Redundant power supply system

Abstract

The present invention relates to a redundant power supply system comprising: a sub-power supply; a first circuit; a second circuit for supplying power from the sub-power source to the plurality of loads; and a control unit for controlling the operation of the first circuit and the second circuit on the basis of the state of the main power supply, the control unit operating only the first circuit when there is no notification of failure of the main power supply from the plurality of loads, and operating only the second circuit when there is no notification of failure of the main power supply from the first load and there is a notification of failure of the main power supply from a second load, which is one of the plurality of loads. The control unit operates the first circuit if the voltage of the sub-power supply drops to a predetermined lower limit voltage after only the second circuit is operated.

Description

Technical Field

[0001] The present disclosure relates to a redundant power supply system that supplies power to a plurality of loads from a secondary power supply as a backup when a primary power supply fails. Background Art

[0002] Japanese Patent Application Laid-Open No. 2022-161163 discloses a redundant power supply system in which, when a main power supply for supplying power to multiple loads (shift-by-wire, brakes, door unlockers) mounted on a vehicle fails, a secondary power supply can be used to supply backup power to the multiple loads instead of the main power supply.

[0003] Switching from the main power source to the secondary power source is based on determining failure of the main power source for each of the multiple loads. However, this determination of main power source failure varies depending on various factors (such as the load's design values, the length of the wiring from the main power source to the load, and detection errors). Consequently, it is possible for one load to determine that the main power source has failed, while other loads may determine that the main power source has not failed.

[0004] In the redundant power supply system of the aforementioned Japanese Patent Application Laid-Open No. 2022-161163, etc., priority is given to the safety of the vehicle. Therefore, if a failure judgment of the main power supply is made in at least one load and it is determined that a backup is required, backup control is started in which power is supplied from the auxiliary power supply. However, there are cases where a specific load cannot be judged as failing the main power supply even after the start of backup control (for example, a case where the voltage does not drop to the judgment standard of a specific load). Since this specific load continues the normal control, there is a possibility that the activities that should be performed in the backup control (such as the behavior of the vehicle and the state transition) cannot be performed. Summary of the Invention

[0005] The present disclosure provides a redundant power supply system capable of supplying power to a load for executing an activity to be performed in backup control when there is a load that cannot determine the failure of the main power supply even after other loads have determined the failure of the main power supply.

[0006] One embodiment of the disclosed technology is a redundant power supply system that provides backup power to multiple loads in the event of a main power failure, comprising:

[0007] Auxiliary power supply;

[0008] a first circuit for supplying power from a main power source to a first load that is one of a plurality of loads;

[0009] a second circuit for supplying power from the secondary power supply to a plurality of loads; and

[0010] The control unit controls the operation of the first circuit and the second circuit based on the state of the main power supply.

[0011] When there is no main power failure notification from the plurality of loads, the control unit operates only the first circuit.

[0012] When there is no main power failure notification from the first load and a main power failure notification from the second load, which is one of the multiple loads, the control unit operates the first circuit if the voltage of the slave power supply drops to a predetermined lower limit voltage after only the second circuit is operated.

[0013] According to the redundant power supply system disclosed above, after a second load other than the first load has determined that the main power supply has failed, and the power supply source has become the secondary power supply (activating the second circuit), if the secondary power supply drops to a lower limit voltage and the first load has not determined that the main power supply has failed, the main power supply is connected to the first load (activating the first circuit). This allows the first load to perform the activities required under backup control. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Hereinafter, features, advantages, technical and industrial significance of exemplary embodiments of the present invention will be described with reference to the accompanying drawings, in which like reference numerals represent like elements, and in which:

[0015] Figure 1 This is a functional block diagram of a redundant power supply system and its peripheral components according to one embodiment of the present disclosure.

[0016] Figure 2 This sequence describes the operation of the redundant power supply system, shift-by-wire, and brakes when the main power supply fails.

[0017] Figure 3 This application example describes the operational sequence of a redundant power supply system, shift-by-wire, and brakes when the main power supply fails. DETAILED DESCRIPTION

[0018] After the power supply source is switched from the primary power source to the secondary power source due to a failure of the primary power source related to brakes, etc., if the failure of the primary power source related to shift-by-wire cannot be detected and the secondary power source is no longer available for backup, the redundant power supply system of the present disclosure can directly supply power from the primary power source to the shift-by-wire system. This allows the shift-by-wire system to perform the parking lock operation using the primary power source even if the secondary power source fails.

[0019] Hereinafter, one embodiment of the present disclosure will be described in detail with reference to the accompanying drawings.

[0020] Implementation Method

[0021] constitute

[0022] Figure 1This is a functional block diagram of a redundant power supply system 100 and its peripheral components according to one embodiment of the present disclosure. Figure 1 The illustrated functional modules include a redundant power supply system 100, a shift-by-wire (SBW) 210, a brake (BRK) 220, and a door unlocker 230. Figure 1 In the figure, the power lines for transmitting and receiving power are shown as solid lines, and the signal lines for transmitting and receiving control instructions, notifications, detection values, etc. are shown as dotted lines. The redundant power supply system 100, the shift-by-wire 210, the brake 220, and the door unlocker 230 are mounted on a vehicle or the like.

[0023] The main power supply 300 is a power supply source that supplies power of a predetermined voltage (+B voltage) to the redundant power supply system 100, the shift-by-wire 210, the brake 220, and the door unlocker 230. The main power supply 300 is composed of a rechargeable secondary battery such as a lithium-ion battery or a lead-acid battery.

[0024] The redundant power supply system 100 functions as an auxiliary power supply for backing up power to the shift-by-wire 210, brake 220, and door unlocker 230 when an abnormality occurs in the power supply from the main power supply 300 to these devices, such as due to a power failure of the main power supply 300. The redundant power supply system 100 includes a pass-through circuit 110, a secondary power supply 120, a DC-DC converter 130, a plurality of switches 141 to 143, a monitor 150, and a control unit 160.

[0025] The through circuit 110 is connected to the main power supply 300 and supplies power from the main power supply 300 to the shift-by-wire 210 and the door unlocker 230. This through circuit 110 is typically configured to include switching elements such as semiconductor relays. The through circuit 110 switches the electrical connection between the main power supply 300, the shift-by-wire 210, and the door unlocker 230 by controlling the switching elements to turn on and off based on instructions from the control unit 160.

[0026] The secondary power supply 120 is a power supply source composed of, for example, a storage element such as a capacitor or a rechargeable secondary battery such as a lithium-ion battery. The secondary power supply 120 is connected to a DC-DC converter 130 so that it can be charged with power input from the main power supply 300 via the direct-through circuit 110. Furthermore, the secondary power supply 120 is connected to the DC-DC converter 130 so that it can discharge its own stored power (backup power) to the shift-by-wire 210, the brake 220, and the door unlocker 230.

[0027] The DC-DC converter 130 is a power converter for controlling the charge and discharge of power from the slave power supply 120. Based on instructions from the control unit 160, the DC-DC converter 130 can convert power input from the main power supply 300 via the through-circuit 110 into power of a predetermined voltage and output it to the slave power supply 120. Furthermore, the DC-DC converter 130 can convert power stored in the slave power supply 120 into power of a predetermined voltage and output it to the shift-by-wire 210, the brake 220, and the door unlocker 230.

[0028] The multiple switches 141-143 are composed of switching elements such as normally closed semiconductor relays. The multiple switches 141-143 are respectively inserted between the power line connecting the through circuit 110 and the DC-DC converter 130 and the shift-by-wire 210, between the power line and the brake 220, and between the power line and the door unlocker 230. When the redundant power supply system 100 performs backup control based on an instruction from the control unit 160, the switches 141-143 are turned on to supply backup power from the secondary power supply 120 to the shift-by-wire 210, the brake 220, and the door unlocker 230.

[0029] In the redundant power supply system 100 described above, the through circuit 110 constitutes a first circuit, and the slave power supply 120 , the DCDC converter 130 , and the switches 141 to 143 constitute a second circuit.

[0030] The monitor 150 is configured to detect the state of the subsidiary power supply 120. Typically, the monitor 150 includes sensors that detect physical quantities such as voltage, current, and stored electricity as the state of the subsidiary power supply 120. The state of the subsidiary power supply 120 detected by the monitor 150 is acquired by the control unit 160.

[0031] The control unit 160 controls the operation of the direct circuit 110, the DCDC converter 130, and the switches 141 to 143 based on the state of the secondary power supply 120 obtained from the monitor 150 to realize backup power supply for the redundant power supply system 100. A microcomputer or the like can be used for the control unit 160.

[0032] The shift-by-wire (SBW) 210, brake 220 (BRK), and door unlocker 230 are onboard loads for achieving specified functions related to the vehicle, and are devices (or systems) that particularly require redundant power supply configurations. Figure 1 The device shown.

[0033] The shift-by-wire (SBW) 210 is a device (first load) that performs shift-by-wire control, enabling the transmission (not shown) to change gears using electrical signals. When the main power supply 300 is functioning normally, the shift-by-wire 210 operates using power (+B direct power) supplied from the main power supply 300 via the direct circuit 110 of the redundant power supply system 100 (normal control). Furthermore, when the main power supply 300 fails, the shift-by-wire 210 operates using power supplied from the slave power supply 120 via the DC-DC converter 130 (backup control). Furthermore, if the voltage (+B voltage) applied from the main power supply 300 falls below a predetermined first threshold, the shift-by-wire 210 can determine that the main power supply 300 has failed. Upon determining that the main power supply 300 has failed, the shift-by-wire 210 transmits a notification (failure notification) to the control unit 160 of the redundant power supply system 100 informing the controller 160 of the failure of the main power supply 300.

[0034] The brake (BRK) 220 is a device (second load) that performs brake control that can generate braking force for the vehicle. When the main power supply 300 is normal, the brake 220 operates using the power directly supplied from the main power supply 300 (normal control). Moreover, when the main power supply 300 fails, the brake 220 operates using the power supplied from the auxiliary power supply 120 via the DCDC converter 130 (backup control). In addition, when the voltage (+B voltage) applied from the main power supply 300 is below a predetermined second threshold value, the brake 220 can determine that the main power supply 300 has failed. When the failure of the main power supply 300 is determined, the brake 220 sends a notification (failure notification) to the control unit 160 of the redundant power supply system 100 to convey the fact that the main power supply 300 has failed.

[0035] The door unlocker 230 is a device (second load) that performs door locking and unlocking control, which uses electrical signals to lock and unlock the vehicle doors. When the main power supply 300 is functioning normally, the door unlocker 230 operates using power (+B direct power) supplied from the main power supply 300 via the direct circuit 110 of the redundant power supply system 100 (normal control). Furthermore, if the main power supply 300 fails, the door unlocker 230 operates using power supplied from the secondary power supply 120 via the DC-DC converter 130 (backup control). Furthermore, if the voltage applied from the main power supply 300 (+B voltage) falls below a predetermined third threshold, the door unlocker 230 can determine that the main power supply 300 has failed. Upon determining that the main power supply 300 has failed, the door unlocker 230 transmits a notification (failure notification) to the control unit 160 of the redundant power supply system 100 informing the controller 160 of the failure of the main power supply 300.

[0036] In this embodiment, it is assumed that the first threshold value used by the shift-by-wire 210 to determine a failure of the main power supply 300 is set lower than the second and third threshold values ​​used by the brake 220 and door unlocker 230 to determine a failure of the main power supply 300. Under this assumption, a situation may arise in which the brake 220 or door unlocker 230 can determine a failure of the main power supply 300, but the shift-by-wire 210 cannot.

[0037] In view of this, in this redundant power supply system 100 , the following operation is performed to cope with such situations where failure determinations are different.

[0038] action

[0039] Next, refer to Figure 2 The operation of the redundant power supply system 100 according to one embodiment of the present disclosure will be described. Figure 2 The following is an operation sequence for explaining the respective actions of the redundant power supply system 100, the shift-by-wire (SBW) 210, and the brake (BRK) 220 when the main power supply 300 fails. Figure 2 Omitted in .

[0040] In this Figure 2 In the action shown, the situation in which the state of the main power supply 300 (+B state) is reduced from a voltage of more than 12V to a voltage of 9.0V is described based on the first threshold value for the wire-controlled shift 210 to determine the failure of the main power supply 300 being set to 8.5V and the second threshold value for the brake 220 to determine the failure of the main power supply 300 being set to 9.4V.

[0041] (1) Stage 1: Main power supply is normal

[0042] When the main power supply 300 is in a normal state (S41), power with a voltage of 12V or higher is supplied from the main power supply 300 to the redundant power supply system 100, the shift-by-wire 210, and the brake 220 (+B power supply). Since the voltage of the +B power supply is 12V or higher (> the first threshold), the shift-by-wire 210 performs normal control (S11). Furthermore, since the voltage of the +B power supply is 12V or higher (> the second threshold), the brake 220 performs normal control (S31). Since there is no failure notification of the main power supply 300 from the shift-by-wire 210 and the brake 220, the redundant power supply system 100 performs normal control (pass-through mode) (S21).

[0043] (2) Stage 2: Main power supply abnormality

[0044] If the main power supply 300 fails, dropping its voltage to 9.0V (S42), power at 9.0V is supplied from the main power supply 300 to the redundant power supply system 100, the shift-by-wire 210, and the brake 220 (+B power supply). Since the voltage of the +B power supply is 9.0V or higher (>1st threshold), the shift-by-wire 210 continues normal control. In contrast, since the voltage of the +B power supply is 9.0V (<2nd threshold), the brake 220 determines that the main power supply 300 has failed (S32). Based on this determination, the brake 220 notifies the redundant power supply system 100 of the failure of the main power supply 300. Since the brake 220 receives the failure notification of the main power supply 300, the redundant power supply system 100 determines that a backup for the brake 220 is required (S22, YES).

[0045] (3) Stage 3: Transition from conventional control to backup control

[0046] Determining that brake 220 requires backup, redundant power supply system 100 executes backup control (capacitor mode) ( S23 ). During this backup control, redundant power supply system 100 disconnects direct-through circuit 110 and turns on switches 141 - 143 . Furthermore, backup power (12V or higher) is supplied from slave power supply 120 via DCDC converter 130 to shift-by-wire 210 and brake 220 (C power supply).

[0047] The redundant power supply system 100 is informed that the brake 220 of the failure of the main power supply 300 requires power to perform three braking operations to generate braking force for the vehicle in order to stop the vehicle safely (S33). The required power is consumed by the secondary power supply 120 (consumption of capacitor capacity).

[0048] (4) Stage 4: P lock control (transition)

[0049] After starting backup control (capacitor mode), the redundant power supply system 100 determines whether it is necessary to lock the vehicle's shift position in the parking position (hereinafter referred to as "P Lock") (S24). This determination is made based on the capacity (lower capacity limit) of the slave power supply 120. Typically, the determination is made based on factors such as whether the slave power supply 120 has consumed an amount of capacity corresponding to the capacity required for brake 220 failure control and whether the slave power supply 120 still has the capacity required to execute P Lock.

[0050] If a P-lock is determined to be necessary (S24, YES), the redundant power supply system 100 transmits a P-lock control signal (e.g., a PWM signal with a predetermined duty cycle) to the shift-by-wire 210, instructing the execution of the P-lock (S25). This P-lock control signal is repeatedly transmitted until the voltage of the slave power supply 120 reaches the lower limit voltage (PWC detection limit voltage) for enabling backup control, that is, until the capacity of the slave power supply 120 decreases to a level equivalent to exhaustion (S26).

[0051] On the other hand, since shift-by-wire 210 is operating in normal control, even if a P lock control signal is received from redundant power supply system 100 , no response is made, that is, shift P is not locked and control is continued ( S12 ).

[0052] If the voltage of the secondary power supply 120 reaches the lower limit voltage for backup control (S26, YES), the redundant power supply system 100 stops sending the P lock control signal (S27). Then, the redundant power supply system 100 performs safety control to turn on the through circuit 110 (S28).

[0053] (5) Stage 5: Restart of the direct circuit

[0054] When the redundant power supply system 100 controls the direct circuit 110, 9.0V power is resupplied from the main power supply 300 to the shift-by-wire 210 and the brake 220 (+B power supply) via the direct circuit 110 (S44). The resumption of the direct 9.0V power supply allows the shift-by-wire 210 to operate in response to a manual P-lock operation by the driver or the like.

[0055] The shift-by-wire 210 determines whether a manual P lock operation is performed by the driver of the vehicle (S13). If a manual P lock operation is performed, the shift-by-wire 210 locks the shift to the parking position and stops the vehicle (S14).

[0056] As described above, in redundant power supply system 100 according to this embodiment, if shift-by-wire 210 does not respond to a P-lock control signal sent to shift-by-wire 210 during backup control, direct-through circuit 110, which was shut off during backup control, is reopened to apply shift-by-wire 210. This control allows shift-by-wire 210 to be P-locked in response to a manual P-lock operation, provided that the voltage at the time of a failure of main power supply 300 is at a voltage at which shift-by-wire 210 can operate. This prevents the loss of backup power from slave power supply 120, which could prevent P-lock from being achieved.

[0057] Apply Action

[0058] Figure 3The following is an operational sequence for explaining the applicable activities of the redundant power supply system 100 , the shift-by-wire (SBW) 210 , and the brake (BRK) 220 when the main power supply 300 fails.

[0059] Should Figure 3 The applied actions shown are similar to those above Figure 2 Compared to the operations shown, the first, second, and third stages are the same, but the fourth and subsequent stages are different. Therefore, the following will describe the different fourth and subsequent stages.

[0060] (4') Stage 4: P lock control (mandatory)

[0061] After starting backup control (S23), the redundant power supply system 100 determines whether the vehicle's gear shift needs to be P-locked (S24). This determination is made based on the capacity (lower capacity limit) of the slave power supply 120. Typically, the determination is made based on factors such as whether the slave power supply 120 has consumed an amount of capacity corresponding to the capacity required for brake 220 failure control and whether the slave power supply 120 still has the capacity required for P-locking.

[0062] If it is determined that P-lock is necessary (S24, Yes), redundant power supply system 100 transmits a P-lock control signal to shift-by-wire 210, instructing the execution of P-lock (S25). Shift-by-wire 210 is pre-designed to forcibly perform P-lock on the shift upon receipt of a P-lock control signal from redundant power supply system 100, regardless of whether the control currently being executed is normal or backup. Therefore, in this practical operation, shift-by-wire 210 performs P-lock on the shift upon receipt of a P-lock control signal from redundant power supply system 100 (S15). The vehicle is thereby secured (S14). Upon completion of P-lock on the shift (S29, Yes), redundant power supply system 100 ceases transmission of the P-lock control signal (S27).

[0063] In the above-mentioned application operation, by pre-designing shift-by-wire 210 to forcibly perform P-lock upon receiving a P-lock control signal regardless of the control state, shift-by-wire 210 can be automatically P-locked at a necessary timing without exhausting subsidiary power supply 120 .

[0064] Function / Effect

[0065] As described above, according to the redundant power supply system 100 involved in one embodiment of the present disclosure, in a configuration in which the +B voltage of the main power supply 300 is applied to the shift-by-wire 210 via the through-circuit 110, when there is no failure notification of the main power supply 300 from the shift-by-wire 210 and there is a failure notification of the main power supply 300 from the brake 220 and the door unlocker 230, priority is given to the application of the backup voltage based on the slave power supply 120, and when the voltage of the slave power supply 120 drops to the lower limit voltage at which backup is possible, the voltage application from the through-circuit 110 is restarted.

[0066] This control allows for maximum power to be supplied from main power supply 300 to shift-by-wire 210 if a failure of main power supply 300 is sufficient to maintain a voltage level sufficient for shift-by-wire 210 operation. Examples of failures sufficient to maintain a voltage level sufficient for shift-by-wire 210 operation include voltage drops due to deterioration of the battery serving as main power supply 300 or voltage drops due to an increase in the vehicle load using main power supply 300 as a power source. Therefore, even if subsidiary power supply 120 is depleted, shift-by-wire 210 can still execute a P-lock operation manually operated by reapplying the +B voltage from main power supply 300.

[0067] Furthermore, according to redundant power supply system 100 of the present embodiment, if a function of forcibly performing P-lock on the shift according to the P-lock control signal is preliminarily assigned to shift-by-wire 210 , the shift can be easily P-locked using the P-lock control signal.

[0068] The above describes one embodiment of the disclosed technology. However, the present disclosure can be understood not only as a redundant power supply system but also as a control method performed by a control unit of a redundant power supply system, a program for the control method, a computer-readable non-transitory storage medium storing the program, a vehicle equipped with the power supply system, and the like.

[0069] The redundant power supply system of the present disclosure can be used when it is desired to backup power supply from a slave power supply to a plurality of loads when a master power supply fails.

Claims

1. A redundant power supply system that provides backup power to multiple loads when the main power supply fails, wherein: have: Auxiliary power supply; a first circuit for supplying power from the main power supply to a first load that is one of the plurality of loads; a second circuit for supplying power from the subsidiary power supply to the plurality of loads; and a control unit that controls the operations of the first circuit and the second circuit based on the state of the main power supply, When there is no failure notification of the main power supply from the plurality of loads, the control unit operates only the first circuit. When there is no failure notification of the main power supply from the first load and there is a failure notification of the main power supply from the second load which is one of the multiple loads, if the voltage of the slave power supply drops to a specified lower limit voltage after only the second circuit is operated, the control unit operates the first circuit.

2. The redundant power supply system according to claim 1, wherein: The first circuit is a through circuit that directly outputs the input power of the main power supply during operation.

3. The redundant power supply system according to claim 1 or 2, wherein: When there is no failure notification of the main power supply from the first load and there is failure notification of the main power supply from the second load, the control unit operates only the first circuit if it is determined that backup power supply to the plurality of loads is unnecessary.

4. The redundant power supply system according to any one of claims 1 to 3, wherein: The redundant power supply system is mounted on a vehicle. The first load is a shift-by-wire device, The second load is a brake device or a door unlocker device.

5. A redundant power supply system, mounted on a vehicle, which provides backup power to multiple loads when the main power supply fails, wherein: have: Auxiliary power supply; a first circuit for supplying power from the main power supply to a shift-by-wire device that is one of the plurality of loads; a second circuit for supplying power from the secondary power supply to the plurality of loads; as well as a control unit that controls the operations of the first circuit and the second circuit based on the state of the main power supply, When there is no failure notification of the main power supply from the plurality of loads, the control unit operates only the first circuit. In a case where there is no failure notification of the main power supply from the shift-by-wire device and there is a failure notification of the main power supply from devices other than the shift-by-wire device included in the multiple loads, if the capacity of the auxiliary power supply decreases to a specified lower limit capacity after only the second circuit is operated, the control unit controls the shift-by-wire device in such a manner that the parking lock is activated. The redundant power supply system according to claim 5 , wherein: When there is no failure notification of the main power supply from the shift-by-wire device and there is failure notification of the main power supply from the other device, the control unit operates only the first circuit if it is determined that backup power supply to the plurality of loads is not necessary.

7. The redundant power supply system according to claim 5 or 6, wherein: The further device is a brake device or a door unlocking device.

Images