circuit 43, and the first phase current monitoring circuit 35 via the regulator (Reg) of the first control unit 9. Furthermore, the regulator (Reg) of the second control unit 11 is connected to the second rotation sensor 16, the second logic circuit 44 described later, and the second phase current monitoring circuit 36 ​​described later. Thus, power is supplied to the second rotation sensor 16, the second logic circuit 44, and the second phase current monitoring circuit 36 ​​via the regulator (Reg) of the second control unit 11.

[0035] The integrated control device 33 is connected to the first control unit 9 and the second control unit 11. That is, the integrated control device 33 is connected to the first control unit 9 and the second control unit 11, for example, via the vehicle data bus 31. In this case, the integrated control device 33 is connected to the first control unit 9 and the second control unit 11 through different systems, respectively. That is, "between the integrated control device 33 and the first control unit 9" and "between the integrated control device 33 and the second control unit 11" are connected through different communication lines 31A and 31B, respectively. As described later, the integrated control device 33 is also connected to the third control unit 41. In this case, the integrated control device 33 is connected to the third control unit 41 via the communication line 31A of the first system connecting the integrated control device 33 and the first control unit 9, and is connected to the third control unit 41 via the communication line 31B of the second system connecting the integrated control device 33 and the second control unit 11. Thus, the first control unit 9, the second control unit 11, the third control unit 41 and the integrated control device 33 form a ring network.

[0036] The integrated control device 33 is, for example, an integrated control device (integrated ECU) that determines vehicle motion control for moving the vehicle relative to a target trajectory obtained from an automatic driving control device (automatic driving ECU). The integrated control device 33 outputs required control instructions (for example, control instructions related to automatic driving) to each actuator control device (actuator ECU), such as a motor drive device (motor drive ECU), a brake control device (brake ECU), a steering control device (steering ECU), a suspension control device (suspension ECU), etc.

[0037] Here, the motor control device 7 can, for example, serve as both a motor drive device (motor drive ECU) that drives the brake motor 2 and a brake control device (brake ECU) that performs comprehensive control related to braking. That is, the motor control device 7 (brake motor control ECU) can be integrally configured as a control device having both a motor drive function and a brake control function. However, the present invention is not limited thereto, and for example, the motor drive device (motor drive ECU) and the brake control device (brake ECU) can be configured separately (in separate bodies).

[0038] On the other hand, the integrated control device 33 is also called a central control device (central ECU), and corresponds to the upper control device of the motor control device 7. The integrated control device 33 is also composed of a microcomputer that becomes a computing circuit (CPU). In this case, the integrated control device 33 is composed of, for example, a dual core (dual circuit) so that the same processing can be performed in parallel and the processing results can be monitored to see if there are any differences. That is, the integrated control device 33 is composed of two control units 33A and 33B (a first central ECU (C_ECU_1) and a second central ECU (C_ECU_2)). The two control units 33A and 33B are connected via communication lines 33C and 33D (communication lines between CPUs). For example, when applying braking force to the vehicle, the integrated control device 33 outputs a command of the target motor torque (or braking force, piston thrust, motor control current value) to the motor control device 7.

[0039] However, the motor drive control unit described in the above-mentioned Patent Document 1 uses a 6-phase motor having 6 sets of windings as a motor that generates steering assist torque in order to ensure redundancy. In the case of such a structure, for example, it is considered to configure two completely independent ASILD chipsets (power management IC / microcomputer / pre-driver for monitoring microcomputer) and control the 3-phase part of the 6-phase motor by different ASILD chipsets.

[0040] In this case, each system can detect its own abnormality, and when an abnormality is detected, the system itself is made to fail open, and the remaining 50% of the residual torque is generated in the other system. However, in order to reliably detect abnormalities in each system through the structure of two systems of a fully redundant system, it is necessary to prepare two expensive chipsets with built-in BIST (built-in self-test circuit) that can self-diagnose the abnormality detection function. This may increase costs.

[0041] Therefore, in the embodiment, the ECU1 (first control unit 9) which is the main channel (first motor drive unit 8 and first control unit 9) of the single system for ensuring the redundant function, and the ECU2 (second control unit 11) which is the auxiliary channel (second motor drive unit 10 and second control unit 11) of the remaining single system adopt an inexpensive chipset that can achieve the main function (motor control function) even if the safety function is not complete. And, the ECU1 (first control unit 9) and ECU2 (second control unit 11) of the inexpensive chipset check that the other party's main function (function of correctly flowing current to the brake motor 2) is functioning correctly.

[0042] That is, ECU1 (first control unit 9) and ECU2 (second control unit 11) monitor the motor phase current (UVW phase motor current) which is the final output based on the function of the other ECU (electronic component), and in the case of abnormality, that is, when the current does not flow correctly in the motor (brake motor 2), the other function is turned off, that is, the other relay (first fail-safe relay 8B or second fail-safe relay 10B) is turned off.

[0043] However, there is a risk that a faulty microcomputer (microcomputer) cannot correctly detect the failure of the other party's function. Therefore, if the faulty microcomputer mistakenly turns off the other party's relay, combined with the failure of its own current control function, there is a concern that the remaining output capacity of the motor will become 0%. In order to prevent such a situation, in the embodiment, a third control unit and a third detection unit (third rotation position detection unit) are added. That is, in the embodiment, not only ECU1 (first control unit 9) and ECU2 (second control unit 11) are provided, but also a sensor ECU (S_ECU) as ECU3 (third control unit 41) is provided. ECU3 (SensECU) has functional blocks for monitoring "the rotation position of the motor (rotor angle)", "the phase current based on the main channel (ECU1)", and "the phase current based on the auxiliary channel (ECU2)".

[0044] ECU3, as a third party, determines the abnormality of the main channel (ECU1) and the secondary channel (ECU2). And, when the judgment based on ECU3 that "the main channel is abnormal" is consistent with the judgment based on the secondary channel (ECU2), the relay of the main channel is cut off. In addition, when the judgment based on ECU3 that "the secondary channel is abnormal" is consistent with the judgment based on the main channel (ECU1), the relay of the secondary channel is cut off. That is, in the embodiment, a majority voting judgment function is added to cut off the relay by the AND condition (AND operation, logical multiplication) of the judgment result of ECU3 and the judgment result of the main channel (ECU1) or the secondary channel (ECU2).

[0045] Thus, even if an inexpensive microcomputer is used in ECU1 (first control unit 9) and ECU2 (second control unit 11), it is possible to prevent all current output functions to the motor (brake motor 2) from failing when the inexpensive microcomputer is abnormal. That is, in the embodiment, it is possible to use inexpensive equipment instead of expensive equipment. In addition, since the component size of the inexpensive chipset with insufficient safety functions is small, the substrate size can be reduced. Furthermore, by reducing the substrate size, it is advantageous for packaging when it is used in a mechatronic actuator with limited space, for example. Moreover, since the substrate size is small and simple, assembly becomes simple. In addition, since the component scale (including the scale of the logic circuit in the IC) is reduced, the failure rate is reduced. These points are described in detail below.

[0046] In the embodiment, the motor control device 7 includes a first motor drive unit 8, a second motor drive unit 10, a first control unit 9, a second control unit 11, and a third control unit 41. The first motor drive unit 8 drives the brake motor 2 as a motor. The second motor drive unit 10 also drives the brake motor 2 as a motor. The first control unit 9 is connected to the first motor drive unit 8. The first control unit 9 obtains the detection value of the first rotation sensor 15 as a first rotation position detection unit that detects the rotation position of the brake motor 2, and monitors the phase current of the second motor drive unit 10. For this purpose, the first phase current monitoring circuit 35 is connected to the U2 phase power line 22, the V2 phase power line 23, and the W2 phase power line 24 of the second motor drive unit 10. The first phase current monitoring circuit 35 is connected to the first control unit 9, and the first control unit 9 monitors the phase current of the second motor drive unit 10 through the first phase current monitoring circuit 35. When the monitoring value in the first phase current monitoring circuit 35 becomes out of the normal range, the first control unit 9 determines that the second control unit 11 or the second motor drive unit 10 is abnormal.

[0047] That is, the first control unit 9 determines that the second control unit 11 and the second motor drive unit 10 are normal when the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, and determines that the second control unit 11 or the second motor drive unit 10 is abnormal when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform. Figure 4 An example of a time change (waveform) of the phase current (U phase, V phase, W phase) in the second motor driving unit 10 is shown. Figure 4 In the figure, the range of the expected current waveform is shown by the double dotted line. The range of the expected current waveform can be set, for example, to the range of the current waveform when the second motor drive unit 10 and then the second control unit 11 are in an appropriate state. In this case, the first control unit 9 can, for example, determine the correct current waveform (phase and peak value of the current) of the three-phase current UVW applied to the brake motor 2 based on the instructions (target motor torque, braking force, piston thrust, motor control current value) from the integrated control device 33 as the upper ECU and the magnet polarity configuration obtained according to the detection value of the first rotation sensor 15. And, as Figure 4 If the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform (correct current waveform), as described as “No good” in the figure, the first control unit 9 determines that the second control unit 11 or the second motor drive unit 10 is abnormal.

[0048] In the embodiment, the first control unit 9 adopts an inexpensive chip set that does not perform self-diagnosis for abnormality detection. On this basis, the first control unit 9 determines whether the behavior of the motor phase current of the second motor drive unit 10 connected to the second control unit 11 on the other side is normal or abnormal. In addition, when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the first control unit 9 outputs a signal to the second fault protection relay 10B via the second logic circuit 44 indicating that the second control unit 11 or the second motor drive unit 10 is abnormal, that is, a signal for stopping the drive of the second motor drive unit 10.

[0049] The signal for stopping the driving of the second motor drive unit 10 corresponds to the abnormal instruction signal (ECU2_Disable (ECU2_disabled) signal) for disconnecting the second fault protection relay 10B. That is, the first control unit 9 outputs an abnormal instruction signal (third abnormal instruction signal) for disconnecting the second fault protection relay 10B as the second relay unit based on the current phase obtained according to the detection value of the first rotation sensor 15 and the phase current value of the second motor drive unit 10. In this case, the abnormal instruction signal can be set to 1 (High). That is, when the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, the first control unit 9 outputs 0 (Low) which becomes a normal instruction signal, and when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the first control unit 9 outputs 1 (High) which becomes an abnormal instruction signal.

[0050] On the other hand, the second control unit 11 is connected to the second motor drive unit 10. The second control unit 11 obtains the detection value of the second rotation sensor 16 as the second rotation position detection unit that detects the rotation position of the brake motor 2, and monitors the phase current of the first motor drive unit 8. To this end, the second phase current monitoring circuit 36 ​​is connected to the U1 phase power line 18, the V1 phase power line 19, and the W1 phase power line 20 of the first motor drive unit 8. The second phase current monitoring circuit 36 ​​is connected to the second control unit 11, and the second control unit 11 monitors the phase current of the first motor drive unit 8 through the second phase current monitoring circuit 36. When the monitoring value in the second phase current monitoring circuit 36 ​​becomes outside the normal range, the second control unit 11 determines that the first control unit 9 or the first motor drive unit 8 is abnormal.

[0051] That is, the second control unit 11 determines that the first control unit 9 and the first motor drive unit 8 are normal when the waveform of the phase current in the first motor drive unit 8 is within the range of the expected current waveform, and determines that the first control unit 9 or the first motor drive unit 8 is abnormal when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform. Figure 4 It also corresponds to an example of the time change (waveform) of the phase current (U phase, V phase, W phase) in the first motor driving unit 8 . Figure 4The double-dotted line in , i.e., the range of the expected current waveform, can be set, for example, to the range of the current waveform when the first motor drive unit 8 and then the first control unit 9 are in an appropriate state. In this case, the second control unit 11 can, for example, determine the correct current waveform (phase and peak value of the current) of the three-phase current UVW applied to the brake motor 2 based on the instructions (target motor torque, braking force, piston thrust, motor control current value) from the upper ECU integrated control device 33 and the magnet polarity configuration obtained according to the detection value of the second rotation sensor 16. And, as Figure 4 If the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform (correct current waveform), as described as “No good” in FIG. 1 , the second control unit 11 determines that the first control unit 9 or the first motor drive unit 8 is abnormal.

[0052] In the embodiment, the second control unit 11 adopts an inexpensive chip set that does not perform self-diagnosis for abnormality detection. On this basis, the second control unit 11 determines whether the behavior of the motor phase current of the first motor drive unit 8 connected to the first control unit 9 on the other side is normal or abnormal. In addition, when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform, the second control unit 11 outputs a signal to the first fault protection relay 8B via the first logic circuit 43 indicating that the first control unit 9 or the first motor drive unit 8 is abnormal, that is, a signal for stopping the drive of the first motor drive unit 8.

[0053] The signal for stopping the driving of the first motor drive unit 8 corresponds to the abnormal instruction signal (ECU1_Disable (ECU1_disabled) signal) for disconnecting the first fault protection relay 8B. That is, the second control unit 11 outputs an abnormal instruction signal (first abnormal instruction signal) for disconnecting the first fault protection relay 8B as the first relay unit based on the current phase obtained according to the detection value of the second rotation sensor 16 and the phase current value of the first motor drive unit 8. In this case, the abnormal instruction signal can be set to 1 (High). That is, the second control unit 11 outputs 0 (Low) which becomes a normal instruction signal when the waveform of the phase current in the first motor drive unit 8 is within the range of the expected current waveform, and outputs 1 (High) which becomes an abnormal instruction signal when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform.

[0054] Furthermore, the third control unit 41 acquires the detection value of the third rotation sensor 42 as the third rotation position detection unit for detecting the rotation position of the brake motor 2, and monitors the phase current of the first motor drive unit 8 and the phase current of the second motor drive unit 10. For this purpose, the third control unit 41 is connected to the third rotation sensor 42. The third rotation sensor 42 detects the rotation position (for example, the rotation angle) of the rotor 4 of the brake motor 2. The third rotation sensor 42 is a rotation sensor different from the first rotation sensor 15 connected to the first control unit 9 and the second rotation sensor 16 connected to the second control unit 11. Thus, redundancy is ensured.

[0055] In addition, the third phase current monitoring circuit 37 is connected to the U1 phase power line 18, the V1 phase power line 19, and the W1 phase power line 20 of the first motor drive unit 8. The third phase current monitoring circuit 37 is connected to the third control unit 41, and the third control unit 41 monitors the phase current of the first motor drive unit 8 through the third phase current monitoring circuit 37. In addition, the fourth phase current monitoring circuit 38 is connected to the U2 phase power line 22, the V2 phase power line 23, and the W2 phase power line 24 of the second motor drive unit 10. The fourth phase current monitoring circuit 38 is connected to the third control unit 41, and the third control unit 41 monitors the phase current of the second motor drive unit 10 through the fourth phase current monitoring circuit 38.

[0056] The third control unit 41 includes, for example, a microcomputer (Micro Controller), a regulator (Reg), and the like. The third control unit 41 is connected to the first power supply 29 of the vehicle via the first DC power line 17. In addition, the third control unit 41 is connected to the second power supply 30 of the vehicle via the second DC power line 21. In addition, although not shown in the figure, the regulator (Reg) of the third control unit 41 is connected to the third rotation sensor 42, the third phase current monitoring circuit 37, and the fourth phase current monitoring circuit 38. Thus, power is supplied to the third rotation sensor 42, the third phase current monitoring circuit 37, and the fourth phase current monitoring circuit 38 via the regulator (Reg) of the third control unit 41. In addition, the regulator (Reg) that supplies power may also be set as a separate body from the third control unit 41. In this case, the separate regulator (Reg) is connected to the first power supply 29 and the second power supply 30, and power is supplied to the third control unit 41, the third rotation sensor 42, the third phase current monitoring circuit 37, and the fourth phase current monitoring circuit 38 via the separate regulator (Reg).

[0057] When the monitoring value in the third phase current monitoring circuit 37 is out of the normal range, the third control unit 41 determines that the first control unit 9 or the first motor drive unit 8 is abnormal. When the monitoring value in the fourth phase current monitoring circuit 38 is out of the normal range, the third control unit 41 determines that the second control unit 11 or the second motor drive unit 10 is abnormal. The determination of abnormality is the same as the determination based on the waveform of the phase current of the first control unit 9 and the determination based on the waveform of the phase current of the second control unit 11. In this case, the third control unit 41 can, for example, obtain the correct current waveform (phase and peak value of the current) of the three-phase current of UVW applied to the brake motor 2 based on the command (target motor torque, braking force, piston thrust, motor control current value) from the integrated control device 33 as the upper ECU and the magnet polarity configuration obtained based on the detection value of the third rotation sensor 42.

[0058] In the embodiment, the third control unit 41 can adopt a chipset without a motor drive function, that is, a chipset with low functionality. In other words, the third control unit 41 can adopt an inexpensive monitoring microcomputer. As a result, the cost can be reduced. On this basis, the third control unit 41 determines whether the behavior of the motor phase current of the first motor drive unit 8 connected to the first control unit 9 is normal or abnormal. At the same time, the third control unit 41 determines whether the behavior of the motor phase current of the second motor drive unit 10 connected to the second control unit 11 is normal or abnormal. In addition, when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform, the third control unit 41 outputs a signal for stopping the drive of the first motor drive unit 8 to the first fault protection relay 8B via the first logic circuit 43. The signal for stopping the drive of the first motor drive unit 8 corresponds to the abnormal instruction signal (ECU1_Disable signal) for cutting off the first fault protection relay 8B. Furthermore, when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform, the third control unit 41 outputs a signal for stopping the driving of the second motor drive unit 10 to the second fail-safe relay 10B via the second logic circuit 44. The signal for stopping the driving of the second motor drive unit 10 corresponds to the abnormal instruction signal (ECU2_Disable signal) for shutting off the second fail-safe relay 10B.

[0059] That is, the third control unit 41 outputs an abnormal command signal (second abnormal command signal) for disconnecting the first fault protection relay 8B based on the current phase obtained from the detection value of the third rotation sensor 42 and the phase current value of the first motor drive unit 8. In addition, the third control unit 41 outputs an abnormal command signal (fourth abnormal command signal) for disconnecting the second fault protection relay 10B based on the current phase obtained from the detection value of the third rotation sensor 42 and the phase current value of the second motor drive unit 10. In this case, the abnormal command signal can be set to 1 (High). That is, the third control unit 41 outputs 0 (Low) which becomes a normal command signal when the waveform of the phase current in the first motor drive unit 8 is within the range of the expected current waveform, and outputs 1 (High) which becomes an abnormal command signal when the waveform of the phase current in the first motor drive unit 8 is outside the range of the expected current waveform. In addition, the third control unit 41 outputs 0 (Low) which is a normal command signal when the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, and outputs 1 (High) which is an abnormal command signal when the waveform of the phase current in the second motor drive unit 10 is outside the range of the expected current waveform.

[0060] Next, in Figure 1 Based on this, we also refer to Figure 2 as well as Figure 3 , the first failsafe relay 8B, the second failsafe relay 10B, the first logic circuit 43 and the second logic circuit 44 are described.

[0061] like Figure 1 as well as Figure 2As shown, the first motor drive unit 8 includes a first inverter circuit 8A as a first bridge circuit unit, and a first fault protection relay 8B as a first relay unit. The first fault protection relay 8B switches the connection and disconnection between the first inverter circuit 8A and the first power supply 29 as a power supply. The first control unit 9, the second control unit 11, and the third control unit 41 are connected to the first fault protection relay 8B via the first logic circuit 43. The first fault protection relay 8B becomes disconnected (OFF) when the output from the first logic circuit 43 is 0 (Low), and disconnects the first inverter circuit 8A from the first power supply 29. In contrast, the first fault protection relay 8B becomes connected (ON) when the output from the first logic circuit 43 is 1 (High), and connects the first inverter circuit 8A to the first power supply 29. The first logic circuit 43 corresponds to a relay switching unit (first relay switching unit) that switches connection (ON) and disconnection (OFF) of the first failsafe relay 8B based on signals (Low, High) from the first control unit 9 , the second control unit 11 , and the third control unit 41 .

[0062] On the other hand, Figure 1 as well as Figure 3 As shown, the second motor drive unit 10 includes a second inverter circuit 10A as a second bridge circuit unit, and a second fault protection relay 10B as a second relay unit. The second fault protection relay 10B switches the connection and disconnection between the second inverter circuit 10A and the second power supply 30 as a power supply. The first control unit 9, the second control unit 11, and the third control unit 41 are connected to the second fault protection relay 10B via the second logic circuit 44. The second fault protection relay 10B is disconnected (OFF) when the output from the second logic circuit 44 is 0 (Low), and the second inverter circuit 10A is disconnected from the second power supply 30. In contrast, the second fault protection relay 10B is turned on (ON) when the output from the second logic circuit 44 is 1 (High), and the second inverter circuit 10A is connected to the second power supply 30. The second logic circuit 44 corresponds to a relay switching unit (second relay switching unit) that switches connection (ON) and disconnection (OFF) of the second failsafe relay 10B based on signals (Low, High) from the first control unit 9 , the second control unit 11 , and the third control unit 41 .

[0063] like Figure 2As shown, the first logic circuit 43 includes a NAND (NAND) circuit 43A and an AND (AND) circuit 43B. The output side of the third control unit 41 and the output side of the second control unit 11 are connected to the input side of the NAND circuit 43A. The output side of the NAND circuit 43A is connected to the input side of the AND circuit 43B. If 1 (High) as an abnormal command signal is input from both the third control unit 41 and the second control unit 11, the NAND circuit 43A outputs 0 (Low) as an abnormal command signal to the AND circuit 43B. On the other hand, if 0 (Low) as a normal command signal is input from at least one of the third control unit 41 and the second control unit 11, the NAND circuit 43A outputs 1 (High) as a normal command signal to the AND circuit 43B. That is, the NAND circuit 43A outputs 1 (High) as a normal command signal unless 1 (High) as an abnormal command signal is input from both the third control unit 41 and the second control unit 11.

[0064] The output side of the first control unit 9 and the output side of the NAND circuit 43A are connected to the input side of the AND circuit 43B. Thus, the third control unit 41 and the second control unit 11 are connected to the AND circuit 43B via the NAND circuit 43A. On the other hand, the output side of the AND circuit 43B is connected to the first fail-safe relay 8B of the first motor drive unit 8. Here, the first control unit 9 outputs a signal (enable signal) for enabling the first motor drive unit 8 (first inverter circuit 8A) to be driven to the first logic circuit 43 (AND circuit 43B). This signal corresponds to a drive permission signal that permits the drive of the first motor drive unit 8, in other words, a signal that permits the connection of the first fail-safe relay 8B. In this case, the drive permission signal can be set to 1 (High). That is, the first control unit 9 outputs 1 (High) which becomes a drive permission signal when the drive of the first motor drive unit 8 (first inverter circuit 8A) is permitted, and outputs 0 (Low) which becomes a drive disapproval signal when the drive of the first motor drive unit 8 (first inverter circuit 8A) is not permitted.

[0065] When 1 (High) as a drive permission signal is input from the first control unit 9 and 1 (High) as a normal command signal is input from the NAND circuit 43A, the AND circuit 43B outputs 1 (High) corresponding to a signal for connecting the first fail-safe relay 8B to the first fail-safe relay 8B. As a result, the first fail-safe relay 8B is turned on, and the first inverter circuit 8A is connected to the first power supply 29. On the other hand, when 0 (Low) as a drive disapproval signal is input from the first control unit 9 or 0 (Low) as an abnormal command signal is input from the NAND circuit 43A, the AND circuit 43B outputs 0 (Low) corresponding to a signal for disconnecting the first fail-safe relay 8B to the first fail-safe relay 8B. As a result, the first fail-safe relay 8B is turned off, and the first inverter circuit 8A is disconnected from the first power supply 29. Figure 6 (A) is the truth table of the first fault protection relay 8B. Figure 6 As shown in (A), even if the output from the first control unit 9 is 1 (High) as the drive permission signal, if the output from both the third control unit 41 and the second control unit 11 is 1 (High) as the abnormal command signal (the first abnormal command signal, the second abnormal command signal), the first fault protection relay 8B is also cut off. As a result, the driving of the first motor drive unit 8 (the first inverter circuit 8A) is stopped. That is, in the embodiment, when both the first abnormal command signal and the second abnormal command signal are output, the first fault protection relay 8B is cut off.

[0066] On the other hand, Figure 3 As shown, the second logic circuit 44 also includes a NAND circuit 44A and an AND circuit 44B. The second logic circuit 44 is different from the first logic circuit 43 in that the output side of the third control unit 41 and the output side of the first control unit 9 are connected to the input side of the NAND circuit 44A, the output side of the second control unit 11 is connected to the input side of the AND circuit 44B, and the output side of the AND circuit 44B is connected to the second fault protection relay 10B of the second motor drive unit 10. Other than this, the structure is the same as that of the first logic circuit 43, so the detailed description of the second logic circuit 44 is omitted. Figure 6 (B) is the truth table of the second fault protection relay 10B. Figure 6As shown in (B), even if the output from the second control unit 11 is 1 (High) which is a drive permission signal, if the output from both the third control unit 41 and the first control unit 9 is 1 (High) which is an abnormal command signal (third abnormal command signal, fourth abnormal command signal), the second fault protection relay 10B is also cut off. As a result, the drive of the second motor drive unit 10 (second inverter circuit 10A) stops. That is, in the embodiment, when both the third abnormal command signal and the fourth abnormal command signal are output, the second fault protection relay 10B is cut off.

[0067] In addition, if Figure 1 As shown, in the embodiment, the first control unit 9, the second control unit 11 and the third control unit 41 are connected to the integrated control device 33 as a controller of the vehicle. And, when the first fault protection relay 8B is cut off, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 of the abnormality of the first control unit 9 or the first motor drive unit 8. In addition, when the second fault protection relay 10B is cut off, the first control unit 9 or the third control unit 41 notifies the integrated control device 33 of the abnormality of the second control unit 11 or the second motor drive unit 10. In addition, both the first control unit 9 and the second control unit 11 do not have a self-diagnosis function. In other words, the ASIL level of the first control unit 9 and the ASIL level of the second control unit are ASIL-B specifications.

[0068] On the other hand, the integrated control device 33 (control units 33A, 33B) has a self-diagnosis function. In other words, the ASIL level of the integrated control device 33 (control units 33A, 33B) is, for example, the ASIL-D specification. In addition, the third control unit 41 is connected to the integrated control device 33 via the communication line 31A of the first system connecting the first control unit 9 and the integrated control device 33. In addition, the third control unit 41 is connected to the integrated control device 33 via the communication line 31B of the second system connecting the second control unit 11 and the integrated control device 33. Thus, the first control unit 9, the second control unit 11, the third control unit 41 and the integrated control device 33 form a ring network.

[0069] As described above, in the embodiment, the first control unit 9 and the second control unit 11 use a cheap chip set that does not have a self-diagnosis function for abnormality detection. In addition, the first control unit 9 and the second control unit 11 determine whether the behavior of the phase current of the other motor drive unit (the second motor drive unit 10 in the case of the first control unit 9 and the first motor drive unit 8 in the case of the second control unit 11) is normal. The normality of the behavior of the motor phase current can be determined by whether a correct current waveform (phase and peak value of the current) is obtained.

[0070] That is, the first control unit 9 and the second control unit 11 can understand the magnitude of the control current based on the target motor torque (or braking force, piston thrust, motor control current value) commanded by the integrated control device 33 as the upper ECU through communication. In addition, the first control unit 9 and the second control unit 11 can correctly understand the magnet polarity configuration of the rotor 4 of the brake motor 2 and the phase of the three-phase current UVW applied to the brake motor 2 through the first rotation sensor 15 or the second rotation sensor 16 connected to themselves as a motor rotation angle sensor (angle sensor). As a result, the first control unit 9 and the second control unit 11 can obtain the correct current waveform (phase and peak value of the current).

[0071] Furthermore, the first control unit 9 and the second control unit 11 detect the phase current of the motor drive unit on the other side (the second motor drive unit 10 in the case of the first control unit 9 and the first motor drive unit 8 in the case of the second control unit 11) through the phase current monitoring circuits 35 and 36 as current detection circuits (current monitoring circuits). Thus, when the correct current waveform (phase and peak value of the current) and the current waveform of the second motor drive unit 10 obtained by the first phase current monitoring circuit 35 are inconsistent, the first control unit 9 knows that some abnormality has occurred on the other side. When the correct current waveform (phase and peak value of the current) and the current waveform of the first motor drive unit 8 obtained by the second phase current monitoring circuit 36 ​​are inconsistent, the second control unit 11 knows that some abnormality has occurred on the other side.

[0072] When the first control unit 9 and the second control unit 11 know that an abnormality has occurred on the other side, they cut off the relays (the first fault protection relay 8B and the second fault protection relay 10B) on the other side. For example, the first control unit 9 cuts off the second fault protection relay 10B of the second motor drive unit 10 and stops the drive of the brake motor 2 based on the second motor drive unit 10. The second control unit 11 cuts off the first fault protection relay 8B of the first motor drive unit 8 and stops the drive of the brake motor 2 based on the first motor drive unit 8. In this way, the bias of the power supply to the brake motor 2 can be cut off when an abnormality has occurred on the other side.

[0073] Here, when an abnormality occurs in the microcomputer on the other side and the control current on the other side deviates from the correct current waveform, the relay on the other side can be cut off by detecting this situation. In this case, 50% of the residual braking force can be ensured. However, consider the case where an abnormality occurs in the microcomputer of the own side, the control current of the own side deviates from the correct current waveform, and the control current of the other side is misjudged. In this case, the normal relay on the other side is cut off by the self, and the other side cuts off its own relay, thereby there is a possibility that the relays of both sides are cut off. In this way, the residual braking force becomes 0%, which is not preferred.

[0074] Therefore, in the embodiment, the motor controller is provided with a simple microcomputer, a motor rotor angle sensor, and a current detection circuit that can make a judgment in a third party manner. That is, the motor control device 7 as a motor controller of the embodiment is provided with a third control unit 41 as a sensor ECU (SensECU), a third rotation sensor 42, a third phase current monitoring circuit 37, and a fourth phase current monitoring circuit 38. The third control unit 41 predicts the current (phase current) of the first motor drive unit 8 and the current (phase current) of the second motor drive unit 10 based on the "command torque (command from upstream) from the integrated control device 33" and the "rotation position (angle of the motor rotor) from the third rotation sensor 42".

[0075] The third control unit 41 compares the "predicted current (phase current)", the "current (phase current) detected by the third phase current monitoring circuit 37", and the "current (phase current) detected by the fourth phase current monitoring circuit 38". When the "current (phase current) detected by the third phase current monitoring circuit 37" deviates from the "predicted current (phase current)", the third control unit 41 determines that an abnormality exists in the first control unit 9 or the first motor drive unit 8. When the third control unit 41 determines that an abnormality exists in the first control unit 9 or the first motor drive unit 8, it outputs an abnormality instruction signal (1: High) corresponding to the presence of an abnormality to the first logic circuit 43 (first fault protection relay 8B side) on the first motor drive unit 8 side. In addition, when the "current (phase current) detected by the fourth phase current monitoring circuit 38" deviates from the "predicted current (phase current)", the third control unit 41 determines that an abnormality exists in the second control unit 11 or the second motor drive unit 10. When determining that an abnormality exists in the second control unit 11 or the second motor drive unit 10 , the third control unit 41 outputs an abnormality instruction signal (1: High) corresponding to the abnormality to the second logic circuit 44 on the second motor drive unit 10 side (second failsafe relay 10B side).

[0076] On the other hand, the first control unit 9 predicts the current (phase current) of the second motor drive unit 10 based on the "command torque from the integrated control device 33 (command from upstream)" and the "rotational position from the first rotation sensor 15 (angle of the motor rotor)". The first control unit 9 compares the "predicted current (phase current)" with the "current (phase current) detected by the first phase current monitoring circuit 35". When the "current (phase current) detected by the first phase current monitoring circuit 35" deviates from the "predicted current (phase current)", the first control unit 9 determines that there is an abnormality in the second control unit 11 or the second motor drive unit 10. When the first control unit 9 determines that there is an abnormality in the second control unit 11 or the second motor drive unit 10, it outputs an abnormal command signal (1: High) corresponding to the presence of the abnormality to the second logic circuit 44 on the second motor drive unit 10 side (second fault protection relay 10B side).

[0077] In addition, the second control unit 11 predicts the current (phase current) of the first motor drive unit 8 based on the "command torque from the integrated control device 33 (command from upstream)" and the "rotational position (angle of the motor rotor) from the second rotation sensor 16". The second control unit 11 compares the "predicted current (phase current)" with the "current (phase current) detected by the second phase current monitoring circuit 36". When the "current (phase current) detected by the second phase current monitoring circuit 36" deviates from the "predicted current (phase current)", the second control unit 11 determines that there is an abnormality in the first control unit 9 or the first motor drive unit 8. When the second control unit 11 determines that there is an abnormality in the first control unit 9 or the first motor drive unit 8, it outputs an abnormal command signal (1: High) corresponding to the presence of the abnormality to the first logic circuit 43 (first fault protection relay 8B side) on the first motor drive unit 8 side.

[0078] Furthermore, when it is determined that both the first control unit 9 and the third control unit 41 are abnormal, that is, when the abnormal command signal (1: High) is input from both the first control unit 9 and the third control unit 41 to the second logic circuit 44 on the second fail-safe relay 10B side, the second logic circuit 44 outputs a disconnection signal (0: Low) to the second fail-safe relay 10B. As a result, the second fail-safe relay 10B is disconnected, and the drive of the brake motor 2 by the second motor drive unit 10 stops. At this time, the drive of the brake motor 2 by the first control unit 9 (for example, 50% output) continues. In addition, when it is determined that both the second control unit 11 and the third control unit 41 are abnormal, that is, when the abnormal command signal (1: High) is input from both the second control unit 11 and the third control unit 41 to the first logic circuit 43 on the first fail-safe relay 8B side, the first logic circuit 43 outputs a disconnection signal (0: Low) to the first fail-safe relay 8B. As a result, the first failsafe relay 8B is turned off, and the driving of the brake motor 2 by the first motor driver 8 stops. At this time, the driving of the brake motor 2 by the second control unit 11 (for example, 50% output) continues.

[0079] In this way, the first control unit 9, the second control unit 11, and the third control unit 41 output a signal for cutting off the relay, that is, an abnormal command signal (1: High) to the logic circuit 43, 44 when it is determined to be abnormal. And, when both the signal from the "first control unit 9 or the second control unit 11" and the signal from the "third control unit 41" are input to the logic circuit 43, 44, the fault protection relay 8B, 10B is cut off. That is, the fault protection relay 8B, 10B is cut off only when the cut-off signal (abnormal command signal) of the first control unit 9 or the second control unit 11 and the cut-off signal (abnormal command signal) of the third control unit 41 are established under the AND condition. As a result, the power supply from the motor drive unit 8, 10 on the side determined to be abnormal to the brake motor 2 is stopped.

[0080] The motor control device and the motor control system for the four-wheeled vehicle according to the embodiment have the above-described configurations, and the operations thereof will be described below.

[0081] For example, the integrated control device 33 outputs a torque control request instruction that serves as an instruction for driving the brake motor 2 to the first control unit 9 and the second control unit 11. The first control unit 9 and the second control unit 11 use a control map to current-drive the brake motor 2 via the first motor drive unit 8 and the second motor drive unit 10 based on the torque control request instruction and the rotational position of the first rotation sensor 15 and the second rotation sensor 16. In addition, the torque control request instruction from the integrated control device 33 is also input to the third control unit 41. The third control unit 41 predicts the phase current of the first motor drive unit 8 and the current of the second motor drive unit 10 (the expected value of the phase current) based on the torque control request instruction and the rotational position of the third rotation sensor 42.

[0082] Here, for example, if a fault occurs in the first control unit 9, the waveforms of the motor phase currents (U, V, W) detected by the second phase current monitoring circuit 36 ​​and the third phase current monitoring circuit 37 deviate from the expected values. The second control unit 11 determines that a fault has occurred in the first control unit 9 based on the fact that the waveform of the motor phase current detected by the second phase current monitoring circuit 36 ​​deviates from the expected value. In addition, the third control unit 41 determines that a fault has occurred in the first control unit 9 based on the fact that the waveform of the motor phase current detected by the third phase current monitoring circuit 37 deviates from the expected value.

[0083] When the motor phase current waveform in the first motor drive unit 8 deviates from the expected value, for example, it is assumed that the first power supply 29 is abnormal, the microcomputer of the first control unit 9, the pre-driver malfunction, etc. The deviation of the motor phase current waveform from the expected value due to these abnormalities / malfunctions, etc., is detected by the second phase current monitoring circuit 36 ​​and the third phase current monitoring circuit 37. When the second control unit 11 determines that a fault has occurred in the first control unit 9, it outputs an abnormal command signal (1: High) for disconnecting the first fault protection relay 8B to the first logic circuit 43. In addition, when the third control unit 41 determines that a fault has occurred in the first control unit 9, it outputs an abnormal command signal (1: High) for disconnecting the first fault protection relay 8B to the first logic circuit 43.

[0084] At this time, follow Figure 6According to the truth table of the first fault protection relay 8B shown in (A), the first fault protection relay 8B is disconnected, and the power supply from the first motor drive unit 8 to the brake motor 2 is stopped. At the same time, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 that a fault has occurred in the first control unit 9. If the integrated control device 33 receives a notification from the second control unit 11 or the third control unit 41 (a fault has occurred in the first control unit 9), it will shift to a standby state of degradation control as needed. As degradation control, for example, vehicle speed limitation, brake balance change, standby position of the target wheel, and gap change can be performed.

[0085] Here, even if the control current of the second motor drive unit 10 is correct, the first control unit 9 may output an abnormal command signal (1: High) to disconnect the second fail-safe relay 10B to the second logic circuit 44 as a result of a failure in the first control unit 9. However, in this case, since the abnormal command signal (1: High) to disconnect the second fail-safe relay 10B is not output from the third control unit 41 to the second logic circuit 44, the second fail-safe relay 10B is not disconnected. In this way, in the embodiment, a logic circuit (first logic circuit 43, second logic circuit 44) based on the consensus of the opinions of two or more ECUs is provided, and a majority vote judgment is performed. As a result, the ECU side where the failure (abnormality) occurs can be disconnected, and the ECU side that is operating normally can be prevented from being disconnected by mistake. In addition, when a failure occurs in the second control unit 11, except that the first control unit 9 and the third control unit 41 disconnect the second fail-safe relay 10B via the second logic circuit 44, it is the same as the case where a failure occurs in the first control unit 9. Therefore, the description of the case where a failure occurs in the second control unit 11 is omitted.

[0086] Figure 5 The control process (current monitoring process) performed in the first control unit 9 , the second control unit 11 , and the third control unit 41 is shown. Figure 5 The control process is repeatedly executed, for example, at a predetermined control cycle (for example, 1 ms). In the following description, the process performed in the first control unit 9 is described as a representative example. The process performed in the second control unit 11 and the process performed in the third control unit 41 are the same as the process performed in the first control unit 9 except that the monitored object and the relay to be cut off are different, so the description is omitted.

[0087] For example, when the first control unit 9 is powered on, Figure 5The processing starts. The first control unit 9 determines in S1 whether a fault (abnormality) has occurred on the second control unit 11 side. That is, the first control unit 9 determines, through the first phase current monitoring circuit 35, whether the waveform of the phase current in the second motor drive unit 10 deviates from the range of the expected current waveform. In other words, the first control unit 9 determines, through the first phase current monitoring circuit 35, whether the current control value of the second motor drive unit 10 based on the second control unit 11 is inconsistent with the current control value of the first control unit 9 that is the expected value.

[0088] If the result of S1 is "NO", that is, if it is determined that the waveform of the phase current in the second motor drive unit 10 is within the range of the expected current waveform, the process returns. That is, the process returns to the beginning and the process after S1 is repeated. In addition, if the result of S1 is "NO" and the process returns, the abnormality counter counted up in S2 described later is reset. In contrast, if the result of S1 is "YES", that is, if it is determined that the waveform of the phase current in the second motor drive unit 10 deviates from the range of the expected current waveform, the process enters S2.

[0089] In S2, the count of the abnormality counter is incremented. In S3 following S2, it is determined whether the count value of the abnormality counter is above the threshold value. The threshold value of the count value can be set, for example, to be able to determine the time when the abnormality (fault) occurs, that is, to prevent the time when the phase current is judged to be abnormal (fault) even if it is normal due to temporary misdetection, error, etc. In S3, it is "No", that is, when it is determined that the count value of the abnormality counter is not above the threshold value, the process returns. In this case, the abnormality counter is not reset, and the processing after S1 is repeated.

[0090] On the other hand, if it is "Yes" in S3, that is, if it is determined that the count value of the abnormality counter is above the threshold, enter S4. In this case, it can be determined that an abnormality (fault) has occurred. Therefore, in S4, a signal for cutting off the relay is output. For example, if it is the first control unit 9, 1 (High) is output to the NAND circuit 44A of the second logic circuit 44 as an abnormality instruction signal. At the same time, the first control unit 9 notifies the integrated control device 33 that an abnormality (fault) has occurred on the second control unit 11 side. If it is the second control unit 11, 1 (High) is output to the NAND circuit 43A of the first logic circuit 43 as an abnormality instruction signal. At the same time, the second control unit 11 notifies the integrated control device 33 that an abnormality (fault) has occurred on the first control unit 9 side.

[0091] If it is the third control unit 41, when the waveform of the phase current on the first control unit 9 side deviates, an abnormal command signal is output to the NAND circuit 43A of the first logic circuit 43, and when the waveform of the phase current on the second control unit 11 side deviates, an abnormal command signal is output to the NAND circuit 44A of the second logic circuit 44. At the same time, the third control unit 41 notifies the integrated control device 33 that an abnormality (fault) has occurred on the first control unit 9 side or an abnormality (fault) has occurred on the second control unit 11 side. After outputting the abnormal command signal and notifying the integrated control device 33, which is the upper ECU, of the occurrence of the abnormality (fault), it returns. At this time, the abnormality counter is not reset. In addition, when the integrated control device 33 is notified of the occurrence of the abnormality (fault), it determines whether a downgrade control (for example, a restriction of the vehicle speed, a change in the brake balance, a change in the standby position of the target wheel and a change in the gap, etc.) is required. And, when it is determined that the downgrade control is required, the integrated control device 33 performs downgrade control such as a restriction of the vehicle speed, a change in the brake balance, a change in the standby position of the target wheel and a change in the gap, etc.

[0092] As described above, according to the embodiment, three control units (ECUs) including the first control unit 9, the second control unit 11, and the third control unit 41 are provided. On this basis, the first control unit 9, the second control unit 11, and the third control unit 41 respectively obtain the rotation position of the brake motor 2 from the first rotation sensor 15, the second rotation sensor 16, and the third rotation sensor 42, which are different rotation position detection units. In addition, the first control unit 9, the second control unit 11, and the third control unit 41 monitor the phase current of the first motor drive unit 8 and the phase current of the second motor drive unit 10. Therefore, for example, even if the first control unit 9 does not have a self-diagnosis function, the second control unit 11 and the third control unit 41 can determine whether "the first control unit 9 or the first motor drive unit 8" is abnormal based on the rotation position and phase current of the brake motor 2.

[0093] In addition, even if the second control unit 11 does not have a self-diagnosis function, the first control unit 9 and the third control unit 41 can determine whether the "second control unit 11 or the second motor drive unit 10" is abnormal based on the rotation position and phase current of the brake motor 2. As a result, the first control unit 9 and the second control unit 11 can be made low-cost. Moreover, when it is determined to be abnormal, the control unit 9 (11) and the motor drive unit 8 (10) determined to be abnormal can be stopped, and the drive of the brake motor 2 can be continued by the control unit 11 (9) and the motor drive unit 10 (8) that are not determined to be abnormal. As a result, redundancy can be ensured. As a result, both low cost and redundancy can be taken into account. That is, low cost can be achieved on the basis of redundancy.

[0094] According to the embodiment, the first motor drive unit 8 is provided with a first fault protection relay 8B for switching the connection and disconnection between the first inverter circuit 8A and the first power supply 29. On this basis, the second control unit 11 outputs a first abnormal instruction signal (1: High) for disconnecting the first fault protection relay 8B based on the current phase obtained according to the detection value of the second rotation sensor 16 and the phase current value of the first motor drive unit 8. In addition, the third control unit 41 outputs a second abnormal instruction signal (1: High) for disconnecting the first fault protection relay 8B based on the current phase obtained according to the detection value of the third rotation sensor 42 and the phase current value of the first motor drive unit 8. Therefore, the first fault protection relay 8B of the first motor drive unit 8 can switch the connection and disconnection between the first inverter circuit 8A and the first power supply 29 using the two signals of the first abnormal instruction signal and the second abnormal instruction signal.

[0095] According to the embodiment, when both the first abnormal command signal (1: High) and the second abnormal command signal (1: High) are output, the first fault protection relay 8B is cut off. Therefore, when the first control unit 9 side is determined to be abnormal in both the second control unit 11 and the third control unit 41, the drive of the brake motor 2 based on the first motor drive unit 8 can be stopped. Conversely, when the first control unit 9 side is determined to be abnormal in one (only one) of the second control unit and the third control unit, the drive of the brake motor 2 based on the first motor drive unit 8 can be continued. Therefore, it is possible to correctly determine whether the first control unit 9 side is abnormal, and when it is determined to be abnormal, the drive of the brake motor 2 based on the first motor drive unit 8 can be reliably stopped. The same is true for the second fault protection relay 10B.

[0096] In addition, in the embodiment, the purpose function (enable / disable) of the output of the first control unit 9, the second control unit 11, and the third control unit 41 is set to a high active logic. In addition, as a result of the logic output, the safety design concept / policy is as follows: the enable signal (Enable signal) for the main function (function) becomes a disadvantageous signal (recessive), and the disable signal (Disable signal) for the safety function becomes a dominant signal (dominant).

[0097] According to the embodiment, when the first fault protection relay 8B is disconnected, the second control unit 11 or the third control unit 41 notifies the integrated control device 33 of the abnormality of the first control unit 9 or the first motor drive unit 8. Therefore, the integrated control device 33 can know that the first fault protection relay 8B is disconnected. The notification of the abnormality can be performed by both the second control unit 11 and the third control unit 41, or by one of the second control unit 11 and the third control unit 41. In addition, when the second fault protection relay 10B is disconnected, the first control unit 9 or the third control unit 41 notifies the integrated control device 33 of the abnormality of the second control unit 11 or the second motor drive unit 10. At this time, the notification of the abnormality can be performed by both the first control unit 9 and the third control unit 41, or by one of the first control unit 9 and the third control unit 41. If the integrated control device 33 is notified of the abnormality, it can perform necessary control, such as degradation control.

[0098] In addition, as to whether the first fail-safe relay 8B and the first fail-safe relay 8B are operating normally, that is, whether they can be properly cut off, for example, it is possible to perform a diagnosis (initial diagnosis) when the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 are started. For example, when the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 are started, as an initial diagnosis, follow Figure 6 The truth table shown in the figure makes all eight conditions operate for each relay. At this time, by monitoring the voltage value on the downstream side of the relay, it can be determined whether the first fail-safe relay 8B and the first fail-safe relay 8B are operating normally.

[0099] In addition, it is also possible to diagnose (initial diagnosis) whether the current control based on the first control unit 9 and the first motor drive unit 8, the current control based on the second control unit 11 and the second motor drive unit 10, the current detection of the first phase current monitoring circuit 35, the current detection of the second phase current monitoring circuit 36, the current detection of the third phase current monitoring circuit 37, and the current detection of the fourth phase current monitoring circuit 38 are normal. For example, when the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 are started, as an initial diagnosis, a torque command in the positive direction is output from the first control unit 9 to the first motor drive unit, and a torque command in the reverse direction is output from the second control unit 11 to the second motor drive unit, so that the brake motor 2 does not rotate. At this time, by monitoring the rotation and phase current of the brake motor 2, it is possible to determine whether the current control and current detection are normal.

[0100] According to the embodiment, the first control unit 9 and the second control unit 11 do not have a self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit 9 and the second control unit 11. On the other hand, the third control unit 41 can adopt a microcomputer (ECU) for current monitoring. That is, the third control unit 41 does not need to control the motor driver (motor drive unit) like a microcomputer (ECU) for motor control (short execution cycle and complex control). Therefore, the third control unit 41 can also achieve low cost. However, depending on conditions such as the number of actual adoption results in other products (quantity conditions), the cost may vary. Therefore, as the third control unit 41, a computing device for motor control can also be used. In short, the third control unit 41 can adopt a low-function computing device, so cost reduction can be expected.

[0101] According to the embodiment, the ASIL level of the first control unit 9 and the ASIL level of the second control unit 11 are ASIL-B standards. Therefore, low-cost microcomputers (ECUs) of ASIL-B standards can be used as the first control unit 9 and the second control unit 11 .

[0102] According to the embodiment, the first control unit 9, the second control unit 11, and the third control unit 41 are connected to the integrated control device 33. Therefore, the first control unit 9, the second control unit 11, and the third control unit 41 can transmit (send, receive) necessary information (signals) to and from the integrated control device 33.

[0103] According to the embodiment, the integrated control device 33 is an integrated controller that determines the motion control of the vehicle and has a self-diagnosis function. Therefore, the first control unit 9, the second control unit 11, and the third control unit 41 can be connected to the integrated controller with a self-diagnosis function. On the other hand, both the first control unit 9 and the second control unit 11 do not have a self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit 9 and the second control unit 11.

[0104] According to the embodiment, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 form a ring network. Therefore, for example, even if the path (communication line) connecting the first control unit 9 and the integrated control device 33, the path (communication line) connecting the second control unit 11 and the integrated control device 33, the path (communication line) connecting the third control unit 41 and the first control unit 9, and the path (communication line) connecting the third control unit 41 and the second control unit 11 are cut off (disconnected), necessary information (signals) can be transferred (sent, received) between the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33.

[0105] That is, the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33 can form a ring network by transmitting information clockwise and counterclockwise between them. Therefore, the information transmitted clockwise and counterclockwise can be extracted or stored in each device (the first control unit 9, the second control unit 11, the third control unit 41, and the integrated control device 33) within the transmission path. Thus, no matter which path is cut off, information can be transmitted to each device. However, the delay in the transmission of information may change to some extent. Therefore, conversely, it is considered that by monitoring the delay in information transmission during normal times, regular monitoring can also be performed.

[0106] According to the embodiment, the motor driven by the first motor driver 8 and the second motor driver 10 is set as the brake motor 2 for controlling the electric brake mechanism. Therefore, the brake motor 2 can be driven by the first motor driver 8 connected to the first control unit 9 and the second motor driver 10 connected to the second control unit 11.

[0107] In addition, in the embodiment, the case where the current detection of the current monitoring circuits 35, 36, 37, and 38 is set to detect the current of the three phases of U phase, V phase, and W phase is described as an example. However, it is not limited to this. For example, the current of two phases out of the three phases can be detected and the remaining one phase can be estimated. That is, in the star connection of the motor, since the current flowing in must flow out through the motor path, the sum of the currents of the U phase, the V phase, and the W phase must be 0. If the current of two phases can be detected, the remaining one phase can be assumed. Therefore, the current of two phases out of the three phases can also be detected, and the remaining one phase can be estimated. Furthermore, as for the method of monitoring the phase current, a method based on a shunt resistor is considered, and the shunt resistor can also be non-redundant (one) or redundant (two).

[0108] In the embodiment, the case where the first control unit 9 and the second control unit 11 do not have a self-diagnosis function is described as an example. However, it is not limited to this. For example, it can also be a structure in which one or both of the first control unit 9 and the second control unit 11 have a low-precision (low-function) self-diagnosis function. In addition, for example, it can also be a structure in which one or both of the first control unit 9 and the second control unit 11 have a high-precision (high-function) self-diagnosis function. In this case, the ASIL level of the first control unit 9 and / or the ASIL level of the second control unit may not be the ASIL-B specification. In other words, the ASIL level of the first control unit 9 and / or the ASIL level of the second control unit may also be the ASIL-A specification, the ASIL-C specification, and the ASIL-D specification.

[0109] In the embodiment, a dual system including the first control unit 9 (sub-system) and the second control unit 11 (main system) is described as an example. However, the present invention is not limited thereto and can be applied to multiple systems such as a triple system, a quadruple system, or more.

[0110] In the embodiment, the case where the brake motor 2 is set as a motor driven by the first motor drive unit 8 and the second motor drive unit 10 to control the electric brake mechanism that applies braking force to the vehicle is described as an example. However, it is not limited to this. As the motor driven by the first motor drive unit and the second motor drive unit, for example, it can also be set as a steering motor that controls (drives) the direction steering actuator of the vehicle. In this case, the steering motor can be driven by the first motor drive unit connected to the first control unit and the second motor drive unit connected to the second control unit. In short, the motor driven by the first motor drive unit and the second motor drive unit is not limited to the brake motor and the steering motor, and can be set as a motor for driving various actuators mounted on the vehicle (a motor that needs to ensure redundancy). In this case, for example, a water pump, an oil pump, a travel motor, etc. that require a redundant structure can be set, and a motor that needs to be continued to be controlled by the remaining single system in the event of a single system function failure. In other words, the motor control device and the motor control system of the embodiment can be widely used as a motor control device and a control system that can continue to control the motor by the remaining single system in the event of a single system function failure (single fault operation (Fail-Operation)).

[0111] In the embodiment, the case where the controller of the vehicle (vehicle controller) is set as the following integrated control device 33 (integrated ECU, central ECU) is described as an example, and the integrated control device 33 (integrated ECU, central ECU) determines the vehicle motion control for moving the vehicle relative to the target trajectory obtained from the automatic driving control device (automatic driving ECU). However, this is not limited to this, and the controller of the vehicle (vehicle controller) may be a control device other than the integrated control device 33, such as a steering control device, a suspension control device, etc., that is, it may not be a higher-level control device. As the controller of the vehicle (vehicle controller), various control devices (ECUs) mounted on the vehicle can be used.

[0112] According to the above-described embodiment, the motor control device (motor controller) includes three control units, namely, a first control unit, a second control unit, and a third control unit. On this basis, the first control unit, the second control unit, and the third control unit obtain the rotational position of the motor from different rotational position detection units (first rotational position detection unit, second rotational position detection unit, and third rotational position detection unit). In addition, the first control unit, the second control unit, and the third control unit monitor the phase current of the first motor drive unit and the phase current of the second motor drive unit. Therefore, for example, even if the first control unit does not have a self-diagnosis function, the second control unit and the third control unit can determine whether the "first control unit or the first motor drive unit" is abnormal based on the rotational position and phase current of the motor. In addition, even if the second control unit does not have a self-diagnosis function, the first control unit and the third control unit can determine whether the "second control unit or the second motor drive unit" is abnormal based on the rotational position and phase current of the motor. As a result, the first control unit and the second control unit can be reduced in cost.

[0113] Furthermore, when it is determined to be abnormal, the control unit and the motor driving unit determined to be abnormal are stopped, and the motor driving can be continued by the control unit and the motor driving unit that are not determined to be abnormal. Thus, redundancy can be ensured. Thus, low cost and redundancy can be taken into account. That is, low cost can be achieved on the basis of redundancy.

[0114] According to an embodiment, the first motor drive unit has a first relay unit that switches the connection and disconnection between the first bridge circuit unit and the power supply. On this basis, the second control unit outputs a first abnormal instruction signal for disconnecting the first relay unit based on the current phase obtained according to the detection value of the second rotation position detection unit and the phase current value of the first motor drive unit. In addition, the third control unit outputs a second abnormal instruction signal for disconnecting the first relay unit based on the current phase obtained according to the detection value of the third rotation position detection unit and the phase current value of the first motor drive unit. Therefore, the first relay unit of the first motor drive unit can use the first abnormal instruction signal and the second abnormal instruction signal to switch the connection and disconnection between the first bridge circuit unit and the power supply.

[0115] According to an embodiment, when both the first abnormal command signal and the second abnormal command signal are output, the first relay unit is cut off. Therefore, when it is determined that the "first control unit or the first motor drive unit" is abnormal in both the second control unit and the third control unit, the drive of the motor based on the first motor drive unit can be stopped. Conversely, when it is determined that the "first control unit or the first motor drive unit" is abnormal in one (only one) of the second control unit and the third control unit, the drive of the motor based on the first motor drive unit can continue. Therefore, it is possible to correctly determine whether the "first control unit or the first motor drive unit" is abnormal, and when it is determined to be abnormal, the drive of the motor based on the first motor drive unit can be reliably stopped.

[0116] According to the embodiment, when the first relay unit is disconnected, the second control unit or the third control unit notifies the vehicle controller of the abnormality of the first control unit or the first motor drive unit. Therefore, the vehicle controller can know that the first relay unit is disconnected.

[0117] According to the embodiment, the first control unit and the second control unit do not have a self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit and the second control unit.

[0118] According to the embodiment, the ASIL level of the first control unit and the ASIL level of the second control unit are ASIL-B standards. Therefore, low-cost microcomputers (ECUs) that meet the ASIL-B standards can be used as the first control unit and the second control unit.

[0119] According to the embodiment, the first control unit, the second control unit, and the third control unit are connected to the controller of the vehicle. Therefore, the first control unit, the second control unit, and the third control unit can transmit (send, receive) necessary information (signals) with the controller of the vehicle.

[0120] According to the embodiment, the controller of the vehicle is an integrated controller that determines the motion control of the vehicle and has a self-diagnosis function. Therefore, the first control unit, the second control unit, and the third control unit can be connected to the integrated controller with the self-diagnosis function. On the other hand, both the first control unit and the second control unit do not have a self-diagnosis function. Therefore, a low-cost microcomputer (ECU) can be used as the first control unit and the second control unit.

[0121] According to the embodiment, the first control unit, the second control unit, the third control unit, and the vehicle controller form a ring network. Therefore, for example, even if the path (communication line) connecting the first control unit and the vehicle controller, the path (communication line) connecting the second control unit and the vehicle controller, the path (communication line) connecting the third control unit and the first control unit, and the path (communication line) connecting the third control unit and the second control unit are cut off (disconnected), necessary information (signals) can be transmitted (sent, received) among the first control unit, the second control unit, the third control unit, and the vehicle controller.

[0122] According to the embodiment, the motor is a brake motor that controls the electric brake mechanism. Therefore, the brake motor can be driven by the first motor drive unit connected to the first control unit and the second motor drive unit connected to the second control unit.

[0123] In addition, the present invention is not limited to the above-mentioned embodiments, and includes various modified examples. For example, the above-mentioned embodiments are embodiments described in detail in order to explain the present invention in an easy-to-understand manner, and are not limited to all the structures described. In addition, a part of the structure of a certain embodiment can be replaced with the structure of other embodiments, and in addition, the structure of other embodiments can be added to the structure of a certain embodiment. In addition, for a part of the structure of each embodiment, other structures can be added / deleted / replaced.

[0124] This application claims the benefit of priority based on Japanese Patent Application No. 2022-117009 filed on July 22, 2022. The entire disclosure of Japanese Patent Application No. 2022-117009 filed on July 22, 2022 including specification, claims, drawings, and abstract is incorporated herein by reference in its entirety.

[0125] Description of Reference Numerals

[0126] 1: Motor control system, 2: Brake motor (motor), 7: Motor control device (motor controller), 8: First motor drive unit, 8A: First inverter circuit (first bridge circuit unit), 8B: First fault protection relay (first relay unit), 9: First control unit, 10: Second motor drive unit, 11: Second control unit, 15: First rotation sensor (first rotation position detection unit), 16: Second rotation sensor (second rotation position detection unit), 29: First power supply (power supply), 33: Integrated control device (vehicle controller, vehicle controller, integrated controller), 41: Third control unit, 42: Third rotation sensor (third rotation position detection unit).

Claims

1. A motor control device, comprising: A first motor driving unit drives a motor; A second motor driving unit drives the motor; a first control unit connected to the first motor driving unit, acquiring a detection value of a first rotation position detecting unit that detects a rotation position of the motor, and monitoring a phase current of the second motor driving unit; a second control unit connected to the second motor driving unit, acquiring a detection value of a second rotation position detection unit that detects a rotation position of the motor, and monitoring a phase current of the first motor driving unit; as well as The third control unit acquires a detection value of a third rotation position detection unit that detects a rotation position of the motor, and monitors a phase current of the first motor drive unit and a phase current of the second motor drive unit.

2. The motor control device according to claim 1, wherein: The first motor driving unit comprises: a first bridge circuit portion; and a first relay unit for switching connection and disconnection between the first bridge circuit unit and a power source; The second control unit outputs a first abnormality instruction signal for disconnecting the first relay unit based on the current phase obtained from the detection value of the second rotation position detection unit and the phase current value of the first motor drive unit. The third control unit outputs a second abnormality instruction signal for disconnecting the first relay unit based on a current phase obtained from a detection value of the third rotational position detection unit and a phase current value of the first motor drive unit.

3. The motor control device according to claim 2, wherein: When both the first abnormal command signal and the second abnormal command signal are output, the first relay unit is cut off.

4. The motor control device according to claim 3, wherein: The first control unit, the second control unit, and the third control unit are connected to a controller of the vehicle. When the first relay unit is disconnected, the second control unit or the third control unit notifies a controller of the vehicle of an abnormality in the first control unit or the first motor drive unit.

5. The motor control device according to claim 1, wherein: The first control unit and the second control unit do not have a self-diagnosis function.

6. The motor control device according to claim 1, wherein: The ASIL level of the first control unit and the ASIL level of the second control unit are ASIL-B standards.

7. The motor control device according to claim 1, wherein: The first control unit, the second control unit, and the third control unit are connected to a controller of a vehicle.

8. The motor control device according to claim 7, wherein: The vehicle controller is a comprehensive controller that determines the motion control of the vehicle and has a self-diagnosis function. Neither the first control unit nor the second control unit has a self-diagnosis function.

9. The motor control device according to claim 7, wherein: The first control portion, the second control portion, the third control portion, and a controller of the vehicle constitute a ring network.

10. The motor control device according to claim 1, wherein: The motor is a brake motor that controls an electric brake mechanism that applies braking force to a vehicle.

11. A motor control system, comprising: Motor; and a motor controller, controlling the motor, The motor controller comprises: A first motor driving unit drives the motor; A second motor driving unit drives the motor; a first control unit connected to the first motor driving unit, acquiring a detection value of a first rotation position detecting unit that detects a rotation position of the motor, and monitoring a phase current of the second motor driving unit; a second control unit connected to the second motor driving unit, acquiring a detection value of a second rotation position detection unit that detects a rotation position of the motor, and monitoring a phase current of the first motor driving unit; as well as a third control unit that acquires a detection value of a third rotation position detection unit that detects a rotation position of the motor and monitors a phase current of the first motor drive unit and a phase current of the second motor drive unit, The motor control system further comprises: The vehicle controller is connected to the first control unit, the second control unit, and the third control unit.

Images