Control device

Abstract

To provide a control device capable of appropriately detecting abnormality of an internal communication partner.SOLUTION: A control device has: control circuits (22, 32) for generating a periodic pulse signal; and two power supply circuits for resetting the control circuits when abnormality of the periodic pulse signal continues for a first abnormality determination time (ΔTCL). The two control circuits decide abnormality of a communication partner when an accumulation time which is the total time in which abnormality is detected reaches an abnormality decision time within a second abnormality determination time if the abnormality of the communication partner is detected in accordance with reset of the communication partner. Furthermore, the first abnormality determination time (ΔTCL) and the second abnormality determination time (ΔTSTP) are set so that a time from when the abnormality of the communication partner is detected until when the abnormality of the communication partner is decided becomes shorter than a time obtained by subtracting the total non-detection time (ΔTNON) due to restarting after completion of reset in which the abnormality of the communication partner is not detected from the second abnormality determination time (ΔTSTP).SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a control device. [Background technology]

[0002] Conventionally, there exists a control device having two control systems. For example, the control device of Patent Document 1 has a first control unit and a second control unit. The first control unit and the second control unit monitor each other's operations. The first control unit determines an abnormality in the second control unit through communication with the second control unit. The second control unit determines an abnormality in the first control unit through communication with the first control unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-167123 Summary of the Invention [Problem to be solved by the invention]

[0004] A control device is required to appropriately detect an abnormality in an internal communication partner. [Means for solving the problem]

[0005] A control device that can solve the above problem includes two control circuits configured to control a controlled object and configured to generate a periodic pulse signal indicating its own normal operation, and two power supply circuits configured to manage power supplied to the control circuits and configured to reset the control circuits when an abnormality in the periodic pulse signal continues for a first abnormality determination time. The two control circuits are communication partners with each other, and are configured to determine the abnormality of the communication partner when an abnormality in the communication partner is detected as a result of resetting the communication partner and an integrated time that is the total time during which the abnormality is detected reaches an abnormality determination time within a second abnormality determination time. The second abnormality determination time is set to a time that allows the resetting of the control circuit in which an abnormality in the periodic pulse signal is detected and the determination of the abnormality in the periodic pulse signal by the power supply circuit corresponding to the control circuit being reset to be repeated multiple times. Furthermore, the first abnormality judgment time and the second abnormality judgment time are set so that the time from when an abnormality in the communication partner is detected to when the abnormality in the communication partner is confirmed is shorter than the second abnormality judgment time minus the total non-detection time due to restart after completion of reset during which no abnormality in the communication partner is detected.

[0006] According to this configuration, the integrated time, which is the sum of the detection times of the abnormality integrated within the second abnormality judgment time, reaches the abnormality determination time within the second abnormality judgment time. In other words, the time from when the abnormality of the communication partner is detected to when the abnormality of the communication partner is determined is shorter than the second abnormality judgment time. Therefore, the control circuit that is not reset can properly detect the internal abnormality of the communication partner.

[0007] In the above control device, the first abnormality judgment time may be set so that the non-detection time due to restart after completion of reset, during which no abnormality in the communication partner is detected, is shorter than the detection time during which an abnormality is detected due to the reset of the communication partner.

[0008] For example, it is conceivable that an abnormality in the periodic pulse signal of one of the two control circuits will occur permanently. In this case, the reset of the control circuit in which the abnormality in the periodic pulse signal is detected and the confirmation of the abnormality in the periodic pulse signal by the power supply circuit corresponding to the reset control circuit are repeated. That is, even if the reset control circuit is restarted upon completion of the reset, the restarted control circuit will be reset again because the abnormality in the periodic pulse signal will be continuously detected again for the first abnormality determination time. The non-detection time after completion of the reset during which no abnormality in the communication partner is detected is the same as the first abnormality determination time. The control circuit that is not reset accumulates the time during which the abnormality in the communication partner is detected each time the communication partner is reset, and confirms the abnormality in the communication partner when the accumulated time reaches the abnormality confirmation time within the second abnormality determination time.

[0009] However, depending on the setting of the first abnormality judgment time, the integrated time may not reach the abnormality confirmation time within the second abnormality judgment time. For example, if the non-detection time due to restart after completion of resetting, during which an abnormality in the communication partner is not detected, is set to be longer than the detection time during which an abnormality in the communication partner is detected by resetting the communication partner, the integrated time may not reach the abnormality confirmation time within the second abnormality judgment time. This is thought to be because the non-detection time due to restart after completion of resetting, during which an abnormality in the communication partner is not detected, is long, resulting in an insufficient number of times that an abnormality in the communication partner is detected within the second abnormality judgment time.

[0010] In this regard, according to the above configuration, the non-detection time due to restart after completion of resetting during which no abnormality in the communication partner is detected is set to be shorter than the detection time during which the abnormality in the communication partner is detected by resetting the communication partner. The number of times that the abnormality in the communication partner is detected within the second abnormality judgment time is ensured by the amount of the non-detection time due to restart after completion of resetting during which no abnormality in the communication partner is detected being shortened. Therefore, the integrated time, which is the total of the abnormality detection times integrated within the second abnormality judgment time, is more likely to reach the abnormality confirmation time. Therefore, the control circuit that is not reset can properly detect an internal abnormality in the communication partner in which an abnormality in the periodic pulse signal is permanently detected.

[0011] The control device may further include a communication line for transmitting and receiving information between the two control circuits, and a signal line for transmitting and receiving the periodic pulse signal between the two control circuits. In this case, the control circuit may be configured to determine that the function of the control circuit of the communication partner has stopped when communication via the communication line is not established and the periodic pulse signal of the communication partner acquired via the signal line is abnormal.

[0012] When the function of the control circuit of the communication partner is stopped, the communication via the communication line is not established. Also, the periodic pulse signal generated by the control circuit of the communication partner whose function has been stopped also shows an abnormality. Therefore, as in the above configuration, if the communication via the communication line is not established and the periodic pulse signal of the communication partner acquired via the signal line is abnormal, it can be said that the function of the control circuit of the communication partner has stopped.

[0013] The control device may further include a communication line for transmitting and receiving information between the two control circuits, and a signal line for transmitting and receiving the periodic pulse signal between the two control circuits. In this case, the control circuit may be configured to determine that the communication via the communication line is abnormal when the communication via the communication line is not established and the periodic pulse signal of the communication partner acquired via the signal line is normal.

[0014] With this configuration, even if communication via the communication line is not established, if the periodic pulse signal of the communication partner acquired via the signal line is normal, it can be said that the control circuit of the communication partner is operating. Therefore, the control circuit of the communication partner is not in a state of non-functioning, but can know that communication via the communication line is abnormal.

[0015] In the above control device, the two control circuits may have a master-slave relationship. That is, one of the two control circuits functions as a master, while the other of the two control circuits functions as a slave. In this case, the control circuit functioning as a slave may be configured to stop operation when it is determined that communication via the communication line is abnormal.

[0016] Depending on the product specifications, it may be required to stop the operation of the control circuit functioning as a slave when it is determined that the communication via the communication line is abnormal. With the above configuration, it is possible to obtain a control device according to the product specifications.

[0017] In the above control device, the controlled object may be a motor having two systems of winding groups. In this case, the control circuit may be configured to independently control the power supply to the winding group of the system corresponding to itself, and to drive the motor only through the power supply to the winding group of the system corresponding to itself when an abnormality in the communication partner is confirmed.

[0018] According to this configuration, even if an abnormality is confirmed in either one of the two control circuits, the motor can be driven. Effect of the Invention

[0019] According to the control device of the present invention, an abnormality in an internal communication partner can be appropriately detected. [Brief description of the drawings]

[0020] [Figure 1]FIG. 2 is a block diagram of an embodiment of a control device. [Diagram 2] 4 is a time chart of a process performed at the time of start-up by a comparative example of a control device. [Diagram 3] 11 is a graph showing a change over time in an integrated time obtained by integrating the time during which an abnormality in a communication counterpart is detected according to a comparative example. [Figure 4] 4 is a time chart of a process performed at startup by an embodiment of a control device. [Diagram 5] 11 is a graph showing a change over time in an integrated time obtained by integrating the time during which an abnormality in a communication counterpart is detected according to an embodiment; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] An embodiment of the control device will be described below. As shown in FIG. 1, a control device 11 controls the driving of a motor 12. The motor 12 is a three-phase brushless motor. The motor 12 has a rotor 13, a first winding group 14, a second winding group 15, a first rotation angle sensor 16, and a second rotation angle sensor 17. The first winding group 14 and the second winding group 15 have a U-phase coil, a V-phase coil, and a W-phase coil, respectively. The first rotation angle sensor 16 and the second rotation angle sensor 17 detect a rotation angle θ of the motor 12. m1 ,θ m2 The rotation angle θ of the motor 12 is detected. m1 ,θ m2 is the rotation angle of the rotor 13.

[0022] The control device 11 and the motor 12 are connected to each other via a power supply path. The power supply path is composed of a bus bar or a cable. The control device 11 is connected to the first winding group 14 via a first power supply path, and is connected to the second winding group 15 via a second power supply path. The control device 11 controls the power supply to the first winding group 14 and the second winding group 15 for each system. The control device 11 has a first control unit 20 that controls the power supply to the first winding group 14, and a second control unit 30 that controls the power supply to the second winding group 15.

[0023] The first control unit 20 has a first power supply circuit 21, a first microcomputer 22 as a control circuit, and a first inverter 23. The first power supply circuit 21 is, for example, a chip-type integrated circuit, and is connected to a power supply via a power line. The power supply is, for example, a battery that is a DC power supply. The first power supply circuit 21 manages the power supplied to the first microcomputer 22. Specifically, the first power supply circuit 21 converts the voltage of the power supply to a voltage suitable for the operation of the first microcomputer 22, and supplies the converted voltage to the first microcomputer 22. The initial voltage or nominal voltage of the power supply is, for example, 12V. The voltage suitable for the operation of the first microcomputer 22 is, for example, 5V, and may be less than 5V depending on the product specifications. The first power supply circuit 21 also has a function of monitoring the operation of the first microcomputer 22.

[0024] The first microcomputer 22 has a first clock pulse generating section 22A. The first clock pulse generating section 22A generates a first clock pulse S based on a clock having a fundamental frequency taken in from a crystal oscillator provided in the control device 11. CL1 The first clock pulse S CL1 is a clock signal for defining the operation timing of each part of the first microcomputer 22. Each part of the first microcomputer 22 includes a CPU (Central Processing Unit) and its peripheral circuits. The first clock pulse S CL1 The first clock pulse S is also a periodic pulse signal indicating that the first microcomputer 22 is operating normally. CL1 The voltage level alternates between high and low at regular intervals.

[0025] The object to be controlled by the first microcomputer 22 is the motor 12. The first microcomputer 22 calculates a first current command value which is a target value of a current to be supplied to the first winding group 14. The first current command value is set to an amount of current required for the first winding group 14 to generate half of the total torque required for the motor 12. In other words, the amount of current supplied to the first winding group 14 is half (50%) of the amount of current required for generating the total torque required for the motor 12.

[0026] The first microcomputer 22 generates a first command signal S1 for the first inverter 23 by executing current feedback control to make the value of the actual current supplied to the first winding group 14 follow a first current command value. The first command signal S1 is, for example, a PWM (Pulse Width Modulation) signal. The first microcomputer 22 generates a first command signal S1 for the first inverter 23 by executing current feedback control to make the value of the actual current supplied to the first winding group 14 follow a first current command value. The first command signal S1 is, for example, a PWM (Pulse Width Modulation) signal. m1 is used to control the energization of the first winding group 14.

[0027] The first inverter 23 is, for example, a three-phase inverter of a PWM type, and converts DC power supplied from a power source into three-phase AC power. The first inverter 23 has a plurality of switching elements provided corresponding to each of the three phases. The DC power supplied from the power source is converted into three-phase AC power by the switching elements of each of the three phases performing a switching operation based on a first command signal S1. A current corresponding to the first command signal S1 is supplied to the first winding group 14 through the first inverter 23.

[0028] The second control unit 30 basically has the same configuration as the first control unit 20. That is, the second control unit 30 has a second power supply circuit 31, a second microcomputer 32 as a control circuit, and a second inverter 33.

[0029] The second power supply circuit 31 is, for example, a chip-type integrated circuit, and is connected to a power supply via a power supply line. The power supply is, for example, a battery that is a DC power supply. The second power supply circuit 31 manages the power supplied to the second microcomputer 32. Specifically, the second power supply circuit 31 converts the voltage of the power supply to a voltage suitable for the operation of the second microcomputer 32, and supplies the converted voltage to the second microcomputer 32. The initial voltage or nominal voltage of the power supply is, for example, 12V. The voltage suitable for the operation of the second microcomputer 32 is, for example, 5V. The second power supply circuit 31 also has a function of monitoring the operation of the second microcomputer 32.

[0030] The second microcomputer 32 has a second clock pulse generating section 32A. The second clock pulse generating section 32A generates a second clock pulse S based on a clock having a fundamental frequency taken in from a crystal oscillator provided in the control device 11. CL2 The second clock pulse S CL2 is a clock signal for defining the operation timing of each part of the second microcomputer 32. Each part of the second microcomputer 32 includes a CPU and its peripheral circuits. The second clock pulse S CL2 The second clock pulse S is also a periodic pulse signal indicating that the second microcomputer 32 is operating normally. CL2 The voltage level alternates between high and low at regular intervals.

[0031] The control target of the second microcomputer 32 is the motor 12. The second microcomputer 32 calculates a second current command value which is a target value of a current to be supplied to the second winding group 15. The second current command value is set to an amount of current required for the second winding group 15 to generate half of the total torque required for the motor 12. In other words, the amount of current supplied to the second winding group 15 is half (50%) of the amount of current required for generating the total torque required for the motor 12.

[0032] The second microcomputer 32 generates a second command signal S2 for the second inverter 33 by executing current feedback control to make the value of the actual current supplied to the second winding group 15 follow the second current command value. The second command signal S2 is, for example, a PWM signal. The second microcomputer 32 generates a second command signal S2 for the second inverter 33 by executing current feedback control to make the value of the actual current supplied to the second winding group 15 follow the second current command value. The second command signal S2 is, for example, a PWM signal. m2 is used to control the energization of the second winding group 15.

[0033] The second inverter 33 is, for example, a three-phase inverter of a PWM type, and converts DC power supplied from a power source into three-phase AC power. The second inverter 33 has a plurality of switching elements provided corresponding to each of the three phases. The DC power supplied from the power source is converted into three-phase AC power by the switching elements of each of the three phases performing a switching operation based on a second command signal S2. A current corresponding to the second command signal S2 is supplied to the second winding group 15 through the second inverter 33.

[0034] There may be a master-slave relationship between the first microcomputer 22 and the second microcomputer 32. For example, the first microcomputer 22 may function as a master, while the second microcomputer 32 may function as a slave.

[0035] <Communication System> The first microcomputer 22 and the second microcomputer 32 exchange digital signals with each other via a first communication line 41 and a second communication line 42. The standard for communication between the first microcomputer 22 and the second microcomputer 32 via the first communication line 41 and the second communication line 42 is, for example, SPI (Serial Peripheral Interface). SPI is a type of standard for synchronous serial communication. The first microcomputer 22 and the second microcomputer 32 each have a function for detecting an abnormality in themselves and in the system to which they belong.

[0036] The first microcomputer 22 outputs a first status signal S d1 and generating a first state signal S d1 The first status signal S is transmitted to the second microcomputer 32 via the first communication line 41 and the second communication line 42. d1 is a digital signal indicating the state of the first microcomputer 22 and the first system to which the first microcomputer 22 belongs.

[0037] First status signal S d1 The abnormality occurrence state of the first system includes, for example, the presence or absence of abnormalities in the first microcomputer 22, the first inverter 23, and the first rotation angle sensor 16.

[0038] Depending on the product specifications, the first status signal S d1 may include the operating state of the first system and the torque generated by the first winding group 14. The operating state of the first system includes a state in which the first microcomputer 22 can control the power supply to the first winding group 14 and a state in which the first microcomputer 22 cannot control the power supply to the first winding group 14 due to a drop in the power supply voltage or the like. The generated torque is the degree of torque generated by the first winding group 14, and corresponds to a first current command value that is a target value of the current supplied to the first winding group 14.

[0039] The first microcomputer 22 receives a first clock pulse S CL1 to the second microcomputer 32. The first microcomputer 22 transmits the first clock pulse S CL1 to the first power supply circuit 21. The second signal line 44 branches off from the first signal line 43.

[0040] The second microcomputer 32, like the first microcomputer 22, outputs a second status signal S d2 and a second state signal Sd2 to the first microcomputer 22 via the first communication line 41 and the second communication line 42. d2 is a digital signal indicating the state of the second microcomputer 32 and the second system to which the second microcomputer 32 belongs.

[0041] The second microcomputer 32 receives a second clock pulse S via a third signal line 45. CL2 to the first microcomputer 22. The second microcomputer 32 transmits a second clock pulse S CL2 to the second power supply circuit 31. The fourth signal line 46 branches off from the third signal line 45.

[0042] <Anomaly detection> The first microcomputer 22 and the second microcomputer 32 output a first status signal S d1 , the second state signal S d2 , the first clock pulse S CL1 , the second clock pulse S CL2 Based on this, they will monitor each other.

[0043] The first microcomputer 22 outputs a second status signal S d2 When it is recognized through the above that a state in which power supply control to the second winding group 15 by the second system cannot be executed, the first microcomputer 22 executes single-system drive by the first system. When executing single-system drive, the first microcomputer 22 executes first power supply control or second power supply control to the first winding group 14. When executing single-system drive, whether to execute the first power supply control or the second power supply control is determined depending on the product specifications, etc.

[0044] The first power supply control is a power supply control during normal operation when the two-system drive is performed, and is a power supply control for providing half of the total torque required for the motor 12 with the torque generated by the first winding group 14. The second power supply control is a power supply control for providing the entire total torque required for the motor 12 with the torque generated by the first winding group 14. When the second power supply control is performed, the first current command value for the first winding group 14 is set to a value twice as high as that during normal operation when the two-system drive is performed. For example, the first microcomputer 22 switches the gain for the first current command value from "1x" during normal operation to "2x". By multiplying the first current command value by the gain "2x", the final first current command value becomes twice as high as that during normal operation.

[0045] The second microcomputer 32 also outputs the first status signal S d1 When it is recognized through the above that a state in which power supply control to the first winding group 14 by the first system cannot be executed, the second microcomputer 32 executes single-system drive by the second system, similar to the first microcomputer 22. When executing single-system drive, the second microcomputer 32 executes first power supply control or second power supply control to the second winding group 15. When executing single-system drive, whether the first power supply control or the second power supply control is executed depends on the product specifications, etc.

[0046] In this way, by independently controlling the power supply to the two winding groups in the motor 12, even if an abnormality occurs in one system, the motor 12 can continue to rotate through the power supply to the other winding group.

[0047] The first microcomputer 22 detects, for example, the following three abnormalities (A), (B), and (C). (A) First communication error The first microcomputer 22 determines that a first communication anomaly has occurred when all of the following judgment conditions (A1) to (A3) are met simultaneously. The first communication anomaly is an anomaly in communication via the first communication line 41. The first microcomputer 22 determines that the state in which all of the judgment conditions (A1) to (A3) are met lasts for a first anomaly determination time (ΔT th1 ) the occurrence of the first communication anomaly is determined. th1 ) is, for example, a time of about several tens of milliseconds.

[0048] (A1) Communication via the first communication line 41 is not established. (A2) Communication via the second communication line 42 is established. (A3) Second clock pulse S CL2 is normal.

[0049] Even if the communication via the first communication line 41 is not established, the communication via the second communication line 42 is established, and the second clock pulse S CL2 is normal, the second microcomputer 32 is operating normally.

[0050] However, as described later, the second microcomputer 32 has an abnormality detection function similar to that of the first microcomputer 22. The second microcomputer 32 stops its own operation when it is determined that an abnormality has occurred in the communication via the first communication line 41. This is in accordance with the product specifications. Therefore, the first microcomputer 22 executes one-system drive using the first system when it is determined that a first communication abnormality has occurred.

[0051] (B) Second communication anomaly The first microcomputer 22 determines that a second communication anomaly has occurred when all of the following judgment conditions (B1) to (B3) are met simultaneously. The second communication anomaly is an anomaly in communication via the second communication line 42. The first microcomputer 22 determines that the state in which all of the judgment conditions (B1) to (B3) are met lasts for a second anomaly determination time (ΔTth2 ) the occurrence of a second communication anomaly is confirmed. th2 ) is, for example, a time of about several tens of milliseconds.

[0052] (B1) Communication via the first communication line 41 is established. (B2) Communication via the second communication line 42 is not established. (B3) Second clock pulse S CL2 is normal.

[0053] Even if the communication via the second communication line 42 is not established, the communication via the first communication line 41 is established and the second clock pulse S CL2 is normal, the second microcomputer 32 is operating normally.

[0054] However, as described later, the second microcomputer 32 has an abnormality detection function similar to that of the first microcomputer 22. The second microcomputer 32 stops its own operation when it is determined that an abnormality has occurred in the communication via the second communication line 42. This is in accordance with the product specifications. Therefore, when it is determined that a first communication abnormality has occurred, the first microcomputer 22 executes one-system drive using the first system.

[0055] (C) The second microcomputer 32 stops functioning The first microcomputer 22 determines that the function of the second microcomputer 32 has stopped when all of the following determination conditions (C1) to (C3) are met simultaneously.

[0056] (C1) Communication via the first communication line 41 is not established. (C2) Communication via the second communication line 42 is not established. (C3) Second clock pulse S CL2 The second clock pulse S CL2 For the abnormality, the second clock pulse S CL2This includes the inability to obtain

[0057] When both the communication through the first communication line 41 and the communication through the second communication line 42 are not established and the second clock pulse S CL2 When the second microcomputer 32 is abnormal, it is highly likely that the second microcomputer 32 has stopped functioning. When the second microcomputer 32 has stopped functioning, the second microcomputer 32 is abnormal.

[0058] The first microcomputer 22 measures the detection period during which all of the judgment conditions (C1) to (C3) are satisfied, that is, the abnormality detection time of the second microcomputer 32. The abnormality detection time is the time during which an abnormality is detected in the second microcomputer 32. The first microcomputer 22 temporarily stores the measured abnormality detection time in a storage device. The storage device is, for example, a volatile memory such as a RAM (Random Access Memory).

[0059] The first microcomputer 22 is stopped after a predetermined stop determination time ΔT has elapsed since the first abnormality of the second microcomputer 32 was detected. STP The abnormality detection time of the second microcomputer 32 is measured every time an abnormality of the second microcomputer 32 is detected until the stop determination time ΔT STP is a second abnormality determination time, which is, for example, about several tens of seconds. STP The first microcomputer 22 sequentially accumulates the abnormality detection times measured within the period of time. The first microcomputer 22 temporarily stores the accumulated time, which is the sum of the accumulated abnormality detection times, in a storage device.

[0060] The first microcomputer 22 determines whether the integrated time is equal to the third abnormality determination time ΔT th3 When the third abnormality determination time ΔT th3 For example, the stop determination time ΔT STPThe first microcomputer 22 detects an abnormality in the second microcomputer 32 for the first time and determines whether or not the stoppage is due to a time ΔT STP When the abnormality detection time and the integrated time temporarily stored in the storage device have elapsed, the first microcomputer 22 executes one-system drive using the first system when the abnormality of the second microcomputer 32 is confirmed.

[0061] The second microcomputer 32 detects, for example, the following three abnormalities (D), (E), and (F). (D) First communication anomaly The second microcomputer 32 determines that a first communication anomaly has occurred when all of the following judgment conditions (D1) to (D3) are met simultaneously. As described above, the first communication anomaly is an anomaly in communication via the first communication line 41. The second microcomputer 32 determines that a first communication anomaly has occurred when the state in which all of the judgment conditions (D1) to (D3) are met continues for a first anomaly determination time.

[0062] (D1) Communication via the first communication line 41 is not established. (D2) Communication via the second communication line 42 is established. (D3) First clock pulse S CL1 is normal.

[0063] Even if the communication via the first communication line 41 is not established, the communication via the second communication line 42 is established, and the first clock pulse S CL1 is normal, the first microcomputer 22 is operating normally. The second microcomputer 32 stops its own operation when it is determined that the first communication abnormality has occurred. This is in accordance with the product specifications. Therefore, when it is determined that the first communication abnormality has occurred, the first microcomputer 22 executes one-system drive using the first system.

[0064] (E) Second communication error The second microcomputer 32 determines that a second communication anomaly has occurred when all of the following judgment conditions (E1) to (E3) are met simultaneously. As described above, the second communication anomaly is an anomaly in communication via the second communication line 42. The second microcomputer 32 determines that a second communication anomaly has occurred when the state in which all of the judgment conditions (E1) to (E3) are met continues for the second anomaly determination time.

[0065] (E1) Communication via the first communication line 41 is established. (E2) Communication via the second communication line 42 is not established. (E3) First clock pulse S CL1 is normal.

[0066] Even if the communication via the second communication line 42 is not established, the communication via the first communication line 41 is established and the first clock pulse S CL1 is normal, the first microcomputer 22 operates normally. However, the second microcomputer 32 stops its own operation when it is determined that the first communication abnormality has occurred. This is due to the product specifications. Therefore, when it is determined that the second communication abnormality has occurred, the first microcomputer 22 executes one-system drive using the first system.

[0067] (F) The first microcomputer 22 stops functioning The second microcomputer 32 determines that the function of the first microcomputer 22 has stopped when all of the following determination conditions (F1) to (F3) are met simultaneously.

[0068] (F1) Communication via the first communication line 41 is not established. (F2) Communication via the second communication line 42 is not established. (F3) First clock pulse S CL1 The first clock pulse S CL1 For the abnormality, the first clock pulse S CL1 This includes the inability to obtain

[0069] When both the communication through the first communication line 41 and the communication through the second communication line 42 are not established and the first clock pulse S CL1 When the first microcomputer 22 is abnormal, it is highly likely that the first microcomputer 22 has stopped functioning. When the first microcomputer 22 has stopped functioning, the first microcomputer 22 is abnormal.

[0070] The second microcomputer 32 measures the detection period during which all of the judgment conditions (F1) to (F3) are satisfied, that is, the abnormality detection time of the first microcomputer 22. The abnormality detection time is the time during which an abnormality is detected in the first microcomputer 22. The second microcomputer 32 temporarily stores the measured abnormality detection time in a storage device. The storage device is, for example, a volatile memory such as a RAM (Random Access Memory).

[0071] The second microcomputer 32 is stopped after a predetermined stop determination time ΔT has elapsed since the first abnormality of the first microcomputer 22 was first detected. STP The abnormality detection time of the first microcomputer 22 is measured every time an abnormality of the first microcomputer 22 is detected until the stop determination time ΔT STP The second microcomputer 32 determines whether the predetermined stop determination time ΔT STP The second microcomputer 32 temporarily stores the accumulated time, which is the sum of the accumulated abnormality detection times, in a storage device.

[0072] The second microcomputer 32 determines whether the integrated time is equal to the third abnormality determination time ΔT th3 When the third abnormality determination time ΔT th3 For example, the stop determination time ΔT STPThe second microcomputer 32 detects an abnormality in the first microcomputer 22 for a period of about half the stoppage determination time ΔT STP When the abnormality detection time and the integrated time temporarily stored in the storage device have elapsed, the second microcomputer 32 executes one-system drive using the second system when the abnormality of the first microcomputer 22 is confirmed.

[0073] <Resetting the microcomputer> The first power supply circuit 21 receives the first clock pulse S CL1 The first power supply circuit 21 receives the first clock pulse S CL1 The first power supply circuit 21 monitors the operation of the first microcomputer 22 based on the first clock pulse S CL1 The state in which an abnormality is detected is determined within the specified clock abnormality judgment time ΔT CL When the first clock pulse S CL1 The clock abnormality determination time ΔT CL is the first abnormality determination time. The first power supply circuit 21 receives the first clock pulse S CL1 When the abnormality is confirmed, the first microcomputer 22 is reset.

[0074] The reset is a process for initializing the internal state of the first microcomputer 22. An abnormality may be, for example, a loss of communication via the second signal line 44, i.e., a loss of the first clock pulse S CL1 One cause of the abnormality is, for example, an open fault in the second signal line 44. The open fault is a permanent fault in the second signal line 44.

[0075] The first power supply circuit 21 receives the first clock pulse S CL1 When an abnormality occurs in the first reset signal S RST1 to the first microcomputer 22. The first reset signal S RST1is an electrical signal for requesting a reset operation to the first microcomputer 22. When the reset is completed, the first microcomputer 22 restarts and executes a predetermined startup sequence. The startup sequence is a series of processes that are executed when the power is turned on, and is also an initial check that is executed after the reset is completed.

[0076] The second power supply circuit 31 receives the second clock pulse S CL2 The second power supply circuit 31 receives the second clock pulse S CL2 The second power supply circuit 31 monitors the operation of the second microcomputer 32 based on the second clock pulse S CL2 The state in which an abnormality is detected is determined within the specified clock abnormality judgment time ΔT CL When the second clock pulse S CL2 The second power supply circuit 31 detects an abnormality in the second clock pulse S CL2 When the abnormality is confirmed, the second microcomputer 32 is reset.

[0077] The reset is a process for initializing the internal state of the second microcomputer 32. An abnormality may be, for example, a loss of communication via the fourth signal line 46, i.e., a loss of the second clock pulse S CL2 One cause of the abnormality is, for example, an open fault of the fourth signal line 46. The open fault is a permanent fault of the fourth signal line 46.

[0078] The second power supply circuit 31 receives the second clock pulse S CL2 When an abnormality occurs in the RST2 to the second microcomputer 32. A second reset signal S RST2 is an electrical signal for requesting a reset operation to the second microcomputer 32. When the reset is completed, the second microcomputer 32 restarts and executes a predetermined startup sequence.

[0079] <Comparison example of anomaly detection> Next, a comparative example of abnormality detection will be described below. Here, a case where an open circuit fault has already occurred in the second signal line 44 before the power is turned on will be taken as an example.

[0080] 2, when the power is turned on (time T1), the first microcomputer 22 starts executing a predetermined startup sequence. When the first microcomputer 22 transitions to an operable state, it outputs a first status signal S d1 , and the first clock pulse S CL1 The output of the signal is started (time T2).

[0081] The first power supply circuit 21 receives the first clock pulse S CL1 After the output of the first clock pulse S CL1 Since an open fault has occurred in the second signal line 44, the first power supply circuit 21 judges whether the first clock pulse S CL1 The first power supply circuit 21 cannot obtain the first clock pulse S even though the power supply is turned on. CL1 Based on the inability to obtain the first clock pulse S CL1 The first power supply circuit 21 judges that the first clock pulse S CL1 The state in which an abnormality is detected is determined within the specified clock abnormality judgment time ΔT CL When the first clock pulse S CL1 The first power supply circuit 21 determines the abnormality of the first clock pulse S CL1 When the abnormality is confirmed, the first reset signal S RST1 to the first microcomputer 22.

[0082] The first microcomputer 22 outputs a first reset signal S RST1 In response to the reception of the first status signal S, the first microcomputer 22 performs a reset operation. d1 , and the first clock pulse S CL1After the reset operation is completed, the first microcomputer 22 starts executing the start-up sequence again (time T4). After that, when the first microcomputer 22 transitions to an operable state, it again outputs the first status signal S d1 , and the first clock pulse S CL1 The output of the signal is started (time T5).

[0083] The first power supply circuit 21 receives the first clock pulse S CL1 After the output of the first clock pulse S is resumed, CL1 Since an open fault has occurred in the second signal line 44, the first power supply circuit 21 again detects an abnormality in the first clock pulse S CL1 The first power supply circuit 21 judges that the first clock pulse S CL1 The state in which an abnormality is detected is determined within the specified clock abnormality judgment time ΔT CL When the first clock pulse S CL1 The abnormality is confirmed (time T6).

[0084] Thereafter, the first microcomputer 22 is reset and the first clock pulse S CL1 This process of confirming abnormalities is repeated. When the first microcomputer 22 is reset, all of the above judgment conditions (F1) to (F3) are satisfied simultaneously, so the second microcomputer 32 judges that the function of the first microcomputer 22 has stopped. The state in which the function of the first microcomputer 22 has stopped is an abnormality of the first microcomputer 22.

[0085] The second microcomputer 32 detects the abnormality detection time ΔT DT The time is measured and temporarily stored in a memory device. DT is the time when an abnormality in the first microcomputer 22 is detected.

[0086] The second microcomputer 32 is stopped after a predetermined stop determination time ΔT has elapsed since the first abnormality of the first microcomputer 22 was first detected. STP Each time the first microcomputer 22 is reset, the abnormality detection time ΔT of the first microcomputer 22 is DT Measure.

[0087] After the first microcomputer 22 has completed the reset, the first status signal S d1 and the first clock pulse S CL1 When the output of the first microcomputer 22 is resumed, the above judgment conditions (F1) to (F3) are no longer satisfied. Therefore, the second microcomputer 32 does not detect the abnormality of the first microcomputer 22. The abnormality non-detection time ΔT during which the second microcomputer 32 does not detect the abnormality of the first microcomputer 22 is NON is the clock anomaly detection time ΔT CL The second microcomputer 32 determines the abnormality non-detection time ΔT NON An abnormality in the first microcomputer 22 is detected every time the power is turned on.

[0088] As shown in FIG. 3, the second microcomputer 32 detects the abnormality detection time ΔT DT However, the stop determination time ΔT STP At the point in time (time Tn) when the abnormality detection time ΔT DT The cumulative time, which is the sum of the above, is the third abnormality confirmation time ΔT th3 This is because, for example, the abnormality non-detection time ΔT NON is the abnormality detection time ΔT DT Since the stop judgment time is longer than STP This is believed to be because the number of times that an abnormality in the first microcomputer 22 is detected within a certain period of time is insufficient.

[0089] Accumulated time is the stop judgment time ΔT STP The third abnormality is confirmed within ΔT th3If the abnormality detection time ΔT does not reach the threshold, the second microcomputer 32 does not determine that the first microcomputer 22 is abnormal, and the abnormality detection time ΔT DT As a result, there is a concern that the second microcomputer 32 may not be able to properly detect an abnormality in the first microcomputer 22 caused by an open fault in the second signal line 44.

[0090] <Example of anomaly detection> Therefore, in this embodiment, the control device 11 has the following configuration. That is, the time T from when an abnormality is detected to when it is confirmed CS The clock abnormality determination time ΔT is set so as to satisfy the following equation (1). CL and the stop determination time ΔT STP The abnormality is an abnormality in the first microcomputer 22 or the second microcomputer 32.

[0091] T CS <ΔT STP -ΣΔT NON …(1) However, "ΣΔT NON " is the abnormality non-detection time ΔT NON is the sum of.

[0092] In addition, the abnormality non-detection time ΔT NON is the abnormality detection time ΔT DT The clock anomaly detection time ΔT CL The clock abnormality determination time ΔT in this embodiment is set. CL is the clock abnormality determination time ΔT CL For example, the clock abnormality determination time ΔT CL That's less than half the time.

[0093] Clock abnormality determination time ΔT CLis set, for example, taking into consideration the variations in the hardware of the first power supply circuit 21, the second power supply circuit 31, the first microcomputer 22, and the second microcomputer 32. CL The first microcomputer 22 generates the second clock pulse S CL2 This is the time during which the clock abnormality can be properly determined. CL The second microcomputer 32 receives the first clock pulse S CL1 This is also the time during which an abnormality in the clock can be properly detected. CL is set to the shortest time allowed.

[0094] As shown in Fig. 4, when an open fault has already occurred in the second signal line 44 before the power is turned on, the first microcomputer 22 and the second microcomputer 32 operate in the same manner as in the comparative example shown in Fig. 2 when the power is turned on. That is, the first microcomputer 22 is reset, and the first clock pulse S CL1 This process of confirming abnormalities is repeated.

[0095] As shown in FIG. 5, the second microcomputer 32 is stopped after a predetermined stop determination time ΔT STP During the period (time T3 to time Tn) until the abnormality detection time ΔT of the first microcomputer 22 has elapsed, every time the first microcomputer 22 is reset, DT The second microcomputer 32 measures the abnormality detection time ΔT DT are sequentially accumulated.

[0096] Abnormal non-detection time ΔT NON The shorter the stop determination time ΔT STP Therefore, the number of times that an abnormality in the first microcomputer 22 is detected is ensured within the stop determination time ΔT STPAt the point in time (time Tn) when the abnormality detection time ΔT DT The cumulative time, which is the sum of the above, is the third abnormality confirmation time ΔT th3 It will be easier to reach that level.

[0097] The second microcomputer 32 determines the stop determination time ΔT STP Within this time, the accumulated time is the third abnormality confirmation time ΔT th3 When this is reached, the second microcomputer 32 determines that there is an abnormality in the first microcomputer 22. That is, the second microcomputer 32 appropriately detects the abnormality in the first microcomputer 22 caused by the open fault of the second signal line 44. When the abnormality in the first microcomputer 22 is determined, the second microcomputer 32 executes one-system drive using the second system.

[0098] In addition, when an open fault occurs in the fourth signal line 46 between the second microcomputer 32 and the second power supply circuit 31, the first microcomputer 22 detects an abnormality in the second microcomputer 32 by executing processing similar to that performed by the second microcomputer 32 when an open fault occurs in the second signal line 44.

[0099] The first microcomputer 22 is stopped after a predetermined stop determination time ΔT has elapsed since the first abnormality of the second microcomputer 32 was detected. STP During the period (from time T3 to time Tn) until the abnormality detection time ΔT of the second microcomputer 32 has elapsed, DT The first microcomputer 22 measures the abnormality detection time ΔT DT are sequentially accumulated.

[0100] The first microcomputer 22 determines the stop determination time ΔT STP Within this time, the accumulated time is the third abnormality confirmation time ΔT th3When this is reached, the first microcomputer 22 determines that there is an abnormality in the second microcomputer 32. That is, the first microcomputer 22 appropriately detects the abnormality in the second microcomputer 32 caused by the open fault of the fourth signal line 46. When the first microcomputer 22 determines that there is an abnormality in the second microcomputer 32, it executes one-system drive using the first system.

[0101] <Effects of the embodiment> This embodiment provides the following advantages. (1) The time T from when an abnormality is detected to when the abnormality is confirmed CS The stop determination time ΔT STP to total time ΣΔT NON The clock anomaly judgment time ΔT is set so that it is shorter than the time obtained by subtracting CL and the stop determination time ΔT STP The abnormality is an abnormality in the first microcomputer 22 or the second microcomputer 32. The total time ΣΔT NON is the abnormality non-detection time ΔT NON is the sum of.

[0102] According to this configuration, the stop determination time ΔT STP The abnormality detection time ΔT accumulated within DT The total accumulated time is the stop determination time ΔT STP The third abnormality is confirmed within ΔT th3 In other words, the time from when an abnormality in the communication partner is detected until the abnormality in the communication partner is confirmed is equal to or exceeds the stop determination time ΔT STP Therefore, the microcomputer (22 or 32) that is not reset can properly detect an abnormality in the internal communication partner.

[0103] (2) Stop judgment time ΔT STP is the clock pulse (S CL1 or S CL2 A reset of the microcomputer (22 or 32) in which an abnormality is detected, and a power supply circuit (21 or 31) corresponding to the microcomputer (22 or 32) to be reset (SCL1 or S CL2 ) is set for a period of time that allows the determination of an abnormality to be repeated multiple times.

[0104] Clock abnormality determination time ΔT CL is the clock pulse (S CL1 or S CL2 ) An abnormality is detected in the microcomputer (22 or 32) An abnormality is not detected in the microcomputer (22 or 32) Abnormality non-detection time due to restart after reset completion ΔT NON is the clock pulse (S CL1 or S CL2 ) Anomaly is detected by resetting the microcomputer (22 or 32) Anomaly detection time ΔT DT is set to be shorter than

[0105] According to this configuration, the abnormality non-detection time ΔT NON The shorter the stop determination time ΔT STP The number of times that an abnormality in the first microcomputer 22 is detected is ensured within the stop determination time ΔT STP The abnormality detection time ΔT accumulated within DT The cumulative time, which is the sum of the above, is the third abnormality confirmation time ΔT th3 It will be easier to reach that level.

[0106] The first microcomputer 22 determines the stop determination time ΔT STP Within this time, the accumulated time is the third abnormality confirmation time ΔT th3 When this is reached, the first microcomputer 22 determines that there is an abnormality in the second microcomputer 32, which is the communication partner. That is, the first microcomputer 22 can properly detect the abnormality in the second microcomputer 32 caused by the open fault of the fourth signal line 46. The second microcomputer 32 is an internal communication partner of the first microcomputer 22.

[0107] The second microcomputer 32 determines the stop determination time ΔT STP Within this time, the accumulated time is the third abnormality confirmation time ΔT th3When this is reached, the abnormality of the first microcomputer 22, which is the communication partner, is determined. That is, the second microcomputer 32 can appropriately detect the abnormality of the first microcomputer 22 caused by the open fault of the second signal line 44. The first microcomputer 22 is an internal communication partner of the second microcomputer 32.

[0108] (3) The control device 11 includes communication lines (41, 42) for transmitting and receiving information between the first microcomputer 22 and the second microcomputer 32, and a clock pulse (S CL1 ,S CL2 The microcomputer (22 or 32) receives a clock pulse (S) of a communication partner acquired through the signal lines (43 to 46) when communication through the communication lines (41 and 42) is not established. CL1 or S CL2 ) is abnormal, it is determined that the function of the communication partner microcomputer (22 or 32) has stopped.

[0109] When the function of the communication partner microcomputer (22 or 32) stops, the first microcomputer 22 and the second microcomputer 32 cannot communicate with each other via the communication lines (41 and 42). In addition, the periodic pulse signal generated by the communication partner microcomputer (22 or 32) whose function has stopped also indicates an abnormality. Therefore, as in the above configuration, when communication via the communication lines (41, 42) is not established and the clock pulse (S) of the communication partner microcomputer (22 or 32) acquired via the signal lines (43-46) is CL1 or S CL2 ) is abnormal, it can be said that the function of the communication partner microcomputer (22 or 32) has stopped.

[0110] (4) The control device 11 includes communication lines (41, 42) for transmitting and receiving information between the first microcomputer 22 and the second microcomputer 32, and a clock pulse (S CL1 ,S CL2 The first microcomputer 22 and the second microcomputer 32 have signal lines (43-46) for transmitting and receiving clock pulses (S CL1 or S CL2 ) is normal, it is determined that the communication via the communication lines (41, 42) is abnormal.

[0111] With this configuration, even if communication via the communication lines (41, 42) is not established, the clock pulse (S CL1 or S CL2 ) is normal, the microcomputer (22 or 32) of the communication partner is operating. Therefore, it is clear that the microcomputer (22 or 32) of the communication partner is not in a non-functional state, but that the communication via the communication line (41, 42) is abnormal.

[0112] (5) The first microcomputer 22 and the second microcomputer 32 have a master-slave relationship. For example, the first microcomputer 22 functions as a master, while the second microcomputer 32 functions as a slave. The second microcomputer 32 functioning as a slave stops operating when it is determined that communication via the communication lines (41, 42) is abnormal.

[0113] Depending on the product specifications, it may be required to stop the operation of the second microcomputer 32 functioning as a slave when it is determined that the communication via the communication lines (41, 42) is abnormal. According to the above configuration, it is possible to obtain the control device 11 according to the product specifications.

[0114] (6) When an abnormality is confirmed in the second microcomputer 32, which is the communication partner, the first microcomputer 22 executes one-system drive using the first system. That is, the first microcomputer 22 drives the motor 12 only through power supply to the first winding group 14 corresponding to the first microcomputer 22. When an abnormality is confirmed in the first microcomputer 22, which is the communication partner, the second microcomputer 32 executes one-system drive using the second system. That is, the second microcomputer 32 drives the motor 12 only through power supply to the second winding group 15 corresponding to the first microcomputer 22. Therefore, even if an abnormality is confirmed in either the first microcomputer 22 or the second microcomputer 32, the motor 12 can be driven. This improves marketability.

[0115] <Other embodiments> This embodiment may be modified as follows. The control device 11 may have three or more communication lines. The control device 11 may have only one of the first communication line 41 and the second communication line 42.

[0116] The signal indicating the normal operation of the first microcomputer 22 and the second microcomputer 32 is a clock pulse (S CL1 ,S CL2 ) That is, the first microcomputer 22 and the second microcomputer 32 may generate a dedicated periodic pulse signal for monitoring the operation. The pulse period of the dedicated periodic pulse signal does not have to be constant. Also, the pulse pattern of the dedicated periodic pulse signal may be different from the pulse pattern of the clock pulse.

[0117] The control device 11 may be a control device for an electric power steering device. In this case, the motor 12 functions as a drive source for the electric power steering device. The motor 12 functions as an assist motor that generates an assist force.

[0118] The control device 11 may be a control device for a steer-by-wire steering device. In this case, the motor 12 functions as a drive source for a reaction mechanism or a turning mechanism constituting the steering device. The motor 12 functions as a reaction motor that generates a steering reaction force, or a turning motor that generates a turning force for turning the steered wheels of the vehicle.

[0119] The control device 11 may be a control device for various mechanical devices, in addition to a control device for a steering device of a vehicle. The mechanical device may be, for example, a machine tool driven by a motor. In this case, the motor 12 functions as a drive source for the mechanical device. [Explanation of symbols]

[0120] 11...Control device 12...Motor (control object) 14…First winding group 15...Second winding group 21...First power supply circuit 22...First microcomputer (control circuit) 31...Second power supply circuit 32...Second microcomputer (control circuit) 41…First communication line 42…Second communication line 43...First signal line 44…Second signal line 45…Third signal line 46…4th signal line ΔT CL …Clock abnormality judgment time (first abnormality judgment time) ΔT STP …Stop judgment time (second abnormality judgment time) S CL1 ...First clock pulse (periodic pulse signal) S CL2 ...Second clock pulse (periodic pulse signal) ΔT th3 …Third abnormality confirmation time (abnormality confirmation time)

Claims

1. Two control circuits configured to control a controlled object and generate a periodic pulse signal indicating a normal operation of the control object; a power supply circuit configured to manage power supplied to the control circuit, and two power supply circuits configured to reset the control circuit when an abnormality in the periodic pulse signal continues for a first abnormality determination time; the two control circuits are communication counterparts, and when an abnormality in the communication counterpart is detected as a result of the communication counterpart being reset, when an integrated time, which is a total time during which the abnormality is detected, reaches an abnormality determination time within a second abnormality determination time, the two control circuits are configured to determine the abnormality in the communication counterpart; the second abnormality determination time is set to a time period that allows a plurality of cycles of resetting the control circuit in which an abnormality in the periodic pulse signal is detected and determining that the periodic pulse signal is abnormal by the power supply circuit corresponding to the control circuit to be reset, Furthermore, the control device sets the first abnormality judgment time and the second abnormality judgment time so that the time from when an abnormality in the communication partner is detected to when the abnormality in the communication partner is confirmed is shorter than the second abnormality judgment time minus the total non-detection time due to restart after completion of reset during which no abnormality in the communication partner is detected.

2. 2. The control device according to claim 1, wherein the first abnormality determination time is set so that a non-detection time due to restart after completion of resetting, during which no abnormality is detected in the communication partner, is shorter than a detection time during which an abnormality is detected due to resetting of the communication partner.

3. a communication line for transmitting and receiving information between the two control circuits; a signal line for transmitting and receiving the periodic pulse signal between the two control circuits; The control device according to claim 1 or 2, wherein the control circuit is configured to determine that the function of the control circuit of the communication partner has stopped when communication via the communication line is not established and the periodic pulse signal of the communication partner obtained through the signal line is abnormal.

4. a communication line for transmitting and receiving information between the two control circuits; a signal line for transmitting and receiving the periodic pulse signal between the two control circuits; The control device according to claim 1 or 2, wherein the control circuit is configured to determine that communication via the communication line is abnormal when communication via the communication line is not established and the periodic pulse signal of the communication partner obtained via the signal line is normal.

5. The two control circuits are configured to have a master-slave relationship, with one of the two control circuits functioning as a master and the other of the two control circuits functioning as a slave; The control device according to claim 4 , wherein the control circuit functioning as a slave is configured to stop operation when it is determined that communication via the communication line is abnormal.

6. The controlled object is a motor having two winding groups, 3. The control device according to claim 1 or 2, wherein the control circuit is configured to independently control the power supply to the group of windings of the system corresponding to itself, and when an abnormality in the communication partner is confirmed, to drive the motor only through the power supply to the group of windings of the system corresponding to itself.

Images