Power supply control device, power supply control method, and power supply control program

Abstract

To provide a power supply control device, a power supply control method, and a power supply control program, capable of suppressing a power consumption of a second power supply when performing a diagnosis that a backup control can be made.SOLUTION: A power supply control device according to an embodiment comprises: a connection part; and a controller. The connection part connects and disconnects a first system that supplies a power from a first power supply to a first load and a second system that supplies a power from a second power supply to a second load. The controller performs a diagnosis processing for performing a diagnosis that a backup control for performing a backup of the first system by the second system after an activation can be made or not, and performs the backup control by disconnecting the connection part in the case where a power supply fault of the first system is detected. A third power supply is connected to the second system. The controller disconnects the connection part, and performs the diagnosis processing by supplying the power from the third power supply to the second load.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The disclosed embodiments relate to a power supply control device, a power supply control method, and a power supply control program. [Background technology]

[0002] There is a redundant power supply system that has a first system that supplies power from a first power source to a first load, and a second system that supplies power from a second power source to a second load, and that performs backup control to back up the first system using the second system if a power failure is detected in the first system during autonomous driving.

[0003] Furthermore, in a redundant power supply system, a prior art is known in which a second power supply supplies a current smaller than normal to a second load to diagnose whether backup control is possible (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2022-190470 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the prior art, when diagnosing whether backup control is possible, power from the second power source is consumed, and therefore it is not possible to charge the second power source after the diagnosis and transition to automatic operation until the voltage of the second power source reaches a voltage that allows backup.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a power supply control device, a power supply control method, and a power supply control program that can reduce power consumption of a second power supply when diagnosing whether backup control is possible. [Means for solving the problem]

[0007] A power supply control device according to an embodiment includes a connection unit and a controller. The connection unit connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load. The controller performs a diagnostic process to diagnose whether backup control for backing up the first system by the second system is possible after startup, and when a power failure of the first system is detected, the controller disconnects the connection unit and performs the backup control. A third power supply is connected to the second system. The controller disconnects the connection unit and then performs the diagnostic process by supplying power from the third power supply to the second load. Effect of the Invention

[0008] According to a power supply control device, a power supply control method, and a power supply control program according to an aspect of the embodiment, it is possible to suppress power consumption of a second power supply when diagnosing whether backup control is possible. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram showing an example of the configuration of a control system according to the first embodiment. [Diagram 2] FIG. 2 is an explanatory diagram of the operation of the controller according to the embodiment at the time of a first system ground fault. [Diagram 3] FIG. 3 is an explanatory diagram of the operation of the controller according to the embodiment when a first system ground fault occurs. [Figure 4] FIG. 4 is an explanatory diagram of the main determination operation of the second system performed by the controller according to the embodiment. [Diagram 5] FIG. 5 is an explanatory diagram of the main determination operation of the second system performed by the controller according to the embodiment. [Figure 6] FIG. 6 is an explanatory diagram of the main determination operation of the second system performed by the controller according to the embodiment. [Figure 7] FIG. 7 is an explanatory diagram showing an example of an operation during diagnosis processing performed by the controller according to the embodiment. [Figure 8]FIG. 8 is an explanatory diagram showing an example of an operation during diagnosis processing performed by the controller according to the embodiment. [Figure 9] FIG. 9 is an explanatory diagram of another example of the main determination operation performed by the controller according to the embodiment. [Figure 10] FIG. 10 is a flowchart illustrating an example of processing executed by the controller according to the first embodiment. [Figure 11] FIG. 11 is a flowchart showing an example of processing executed by the controller according to the first embodiment. [Figure 12] FIG. 12 is an explanatory diagram illustrating an example of the configuration of a control system according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of a power supply control device, a power supply control method, and a power supply control program will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the following embodiment. The power supply control device according to the embodiment is installed in an electric vehicle with an automatic driving function, a hybrid vehicle, or an engine vehicle that runs on an internal combustion engine.

[0011] [1. First embodiment] [1-1. Control system configuration] Fig. 1 is an explanatory diagram showing an example of the configuration of a control system 100 according to the first embodiment. As shown in Fig. 1, the control system 100 according to the embodiment includes a power supply control device 1 and a first power supply 10. The power supply control device 1 is electrically connected to the first power supply 10, an ignition switch of a vehicle (hereinafter, referred to as "IG61"), an automatic driving control device 62, a first load 101, and a second load 102.

[0012] When the power supply control device 1 is mounted on an engine vehicle, the first power supply 10 includes a 12V lead battery (hereinafter referred to as "PbB11") and a generator 12. The battery of the first power supply 10 may be any secondary battery other than PbB11.

[0013] The generator 12 is, for example, an alternator that converts the kinetic energy of a traveling vehicle into electricity to generate power. The generator 12 charges the PbB 11 and a second power source 20 (described later) with the generated power. The first power source 10 also supplies power to a plurality of electrical loads mounted on the vehicle.

[0014] When the power supply control device 1 is mounted on an electric vehicle or a hybrid vehicle, the first power supply 10 includes a DC / DC converter (hereinafter, referred to as "DCDC") and PbB11. In this case, the DCDC is connected to a generator and a high-voltage battery having a higher voltage than PbB11, and supplies power to a plurality of electric loads by stepping down the voltage of the generator and the high-voltage battery. The high-voltage battery is, for example, a battery for driving the vehicle mounted on the electric vehicle or the hybrid vehicle.

[0015] IG61 is a switch that, when the user, for example, pushes the switch while the vehicle is not started, transmits a start signal to the power supply control device 1 to start the vehicle. When the user, for example, pushes the switch while the vehicle is started, transmits a stop signal to the power supply control device 1 to stop the start-up of the vehicle.

[0016] The automatic driving control device 62 is electrically connected to the power supply control device 1. The automatic driving control device 62 is capable of communicating information with the power supply control device 1. The automatic driving control device 62 is a device that includes a GPS (Global Positioning System) and controls the automatic driving of a vehicle.

[0017] The power supply control device 1 is a device that controls power supply to a plurality of electric loads mounted on a vehicle. In the example shown in Fig. 1, the power supply control device 1 supplies power to a first load 101 and a second load 102.

[0018] The first load 101 includes an electric load related to the vehicle traveling itself by manual driving and automatic driving, and an electric load not related to the vehicle traveling itself by manual driving and automatic driving. The electric load related to the vehicle traveling itself by automatic driving includes, for example, an electric steering device, an electric brake device, an on-board camera, a sensor, and a radar.

[0019] Electrical loads that are not related to the vehicle's manual or automatic driving include, for example, displays, air conditioners, audio, video, various lights, drive recorders, security devices, communication devices, and various sensors.

[0020] The second load 102 includes an electric load related to the vehicle traveling itself by manual driving and automatic driving. The second load 102 includes an electric load that is the minimum required for automatic driving among the electric loads included in the first load 101. The second load 102 may be configured to include the same electric load as the electric load included in the first load 101 that is related to the vehicle traveling itself by manual driving and automatic driving.

[0021] The first load 101 and the second load 102 assist the driver in steering, accelerating, and braking during manual driving. During automatic driving, the first load 101 and the second load 102 are controlled by the automatic driving control device 62 to drive the vehicle automatically.

[0022] The power supply control device 1 includes a second power supply 20, a third power supply 30, a controller 3, a first system 110, a second system 120, and an inter-system line 130. The power supply control device 1 also includes a connection unit (hereinafter referred to as an "inter-system switch 41"), a first switch (hereinafter referred to as a "backup switch 42"), and a second switch (hereinafter referred to as a "battery switch 43"). The power supply control device 1 also includes a first voltage sensor 51, a second voltage sensor 52, a third voltage sensor 53, and a fourth voltage sensor 54.

[0023] The second power source 20 is a backup power source in case the first power source 10 is unable to supply power. The voltage of the second power source 20 when fully charged is higher than the voltage of the PbB11, for example, 16V. The second power source 20 includes a lithium ion battery (hereinafter referred to as "LiB21"). The battery of the second power source 20 may be any secondary battery other than the LiB21.

[0024] The third power source 30 is electrically connected to the second system 120. The third power source 30 includes a capacitor 31. The capacitor 31 is an energy storage element capable of supplying to the second system 120 a current that is smaller than the current supplied from the LiB 21 to the second load 102.

[0025] The first system 110 is a power supply line that supplies power from the first power source 10 to the first load 101. The second system 120 is a power supply line that supplies power from the second power source 20 to the second load 102. The inter-system line 130 is a connection line that electrically connects the first system 110 and the second system 120.

[0026] The inter-system switch 41 is provided on the inter-system line 130. The inter-system switch 41 is a switch that can connect and disconnect the first system 110 and the second system 120. The inter-system switch 41 may be a DCDC. In this case, the DCDC electrically connects the first system 110 and the second system 120 by operating. The DCDC cuts off the electrical connection between the first system 110 and the second system 120 by stopping its operation.

[0027] The backup switch 42 is a switch that connects and disconnects a first path R1 from a connection point P between the third power source 30 and the second system 120 to the second load 102. The battery switch 43 is a switch that connects and disconnects a second path R2 from the connection point P to the second power source 20.

[0028] The first voltage sensor 51 detects the voltage of the first system 110 (hereinafter referred to as "first system voltage V1") and outputs the detection result to the controller 3. The second voltage sensor 52 detects the voltage of the connection line connecting the backup switch 42 and the second load 102 and outputs the detection result to the controller 3. The third voltage sensor 53 detects the voltage of the connection line connecting the battery switch 43 and the backup switch 42 and outputs the detection result to the controller 3. The fourth voltage sensor 54 detects the voltage of the connection line connecting the second power source 20 and the battery switch 43 and outputs the detection result to the controller 3.

[0029] The controller 3 includes a microcomputer having a central processing unit (CPU), a read only memory (ROM), a random access memory (RAM), etc., and various other circuits. Note that the controller 3 may be partially or entirely configured with hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0030] The controller 3 controls the operations of the inter-system switch 41, the backup switch 42, and the battery switch 43 by executing a power supply control program stored in the ROM by the CPU using the RAM as a working area. The power supply control program may be stored in a storage device from the outside via a communication line or the like.

[0031] During normal operation when no power supply failure is detected in the first system 110 and the second system 120, the controller 3 turns on the inter-system switch 41 and the backup switch 42 while keeping the battery switch 43 in an OFF state, as shown in Fig. 1. This allows power to be supplied from the first power source 10 to the first load 101 and the second load 102. At this time, the capacitor 31 of the third power source 30 is charged by the power supplied from the first power source 10.

[0032] [1-2. Operation when first system fails] Next, the operation of the controller 3 when the first system 110 fails will be described with reference to Fig. 2 and Fig. 3. Fig. 2 and Fig. 3 are explanatory diagrams of the operation of the controller 3 according to the embodiment when a ground fault occurs in the first system. Here, the case where a ground fault 200 occurs in the first system 110 will be described.

[0033] The controller 3 detects a sign of a power supply failure based on a parameter corresponding to the voltage or current of the first system 110 or the second system 120. Here, a case will be described in which the controller 3 detects a sign of a power supply failure based on the voltage of the second system 120. The controller 3 may be configured to detect a sign of a power supply failure based on the currents of the first system 110 and the second system 120.

[0034] The voltage of the second system 120 in normal operation is equal to the voltage of the capacitor 31 of the third power supply 30 (hereinafter referred to as the "third power supply voltage V3"). For this reason, it is assumed here that the controller 3 detects a symptom of a power supply failure based on the third power supply voltage V3.

[0035] For example, when the third power supply voltage V3 detected by the third voltage sensor 53 becomes equal to or lower than the ground fault threshold, the controller 3 determines that there is a symptom of the ground fault 200 in the first system 110 or the second system 120. When the controller 3 detects the symptom of the ground fault 200, it provisionally determines that there is a possibility that the ground fault 200 has occurred, and shuts off the inter-system switch 41 (hereinafter referred to as "pre-shutdown") as shown in FIG.

[0036] Next, the controller 3 performs a main determination process to determine whether the ground fault 200 has occurred in the first system 110 or the second system 120 on the basis of a parameter corresponding to the voltage or current of the first system 110 and the second system 120.

[0037] Here, a case will be described in which the controller 3 performs the main determination process for the first system 110 based on the first system voltage V1, and performs the main determination process for the second system 120 based on the third power supply voltage V3.

[0038] Here, when a ground fault occurs in the second system 120 and the first system 110 is normal, when the system switch 41 is cut off, the first system voltage V1 is restored to a voltage exceeding the ground fault threshold by the power supply from the first power source 10. In contrast, when a ground fault 200 occurs in the first system 110, the first system voltage V1 is maintained at a voltage equal to or lower than the ground fault threshold even when the system switch 41 is cut off. For this reason, the controller 3 determines that the first system 110 is normal when the first system voltage V1 exceeds the ground fault threshold continuously for a certain period of time after the system switch 41 is pre-cut off. In addition, the controller 3 determines that the ground fault 200 has occurred in the first system 110 when the first system voltage V1 is equal to or lower than the ground fault threshold continuously for a certain period of time after the system switch 41 is pre-cut off.

[0039] Furthermore, as shown in FIG. 3, the controller 3 can, for example, pre-shut off the inter-system switch 41, turn on the battery switch 43, supply power from the second power source 20 to the second load 102, and then make a final determination as to whether a ground fault 200 has occurred in the second system 120.

[0040] At this time, if a ground fault 200 occurs in the first system 110 and the second system 120 is normal, when the inter-system switch 41 is cut off, the third power supply voltage V3 recovers to a voltage exceeding the ground fault threshold value due to power supply from the second power source 20. In contrast, when a ground fault occurs in the second system 120, the third power supply voltage V3 is maintained at a voltage equal to or lower than the ground fault threshold value even if the inter-system switch 41 is cut off.

[0041] Therefore, after pre-shutting off the inter-system switch 41, the controller 3 turns on the battery switch 43 and when the third power supply voltage V3 continues to exceed the ground fault threshold for a certain period of time, the controller 3 finally determines that the second system 120 is normal. Also, after pre-shutting off the inter-system switch 41, if the battery switch 43 turns on but the third power supply voltage V3 remains below the ground fault threshold for a certain period of time, the controller 3 finally determines that a ground fault has occurred in the second system 120.

[0042] However, when the power supply control device 1 turns on the battery switch 43 for this judgment, it consumes power from the second power supply 20, and therefore the driving time for the evacuation driving that is subsequently performed using the power from the second power supply 20 is shortened.

[0043] Therefore, in this determination, the controller 3 determines whether a power failure has occurred in the second system 120 based on the change in the power of the third power source 30. Specifically, as shown in Fig. 2, after the inter-system switch 41 is pre-shutoff, the controller 3 monitors the detection result of the third voltage sensor 53 with the battery switch 43 in a cut-off state.

[0044] Here, a description will be given of the main determination operation of the second system 120 performed by the controller 3 based on the detection result of the third voltage sensor 53 with reference to Fig. 4 to Fig. 6. Fig. 4 to Fig. 6 are explanatory diagrams of the main determination operation of the second system 120 performed by the controller 3 according to the embodiment.

[0045] 4, when a ground fault occurs in the second system 120, the third power supply voltage V3 drops to 0 [V]. Therefore, the controller 3 can truly determine that a ground fault has occurred in the second system 120 because the third power supply voltage V3 remains equal to or lower than the ground fault threshold value until time T2, which is a certain time after the pre-shutoff of the inter-system switch 41 at time T1.

[0046] In contrast, if a ground fault 200 has occurred in the first system 110, the third power supply voltage V3 may drop due to the influence of the ground fault 200 before the inter-system switch 41 is pre-shutdown at time T1. For example, if the capacitance of the capacitor 31 is too small, the third power supply voltage V3 may drop to or below the ground fault threshold before the pre-shutdown.

[0047] 5, for example, if the third power supply voltage V3 becomes equal to or lower than the ground fault threshold before pre-shutdown at time T1, it will also become equal to or lower than the ground fault threshold at time T2 after a certain time has elapsed. In this case, the controller 3 erroneously determines that a ground fault has occurred in the second system 120, even though a ground fault 200 has occurred in the first system 110 and no ground fault has occurred in the second system 120.

[0048] Therefore, for example, when the second system voltage V2 (the voltage of the capacitor 31) falls below the ground fault threshold (for pre-shutdown) at time T1, the controller 3 detects a ground fault and pre-shuts down the inter-system switch 41 as shown in FIG.

[0049] At this time, if the second system 120 is normal, the third power supply voltage V3 switches from a rapid voltage drop from the point in time when the inter-system switch 41 is pre-shutdown to a gradual voltage drop due to power supply to the second load 102. In contrast, if a ground fault occurs in the second system 120, the third power supply voltage V3 continues to rapidly drop even after the inter-system switch 41 is pre-shutdown.

[0050] Therefore, if the third power supply voltage V3 continues to exceed the ground fault threshold value (for main determination) for a period equal to or longer than the first period Pr1 after the pre-shutdown of the inter-system switch 41, the controller 3 makes a main determination that the second system 120 is normal.

[0051] Furthermore, the controller 3 determines that a ground fault has occurred in the second system 120 if the third power supply voltage V3 continues to be below the ground fault threshold (for main determination) for a period equal to or longer than the second period Pr2 after the pre-shutdown of the inter-system switch 41. This makes it possible for the controller 3 to prevent erroneous determination that a ground fault has occurred in the second system 120 when a ground fault has not occurred in the second system 120.

[0052] In this way, the controller 3 determines whether a power failure has occurred in the second system 120 by using the power of the third power source 30 without using the power of the second power source 20, thereby reducing power consumption of the second power source 20. Therefore, the power supply control device 1 can prevent a shortened travel time of evacuation travel performed using the power of the second power source 20.

[0053] Then, when the controller 3 determines that the second system 120 is normal and that a ground fault 200 has occurred in the first system 110, it turns on the battery switch 43 with the system switch 41 in an OFF state, as shown in FIG. 3. This causes power to be supplied from the second power source 20 to the second load 102. Therefore, the power supply control device 1 can cause the automatic driving control device 62 to use the second load 102 to perform evacuation running. At this time, the capacitor 31 is charged by the power supplied from the second power source 20.

[0054] Furthermore, when the controller 3 determines that the first system 110 is normal and a ground fault has occurred in the second system 120, it shuts off the system switch 41, the backup switch 42, and the battery switch 43. This allows power to be supplied from the first power source 10 to the first load 101. Therefore, the power supply control device 1 can cause the automatic driving control device 62 to use the first load 101 to perform evacuation running.

[0055] If the controller 3 determines in this determination after the pre-shutdown that both the first system 110 and the second system 120 are normal, it determines that the voltage drop was due to a temporary voltage drop caused by an overload or the like, and returns the system switch 41 and the battery switch 43 to the normal state shown in Figure 1.

[0056] In this way, when the controller 3 detects a power failure in the first system 110, it performs backup control by turning off the inter-system switch 41 and turning on the backup switch 42 and the battery switch 43 to back up the first system 110 using the second system 120.

[0057] At this time, if the backup switch 42 or the battery switch 43 has an off-stuck fault, for example, in which the backup switch 42 or the battery switch 43 is stuck in a disconnected state, the power supply control device 1 cannot supply power from the second power source 20 to the second load 102 and cannot perform backup control.

[0058] For this reason, after starting the vehicle, the controller 3 performs a diagnostic process to diagnose whether backup control for backing up the first system 110 by the second system 120 is possible. Hereinafter, the diagnostic process performed by the controller 3 will be described.

[0059] [1-3. Diagnostic processing operation] 7 and 8 are explanatory diagrams showing an example of the operation of the diagnostic process performed by the controller 3 according to the embodiment. When the controller 3 receives a start signal from the IG 61, it executes the diagnostic process.

[0060] When the controller 3 receives the start-up signal, it first cuts off the battery switch 43, and turns on the inter-system switch 41 to charge the capacitor 31 with the first power source 10. This causes the voltage of the capacitor 31 to become 12V, the same as PbB11. Thereafter, as shown in Fig. 7, it cuts off the inter-system switch 41 and performs a diagnostic process by supplying power from the third power source 30 to the second load 102. Specifically, with the inter-system switch 41 and the battery switch 43 cut off, the controller 3 turns on the backup switch 42 and determines whether the first path R1 is normal.

[0061] Then, the controller 3 determines that the first path R1 is normal if the second voltage sensor 52 detects a voltage equivalent to the voltage of the capacitor 31. Specifically, if the first path R1 is normal, that is, if the backup switch 42 is not stuck off, the detected voltage of the second voltage sensor 52 and the detected voltage of the third voltage sensor 53 will be approximately equal. Therefore, if the difference between the detected voltage of the second voltage sensor 52 and the detected voltage of the third voltage sensor 53 is equal to or less than a predetermined value close to 0, the controller 3 determines that the first path R1 is normal, that is, the backup switch 42 is not stuck off.

[0062] Furthermore, the controller 3 determines that the first path R1 is abnormal if no voltage is detected by the second voltage sensor 52. Specifically, if the backup switch 42 is stuck off, the voltage of the capacitor 31 is applied to the third voltage sensor 53, and no voltage is applied to the second voltage sensor 52, so that the voltage difference between the two becomes large. Therefore, if the difference between the voltage detected by the second voltage sensor 52 and the voltage detected by the third voltage sensor 53 is equal to or greater than a predetermined value close to the voltage of the capacitor 31, the controller 3 determines that the first path R1 is abnormal, that is, the backup switch 42 is stuck off.

[0063] The detected voltage of the second voltage sensor 52 is greater than 0 if the first path R1 is normal, and is 0 if the backup switch 42 is stuck off. Therefore, the controller 3 may determine that the first path R1 is normal when the detected voltage of the second voltage sensor 52 is greater than a threshold close to 0 (e.g., 1 V), and that the first path R1 is abnormal when the detected voltage is equal to or less than the threshold.

[0064] In this way, the controller 3 can diagnose the first path R1 and the backup switch 42 using the power of the third power source 30 without using the power of the second power source 20, so that the power consumption of the second power source 20 can be reduced.

[0065] Furthermore, the controller 3 subsequently turns on the battery switch 43 while keeping the inter-system switch 41 and the backup switch 42 in an OFF state, as shown in FIG. 8, and determines whether the second path R2 is normal.

[0066] As described above, the voltage of the second power source 20 is 16V, which is higher than the voltage of the third power source 30. On the other hand, the voltage of the third power source 30 is 12V, being charged by the first power source 10. When diagnosing whether the second path R2 is normal, the voltage of the capacitor 31 is slightly lower than 12V due to the diagnosis of the first path R1.

[0067] Therefore, when the controller 3 turns on the battery switch 43 to diagnose the second path R2, if the second path R2 is normal, the capacitor 31 is charged by the second power supply 20. Therefore, the detected voltage of the third voltage sensor 53 and the detected voltage of the fourth voltage sensor 54 are approximately equal. On the other hand, if the battery switch 43 is stuck off, the detected voltage of the third voltage sensor 53 is a voltage slightly lower than 12 V, and the detected voltage of the fourth voltage sensor 54 is 16 V, resulting in a difference of 4 V or more between the detected voltages of the third voltage sensor 53 and the fourth voltage sensor 54.

[0068] Therefore, if the difference between the third voltage sensor 53 and the fourth voltage sensor 54 is less than a threshold value close to 0 (e.g., 1 V), the controller 3 determines that the second path R2 is normal, that is, the battery switch 43 is not stuck off. Also, if the difference between the third voltage sensor 53 and the fourth voltage sensor 54 is equal to or greater than the threshold value (e.g., 1 V), the controller 3 determines that the second path R2 is abnormal, that is, the battery switch 43 is stuck off.

[0069] At this time, power is supplied from the second power source 20 to the third power source 30, but since the amount of charge that the capacitor 31 receives from the second power source 20 is small, at around a few volts, the power supply control device 1 can suppress the power consumption of the second power source 20.

[0070] In this way, the controller 3 judges whether the first path R1 is normal by turning on the backup switch 42 and turning off the battery switch 43. Furthermore, the controller 3 judges whether the second path R2 is normal by turning off the backup switch 42 and turning on the battery switch 43. This allows the controller 3 to reliably diagnose a disconnection state of the second system 120 and whether the backup switch 42 and the battery switch 43 are stuck off.

[0071] The controller 3 may be configured to execute the diagnostic process after the vehicle is started, for example, before the autonomous driving starts. In this case, when the controller 3 receives a signal indicating the start of autonomous driving from the autonomous driving control device 62, the controller 3 executes the diagnostic process according to the same procedure as described above. Then, when the controller 3 determines that the second system 120 is normal, the controller 3 transmits a permission signal for starting autonomous driving to the autonomous driving control device 62.

[0072] In the above description, the first path R1 and the second path R2 are diagnosed using voltage, but they may be diagnosed using current. In that case, a current sensor is provided at the connection point P in the second system 120. When the controller 3 diagnoses the first path R1, if the first path R1 is normal, a current flows from the capacitor 31 to the second load 102 via the current sensor. On the other hand, if the backup switch 42 is stuck off, no current flows to the current sensor.

[0073] Therefore, when the controller 3 diagnoses the first path R1, if the current value detected by the current sensor is greater than 0, it determines that the first path R1 is normal, and if the current value detected by the current sensor is 0, it determines that the first path R1 is abnormal.

[0074] Furthermore, when the controller 3 diagnoses the second path R2, if the second path R2 is normal, a charging current flows from the second power source 20 to the capacitor 31 via the current sensor. On the other hand, if the battery switch 43 is stuck off, no current flows to the current sensor.

[0075] Therefore, when the controller 3 diagnoses the second path R2, if the current value detected by the current sensor is greater than 0, it determines that the second path R2 is normal, and if the current value detected by the current sensor is 0, it determines that the second path R2 is abnormal.

[0076] [1-4. Other Examples of This Judgment] Next, another example of the main determination will be described with reference to Fig. 9. Fig. 9 is an explanatory diagram of another example of the main determination operation performed by the controller 3 according to the embodiment.

[0077] 5, when the second system 120 is normal and the ground fault 200 has occurred in the first system 110, the third power supply voltage V3 may drop to a level equal to or lower than the ground fault threshold before the pre-shutdown. In this case, the controller 3 may erroneously determine that a ground fault has occurred in the second system 120, even though the ground fault 200 has occurred in the first system 110.

[0078] 9, in another embodiment, the controller 3 pre-shuts off the inter-system switch 41 at time T1, then turns on the battery switch 43 for a certain period of time from time T1-2 to time T1-3, charges the third power source 30 using the second power source 20, and makes the third power source voltage V3 higher than the ground fault threshold. After that, the controller 3 determines whether a power failure has occurred in the second system 120 based on the voltage state of the third power source 30.

[0079] As a result, the third power supply voltage V3 maintains a value higher than the ground fault threshold unless a ground fault has occurred in the second system 120. Therefore, if the third power supply voltage V3 is higher than the ground fault threshold at time T2 after a certain time has elapsed from time T1-3, the controller 3 can accurately determine that there is no ground fault in the second system 120 without making an erroneous determination.

[0080] On the other hand, if a ground fault has occurred in the second system 120, even if the battery switch 43 is turned on for a certain period of time from time T1-2 to time T1-3, the third power source 30 will not be charged, and the third power source voltage V3 will continue to be below the ground fault threshold even after time T1. Therefore, the controller 3 determines that a ground fault has occurred in the second system 120 when the third power source voltage V3 has been below the ground fault threshold for a certain period of time from time T1. Therefore, the controller 3 can accurately determine that a ground fault has occurred in the second system 120.

[0081] [1-5. Processing Executed by the Controller According to the First Embodiment] Next, a process executed by the controller 3 according to the first embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of a process executed by the controller 3 according to the first embodiment.

[0082] When the vehicle is started, the controller 3 starts the process shown in Fig. 10. Specifically, the controller 3 first turns off the system switch 41, turns on the backup switch 42, and turns off the battery switch 43 (step S101).

[0083] Next, the controller 3 determines whether the first path R1 is normal or not (step S102). If the voltage detected by the second voltage sensor 52 is higher than a threshold value close to 0 [V] (e.g., 1 V), the controller 3 determines that the first path R1 is normal. Furthermore, if the voltage detected by the second voltage sensor 52 is equal to or lower than the threshold value, the controller 3 determines that the first path R1 is abnormal. Note that the controller 3 may determine whether the first path R1 is normal or abnormal based on the difference between the voltage detected by the second voltage sensor 52 and the voltage detected by the third voltage sensor 53.

[0084] When the controller 3 determines that the first path R1 is normal (Yes in step S102), it turns off the backup switch 42 and turns on the battery switch 43 (step S103). Then, the controller 3 determines whether the second path R2 is normal (step S104).

[0085] The controller 3 determines that the second path R2 is normal if the difference between the voltage detected by the third voltage sensor 53 and the voltage detected by the fourth voltage sensor 54 is less than a threshold value close to 0 (e.g., 1 V). The controller 3 determines that the second path R2 is abnormal if the difference between the voltage detected by the third voltage sensor 53 and the voltage detected by the fourth voltage sensor 54 is equal to or greater than the threshold value (e.g., 1 V).

[0086] When the controller 3 determines that the second route R2 is normal (step S104, Yes), it determines that backup control is possible (step S105). Next, the controller 3 transmits an automatic driving permission signal to the automatic driving control device 62 (step S106).

[0087] Next, the controller 3 turns on the system switch 41, turns on the backup switch 42, and turns off the battery switch 43 (step S107). After that, the controller 3 executes a ground fault detection process (step S108) and ends the process. A specific example of the ground fault detection process will be described later with reference to FIG. 10.

[0088] Furthermore, when the controller 3 determines that the first route R1 is not normal (step S102, No) or the second route R2 is not normal (step S104, No), it determines that backup control is not possible (step S109).Then, the controller 3 transmits an automatic driving prohibition signal to the automatic driving control device 62 (step S110), turns off the battery switch 43 to prevent the second power source from discharging (step S111), and ends the process.

[0089] Next, the ground fault detection process executed by the controller 3 will be described with reference to Fig. 11. As shown in Fig. 11, when starting the ground fault detection process, the controller 3 first determines whether the first system voltage V1 or the second system voltage V2 is equal to or lower than a ground fault threshold value (for provisional determination) (step S201).

[0090] When the controller 3 determines that the first system voltage V1 or the second system voltage V2 is not equal to or lower than the ground fault threshold (for provisional determination) (step S201, No), the controller 3 starts the process again from step 201. When the controller 3 determines (provisionally determines) that the first system voltage V1 or the second system voltage V2 is equal to or lower than the ground fault threshold (for provisional determination) (step S201, Yes), the controller 3 pre-shuts off the inter-system switch 41 (step S202).

[0091] Thereafter, the controller 3 executes a first-system ground fault main determination process (step S203). In the first-system ground fault main determination process, the controller 3 makes a main determination that a ground fault 200 has occurred in the first system 110 if the first-system voltage V1 is maintained at a voltage equal to or lower than the ground fault threshold value after the inter-system switch 41 is pre-shutoff. In addition, the controller 3 makes a main determination that the first system 110 is normal if the first-system voltage V1 continues to exceed the ground fault threshold value for a certain period of time after the inter-system switch 41 is pre-shutoff.

[0092] Next, the controller 3 executes the second system ground fault main determination process (step S204). In the second system ground fault main determination process, the controller 3 executes the main determination process of the second system 120 described with reference to FIG. 6 or the main determination process of the second system 120 described with reference to FIG.

[0093] When performing the main judgment process shown in Figure 6, if the third power supply voltage V3 continues to exceed the ground fault threshold value (for main judgment) for a period of time equal to or longer than the first period Pr1 after the pre-shutdown of the inter-system switch 41, the controller 3 makes a main judgment that the second system 120 is normal.

[0094] Furthermore, after the pre-shutdown of the inter-system switch 41, if the third power supply voltage V3 continues to be below the ground fault threshold value (for main determination) for a period equal to or longer than the second period Pr2, the controller 3 makes a main determination that the second system 120 has a ground fault.

[0095] When performing the main judgment process shown in Figure 9, the controller 3 pre-shuts off the inter-system switch 41, then keeps the battery switch 43 conductive for a certain period of time, charges the third power source 30 using the second power source 20, and makes the third power source voltage V3 higher than the ground fault threshold.

[0096] Then, if the third power supply voltage V3 exceeds the ground fault threshold for a certain period of time continuously after charging the third power supply 30, the controller 3 officially determines that the second system 120 is normal. Also, if the third power supply voltage V3 falls below the ground fault threshold for a certain period of time or more after the pre-shutdown, the controller 3 officially determines that the second system 120 has a ground fault.

[0097] Here, the controller 3 executes the first system earth fault main judgment process and then executes the second system earth fault main judgment process, but the controller 3 may execute the first system earth fault main judgment process after executing the second system earth fault main judgment process.

[0098] The controller 3 determines whether or not the first system 110 has had a ground fault as a result of the first system ground fault main determination process and the second system ground fault main determination process (step S205). If the controller 3 determines that the first system 110 has had a ground fault (step S205, Yes), it turns on the battery switch 43 (step S206) and ends the ground fault determination process. This causes power to be supplied from the second power source 20 to the second load 102.

[0099] Furthermore, when the controller 3 determines that the fault was not a ground fault in the first system 110 (step S205, No), it determines whether or not the fault was a ground fault in the second system 120 (step S207). When the controller 3 determines that the fault was a ground fault in the second system 120 (step S207, Yes), it turns off the battery switch 43 (step S208) and ends the ground fault determination process. This allows power supply from the first power source 10 to the first load 101 to continue.

[0100] Furthermore, if the controller 3 determines that there was no ground fault in the second system 120 (step S207, No), it determines that no ground fault has occurred in either the first system 110 or the second system 120, and turns on the inter-system switch 41 again (step S209), and transfers the processing to step S201.

[0101] [2. Second embodiment] [2-1. Control system configuration] Next, a control system 100A according to a second embodiment will be described with reference to Fig. 12. Fig. 11 is an explanatory diagram showing an example of the configuration of the control system 100A according to the second embodiment.

[0102] As shown in Fig. 12, in a control system 100A, the configuration of a power supply control device 1A is different from that of the power supply control device 1 shown in Fig. 1. The power supply control device 1A according to the second embodiment includes a switch 44 that connects and disconnects a connection point P in the second system 120 and a capacitor 31. Furthermore, the power supply control device 1A differs from the power supply control device 1 shown in Fig. 1 in the operation when making a main determination as to whether a failure has occurred in the second system.

[0103] 12, the controller 3A of the power supply control device 1A turns off the battery switch 43 both during normal operation and during pre-shutdown of the inter-system switch 41. Then, the controller 3A determines that a ground fault 200 has occurred in the first system 110, and turns on the battery switch 43 during the subsequent backup by the second system 120.

[0104] Furthermore, the controller 3A normally turns on the switch 44 to charge the capacitor 31, and then turns off the switch 44, and turns on the switch 44 during pre-shutdown of the inter-system switch 41. In other words, the controller 3 normally turns off the switch 44, and when a sign of a power failure is detected, turns on the switch 44 and then makes a final determination as to whether a power failure has occurred in the second system 120 based on a change in the power of the third power source 30.

[0105] In this way, when a ground fault 200 has occurred in the first system 110, the controller 3A causes the switch 44 to cut off the electrical connection between the third power source 30 and the second system 120 until the inter-system switch 41 is pre-shutoff.

[0106] Therefore, in the power supply control device 1, if a ground fault 200 occurs in the first system 110, after the inter-system switch 41 is pre-shutoff, from the point when the switch 44 is turned on, the third power supply voltage V3 will not fall below the ground fault threshold value.

[0107] Therefore, when a ground fault 200 has occurred in the first system 110, the controller 3A can accurately determine that a ground fault 200 has occurred in the first system 110 without erroneously determining that a ground fault has occurred in the second system 120.

[0108] In addition, when the controller 3, 3A detects a power failure based on the current in the first system 110 or the second system 120, the power supply control device 1, 1A is equipped with a first current sensor that detects the current flowing in the first system 110 and a second current sensor that detects the current flowing in the second system 120.

[0109] In this case, when the current flowing through the first system 110 or the second system 120 becomes equal to or greater than the ground fault threshold value for current, the controller 3, 3A determines that there is a sign of a power supply failure and pre-shuts off the inter-system switch 41. Thereafter, the controller 3, 3A officially determines, of the first system 110 or the second system 120, the system through which the current flows as the system in which a ground fault has not occurred, and officially determines, of the system through which the current does not flow as the system in which a ground fault has occurred.

[0110] [3. Notes] As an appendix, the features of the present invention are as follows: (1) a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; A power supply control device comprising: a third power source is connected to the second system; The controller: The connection is interrupted, and the diagnostic process is performed by supplying power from the third power source to the second load. Power control device. (2) a first switch that connects and disconnects a first path from a connection point between the third power source and the second system to the second load, and a second switch that connects and disconnects a second path from the connection point to the second power source, The controller: The diagnostic process is performed by determining whether the first path is normal by turning on the first switch and turning off the second switch, and determining whether the second path is normal by turning off the first switch and turning on the second switch. The power supply control device according to (1) above. (3) The controller is When a sign of a power failure is detected based on a parameter corresponding to the voltage or current of the first system or the second system, a main determination process is performed in which the connection is interrupted and it is determined whether the power failure has occurred in the first system or the second system based on the parameter; In this determination process, it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to (1) or (2). (4) The controller: detecting an indication of a power supply failure by comparing a first ground fault threshold with the parameter; In the main determination process, when the parameter of the second system indicates that the parameter is on the non-ground fault side with respect to a second ground fault threshold value set on the ground fault side relative to the first ground fault threshold value for a certain period of time or more, the second system is determined to be normal; When the parameter of the second system indicates that the second system is on the ground fault side with respect to the second ground fault threshold value for a certain period of time or more, the second system is determined to be abnormal. The power supply control device according to (3) above. (5) The controller: In the main determination process, after the third power source is charged by the second power source for a certain period of time, it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to (3) above. (6) a switch for connecting and disconnecting the third power supply and the second system; The controller: The switch is normally turned off, and when a sign of a power failure is detected, the switch is turned on and it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to (3) above. (7) a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a third power source connected to the second system; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; The controller of the power supply control device is The connection is interrupted, and the diagnostic process is performed by supplying power from the third power source to the second load. A power supply control method comprising: (8) a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a third power source connected to the second system; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; The controller of the power supply control device includes: and executing a procedure for performing the diagnostic process by supplying power from the third power source to the second load after disconnecting the connection portion. Power control program.

[0111] Further advantages and modifications may readily occur to those skilled in the art. Thus, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and equivalents thereof. [Explanation of symbols]

[0112] 1,1A Power Control Device 3,3A Controller 10 1st power supply 11 PbB 12. Generator 20 2nd power supply 21 LiB 30 Third power supply 31 Capacitor 41 Intersystem switch 42 Backup switch 43 Battery Switch 44 Switch 51 First voltage sensor 52 Second voltage sensor 53 Third voltage sensor 54 4th voltage sensor 62 Automatic Driving Control Device 100,100A Control System 101 1st load 102 2nd load 110 1st system 120 2nd system 130 Intersystem Line 200 Earth fault P Connection Point R1 1st Pathway R2 2nd Pathway V1 1st system voltage V3 Third power supply voltage

Claims

1. a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; A power supply control device comprising: a third power source is connected to the second system; The controller: The connection is interrupted, and the diagnostic process is performed by supplying power from the third power source to the second load. Power control device.

2. a first switch that connects and disconnects a first path from a connection point between the third power source and the second system to the second load, and a second switch that connects and disconnects a second path from the connection point to the second power source, The controller: The diagnostic process is performed by determining whether the first path is normal by turning on the first switch and turning off the second switch, and determining whether the second path is normal by turning off the first switch and turning on the second switch. The power supply control device according to claim 1 .

3. The controller: When a sign of a power failure is detected based on a parameter corresponding to a voltage or a current of the first system or the second system, a main determination process is performed in which the connection part is interrupted and it is determined whether a power failure has occurred in the first system or the second system based on the parameter; In the main determination process, it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to claim 1 .

4. The controller: Detecting an indication of a power supply failure by comparing a first ground fault threshold with the parameter; In the main determination process, when the parameter of the second system indicates that the parameter is on the non-ground fault side with respect to a second ground fault threshold value set on the ground fault side relative to the first ground fault threshold value for a certain period of time or more, the second system is determined to be normal; When the parameter of the second system indicates that the second system is on the ground fault side with respect to the second ground fault threshold value for a certain period of time or more, the second system is determined to be abnormal. The power supply control device according to claim 3.

5. The controller: In the main determination process, after the third power source is charged by the second power source for a certain period of time, it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to claim 3.

6. a switch that connects and disconnects the third power supply and the second system; The controller: The switch is normally turned off, and when a symptom of a power failure is detected, the switch is turned on and it is determined whether a power failure has occurred in the second system based on a change in the power of the third power source. The power supply control device according to claim 3.

7. a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a third power source connected to the second system; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; The controller of the power supply control device is The connection is interrupted, and the diagnostic process is performed by supplying power from the third power source to the second load. A power supply control method comprising:

8. a connection unit that connects and disconnects a first system that supplies power from a first power source to a first load and a second system that supplies power from a second power source to a second load; a third power source connected to the second system; a controller that performs a diagnostic process for diagnosing whether backup control for backing up the first system by the second system is possible after startup, and that cuts off the connection and performs the backup control when a power failure of the first system is detected; The controller of the power supply control device includes: and executing a procedure for performing the diagnostic process by supplying power from the third power source to the second load after disconnecting the connection portion. Power control program.

Images