Electronic control device

Abstract

To provide an electronic control device capable of maintaining an electric power supply to at least part of the load.SOLUTION: An ECU 20 includes a control unit 70 that controls a cut-off circuit 50. The cut-off circuit 50 includes: a cut-off circuit 50C provided to a main line 41; cut-off circuits 50A1 and 50B1 provided to terminals 30A1 and 30B1 connected to a power source 10; and cut-off circuits 50A2, 50A3, 50B2, and 50B3 provided to terminals 30A2, 30A3, 30B2, and 30B3 connected to the load 11. A control unit 70 is configured so as to, when at least one of the currents flowing through the cut-off circuit 50 and the voltage of power source wiring 40 satisfies the predetermined abnormality detection condition, control part of the multiple cut-off circuits 50A1, 50A2, 50A3, 50B1, 50B2, 50B3, and the cut-off circuit 50C to be a cut-off state.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] TECHNICAL FIELD The disclosure herein relates to electronic control devices having power distribution capabilities. [Background technology]

[0002] Patent Document 1 discloses a power supply device (electronic control device) having a power distribution function. The contents of the prior art documents are incorporated by reference as explanations of technical elements in this specification. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-120479 A Summary of the Invention [Problem to be solved by the invention]

[0004] The electronic control device of Patent Document 1 includes two switches arranged on an electric wire connecting two power sources. A load is electrically connected to the electric wire at a position between the two switches. For this reason, if the switch is broken (stuck on) at the time when an abnormality such as a ground fault occurs in the power line connecting the electronic control device and the power sources, for example, the power supply to the load cannot be maintained. In the above-mentioned respects and in other respects not mentioned, further improvements are required for electronic control devices.

[0005] One disclosed object is to provide an electronic control device that can maintain power supply to at least a portion of a load. [Means for solving the problem]

[0006] One aspect of the disclosure is an electronic control device that receives power from a plurality of power sources (10) and distributes the power to a plurality of loads, the electronic control device comprising: A terminal (30) including a plurality of power supply terminals (30A1, 30B1) electrically connected to a plurality of power supplies and a plurality of load terminals (30A2, 30A3, 30B2, 30B3) electrically connected to a plurality of loads; a power supply wiring (40) including a trunk line (41) electrically connecting a first power supply terminal, which is one of a plurality of power supply terminals, and a second power supply terminal, which is another of the power supply terminals, and a plurality of branch lines (42) electrically connecting the trunk line and a load terminal; a plurality of interrupting circuits (50) provided in each of the trunk line and the branch line for passing or interrupting a current of electric power supplied from a power source; A control unit (70) that controls a plurality of interruption circuits; Equipped with The interruption circuit includes a trunk line interruption circuit (50C) provided in the trunk line, and a plurality of terminal interruption circuits (50A1, 50A2, 50A3, 50B1, 50B2, 50B3) provided corresponding to the terminals, the terminal interruption circuit includes a plurality of load interruption circuits provided on each of the branch lines corresponding to the load terminals, a first power supply interruption circuit provided in a first trunk line (41A) that is a trunk line between the trunk interruption circuit and the first power supply terminal, between a connection portion of the branch line and the first power supply terminal, and a second power supply interruption circuit provided in a second trunk line (41B) that is a trunk line between the trunk interruption circuit and the second power supply terminal, between a connection portion of the branch line and the second power supply terminal; The control unit controls some of the terminal interruption circuits and the main line interruption circuit to an interrupted state when at least one of the current flowing through the interruption circuit and the voltage of the power supply line satisfies a predetermined abnormality detection condition.

[0007] According to the disclosed electronic control device, even if the terminal cutoff circuit cannot be cut off at the time when an abnormality such as a ground fault occurs, it is possible to avoid a situation in which power cannot be supplied to all loads due to the cutoff of the main line cutoff circuit, i.e., it is possible to maintain the power supply to at least some of the loads.

[0008] The various aspects disclosed in this specification adopt different technical means to achieve their respective objectives. The claims and the parenthetical symbols described in this section are merely illustrative of the corresponding relationship with the embodiments described below, and are not intended to limit the technical scope. The objectives, features, and effects disclosed in this specification will become clearer with reference to the following detailed description and the accompanying drawings. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram showing an overall configuration of an ECU according to a first embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of an interrupter circuit. [Diagram 3] FIG. 13 is a diagram showing another example of an interrupter circuit. [Figure 4] FIG. 13 is a diagram showing another example of an interrupter circuit. [Diagram 5] FIG. 13 is a diagram showing another example of an interrupter circuit. [Figure 6] FIG. [Figure 7] FIG. 2 is a diagram illustrating terminals of a microcomputer. [Figure 8] FIG. [Figure 9] FIG. 13 is a diagram showing the relationship between each latch detection and an abnormal mode. [Figure 10] 13 is a flowchart showing an INT_C interrupt process. [Figure 11] 13 is a flowchart showing post-shutdown processing 1. [Figure 12] 13 is a flowchart showing A3 / B3 output processing. [Figure 13] 13 is a flowchart showing an INT_A1 interrupt process. [Figure 14] 13 is a flowchart showing an INT_A1H' interrupt process. [Figure 15] 13 is a flowchart showing post-shutdown process 2. [Figure 16] 13 is a flowchart showing an INT_A1h interrupt process. [Figure 17]FIG. 13 is a diagram showing an example of operation when a ground fault occurs at the A3 terminal. [Figure 18] This figure shows the operation when a ground fault occurs at the A3 terminal. [Figure 19] 13 is a diagram illustrating an example of an operation when an interrupter circuit A3 cannot be interrupted when a ground fault occurs at the A3 terminal. FIG. [Figure 20] FIG. 13 is a diagram showing an example of operation when a ground fault occurs at the A1 terminal. [Figure 21] FIG. 13 is a diagram showing the operation when a ground fault occurs at the A1 terminal. [Figure 22] 11 is a diagram illustrating an example of an operation when an interrupter circuit A1 cannot be interrupted when a ground fault occurs at the A1 terminal. [Diagram 23] FIG. 13 is a diagram illustrating an example of an operation when an open fault occurs at the A1 terminal. [Figure 24] FIG. 13 is a diagram illustrating the operation when an open fault occurs at the A1 terminal. [Diagram 25] FIG. 11 is a diagram showing an example of operation when a ground fault occurs due to an off-delay. [Figure 26] FIG. 13 is a diagram showing the operation when a ground fault occurs due to an off-delay. [Figure 27] FIG. 11 is a diagram illustrating the operation of a control unit when a ground fault occurs. [Figure 28] FIG. 13 is a diagram showing a modified example of the control unit. [Figure 29] FIG. [Diagram 30] FIG. 13 is a diagram illustrating another example of a load. [Diagram 31] FIG. 11 is a diagram illustrating a control unit in an ECU according to a second embodiment. [Diagram 32] FIG. 11 is a diagram illustrating a control unit in an ECU according to a third embodiment. [Diagram 33] FIG. 13 is a diagram illustrating a control unit in an ECU according to a fourth embodiment. [Diagram 34] FIG. [Diagram 35] FIG. [Diagram 36] FIG. [Figure 37]FIG. 13 is a diagram showing a power supply system to which an ECU according to a fifth embodiment is applied. [Figure 38] FIG. [Figure 39] FIG. [Diagram 40] FIG. 4 is a diagram showing interruption conditions of an interruption circuit. [Diagram 41] FIG. 11 is a diagram illustrating an example of an operation when a ground fault occurs. [Diagram 42] FIG. 11 is a diagram illustrating an example of an operation when a ground fault occurs. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, several embodiments will be described with reference to the drawings. In addition, by assigning the same reference numerals to corresponding components in each embodiment, duplicated explanations may be omitted. When only a part of the configuration is described in each embodiment, the configuration of the other embodiment described above can be applied to the other parts of the configuration. In addition to the combination of configurations explicitly stated in the description of each embodiment, configurations of several embodiments can be partially combined together even if not explicitly stated, as long as there is no particular problem with the combination.

[0011] (First embodiment) The electronic control device according to this embodiment has a power distribution function (power supply distribution function). Hereinafter, the electronic control device will be referred to as an ECU. ECU is an abbreviation for Electronic Control Unit. The ECU is mounted on, for example, a moving object. The ECU receives power supply from multiple power sources mounted on the moving object, and distributes the power to multiple devices mounted on the moving object. The moving object is, for example, a vehicle, an aircraft, a ship, a construction machine, an agricultural machine, etc. As an example, the ECU of this embodiment is mounted on a vehicle. The ECU is a power distribution ECU that aggregates the power distribution function in the vehicle. For example, a zone ECU may also function as the power distribution ECU. The vehicle may be provided with a power distribution ECU separate from the zone ECU, or may be provided with a power distribution ECU in a configuration that does not include a zone ECU.

[0012] The zone ECU, together with the central ECU, which is a higher-level ECU, the in-vehicle devices, and communication lines, configures an in-vehicle network system. The in-vehicle network system is a communication network based on a zone architecture, and realizes efficient data transfer between the central ECU, multiple zone ECUs, and a large number of in-vehicle devices. The zone ECU controls the in-vehicle devices based on commands from the central ECU. The in-vehicle devices may include ECUs, actuators, and sensors that are lower than the zone ECU. The zone ECU is disposed in a zone that is set in advance in the vehicle. The zone ECU has a power distribution function and supplies power for operation to each of the in-vehicle devices. The zone ECU has a gateway function and enables mutual communication by converting and relaying data between networks with different communication methods. At least one of the multiple zone ECUs may also serve as the power distribution ECU described above.

[0013] <ecu> First, the overall configuration of the ECU will be described with reference to Fig. 1. As shown in Fig. 1, the ECU 20 receives power from a plurality of power sources 10 and distributes the power to a plurality of loads 11. The loads 11 correspond to the above-mentioned in-vehicle devices.

[0014] The power source 10 that supplies power to the ECU 20 includes at least a power source 10A and a power source 10B. As an example, the power source 10A (power source A) in this embodiment is a main power source, and the power source 10B (power source B) is an auxiliary power source having a lower power supply capacity than the power source 10A. The power source 10A corresponds to the first power source, and the power source 10B corresponds to the second power source. The power source 10B cannot supply power to all the loads 11 by itself. The power source 10A is, for example, a DC-DC converter that steps down and outputs power supplied from a main battery. The power source 10B is, for example, an auxiliary battery.

[0015] The loads 11 include a load electrically connected to the trunk line 41A and a load electrically connected to the trunk line 41B of the trunk line 41 described later. The loads 11 may include a load electrically connected to both the trunk line 41A and the trunk line 41B. As an example, the loads 11 in this embodiment include a load 11A, a load 11B, and a load 11C. The load 11A (load A) is electrically connected to the trunk line 41A via a corresponding branch line 42. The load 11B (load B) is electrically connected to the trunk line 41B via a corresponding branch line 42. The load 11C (load C) is electrically connected to each of the trunk lines 41A and 41B. The multiple loads 11 can communicate with each other via a communication bus 12, for example.

[0016] The load 11C has a higher priority for power supply by the ECU 20 than the loads 11A and 11B. The loads 11A and 11B have a lower priority for power supply by the ECU 20 than the load 11C. The load 11C corresponds to a first load, and the loads 11A and 11B correspond to a second load. Priorities for power supply to the multiple loads 11 are set in advance. The priorities are set, for example, according to the importance of the functions. The load 11 having an important function for driving, for example a safety-related function, may be set as a high-priority load, and the load 11 having other functions (normal functions), that is, non-safety-related functions, may be set as a low-priority load. The load 11 having a redundant configuration may be set as a high-priority load, and the load 11 having a non-redundant configuration may be set as a low-priority load. An EPS device, a brake device, and the like are provided redundantly in a vehicle. EPS is an abbreviation for Electric Power Steering.

[0017] As an example, the load 11C in this embodiment is an ECU having a safety-related function. The load 11C is a redundant load. For example, the load 11C is an ECU having a redundant configuration corresponding to a redundantly provided motor in an EPS device.

[0018] The ECU 20 includes a plurality of terminals 30, a power supply line 40, a plurality of interrupter circuits 50, a power supply circuit 60, and a control unit .

[0019] The terminal 30 is an external connection terminal for electrically connecting the ECU 20 to an external device. As an example, the terminal 30 in this embodiment includes a terminal 30A1, a terminal 30A2, a terminal 30A3, a terminal 30B1, a terminal 30B2, and a terminal 30B3. The terminals 30A1 and 30B1 are so-called power supply terminals. The terminal 30A1 (A1 terminal) is electrically connected to the power supply 10A via a power supply line. The terminal 30B1 (B1 terminal) is electrically connected to the power supply 10B via a power supply line. The terminal 30A1 corresponds to a first power supply terminal, and the terminal 30B1 corresponds to a second power supply terminal. As an example, the terminals 30A1 and 30B1 in this embodiment are connected to the corresponding power supplies 10A and 10B without passing through another device (for example, an ECU).

[0020] The terminals 30A2, 30A3, 30B2, and 30B3 are load terminals for outputting power from the ECU 20 to the corresponding loads 11. Each of the terminals 30A2 and 30B2 is electrically connected to the load 11C via a corresponding power supply line. The terminal 30A2 (A2 terminal) is connected via a power supply line corresponding to one of the redundant configurations of the load 11C, and the terminal 30B2 (B2 terminal) is connected via a power supply line corresponding to the other one of the redundant configurations of the load 11C. The terminal 30A3 (A3 terminal) is electrically connected to the load 11A via the corresponding power supply line. The terminal 30B3 (B3 terminal) is electrically connected to the load 11B via the corresponding power supply line.

[0021] The multiple terminals 30 are mounted on a printed circuit board as, for example, connectors. The multiple terminals 30 may be aggregated in one connector, or may be distributed across multiple connectors. As described above, the load 11C has a redundant configuration, so the corresponding terminals 30A2 and 30B2 also have a redundant configuration. For example, the number of terminals (the number of pins) of the terminals 30A2 and 30B2 are equal to each other, and the structures are also approximately equal to each other.

[0022] The power supply wiring 40 electrically connects the multiple terminals 30 together. The power supply wiring 40 provides a power network. The power supply wiring 40 includes a trunk line 41 and multiple branch lines 42. The trunk line 41 electrically connects the power supply terminals together. The trunk line 41 is a power supply wiring that connects the terminal 30A1 and the terminal 30B1. The trunk line 41 forms the main structure of the power network. The trunk line 41 is sometimes referred to as a backbone, etc.

[0023] The trunk line 41 has trunk lines 41A and 41B. The trunk line 41A (trunk line A) is the portion of the trunk line 41 from terminal 30A1 to the interrupter circuit 50C described below. The trunk line 41B (trunk line B) is the portion from terminal 30B1 to the interrupter circuit 50C. The trunk line 41A is the portion of the trunk line 41 on the terminal 30A1 side, and the trunk line 41B is the portion of the trunk line 41 on the terminal 30B1 side. The trunk line 41A corresponds to the first trunk, and the trunk line 41B corresponds to the second trunk.

[0024] The branch lines 42 electrically connect each of the load terminals to the trunk line 41. The branch lines 42 connect the load terminals to the trunk line 41 individually. The power supply wiring 40 includes a branch line 42 connected to the trunk line 41A and a branch line 42 connected to the trunk line 41B. As an example, the power supply wiring 40 of this embodiment includes two branch lines 42 connected to the trunk line 41A and two branch lines 42 connected to the trunk line 41B. One of the branch lines 42 connected to the trunk line 41A is connected to the terminal 30A2, and the other is connected to the terminal 30A3. One of the branch lines 42 connected to the trunk line 41B is connected to the terminal 30B2, and the other is connected to the terminal 30B3.

[0025] The power supply wiring 40 includes, for example, wiring formed on a printed circuit board. The power supply wiring 40 may include the above-mentioned wiring and a wiring member such as a metal plate mounted on the printed circuit board.

[0026] The interruption circuit 50 is provided on the power supply wiring 40, and passes or interrupts a current flowing through the power supply wiring 40. The interruption circuit 50 interrupts an electrical connection with the power supply 10. The interruption circuit 50 is provided on each of the main line 41 and the branch line 42. As an example, the interruption circuit 50 of the present embodiment includes interruption circuits 50A1, 50A2, 50A3, 50B1, 50B2, 50B3, and 50C.

[0027] The interruption circuit 50C (interruption circuit C) is provided in the trunk 41. The interruption circuit 50C corresponds to a trunk interruption circuit. The trunk 41A is connected to the interruption circuit 50C. The interruption circuit 50C is connected to the trunk 41B. In the interrupted (off) state, the interruption circuit 50C electrically separates the trunk 41A from the trunk 41B. In the non-interrupted (on) state, the interruption circuit 50C electrically connects the trunks 41A and 41B. The interruption circuit 50C is sometimes referred to as an isolator, a backbone switch, etc.

[0028] Shutdown circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 are provided corresponding to terminals 30. Shutdown circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 correspond to terminal shutdown circuits. Shutdown circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 connect or disconnect the corresponding terminals 30 and power supply wiring 40.

[0029] The interruption circuit 50A1 (interruption circuit A1) is provided in the trunk 41A near the terminal 30A1. The interruption circuit 50A1 corresponds to a first power supply interruption circuit. The interruption circuit 50A1 is provided in the trunk 41A between the connection position of the branch line 42 and the terminal 30A1. In other words, the branch line 42 is connected to the trunk 41A between the interruption circuit 50A1 and the interruption circuit 50C. In the interrupted state, the interruption circuit 50A1 electrically separates the portion of the trunk 41 on the interruption circuit 50C side from the interruption circuit 50A1 and the terminal 30A1 (power source 10A).

[0030] The interruption circuit 50B1 (interruption circuit B1) is provided in the trunk 41B near the terminal 30B1. The interruption circuit 50B1 corresponds to a second power supply interruption circuit. The interruption circuit 50B1 is provided in the trunk 41B between the connection position of the branch line 42 and the terminal 30B1. In other words, the branch line 42 is connected to the trunk 41B between the interruption circuit 50B1 and the interruption circuit 50C. In the interrupted state, the interruption circuit 50B1 electrically separates the portion of the trunk 41 on the interruption circuit 50C side from the interruption circuit 50B1 and the terminal 30B1 (power supply 10B).

[0031] The interrupting circuits 50A2, 50A3, 50B2, and 50B3 correspond to load interrupting circuits. The interrupting circuit 50A2 (interrupting circuit A2) is provided in the branch line 42 connecting the trunk line 41A and the terminal 30A2. The interrupting circuit 50A2 is provided in the corresponding branch line 42 near the terminal 30A2. In the interrupted state, the interrupting circuit 50A2 electrically separates the terminal 30A2 from the trunk line 41A. The interrupting circuit 50B2 (interrupting circuit B2) is provided in the branch line 42 connecting the trunk line 41B and the terminal 30B2. The interrupting circuit 50B2 is provided in the corresponding branch line 42 near the terminal 30B2. In the interrupted state, the interrupting circuit 50B2 electrically separates the terminal 30B2 from the trunk line 41B. As an example, in this embodiment, interruption circuit 50A2, in the interrupted state, electrically isolates one of the redundant configurations of load 11C from trunk 41A. Interruption circuit 50B2, in the interrupted state, electrically isolates the other of the redundant configurations of load 11C from trunk 41B.

[0032] The interrupting circuit 50A3 (interrupting circuit A3) is provided in the branch line 42 connecting the trunk line 41A and the terminal 30A3. The interrupting circuit 50A3 is provided in the corresponding branch line 42 near the terminal 30A3. In the interrupted state, the interrupting circuit 50A3 electrically separates the terminal 30A3 from the trunk line 41A. The interrupting circuit 50B3 (interrupting circuit B3) is provided in the branch line 42 connecting the trunk line 41B and the terminal 30B3. The interrupting circuit 50B3 is provided in the corresponding branch line 42 near the terminal 30B3. In the interrupted state, the interrupting circuit 50B3 electrically separates the terminal 30B3 from the trunk line 41B.

[0033] The interrupter circuit 50 is configured to include electronic components mounted on, for example, a printed circuit board. The interrupter circuit 50 has a switch, a drive unit (drive circuit) for driving the switch, and a current detection unit. In the following, the direction in which the current flows through each interrupter circuit 50 toward the nearby terminal 30 is defined as a positive direction, and the direction in which the current flows away from the terminal 30 is defined as a negative direction. All directions indicated by solid arrows in FIG. 1 indicate the positive direction. The detailed configuration of the interrupter circuit 50 will be described later.

[0034] The power supply circuit 60 is an internal power supply circuit provided in the ECU 20. The power supply circuit 60 generates a constant voltage lower than the supply voltage based on the voltage supplied from the power supply 10. The power supply circuit 60 generates an operating voltage (e.g., 5 V) for the control unit 70 and outputs it to the control unit 70. In addition to the power supply circuit 60, the ECU 20 includes diodes 61 and 62, a capacitor 63, voltage divider circuits 64 and 65, and a communication IC 66. The power supply circuit 60, the diodes 61 and 62, the capacitor 63, the voltage divider circuits 64 and 65, and the communication IC 66 are configured to include electronic components mounted on, for example, a printed circuit board. In addition to the electronic components, wiring on the printed circuit board may be included.

[0035] Diodes 61 and 62 are disposed in the wiring electrically connecting power supply 10 and power supply circuit 60 to prevent reverse current. Diodes 61 and 62 are disposed with their anodes on the power supply 10 side. The anode of diode 61 is connected to trunk line 41A between terminal 30A1 and interrupter circuit 50A1. The anode of diode 62 is connected to trunk line 41B between terminal 30B1 and interrupter circuit 50B1.

[0036] The capacitor 63 is connected to a wiring that electrically connects the power supply 10 and the power supply circuit 60. The capacitor 63 is connected to the wiring at a position between the cathodes of the diodes 61 and 62. The positive electrode of the capacitor 63 is connected to the wiring, and the negative electrode is grounded.

[0037] The voltage dividing circuit 64 is a circuit for detecting the voltage of the trunk line 41A. The voltage dividing circuit 65 is a circuit for detecting the voltage of the trunk line 41B. The control unit 70 monitors the voltage Va resistively divided by the voltage dividing circuit 64 and the voltage Vb resistively divided by the voltage dividing circuit 65. The communication IC 66 is a circuit for the ECU 20 (control unit 70) to communicate with other devices, for example, other ECUs, via the communication bus 12.

[0038] The control unit 70 controls the interrupter circuit 50. The control unit 70 controls the driving (on / off) of the switch of the interrupter circuit 50. The control unit 70 acquires the voltages Va and Vb described above, and controls the interrupter circuit 50 based on the voltages Va and Vb. The control unit 70 acquires a current detected in the interrupter circuit 50, and controls the interrupter circuit 50 based on the current. As shown in FIG. 1, the control unit 70 acquires a current Ia1 from the interrupter circuit 50A1, and acquires a current Ib1 from the interrupter circuit 50B1. The control unit 70 acquires a current Ia2 from the interrupter circuit 50A2, and acquires a current Ib2 from the interrupter circuit 50B2. The control unit 70 acquires a current Ia3 from the interrupter circuit 50A3, and acquires a current Ib3 from the interrupter circuit 50B3.

[0039] The control unit 70 is configured to include, for example, electronic components mounted on a printed circuit board and wiring formed on the printed circuit board. The control unit 70 has a function of detecting anomalies based on voltage and current, as well as a latch function of holding anomaly detection data. The detailed configuration of the control unit 70 will be described later.

[0040] <Shutoff circuit> Next, the configuration of the interrupter circuit will be described with reference to Figures 2 to 5. Figure 2 shows one example of an interrupter circuit. Figure 3 shows another example of an interrupter circuit. Figure 4 shows another example of an interrupter circuit. Figure 5 shows another example of an interrupter circuit. The solid arrows in Figures 2 to 5 indicate the direction of current that can be interrupted by each MOSFET.

[0041] Interrupting circuit 50C may employ, for example, any of the configurations shown in Figs. 2, 3, and 4. Interrupting circuit 50A1 may employ, for example, any of the configurations shown in Figs. 2, 3, 4, and 5. The remaining interrupting circuits 50A2, 50A3, 50B1, 50B2, and 50B3 may employ, for example, the configuration shown in Fig. 5. Figs. 2 to 4 show interrupting circuit 50C as an example. Fig. 5 shows interrupting circuit 50A2 as an example.

[0042] The interrupter circuit 50C shown in FIG. 2 has n-channel MOSFETs 51 and 52, diodes 53 and 54, drivers 55 and 56, and a current detector 57. MOSFET is an abbreviation for Metal Oxide Semiconductor Field Effect Transistor. The MOSFETs 51 and 52 correspond to the above-mentioned switches. The interrupter circuit 50C is a common-source type interrupter circuit in which the sources of the two MOSFETs 51 and 52 are connected in common. The diodes 53 and 54 are parasitic diodes of the corresponding MOSFETs 51 and 52. The diode 53 is connected in anti-parallel to the corresponding MOSFET 51. The diode 54 is connected in anti-parallel to the corresponding MOSFET 52. The anodes of the diodes 53 and 54 are connected to the sources of the corresponding MOSFETs 51 and 52, and the cathodes are connected to the drains.

[0043] The driving units 55 and 56 are sometimes referred to as drivers. A common control signal (gate driving signal) is input to the driving units 55 and 56. When an off signal (L level) is input, the driving units 55 and 56 turn off the MOSFETs 51 and 52. The current detection unit 57 is disposed outside the series circuit of the MOSFETs 51 and 52. The current detection unit 57 may include, for example, a shunt resistor and acquire a voltage value corresponding to the current.

[0044] Since the diodes 53 and 54 are arranged in the opposite directions, by turning off both the MOSFETs 51 and 52, it is possible to prevent bidirectional current from flowing. The diode 53 can block the current from the drain to the source of the MOSFET 51, that is, from the MOSFET 51 to the MOSFET 52. The diode 54 can block the current from the drain to the source of the MOSFET 52, that is, from the MOSFET 52 to the MOSFET 51. On the other hand, when an on signal (a signal of H level) is input, the cutoff circuit 50C enters a conducting state, and can pass a current flowing from the MOSFET 51 to the MOSFET 52 and a current flowing from the MOSFET 52 to the MOSFET 51, that is, a bidirectional current. In this way, it is possible to pass or block a bidirectional current.

[0045] As shown in Fig. 3, a current detection unit 57 may be provided between MOSFETs 51 and 52. The current detection unit 57 is provided between the source of MOSFET 51 and the source of MOSFET 52. The other configurations are similar to those of the example shown in Fig. 2. The configuration shown in Fig. 3 also makes it possible to pass or block a bidirectional current.

[0046] As shown in FIG. 4, a common-drain type cutoff circuit may be used. The drains of MOSFETs 51 and 52 are commonly connected. The other configuration is the same as the example of FIG. 2. In this configuration as well, diodes 53 and 54 are arranged in the opposite directions. Therefore, by turning off both MOSFETs 51 and 52, it is possible to prevent bidirectional current from flowing. Also, by turning on both MOSFETs 51 and 52, it is possible to pass bidirectional current. Although not shown, a current detection unit 57 may be provided between the drains of MOSFETs 51 and 52 in the configuration shown in FIG. 4.

[0047] 5 includes a MOSFET 51, a diode 53, a drive unit 55, and a current detection unit 57. As in the configuration described above, the diode 53 is connected inversely parallel to the MOSFET 51. The anode of the diode 53 is connected to the source of the MOSFET 51, and the cathode is connected to the drain. The MOSFET 51 is disposed such that the drain is on the inside side of the ECU 20 and the source is outside the ECU 20. The current detection unit 57 is connected to the source of the MOSFET 51.

[0048] By turning off MOSFET 51, interrupter circuit 50A2 cuts off the current in the direction from the drain to the source of MOSFET 51, that is, in the direction from the inside to the outside of ECU 20. By turning off MOSFET 51, it is possible to cut off the current flowing from interrupter circuit 50 to the corresponding terminal 30.

[0049] Instead of a switch having a parasitic diode, the switch in interrupter circuit 50 may be a switch without a parasitic diode, such as an IGBT or a normally-on switch. IGBT is an abbreviation for Insulated Gate Bipolar Transistor. If a switch without a parasitic diode is used, interrupter circuit 50C can be configured with a single switch, for example.

[0050] <Control Unit> Next, the configuration of the control unit 70 will be described with reference to Fig. 6 to Fig. 8. Fig. 6 shows the control unit 70. Fig. 7 shows the terminals of the microcomputer 71. Fig. 8 shows the threshold values.

[0051] The control unit 70 includes an arithmetic processing circuit including a processor, a memory, a storage, and the like. The processor executes various processes for implementing each function by accessing the memory. The memory is, for example, a RAM. RAM is an abbreviation for Random Access Memory. The storage includes a non-volatile storage medium such as a flash memory. The storage stores a control program to be executed by the processor. The processor executing the control program corresponds to the execution of a control method corresponding to the control program.

[0052] As an example, the control unit 70 of this embodiment includes a microcomputer 71, a DAC 72, a plurality of comparators 73, a plurality of latches 74, and a plurality of gate circuits (logic gates). DAC is an abbreviation for Digital to Analog Converter.

[0053] The microcomputer 71 includes a CPU, RAM, ROM, an A / D converter, etc. CPU is an abbreviation for Central Processing Unit. ROM is an abbreviation for Read Only Memory. As shown in Fig. 7, the microcomputer 71 has a plurality of terminals. The terminals include an ADin terminal, an INT terminal, a PT terminal, and a COMn terminal.

[0054] The above-mentioned voltages Va, Vb and currents Ia1, Ia2, Ia3, Ib1, Ib2, Ib3, and Ic are input to the ADin terminal. The ADin terminal is a terminal for monitoring voltages and currents. The value output by the latch 74 is input to the INT terminal. The INT terminal is an interrupt request terminal. The PT terminal includes a terminal for outputting a control signal for the switch (MOSFET) that constitutes the interruption circuit 50. The PT terminal includes a terminal for outputting a signal for clearing the latch 74, and a terminal for setting the DAC 72. The communication terminal COMn is an input / output terminal for communicating with an external device via the above-mentioned communication IC 66.

[0055] The DAC 72 performs D / A conversion on the set value output from the microcomputer 71 and outputs it as a threshold to each comparator 73. The comparators 73 compare the detected voltage or current value with the threshold and output the comparison result. The comparators 73 detect abnormalities such as a ground fault or overvoltage. The comparators 73 include comparators 73A1, 73A2, 73A3, 73B1, 73B2, and 73B3. These comparators 73A1, 73A2, 73A3, 73B1, 73B2, and 73B3 detect, for example, a ground fault based on the current flowing through the interrupter circuit 50.

[0056] Comparator 73A1 outputs a comparison result between current Ia1 and a threshold. Comparator 73A2 outputs a comparison result between current Ia2 and a threshold. Comparator 73A3 outputs a comparison result between current Ia3 and a threshold. Comparator 73B1 outputs a comparison result between current Ib1 and a threshold. Comparator 73B2 outputs a comparison result between current Ib2 and a threshold. Comparator 73B3 outputs a comparison result between current Ib3 and a threshold. In the example shown in FIG. 6, the thresholds are input to the inverting input terminals of comparators 73A1, 73A2, 73A3, 73B1, 73B2, and 73B3, and the current values ​​are input to the non-inverting input terminals.

[0057] FIG. 8 shows an example of the threshold value to be set. FIG. 8 shows the threshold value for detecting a ground fault, the overcurrent threshold value, and the normal operating current range. The detection value by the current detection unit 57 indicates a positive (+) value when the current flows in the positive direction, and indicates a negative (-) value when the current flows in the negative direction. The ground fault detection threshold value is set between the overcurrent threshold value and the normal operating current range. As described later, a ground fault refers to a ground fault occurring outside the terminal 30 or at the terminal 30. The outside of the terminal 30 refers to, for example, a power supply line connecting the terminal 30 and the power supply 10 or a power supply line connecting the terminal 30 and the load 11. For convenience, hereinafter, a ground fault occurring outside the terminal 30 may also be referred to as a ground fault at the terminal 30.

[0058] As an example, in this embodiment, the ground fault detection threshold for the current Ia1 is set so that open circuit detection is also possible. In other words, a threshold that can also be used for open circuit detection is set. Since the current Ia1 that flows when open circuit is almost zero (0), a negative value close to zero is set. In this embodiment, the power supply capacity of the power supply 10B may be lower than that of the power supply 10A, and the power supply 10B may be charged by the power supplied from the power supply 10A. An open circuit at the terminal 30A1 refers to an open circuit that occurs in the power supply line that connects the terminal 30A1 and the power supply 10A, for example.

[0059] The comparator 73 further includes comparators 73AH1, 73AH2, 73VA1, 73VA2, 73VB1, and 73VB2. The comparators 73AH1 and 73AH2 detect an abnormality (overvoltage) in the voltage supplied from the power supply 10A with a high power supply capacity. The voltage Va is input to both comparators 73AH1 and 73AH2. The threshold value set in the comparator 73AH2 is higher than the threshold value set in the comparator 73AH1. As a result, the comparator 73AH2 outputs an H-level signal indicating an abnormality later than the comparator 73AH1. Therefore, the latch timing is also delayed. In the example shown in FIG. 6, the threshold value is input to the inverting input terminal of the comparators 73AH1 and 73AH2, and the voltage value is input to the non-inverting input terminal.

[0060] The comparators 73VA1 and 73VA2 detect a drop in the voltage Va due to, for example, a ground fault. The voltage Va is input to both the comparators 73VA1 and 73VA2. The threshold set in the comparator 73VA2 is lower than the threshold set in the comparator 73VA1. As a result, the comparator 73VA2 outputs an H-level signal indicating an abnormality later than the comparator 73VA1. Similarly, the comparators 73VB1 and 73VB2 detect a drop in the voltage Vb. The voltage Vb is input to both the comparators 73VB1 and 73VB2. The threshold set in the comparator 73VB2 is lower than the threshold set in the comparator 73VB1. As a result, the comparator 73VB2 outputs an H-level signal indicating an abnormality later than the comparator 73VB1.

[0061] In the example shown in Fig. 6, the threshold value is input to the non-inverting input terminal of the comparators 73VA1, 73VA2, 73VB1, and 73VB2, and the voltage value is input to the inverting input terminal. As an example, in this embodiment, the threshold values ​​of the comparators VA1 and VB1 are a common value (equal value). The threshold values ​​of the comparators VA2 and VB2 are a common value.

[0062] The latches 74 hold data. As an example, the latches 74 in this embodiment are SR latches. A PT terminal (PT_LC) that outputs a signal for clearing the data in the latches 74 is electrically connected to an R terminal of each latch 74. The latches 74 include latches 74A1, 74A2, 74A3, 74B1, 74B2, 74B3, and 74C.

[0063] To detect open circuits, the S terminal of the latch 74A1 receives the output signal of the corresponding comparator 73A1. The S terminal of the latch 74A2 receives the output signal of the corresponding gate circuit 75A2. The gate circuit 75A2 is an AND gate, and the output signals of the comparators 73A2 and 73VA1 are input to the input terminals of the gate circuit 75A2. Similarly, the S terminal of the latch 74A3 receives the output signal of the corresponding gate circuit 75A3. The gate circuit 75A3 is an AND gate, and the output signals of the comparators 73A3 and 73VA1 are input to the input terminals of the gate circuit 75A3.

[0064] The S terminal of the latch 74B1 receives the output signal of the corresponding gate circuit 75B1. The gate circuit 75B1 is an AND gate, and the input terminals of the gate circuit 75B1 receive the output signals of the comparators 73B1 and 73VB1. Similarly, the S terminal of the latch 74B2 receives the output signal of the corresponding gate circuit 75B2. The gate circuit 75B2 is an AND gate, and the input terminals of the gate circuit 75B2 receive the output signals of the comparators 73B2 and 73VB1. The S terminal of the latch 74B3 receives the output signal of the corresponding gate circuit 75B3. The gate circuit 75B3 is an AND gate, and the input terminals of the gate circuit 75B3 receive the output signals of the comparators 73B3 and 73VB1.

[0065] The latch 74 further includes latches 74AH1 and 74AH2. The output signal of the corresponding comparator 73AH1 is input to an S terminal of the latch 74AH1. Similarly, the output signal of the corresponding comparator 73AH2 is input to an S terminal of the latch 74AH2.

[0066] The latch 74A1 outputs an A1b signal. The latch 74A2 outputs an A2b signal. The latch 74A3 outputs an A3b signal. The latch 74B1 outputs a B1b signal. The latch 74B2 outputs a B2b signal. The latch 74B3 outputs a B3b signal. The latch 74AH1 outputs an A1hb signal. The latch 74AH2 outputs an A1hb' signal. Each of the above signals is input to a corresponding INT terminal of the microcomputer 71.

[0067] The gate circuit further includes gate circuits 76A1, 76A2, 76A3, 76B1, 76B2, 76B3, and 76C. Gate circuits 76A1, 76A2, 76A3, 76B1, 76B2, 76B3, and 76C are AND gates, and a NOT gate is connected to one of the input terminals. Output signals of gate circuits 76A1, 76A2, 76A3, 76B1, 76B2, 76B3, and 76C are input to the drive units of the corresponding blocking circuits 50.

[0068] The gate circuit 76A1 receives an inverted signal of the A1b signal and an output signal of the gate circuit 771. The gate circuit 771 is also an AND gate, and a NOT gate is connected to one of its input terminals. The gate circuit 771 receives a control signal of the interruption circuit 50A1 outputted from the microcomputer 71 and an inverted signal of the A1hb signal. When at least one of the following is satisfied: the control signal is at L level, the A1b signal is at H level, and the A1hb signal is at H level, the gate circuit 76A1 outputs an OFF signal (signal of L level) to the interruption circuit 50A1 (switch). For example, when the A1b signal becomes H level due to a ground fault or an open circuit, the gate circuit 76A1 outputs an OFF signal to the interruption circuit 50A1. When the A1hb signal becomes H level due to an overvoltage, the gate circuit 76A1 outputs an OFF signal to the interruption circuit 50A1.

[0069] An inverted signal of the A2b signal and a control signal for the interruption circuit 50A2 output from the microcomputer 71 are input to the gate circuit 76A2. When the control signal is at an L level and / or the A2b signal is at an H level, the gate circuit 76A2 outputs an OFF signal to the interruption circuit 50A2. For example, when the A2b signal becomes an H level due to a ground fault, the gate circuit 76A2 outputs an OFF signal to the interruption circuit 50A2.

[0070] The gate circuit 76A3 receives an inverted signal of the A3b signal and an output signal of the gate circuit 772. The gate circuit 772 is an AND gate, and a NOT gate is connected to one of its input terminals. The control signal of the interruption circuit 50A3 output from the microcomputer 71 and an inverted signal of the A3b' signal are input to the gate circuit 772. The A3b' signal is the A1b' signal output from the gate circuit 773. The gate circuit 773 is an OR gate, and receives the A1b signal and the A1hb signal. When at least one of the following is satisfied: the control signal is at an L level, the A3b signal is at an H level, the A1b signal is at an H level, and the A1hb signal is at an H level, the gate circuit 76A3 outputs an OFF signal to the interruption circuit 50A3.

[0071] For example, when the A3b signal goes high due to a ground fault, gate circuit 76A3 outputs an off signal to shutoff circuit 50A3. When the A1hb signal goes high due to an overvoltage, gate circuit 76A3 outputs an off signal to shutoff circuit 50A3. When the A1b signal goes high due to a ground fault or open, gate circuit 76A3 outputs an off signal to shutoff circuit 50A3.

[0072] The gate circuit 76B1 receives an inverted signal of the B1b signal and a control signal of the shutoff circuit 50B1 output from the microcomputer 71. When the control signal is at an L level and / or the B1b signal is at an H level, the gate circuit 76B1 outputs an OFF signal to the shutoff circuit 50B1. Therefore, for example, when the B1b signal becomes an H level due to a ground fault, the gate circuit 76B1 outputs an OFF signal to the shutoff circuit 50B1. Similarly, the gate circuit 76B2 receives an inverted signal of the B2b signal and a control signal of the shutoff circuit 50B2 output from the microcomputer 71. When the control signal is at an L level and / or the B2b signal is at an H level, the gate circuit 76B2 outputs an OFF signal to the shutoff circuit 50B2. For example, when the B2b signal becomes an H level due to a ground fault, the gate circuit 76B2 outputs an OFF signal to the shutoff circuit 50B2.

[0073] An inverted signal of the B3b signal and an output signal of the gate circuit 774 are input to the gate circuit 76B3. The gate circuit 774 is an AND gate, and a NOT gate is connected to one of its input terminals. A control signal of the interruption circuit 50B3 output from the microcomputer 71 and an inverted signal of the B3b' signal are input to the gate circuit 774. The B3b' signal is an output signal of the gate circuit 775. The gate circuit 775 is an OR gate, and an A1b' signal and a Cb' signal are input to the gate circuit 775. The Cb' signal is an output signal of the gate circuit 776. The gate circuit 776 is an OR gate, and an Cb signal and an A1hb' signal are input to the gate circuit 776. When at least one of the following is satisfied: the control signal is at the L level, the B3b signal is at the H level, the Cb signal is at the H level, the A1hb' signal is at the H level, the A1b signal is at the H level, and the A1hb signal is at the HH level, the gate circuit 76B3 outputs an OFF signal to the blocking circuit 50B3.

[0074] For example, when the B3b signal becomes H level due to a ground fault, gate circuit 76B3 outputs an OFF signal to shutoff circuit 50B3. When voltage Va and / or voltage Vb drops due to a ground fault and the Cb signal becomes H level, gate circuit 76B3 outputs an OFF signal to shutoff circuit 50B3. When the A1hb signal becomes H level due to an overvoltage, gate circuit 76B3 outputs an OFF signal to shutoff circuit 50B3. When the A1b signal becomes H level due to a ground fault, gate circuit 76B3 outputs an OFF signal to shutoff circuit 50B3.

[0075] The gate circuit 76C receives an inverted signal of the Cb signal and an output signal of the gate circuit 777. The gate circuit 777 is an AND gate, and a NOT gate is connected to one of its input terminals. The gate circuit 777 receives a control signal of the interrupter circuit 50C outputted from the microcomputer 71 and an inverted signal of the A1hb' signal. When at least one of the following is satisfied: the control signal is at L level, the A1hb' signal is at H level, and the Cb signal is at H level, the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C. For example, when the voltage Va and / or the voltage Vb is reduced due to a ground fault and the Cb signal becomes H level, the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C. When the A1hb' signal becomes H level due to an overvoltage, the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C.

[0076] <Each latch detection and abnormal mode> Fig. 9 shows an example of the relationship between each latch detection and the abnormal mode. That is, it shows the relationship between the state of the signal output from each latch 74 and input to the INT terminal of the microcomputer 71 and the abnormal mode detected by the microcomputer 71. Fig. 9 also shows the states of the A3b' signal and the B3b' signal for cutting off the power supply to the low priority loads 11A and 11B by hardware processing.

[0077] 9, when the A1b signal acquired from the INT_A1 terminal is at H level and the Cb signal acquired from the INT_C terminal is at L level, the microcomputer 71 detects that the terminal 30A1 (A1 terminal) is open. Since the A1b signal is at H level, the A3b' signal and the B3b' signal also become H level.

[0078] When the A1b signal is at H level and the Cb signal is at H level, the microcomputer 71 detects that the terminal 30A1 has a ground fault. Since the A1b signal and the Cb signal are at H level, the A3b' signal and the B3b' signal become H level.

[0079] The microcomputer 71 detects that the terminal 30A3 (A3 terminal) has a ground fault when the A3b signal acquired from the INT_A3 terminal is at H level and the Cb signal is at H level. In this case, the A3b' signal becomes L level, and since the Cb signal is at H level, the B3b' signal becomes H level. Similarly, the microcomputer 71 detects that the terminal 30A2 (A2 terminal) has a ground fault when the A2b signal acquired from the INT_A2 terminal is at H level and the Cb signal is at H level. In this case, the A3b' signal becomes L level, and since the Cb signal is at H level, the B3b' signal becomes H level.

[0080] The microcomputer 71 detects that the terminal 30B1 (B1 terminal) is grounded when the B1b signal acquired from the INT_B1 terminal is at H level and the Cb signal is at H level. In this case, the A3b' signal is at L level, and the B3b' signal is at H level because the Cb signal is at H level. The microcomputer 71 detects that the terminal 30B3 (B3 terminal) is grounded when the B3b signal acquired from the INT_B3 terminal is at H level and the Cb signal is at H level. In this case, the A3b' signal is at L level, and the B3b' signal is at H level because the Cb signal is at H level. The microcomputer 71 detects that the terminal 30B2 (B2 terminal) is grounded when the B2b signal acquired from the INT_B2 terminal is at H level and the Cb signal is at H level. In this case, the A3b' signal is at L level, and the B3b' signal is at H level because the Cb signal is at H level.

[0081] When the A1hb signal acquired from the INT_A1hb terminal is at H level and the A1hb' signal acquired from the INT_A1hb' terminal is at H level, the microcomputer 71 detects that the terminal 30A1 (A1 terminal) is at an overvoltage, that is, the voltage supplied from the power supply 10A is at an overvoltage (high voltage). In this case, since the A1hb signal is at H level, the A3b' signal is at H level, and since the A1hb signal and the A1hb' signal are at H level, the B3b' signal is at H level.

[0082] <Control method> Next, the process executed by the microcomputer 71 (processor), that is, the control method, will be described with reference to Fig. 10 to Fig. 16. When the microcomputer 71 receives an interrupt request while all the cutoff circuits 50 are on (energized), it executes the following process. Fig. 10 shows the INT_C interrupt process. The H level of the signal corresponds to 1, and the L level corresponds to 0 (zero). In the following, the H level may be represented as 1 and the L level as 0.

[0083] When an H-level Cb signal is input to the INT terminal (INT_C) for the interrupter circuit 50C, the microcomputer 71 executes an INT_C interrupt process. When the voltage Va drops below the threshold, the output of the comparator 73VA2 goes to H level, and the output of the gate circuit 75C goes to H level, and the Cb signal output from the latch 74C also goes to H level. Similarly, when the voltage Vb drops below the threshold, the output of the comparator 73VB2 goes to H level, and the output of the gate circuit 75C goes to H level, and the Cb signal output from the latch 74C also goes to H level. In this way, when at least one of the voltages Va and Vb goes below the threshold, the Cb signal goes to H level.

[0084] As shown in Fig. 10, first, the microcomputer 71 outputs an L-level signal as a control signal from the PT terminal (PT_C) corresponding to the interruption circuit 50C (step S100). As a result, the output of the gate circuit 777 becomes L-level, so that even if the Cb signal, which is the cause of this interruption and is later latched and cleared, becomes L-level from H-level., the gate circuit 76C can maintain the OFF signal (L-level signal) for switching the interruption circuit 50C to the interruption state. Next, the microcomputer 71 executes post-shutdown process 1, which is a process after outputting a shutoff instruction to the interruption circuit 50C (step S101). When the post-shutdown process 1 ends, the microcomputer 71 ends the series of processes.

[0085] 11 shows post-shutdown processing 1. The microcomputer 71 first determines whether both voltages Va and Vb have dropped (step S110). The microcomputer 71 compares the values ​​of voltages Va and Vb acquired via the corresponding ADin terminals (AD_VA, AD_VB) with a pre-stored threshold value, and determines whether voltages Va and Vb are below the threshold value, i.e., whether they have dropped. The threshold value is, for example, a common value (equal value) for voltages Va and Vb.

[0086] If the voltages Va and Vb have dropped, the microcomputer 71 determines whether the momentary interruption counter has overflowed (step S111). If the momentary interruption counter has overflowed, an abnormality flag is set (step S112), and the process proceeds to the A3 / B3 output process (step S121) described below. If the momentary interruption counter has not overflowed, the microcomputer 71 increments the momentary interruption counter, that is, adds +1 to the value (step S113), waits for a predetermined time (step S114), and then executes the process from step S110 onwards again.

[0087] If the result of the determination in step S110 is NO, the microcomputer 71 determines whether one (either) of the voltages Va and Vb is below a threshold, that is, whether one of the voltages Va and Vb has dropped (step S115). If one of the voltages Va and Vb has dropped, it determines whether the current on the side where the voltages Va and Vb have dropped is abnormal (step S116). The microcomputer 71 compares the values ​​of the currents Ia1, Ia2, Ia3, Ib1, Ib2, and Ib3 acquired via the corresponding ADin terminals with prestored thresholds, and determines whether the currents exceed the thresholds, that is, whether there is an abnormality. For example, if the voltage Va has dropped, it determines whether the currents Ia1, Ia2, and Ia3 on the trunk 41A side are abnormal. If the voltage Vb has dropped, it determines whether the currents Ib1, Ib2, and Ib3 on the trunk 41B side are abnormal.

[0088] If there is no current abnormality on the decreasing side, the process proceeds to step S118. If there is a current abnormality on the decreasing side, the microcomputer 71 outputs an L-level control signal from the PT terminal corresponding to the interrupter circuit 50 in which the current abnormality was detected, and waits for a predetermined time (step S117). For example, if the current Ia3 exceeds the threshold, the microcomputer 71 outputs an L-level signal from the PT terminal (PT_A3) corresponding to the interrupter circuit 50A3. This causes the output of the gate circuit 772 to go to L level, and the gate circuit 76A3 outputs an off signal to the interrupter circuit 50A3.

[0089] Next, the microcomputer 71 again determines whether both the voltages Va and Vb have dropped (step S118). If the voltages Va and Vb have dropped, the microcomputer 71 executes the processes from step S111 onward. If the determination is NO in step S118, the microcomputer 71 again determines whether one of the voltages Va and Vb has dropped (step S119). If one of the voltages Va and Vb has dropped, the process proceeds to the A3 / B3 output process (step S121) described below.

[0090] If the determination in steps S115 and S119 is NO, that is, if the voltages Va and Vb are equal to or greater than the thresholds, the microcomputer 71 outputs an H-level control signal from the PT terminal (PT_C) corresponding to the interrupter circuit 50C (step S120). If the voltage Va is less than the overvoltage threshold, the A1hb' signal goes to an L-level, and both inputs to the gate circuit 777 go to an H-level. Thus, the output of the gate circuit 777 goes to an H-level. Also, since the voltages Va and Vb are equal to or greater than the ground fault detection threshold, the Cb signal goes to an L-level. Thus, both inputs to the gate circuit 76C go to an H-level, and the gate circuit 76C outputs an ON signal to the interrupter circuit 50C.

[0091] Next, the microcomputer 71 executes an A3 / B3 output process (step S121). After the A3 / B3 output process, the microcomputer 71 executes a latch clear process (step S122) and ends a series of post-cutoff process 1. In step S123, the microcomputer 71 outputs an H-level signal from the PT terminal (PT_LC) for latch clear. As a result, an H-level signal is input to the R terminal of each latch 74, and the data held in the latch 74 is cleared (reset).

[0092] 12 shows the A3 / B3 output process. The microcomputer 71 first reads data from each INT terminal (step S130). Next, the microcomputer 71 determines whether the read data contains a 1 (H level), i.e., whether an abnormality has been detected (step S131). If there is no 1, the microcomputer 71 ends the series of processes. If there is a 1, the microcomputer 71 outputs an L-level control signal from the PT terminal corresponding to the target interruption circuit 50 (step S132). For example, if the A1b signal is 1, the microcomputer 71 outputs an L-level signal from the PT terminal (PT_A1) corresponding to the interruption circuit 50A1.

[0093] Next, the microcomputer 71 judges whether at least one of the A1b signal and the A1hb signal is 1 (step S133). That is, it judges whether at least one of the A1b signal and the A1hb signal is at H level. If the judgment in step S133 is YES, the microcomputer 71 outputs an L level control signal from the PT terminal (PT_A3) corresponding to the cutoff circuit 50A3 in order to suppress power consumption on the main line 41A side (step S134). As a result, the output of the gate circuit 772 becomes L level, and the gate circuit 76A3 outputs an OFF signal to the cutoff circuit 50A3. In this way, the microcomputer 71 controls to cut off the power supply to the load 11A with low priority. After executing step S134, the process proceeds to step S135.

[0094] If the determination in step S133 is NO, the microcomputer 71 determines whether at least one of the A1b signal, the A1hb signal, the Cb signal, and the A1hb' signal is 1 (step S135). That is, it determines whether at least one of the A1b signal, the A1hb signal, the Cb signal, and the A1hb' signal is at H level. If the determination in step S135 is NO, the microcomputer 71 ends the A3 / B3 output process.

[0095] If step S135 is judged as YES, the microcomputer 71 outputs an L-level control signal from the PT terminal (PT_B3) corresponding to the cutoff circuit 50B3 in order to suppress power consumption on the trunk line 41B side (step S136). This causes the output of the gate circuit 774 to become L-level, and the gate circuit 76B3 outputs an OFF signal to the cutoff circuit 50B3. In this way, the microcomputer 71 performs control so as to cut off the power supply to the load 11B with a low priority. After executing step S136, the microcomputer 71 ends the A3 / B3 output process.

[0096] By executing the A3 / B3 output process in this manner, even if the latch is cleared in step S123, for example, it is possible to maintain the interrupted state (off) of interruption circuit 50A3 and interruption circuit 50B3.

[0097] 13 shows the INT_A1 interrupt process. When an H-level A1b signal is input to the INT terminal (INT_A1) for the interrupter circuit 50A1, the microcomputer 71 executes the INT_A1 interrupt process. When the value of the current Ia1 exceeds the threshold, the output of the comparator 73A1 becomes H level, and the A1b signal output from the latch 74A1 becomes H level.

[0098] As shown in FIG. 13, first, the microcomputer 71 outputs an L-level signal as a control signal from the PT terminal (PT_A1) corresponding to the interrupt circuit 50A1 (step S140). As a result, the output of the gate circuit 771 becomes L level, so that even if the A1b signal, which is the cause of this interruption, is later latched and cleared and becomes L from H, the gate circuit 76A1 can maintain the OFF signal (L-level signal) for turning the interrupt circuit 50A1 into an interrupted state. Next, the microcomputer 71 determines whether the voltage Va and / or the voltage Vb is below the threshold, that is, whether it has decreased (step S141). If there is a decrease, the microcomputer 71 outputs an L-level control signal from the PT terminal (PT_C) corresponding to the interrupt circuit 50C and waits for a predetermined time (step S142). The L-level control signal causes the output of the gate circuit 777 to become L level, and the gate circuit 76C outputs an OFF signal to the interrupt circuit 50C. After waiting, the microcomputer 71 executes the post-cutoff process 1 shown in FIG. 11 (step S143), and after the execution, ends the series of INT_A1 interrupt processes.

[0099] If the determination in step S141 is NO, that is, if there is no drop in the voltages Va and Vb, the microcomputer 71 executes the A3 / B3 output process shown in FIG. 12 (step S144). Next, the microcomputer 71 executes the latch clear process (step S145) and ends the series of INT_A1 interrupt processes. For example, if a ground fault occurs at the terminal 30A1, an OFF signal for the interruption circuit 50A3 is output by the process of step S144. Therefore, even if the latch is cleared, the interruption state of the interruption circuit 50A3 can be maintained.

[0100] Although not shown, the INT_A2 interrupt process, the INT_A3 interrupt process, the INT_B1 interrupt process, the INT_B2 interrupt process, and the INT_B3 interrupt process are the same as the INT_A1 interrupt process described above. For example, in the case of the INT_A2 interrupt process, in step S140, an L-level signal may be output as a control signal from the PT terminal (PT_A2) corresponding to the cutoff circuit 50A2. As described above, the microcomputer 71 first cuts off the cutoff circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 corresponding to each terminal 30, and controls the cutoff circuit 50C to be cut off if at least one of the voltages Va and Vb falls below the threshold value even after the cutoff.

[0101] 14 shows the INT_A1h' interrupt process. When an H-level A1hb' signal is input to the INT terminal (INT_A1h'), the microcomputer 71 executes the INT_A1h' interrupt process. When the voltage Va exceeds the overvoltage threshold, the output of the comparator 73AH2 becomes H level, and the A1hb' signal output from the latch 74AH2 becomes H level.

[0102] 14, first, the microcomputer 71 outputs an L-level signal as a control signal from the PT terminal (PT_C) corresponding to the interrupt circuit 50C (step S150). This causes the gate circuit 777 to go to L level, so that even if the A1hb' signal, which is the cause of this interrupt, goes from H level to L level after being latched and cleared later, the gate circuit 76C can continue to output an OFF signal (L-level signal) to the interrupt circuit 50C to put the circuit into an interrupted state. Next, the microcomputer 71 executes post-shutdown processing 2, which is processing after outputting a shutoff instruction (OFF signal) to the interrupt circuit 50C (step S151), and when the post-shutdown processing 2 ends, the series of INT_A1H' interrupt processing ends.

[0103] FIG. 15 shows the post-shutdown process 2. The microcomputer 71 first determines whether both the voltages Va and Vb exceed the threshold, that is, whether there is an overvoltage (step S160). The threshold for overvoltage determination is stored in advance. The threshold is, for example, a common value for the voltages Va and Vb. If the voltages Va and Vb are overvoltages, the microcomputer 71 determines whether the abnormality counter has overflowed (step S161). If there is an overflow, the microcomputer 71 sets an overvoltage abnormality flag (step S162) and proceeds to the A3 / B3 output process (step S170) described later. If there is no overflow, the abnormality counter is incremented, that is, the value is increased by +1 (step S163), and the process waits for a predetermined time (step S164), and then the process from step S160 onwards is executed again.

[0104] If the determination in step S160 is NO, the microcomputer 71 determines whether the voltage Va on the side of the power source 10A with the higher power supply capacity is an overvoltage (step S165). If the voltage Va is an overvoltage, the microcomputer 71 outputs an L-level control signal from the corresponding PT terminal (PT_A1) and waits for a predetermined time in order to shut off the shutoff circuit 50A1 closest to the power source 10A (step S166). The L-level control signal causes the output of the gate circuit 771 to become L level, and the gate circuit 76A1 outputs an OFF signal to the shutoff circuit 50A1.

[0105] Next, the microcomputer 71 again determines whether both the voltages Va and Vb are overvoltages (step S167). If the voltages Va and Vb are overvoltages, the microcomputer 71 executes the processes from step S161 onward. If the determination is NO in step S167, the microcomputer 71 again determines whether the voltage Va is an overvoltage (step S168). If the voltage Va is an overvoltage, the process proceeds to the A3 / B3 output process (step S170).

[0106] If the determinations in steps S165 and S168 are NO, that is, if the voltage Va is not an overvoltage, the microcomputer 71 outputs an H-level control signal from the PT terminal (PT_C) (step S169). If the voltage Va is less than the overvoltage threshold, the A1hb' signal goes to L level, and so both inputs to the gate circuit 777 go to H level. If the voltages Va and Vb are equal to or greater than the threshold for determining a ground fault, the Cb signal goes to L level, and so both inputs to the gate circuit 76C go to H level. Therefore, the gate circuit 76C outputs an ON signal to the interrupter circuit 50C.

[0107] Next, the microcomputer 71 executes the A3 / B3 output process (step S170). After the A3 / B3 output process, the microcomputer 71 executes the latch clear process (step S171) and ends the series of post-cutoff process 2.

[0108] 16 shows the INT_A1h interrupt process. When an H-level A1hb signal is input to the INT terminal (INT_A1h), the microcomputer 71 executes the INT_A1h interrupt process. When the voltage Va exceeds the overvoltage threshold, the output of the comparator 73AH1 becomes H level, and the A1hb signal output from the latch 74AH1 also becomes H level.

[0109] As shown in FIG. 16, first, the microcomputer 71 outputs an L-level signal as a control signal from the PT terminal (PT_A1) (step S180). As a result, the output of the gate circuit 771 becomes L-level, so that even if the A1b signal, which is the cause of this interruption, is later latched and cleared and becomes L-level from H-level, the gate circuit 76A1 can continue to output an OFF signal (L-level signal) to the interruption circuit 50A1 to bring the circuit into an interruption state. Next, the microcomputer 71 determines whether the voltage Va and / or the voltage Vb is an overvoltage (step S181). If it is an overvoltage, the microcomputer 71 outputs an L-level control signal from the PT terminal (PT_C) and waits for a predetermined time (step S182). Due to the L-level output, the output of the gate circuit 777 becomes L-level, and the gate circuit 76C outputs an OFF signal to the interruption circuit 50C. After waiting, the microcomputer 71 executes the post-interruption process 2 shown in FIG. 15 (step S183), and ends the series of INT_A1h interruption processes after execution.

[0110] If the determination in step S181 is NO, that is, if the voltages Va and Vb are not overvoltages, the microcomputer 71 executes the A3 / B3 output process shown in Fig. 12 (step S184). Next, the microcomputer 71 executes the latch clear process (step S185) and ends the series of INT_A1h interrupt processes.

[0111] <Example of abnormal operation> 17 and 18 show an example of the operation when a ground fault occurs at the terminal 30A3 (A3 terminal). As shown in FIG. 17, when a ground fault occurs at the terminal 30A3, a current flows into the ground fault location as shown by the solid arrow, and the voltage of the trunk lines 41A and 41B drops, and the divided voltages Va and Vb drop. When the current Ia3 of the interrupter circuit 50A3 closest to the ground fault location exceeds the threshold and the voltage Va falls below the ground fault threshold, the A3b signal goes to H level, and the gate circuit 76A3 outputs an OFF signal to the interrupter circuit 50A3. When at least one of the voltages Va and Vb falls below the threshold, the Cb signal goes to H level, and the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C. When the Cb signal goes to H level, the B3b' signal goes to H level, and the gate circuit 76B3 outputs an OFF signal to the interrupter circuit 50B3.

[0112] As described above, in this embodiment, the thresholds of the comparators 73VA1 and 73VB1 are higher than the thresholds of the comparators 73VA2 and 73VB2. Therefore, an OFF signal is output to the shutoff circuit 50A3 first. When the voltage does not recover even if an OFF signal is output to the shutoff circuit 50A3, and at least one of the voltages Va and Vb falls below the corresponding threshold of the comparator 73VA2 or 73VB2, an OFF signal is output to the shutoff circuit 50C. Also, an OFF signal is output to the shutoff circuit 50B3. When the voltages Va and Vb recover to or exceed the threshold after the shutoff circuit 50C is turned off, an ON signal is output to the shutoff circuit 50C by the interrupt process of the microcomputer 71 described above. FIG. 18 shows the OFF state of the shutoff circuits 50A3, 50B3, and 50C. The remaining shutoff circuits 50A1, 50A2, 50B1, and 50B2 are in the ON (energized) state.

[0113] First, an off signal is output to interruption circuit 50A3, so that when voltages Va and Vb are restored by this process, it is possible to avoid turning off interruption circuit 50C on trunk line 41. Even if interruption circuit 50C is turned off, power can be supplied to load 11C, which has a high priority for power supply, from the path of power source 10A, trunk line 41A, and interruption circuit 50A2 and the path of power source 10B, trunk line 41B, and interruption circuit 50B2, so that the power supply can be maintained.

[0114] FIG. 19 shows an example of the operation when the terminal 30A3 side cannot be cut off when a ground fault occurs at the terminal 30A3. That is, it shows an example of the operation when the interrupter circuit 50A3 cannot be turned off due to a failure such as a stuck-on state. As described above, the gate circuit 76A3 first outputs an OFF signal to the interrupter circuit 50A3. However, the interrupter circuit 50A3 does not turn off due to the stuck-on state. In this case, the voltages Va and Vb do not return, and at least one of the voltages Va and Vb falls below the threshold of the corresponding comparator 73VA2 or 73VB2. Therefore, the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C. In addition, the gate circuit 76B3 outputs an OFF signal to the interrupter circuit 50B3. FIG. 19 shows a failure (stuck-on) of the interrupter circuit 50A3 and an OFF state of the interrupter circuits 50B3 and 50C. The remaining interrupter circuits 50A1, 50A2, 50B1, and 50B2 are in the ON state.

[0115] By turning off the interrupter circuit 50C, the trunk 41B can be separated from the trunk 41A in a ground fault state. This allows the voltage of the trunk 41B to return to normal. Even if the interrupter circuit 50A3 closest to the ground fault location fails (stuck on), power can be supplied to the load 11C, which has a high priority for power supply, via the path of the power source 10B, the trunk 41B, and the interrupter circuit 50B2. Power can be supplied to one of the redundant configurations provided in the load 11C, and the function can be maintained. Furthermore, by turning off the interrupter circuit 50B3, power from the power source 10B can be preferentially supplied to the load 11C. This also allows the function of the load 11C, which has a high priority, to be maintained.

[0116] If a ground fault occurs at terminal 30B3 (B3 terminal), the operation is the same as when a ground fault occurs at terminal 30A3. As an example, in this embodiment, the interrupter circuit 50A3 corresponding to the load 11A with a low priority is not turned off. For example, if the interrupter circuit 50B3 is stuck on, the voltage of the main line 41A is restored by turning off the interrupter circuit 50C. Since the power supply 10A has a higher power supply capacity than the power supply 10B, it is not necessary to turn off the interrupter circuit 50A3. For example, in a configuration in which the power supply capacities of the power supplies 10A and 10B are approximately equal to each other, the interrupter circuit 50A3 may be turned off together with the interrupter circuit 50C.

[0117] When a ground fault occurs at the terminal 30A2 (A2 terminal), the operation is the same as when a ground fault occurs at the terminal 30A3. Power can be supplied to the load 11C, which has a high priority for power supply, via the power source 10B, the trunk 41B, and the interrupter circuit 50B2. Even if the interrupter circuit 50A2 is stuck on, the voltage of the trunk 41B can be restored by turning off the interrupter circuit 50C. Power can be supplied preferentially to the load 11C by turning off the interrupter circuit 50B3. When a ground fault occurs at the terminal 30B2 (B2 terminal), the operation is the same as when a ground fault occurs at the terminal 30B3. Power can be supplied to the load 11C, which has a high priority for power supply, via the power source 10A, the trunk 41A, and the interrupter circuit 50A2.

[0118] 20 and 21 show an example of the operation when a ground fault occurs at the terminal 30A1 (A1 terminal). As shown by the solid arrow in FIG. 20, a current flows into the ground fault location, and the voltage of the trunk lines 41A and 41B drops, causing the divided voltage values ​​Va and Vb to drop. When the current Ia1 of the interrupter circuit 50A1 closest to the ground fault location exceeds a threshold, the A1b signal goes to H level, and the gate circuit 76A1 outputs an OFF signal to the interrupter circuit 50A1. When the A1b signal goes to H level, the A3b' signal goes to H level, and the gate circuit 76A3 outputs an OFF signal to the interrupter circuit 50A3. When at least one of the voltages Va and Vb falls below the threshold, the Cb signal goes to H level, and the gate circuit 76C outputs an OFF signal to the interrupter circuit 50C. Furthermore, when the A1b signal and / or the Cb signal goes high, the B3b' signal goes high, and the gate circuit 76B3 outputs an OFF signal to the shutoff circuit 50B3.

[0119] In this embodiment, first, an OFF signal is output to the shutoff circuit 50A1. Also, an OFF signal is output to the shutoff circuit 50A3. When the voltage does not recover even if an OFF signal is output to the shutoff circuit 50A1, and at least one of the voltages Va and Vb falls below the threshold of the comparators 73VA2 and 73VB2, an OFF signal is output to the shutoff circuit 50C. Also, an OFF signal is output to the shutoff circuit 50B3. When the voltages Va and Vb become equal to or higher than the threshold after the shutoff circuit 50C is turned off, an ON signal is output to the shutoff circuit 50C by the interrupt process of the microcomputer 71 described above. FIG. 21 shows the OFF state of the shutoff circuits 50A1, 50A3, 50B3, and 50C. The remaining shutoff circuits 50A2, 50B1, and 50B2 are in the ON state.

[0120] When the voltages Va and Vb are restored by outputting an off signal to the interrupter circuit 50A1, it is possible to avoid turning off the interrupter circuit 50C, and therefore the interrupter circuit 50B3. Even when the interrupter circuit 50C is turned off, power can be supplied to the load 11C, which has a high priority for power supply, from the path of the power source 10B, the main line 41B, and the interrupter circuit 50B2. By turning off the interrupter circuit 50B3, it is possible to supply power preferentially to the load 11C. By turning off the interrupter circuit 50A3, it is possible to supply power preferentially to the load 11C even if the interrupter circuit 50C is turned on. Even when the interrupter circuit 50A1 is turned off to separate the power source 10A from the ECU 20, it is possible to maintain the power supply to the load 11C.

[0121] FIG. 22 shows an example of the operation when the terminal 30A1 side cannot be cut off when a ground fault occurs at the terminal 30A1. That is, it shows an example of the operation when the interrupter circuit 50A1 cannot be turned off due to a failure such as a stuck-on state. Even if the gate circuit 76A1 outputs an off signal to the interrupter circuit 50A1, the interrupter circuit 50A1 does not turn off due to the stuck-on state. In this case, the voltages Va and Vb do not return, and at least one of the voltages Va and Vb falls below the thresholds of the comparators 73VA2 and 73VB2. Therefore, the gate circuit 76C outputs an off signal to the interrupter circuit 50C. Also, the gate circuit 76B3 outputs an off signal to the interrupter circuit 50B3. FIG. 22 shows a failure (stuck-on) of the interrupter circuit 50A1, and the off states of the interrupter circuits 50A3, 50B3, and 50C. The remaining interrupter circuits 50A1, 50A2, 50B1, and 50B2 are in the on state.

[0122] Turning off the interrupter circuit 50C allows the trunk 41B to be separated from the trunk 41A in a ground fault state. This allows the voltage of the trunk 41B to return to normal. Therefore, even if the interrupter circuit 50A1 closest to the ground fault location fails (stuck on), power can be supplied to the load 11C, which has a high priority for power supply, via the path of the power source 10B, the trunk 41B, and the interrupter circuit 50B2. Also, turning off the interrupter circuit 50B3 allows power from the power source 10B to be supplied preferentially to the load 11C.

[0123] When an overvoltage abnormality occurs at terminal 30A1, the operation is the same as when a ground fault occurs at terminal 30A1. When an overvoltage abnormality occurs at terminal 30A1, voltage Va exceeds the overvoltage threshold and the A1hb signal becomes H level. As a result, gate circuit 76A1 outputs an OFF signal to interrupter circuit 50A1, and gate circuit 76A3 outputs an OFF signal to interrupter circuit 50A3. When the A1hb' signal becomes H level, gate circuit 76C outputs an OFF signal to interrupter circuit 50C. Also, gate circuit 76B3 outputs an OFF signal to interrupter circuit 50B3.

[0124] 23 and 24 show an example of the operation when an open circuit fault occurs at the terminal 30A1. When the terminal 30A1 is open, the power supply from the power supply 10A to the ECU 20 is cut off. Therefore, the current of the power supplied from the power supply 10B flows through each load 11. When the current Ia1 of the interrupter circuit 50A1 closest to the open circuit exceeds the threshold for both ground fault and open circuit, the A1b signal becomes H level, and the gate circuit 76A1 outputs an OFF signal to the interrupter circuit 50A1. In addition, the gate circuit 76A3 outputs an OFF signal to the interrupter circuit 50A3, and the gate circuit 76B3 outputs an OFF signal to the interrupter circuit 50B3. FIG. 24 shows the OFF state of the interrupter circuits 50A1, 50A3, and 50B3. The remaining interrupter circuits 50A2, 50B1, 50B2, and 50C are in the ON state.

[0125] Even if the power supply from power supply 10A is interrupted due to an open circuit, by turning off shutoff circuit 50A3, power from power supply 10B can be preferentially supplied to load 11C. Similarly, by turning off shutoff circuit 50B3, power from power supply 10B can be preferentially supplied to load 11C.

[0126] Figures 25 and 26 show an example of operation when a ground fault occurs due to an off delay. An example of operation is shown when a ground fault occurs and a momentary interruption occurs due to an off delay of the switch of the interrupter circuit 50. Figures 25 and 26 show an example in which a ground fault occurs at terminal 30A3, as in Figure 17. Figure 27 shows the operation of the control unit when a ground fault occurs.

[0127] The interrupter circuit 50 has a power-on reset circuit (not shown). When a ground fault occurs at the terminal 30A3 and the resistance near the ground fault is small, the divided voltage values ​​Va, Vb of the voltages of the trunks 41A, 41B drop suddenly. Thus, the ground fault is detected by the current Ia3 and the voltages Va, Vb, and the S terminals of the latches 74A3, 74C are set to H. However, if the interrupter circuits 50A3, 50C are not turned off (shut down) in time due to a delay, and the trunks 41A, 41B are momentarily interrupted (ground faulted), the interrupter circuit 50 performs a power-on reset.

[0128] As described above, the ECU 20 of this embodiment includes the capacitor 63. Therefore, even if a momentary interruption occurs, the voltage of the control unit 70 is held. That is, the data of the latch 74 is held. Therefore, when returning (restarting) from the power-on reset, as shown in FIG. 27, a signal of H level is output from the latch 74A3 as the A3b signal, and an OFF signal is output to the interruption circuit 50A3. Also, a signal of H level is output from the latch 74C as the Cb signal, and an OFF signal is output to the interruption circuit 50C. Since the B3b' signal becomes H level based on the Cb signal, an OFF signal is output to the interruption circuit 50B3. An ON signal is output to the other interruption circuits 50A1, 50A2, 50B1, and 50B2. Therefore, it is possible to suppress the trunk lines 41A and 41B from being momentarily interrupted (grounded) again. That is, it is possible to suppress repeated momentary interruptions.

[0129] <Summary of the First Embodiment> According to this embodiment, the ECU 20 includes the interruption circuit 50C (main line interruption circuit) in the main line 41 in addition to the interruption circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 (terminal interruption circuits) corresponding to the terminals 30. When at least one of the current flowing through the interruption circuit 50 and the voltage of the power supply wiring 40 satisfies a predetermined abnormality detection condition, the control unit 70 outputs an OFF signal to the corresponding terminal interruption circuit and the main line interruption circuit that exceed the current threshold among the multiple terminal interruption circuits. Therefore, even if the terminal interruption circuit closest to the abnormality such as a ground fault cannot be turned off at the time when an abnormality such as a ground fault occurs, it is possible to avoid a situation where power cannot be supplied to all the loads 11 due to the main line interruption circuit being turned off. In other words, the power supply to at least some of the loads 11 can be maintained.

[0130] As illustrated in this embodiment, the load 11 may include a load 11C (first load) having a high priority of power supply and loads 11A and 11B (second load) having a low priority of power supply. The terminal 30A2 electrically connected to the trunk 41A and the terminal 30B2 electrically connected to the trunk 41B may be connected to a common load 11C. This allows the power supply to the load 11C with a high priority to be maintained even if the interrupter circuit 50C is turned off. Furthermore, the control unit 70 may control the interrupter circuit 50C to a cutoff state, or may control at least one of the interrupter circuits 50A3 and 50B3 corresponding to the loads 11A and 11B to a cutoff state in conjunction with controlling the interrupter circuit 50A1 to a cutoff state. This allows the power to be supplied to the load 11C with a high priority to be secured.

[0131] The control unit 70 may output an off signal to the interruption circuit 50C when the value of the current flowing through the interruption circuit 50C exceeds a predetermined threshold current. As exemplified in this embodiment, the control unit 70 may output an off signal to the interruption circuit 50C when at least one of the divided voltage values ​​Va, Vb of the voltages of the trunks 41A, 41B falls below a predetermined threshold voltage. Since the voltages of only the trunks 41A, 41B are monitored rather than the voltages of each of the interruption circuits 50, the configuration can be simplified.

[0132] The control unit 70 may output an OFF signal to the corresponding interrupting circuit 50A1, 50A2, 50A3, 50B1, 50B2, 50B3 when any of the currents Ia1, Ia2, Ia3, Ib1, Ib2, Ib3 exceeds a predetermined threshold current. As illustrated in this embodiment, the control unit 70 may output an OFF signal to the corresponding interrupting circuit 50A1, 50A2, 50A3, 50B1, 50B2, 50B3 when at least one of the voltages Va and Vb is below a predetermined threshold voltage and any of the currents Ia1, Ia2, Ia3, Ib1, Ib2, Ib3 exceeds a predetermined threshold current. Since the voltages Va and Vb are also used, the current threshold for detecting a ground fault can be set low. This makes it possible to suppress erroneous interruption while improving the interruption responsiveness.

[0133] The threshold voltage for shutting off the shutoff circuit 50C and the threshold voltage for shutting off the shutoff circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 may be a common value. As illustrated in this embodiment, the threshold voltage for shutting off the shutoff circuit 50C may be lower than the threshold voltage for shutting off the shutoff circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3. That is, the thresholds of the comparators 73VA2 and 73VB2 are lower than the thresholds of the comparators 73VA1 and 73VB1. Therefore, the shutoff circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 corresponding to the abnormality are first turned off, and if the voltages Va and Vb still drop, the shutoff circuit 50C is turned off. This makes it possible to suppress unnecessary shutoff of the shutoff circuit 50C.

[0134] As exemplified in this embodiment, the control unit 70 may turn on the interrupting circuit 50C when the voltages Va and Vb become equal to or higher than the threshold voltage after turning off the interrupting circuit 50C. If there is no failure in the interrupting circuit 50 that was turned off after performing ground fault detection and redundant operation, the control unit 70 turns on the interrupting circuit 50C again. This allows the state of redundant power supply for the load 11 to be continued.

[0135] As illustrated in this embodiment, the ECU 20 may further include a capacitor 63 connected to a power supply path from the power supply 10 to the control unit 70, and the control unit 70 may have a latch function for holding the abnormality detection data. The abnormality detection data is data that correlates with satisfying the abnormality detection condition. As described above, when a ground fault is detected but the corresponding interruption circuit 50 is not turned off in time due to a delay, and the trunk lines 41A, 41B are momentarily interrupted, each interruption circuit 50 performs a power-on reset. By including the capacitor 63, the operating voltage of the control unit 70 can be secured even if a momentary interruption occurs. That is, the control unit 70 can hold the abnormality detection data obtained by detecting the ground fault. As a result, the corresponding interruption circuit 50 can be turned off using the abnormality detection data at the time of recovery (restart).

[0136] As illustrated in this embodiment, the power supply capacity of power supply 10A (first power supply) may be higher than the power supply capacity of power supply 10B (second power supply). In such a configuration in which power supply 10A has a high power supply capacity, if the direction of current flow from interrupter circuit 50A1 to terminal 30A1 is defined as the positive direction, control unit 70 may control interrupter circuit 50A1 to an interrupted state when the current flowing through interrupter circuit 50A1 is a positive value or zero. This makes it possible to detect not only ground faults but also opens.

[0137] In a configuration in which power supply 10A has a high power supply capacity, control unit 70 may output an off signal to interruption circuits 50A1 and 50C when voltage Va exceeds an overvoltage threshold. In this way, when the supply voltage from power supply 10A is an overvoltage, even if interruption circuit 50A1 breaks down, interruption circuit 50C can be turned off to prevent the influence of the overvoltage from reaching the trunk line 41B side.

[0138] The overvoltage threshold for shutting off the interruption circuit 50C and the overvoltage threshold voltage for shutting off the interruption circuit 50A1 may be a common value. As illustrated in this embodiment, the overvoltage threshold for shutting off the interruption circuit 50C may be higher than the threshold voltage for shutting off the interruption circuit 50A1. The threshold of the comparator 73AH2 is higher than the threshold of the comparator 73AH1. Therefore, the interruption circuit 50A1 is first turned off, and if the voltage Va still rises, the interruption circuit 50C is turned off. This makes it possible to suppress unnecessary shutoff of the interruption circuit 50C.

[0139] The ECU 20 of this embodiment has gate circuits 772-776 for cutting off the power supply to the low priority loads 11A, 11B. It also has a latch 74 (SR latch) for holding an abnormality detection signal. The hardware processing can improve the cutoff responsiveness from the detection of an abnormality.

[0140] <Modification> As shown in FIG. 28, the ECU 20 may be configured not to detect an open fault at the terminal 30A1. The ECU 20 includes a gate circuit 75A1. The output signals of the comparators 73A1 and 73VA1 are input to the gate circuit 75A1. The output signal of the gate circuit 75A1 is input to the S terminal of the latch 74A1. When the current Ia1 is greater than the threshold voltage for detecting a ground fault and the voltage Va falls below the threshold voltage for detecting a ground fault, the gate circuit 75A1 outputs an H-level signal. As shown in FIG. 29, the threshold voltage for detecting a ground fault compared with the current Ia1 is not shared with the open fault detection but is dedicated to the ground fault detection. When a ground fault occurs at the terminal 30A1, the current Ia1 flows in the opposite direction to that during normal operation, that is, in the positive direction. Therefore, a positive (+) value is set. By setting the value to a low value close to zero, the interrupter circuit 50A1 can be quickly turned off by hardware processing when a ground fault occurs.

[0141] The number of loads 11 and the arrangement of the loads 11 are not limited to the above example. As shown in Fig. 30, the terminals 30A2 and 30B2 may be configured to be connected to different loads 11. In Fig. 30, the load 11D (load D) is electrically connected to the terminal 30A2, and the load 11E (load E) is electrically connected to the terminal 30B2. As shown in Fig. 30, the configuration may be such that power is supplied only to the loads 11 that do not have redundancy. A configuration may be such that no priority of power supply is set for multiple loads 11.

[0142] Furthermore, a plurality of loads 11 having a high priority for power supply may be provided. A configuration may be adopted in which a plurality of loads 11 having a high priority for power supply are connected to the ECU 20 at approximately equal positions. A plurality of loads 11 having a low priority for power supply may be provided for each of the trunks 41A, 41B. A configuration may be adopted in which a plurality of loads 11 corresponding to each of the trunks 41A, 41B are connected to the ECU 20 at approximately equal positions. The loads 11 may have a power distribution function. Power may be distributed from the loads 11 to lower-level devices.

[0143] The ECU 20 includes a communication IC 66 as shown in Fig. 1. The control unit 70 (microcomputer 71) is capable of communication via the communication IC 66 as shown in Fig. 6. Therefore, instead of cutting off the power supply to the loads 11A and 11B with low priority, an operation restriction request for reducing power consumption may be transmitted to the loads 11A and 11B. This reduces the power consumption of the loads 11A and 11B, and ensures power supply to the load 11C with high priority.

[0144] As shown in FIG. 1 and FIG. 6, the control unit 70 (microcomputer 71) acquires values ​​of currents Ia1, Ia2, Ia3, Ib1, Ib2, Ib3, and Ic flowing through each interruption circuit 50. Therefore, a fault diagnosis of the current detection unit 57 of the interruption circuits 50A1, 50A2, 50A3, and 50C may be performed by comparing the currents Ia1, Ia2, and Ia3 on the power supply 10A side with the current Ic. Specifically, if the sum of the currents (-Ia1-Ia3-Ia2) flowing through the terminal interruption circuits on the power supply 10A side is approximately equal to the current Ic, the circuit is normal. Similarly, a fault diagnosis of the current detection unit 57 of the interruption circuits 50B1, 50B2, 50B3, and 50C may be performed by comparing the currents Ib1, Ib2, and Ib3 on the power supply 10B side with the current Ic. Specifically, it is normal if the sum of the currents (Ib1+Ib3+Ib2) flowing through the terminal interruption circuits on the power supply 10B side is approximately equal to the current Ic.

[0145] Second embodiment This embodiment is a modification based on the previous embodiment, and the description of the previous embodiment can be used. In the previous embodiment, the power supply to the loads 11A and 11B with low priority is cut off by a hardware configuration. Instead of this, the power supply to the loads 11A and 11B with low priority may be cut off by the microcomputer 71.

[0146] FIG. 31 shows the configuration of the control unit 70 in the ECU 20 according to this embodiment. The control unit 70 has a configuration in which the gate circuits 772, 773, 774, 775, and 776 are removed from the configuration shown in the preceding embodiment (see FIG. 6). The microcomputer 71 has a function (low-priority cutoff function) of cutting off the loads 11A and 11B having a low priority of power supply. The microcomputer 71 (processor) executes processing equivalent to the gate circuits 772 and 773. When a signal of H level is input as the A1b signal and / or the A1hb signal to the corresponding INT terminal, the microcomputer 71 outputs a control signal of L level from the PT_A3 terminal. This causes the gate circuit 76A3 to output an OFF signal to the cutoff circuit 50A3.

[0147] The microcomputer 71 executes processes corresponding to the gate circuits 774, 775, and 776. When an H-level signal is input to the corresponding INT terminal as at least one of the A1b signal, the Cb signal, the A1hb signal, and the A1hb' signal, the microcomputer 71 outputs an L-level control signal from the PT_B3 terminal. This causes the gate circuit 76B3 to output an OFF signal for the interrupter circuit 50B3. The other configurations are the same as those of the ECU 20 described in the preceding embodiment.

[0148] <Summary of the second embodiment> The ECU 20 of this embodiment can achieve the same effects as those of the configurations described in the preceding embodiments. Since the microcomputer 71 has a function of cutting off the power supply to the loads 11A and 11B with low priority, the circuit configuration of the control unit 70 can be simplified.

[0149] Third embodiment This embodiment is a modification based on the previous embodiment, and the description of the previous embodiment can be used. In the previous embodiment, the abnormality detection data is latched by a hardware configuration. The control unit 70 is provided with an SR latch. Instead of this, the abnormality detection data may be latched by the microcomputer 71.

[0150] FIG. 32 shows the configuration of the control unit 70 in the ECU 20 according to this embodiment. The control unit 70 is configured by removing all the latches 74 and the gate circuits 76A1, 76A2, 76A3, 76B1, 76B2, 76B3, 76C, 771, and 777 from the configuration shown in the preceding embodiment (see FIG. 31). The microcomputer 71 has a function (latch function) of holding abnormality detection data. The microcomputer 71 executes processing equivalent to the latches 74A1, 74A2, 74A3, 74AH1, 74AH2, 74B1, 74B2, 74B3, and 74C. The output signals of the comparators 73A1, 73AH1, and 73AH2 and the output signals of the gate circuits 75A2, 75A3, 75B1, 75B2, 75B3, and 75C are input to the INT terminal of the microcomputer 71. The control signal output from the PT terminal of the microcomputer 71 is input to the drive unit of the corresponding interrupter circuit 50.

[0151] Even if a momentary interruption occurs, the operating voltage of the microcomputer 71 is maintained by the capacitor 63. The microcomputer 71 holds the abnormality detection data acquired through the INT terminal. When returning from a power-on reset, the microcomputer 71 outputs a control signal according to the held abnormality detection data. The other configurations are the same as those of the ECU 20 described in the preceding embodiment.

[0152] <Summary of the third embodiment> The ECU 20 of this embodiment can achieve the same effects as the configuration described in the preceding embodiment. The microcomputer 71 has a function of latching abnormality detection data in addition to a function of cutting off power to the low-priority loads 11A and 11B. Therefore, the circuit configuration of the control unit 70 can be further simplified.

[0153] (Fourth embodiment) This embodiment is a modification based on the preceding embodiment, and the description of the preceding embodiment can be used. In the preceding embodiment, a ground fault is detected using the current flowing through each interruption circuit 50. Alternatively, a ground fault may be detected only by interruption circuit 50C.

[0154] 33 shows the configuration of the control unit 70 in the ECU 20 according to this embodiment. The control unit 70 includes a microcomputer 71, a DAC 72, a plurality of comparators 73, a plurality of latches 74, and a plurality of gate circuits. The DAC 72 sets the thresholds of the comparators 73 according to instructions from the microcomputer 71.

[0155] The comparator 73 does not include comparators corresponding to the interrupter circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3. The comparator 73 includes comparators 73VA and 73VB for detecting a voltage drop. The thresholds of the comparators 73VA and 73VB are, for example, a common value. Since a ground fault is not detected based on the currents Ia1, Ia2, Ia3, Ib1, Ib2, and Ib3, the comparator 73 includes one comparator each of 73VA and 73VB. The comparator 73VA outputs an H-level signal when the voltage Va falls below the threshold. The comparator 73VB outputs an H-level signal when the voltage Vb falls below the threshold. The comparator 73 includes overvoltage comparators 73AH1 and 73AH2, as in the previous embodiment.

[0156] The comparator 73 further includes comparators 73C1 and 73C2. A threshold value is input to the inverting input terminal of the comparator 73C1, and a current Ic is input to the non-inverting input terminal. The current Ic is input to the inverting input terminal of the comparator 73C2, and a threshold value is input to the non-inverting input terminal. The comparator 73C1 detects an abnormality in the positive direction, that is, from the trunk 41A toward the trunk 41B. The comparator 73C1 detects, for example, a ground fault on the trunk 41B side. The comparator 73C2 detects an abnormality in the negative direction, that is, from the trunk 41B toward the trunk 41A. The comparator 73C2 detects, for example, a ground fault on the trunk 41A side.

[0157] 34 shows threshold values. The threshold value of comparator 73C1 is a positive (+) value and is set between the normal operating current range and the positive overcurrent threshold so as to detect a ground fault on the trunk 41B side. The threshold value of comparator 73C2 is a negative (-) value and is set between the normal operating current range and the negative overcurrent threshold so as to detect a ground fault on the trunk 41A side.

[0158] The latch 74 does not include latches corresponding to the interruption circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3. The latch 74 includes latches 74AH1 and 74AH2, as in the previous embodiment. The latch 74 further includes latches 74C1 and 74C2. An output signal of a gate circuit 778 is input to an S terminal of the latch 74C1. The gate circuit 778 is an AND gate, and output signals of comparators 73C1 and 73VB are input to the gate circuit 778. The latch 74C1 outputs a Cb1 signal. An output signal of a gate circuit 779 is input to an S terminal of the latch 74C2. The gate circuit 779 is an AND gate, and output signals of comparators 73C2 and 73VA are input to the gate circuit 779. The latch 74C2 outputs a Cb2 signal.

[0159] The microcomputer 71 has four INT terminals. The microcomputer 71 receives an A1hb signal, an A1hb' signal, a Cb1 signal, and a Cb2 signal as signals indicating an interrupt request.

[0160] The gate circuit includes gate circuits 76C, and 777 to 789. Each of the gate circuits 76C, and 777 to 789 is an AND gate having a NOT gate connected to one of its input terminals.

[0161] The control signal output from the PT terminal (PT_C) of the microcomputer 71 is input to the gate circuit 777, as in the preceding embodiment. The control signal and the A1hb' signal are input to the gate circuit 777. The output signal of the gate circuit 777 is input to the gate circuit 780. The output signal of the gate circuit 777 and an inverted signal of the Cb2 signal are input to the gate circuit 780. The output signal of the gate circuit 780 is input to the gate circuit 76C. The output signal of the gate circuit 780 and an inverted signal of the Cb1 signal are input to the gate circuit 76C. That is, when at least one of the control signal is at the L level, the A1hb' signal is at the H level, the Cb2 signal is at the H level, and the Cb1 signal is at the H level, the gate circuit 76C outputs an OFF signal to the cutoff circuit 50C.

[0162] The control signal output from the PT terminal (PT_A1) of microcomputer 71 is input to gate circuit 781. The control signal and an inverted signal of the Cb2 signal are input to gate circuit 781. The output signal of gate circuit 781 is input to gate circuit 782. The output signal of gate circuit 781 and an inverted signal of the A1hb signal are input to gate circuit 782. In other words, when at least one of the control signal being at L level, the A1hb signal being at H level, and the Cb2 signal being at H level is satisfied, gate circuit 782 outputs an OFF signal to shutoff circuit 50A1.

[0163] The control signal output from the PT terminal (PT_A2) of microcomputer 71 is input to gate circuit 783. The control signal and a signal obtained by inverting the Cb2 signal are input to gate circuit 783. When the control signal is at an L level and / or the Cb2 signal is at an H level, gate circuit 783 outputs an OFF signal to shutoff circuit 50A2.

[0164] The control signal output from the PT terminal (PT_A3) of the microcomputer 71 is input to the gate circuit 784. The control signal and an inverted signal of the Cb2 signal are input to the gate circuit 784. The output signal of the gate circuit 784 is input to the gate circuit 785. The output signal of the gate circuit 784 and an inverted signal of the A1hb signal are input to the gate circuit 785. When at least one of the control signal being at the L level, the A1hb signal being at the H level, and the Cb2 signal being at the H level is satisfied, the gate circuit 785 outputs an OFF signal to the interruption circuit 50A3.

[0165] The control signal output from the PT terminal (PT_B1) of microcomputer 71 is input to gate circuit 786. The control signal and a signal obtained by inverting the Cb1 signal are input to gate circuit 786. When the control signal is at an L level and / or the Cb1 signal is at an H level, gate circuit 786 outputs an OFF signal to shutoff circuit 50B1.

[0166] The control signal output from the PT terminal (PT_B2) of the microcomputer 71 is input to the gate circuit 787. The control signal and a signal obtained by inverting the Cb1 signal are input to the gate circuit 787. When the control signal is at an L level and / or the Cb1 signal is at an H level, the gate circuit 787 outputs an OFF signal to the shutoff circuit 50B2.

[0167] The control signal output from the PT terminal (PT_B3) of the microcomputer 71 is input to the gate circuit 788. The control signal and a signal obtained by inverting the Cb1 signal are input to the gate circuit 788. The output signal of the gate circuit 788 is input to the gate circuit 789. The output signal of the gate circuit 788 and a signal obtained by inverting the Cb2 signal are input to the gate circuit 789. When at least one of the control signal, the Cb1 signal, and the Cb2 signal is at the L level is satisfied, the gate circuit 789 outputs an OFF signal to the cutoff circuit 50A3. For example, when the Cb2 signal is at the H level, the gate circuit 789 outputs an OFF signal, so that when a ground fault occurs on the main line 41A side, the power supply to the load 11B with a low priority can be cut off. The other configurations are the same as those of the ECU 20 described in the preceding embodiment.

[0168] <Summary of the Fourth Embodiment> The ECU 20 of this embodiment can achieve the same effects as the configuration described in the preceding embodiment. The control unit 70 of this embodiment outputs an OFF signal to the interrupter circuit 50C when at least one of the voltages Va and Vb falls below a predetermined threshold voltage and the current Ic exceeds a predetermined threshold current. Since ground fault detection is possible only by the interrupter circuit 50C, the circuit configuration can be simplified.

[0169] <Modification> As shown in FIG. 35, the microcomputer 71 may have a function of cutting off the power supply to a load with a low priority. The control unit 70 shown in FIG. 35 has a configuration in which the gate circuits 785 and 789 are removed from the configuration shown in FIG. 33. The microcomputer 71 has a function of cutting off the loads 11A and 11B with a low priority. The microcomputer 71 (processor) executes a process equivalent to the gate circuit 785. When an H-level signal is input as the A1hb signal, the microcomputer 71 outputs an L-level control signal from the PT_A3 terminal. The gate circuit 784 outputs an OFF signal to the cutoff circuit 50A3. The microcomputer 71 executes a process equivalent to the gate circuit 789. When an H-level signal is input as the Cb2 signal, the microcomputer 71 outputs an L-level control signal from the PT_B3 terminal. The gate circuit 788 outputs an OFF signal to the cutoff circuit 50B3.

[0170] As shown in FIG. 36, the microcomputer 71 may have a function of latching abnormality detection data. The control unit 70 shown in FIG. 36 has a configuration in which all of the latches 74 and the gate circuits 76C, 777, 780 to 787 are removed from the configuration shown in FIG. 35. The microcomputer 71 has a function of holding abnormality detection data. The microcomputer 71 executes processes corresponding to the latches 74AH1, 74AH2, 74C1, and 74C2. The output signals of the comparators 73AH1 and 73AH2 and the output signals of the gate circuits 778 and 789 are input to the INT terminal of the microcomputer 71. The control signal output from the PT terminal of the microcomputer 71 is input to the drive unit of the corresponding interrupter circuit 50.

[0171] Even if a momentary interruption occurs, the operating voltage of the microcomputer 71 is maintained by the capacitor 63. The microcomputer 71 holds the abnormality detection data before the momentary interruption. When recovering after a power-on reset, the microcomputer 71 outputs a control signal according to the held abnormality detection data.

[0172] Fifth embodiment This embodiment is a modified example based on the preceding embodiment, and the description of the preceding embodiment can be used. In the preceding embodiment, a single ECU 20 is supplied with power from a plurality of power sources 10. Alternatively, a plurality of ECUs 20 connected in a ring shape may be supplied with power from a plurality of power sources 10.

[0173] <Power supply system> 37 shows an example of a power supply system. The power supply system includes a plurality of power supplies 10 and a plurality of ECUs 20. As an example, the power supply 10 of this embodiment includes a power supply 10A and a power supply 10B, similar to the preceding embodiment.

[0174] Each of the ECUs 20 receives power from a plurality of power sources 10 and distributes the power to a plurality of loads 11, as in the previous embodiment. As an example, the ECU 20 of this embodiment includes six ECUs 20A, 20B, 20C, 20D, 20E, and 20F. The number and functions of the connected loads 11 may differ depending on the ECU 20. The loads 11 connected to each ECU 20 may include a load with a high priority for power supply and a load with a low priority, as in the previous embodiment. Only some of the ECUs 20 may include a load with a high priority and a load with a low priority as the connected loads 11. For convenience, in FIG. 37, the configuration of each ECU 20 is common, and the number of loads 11 connected to each ECU 20 is three. The arrangement of the terminals 30, the power supply wiring 40, and the interrupter circuit 50 in the ECU 20 is the same as the configuration shown in the previous embodiment (see, for example, FIG. 1). The ECU 20 includes a capacitor 63.

[0175] The multiple ECUs 20 are connected in a ring shape via a power supply line 13. In the example shown in Fig. 37, the ECUs 20 are arranged in the order of ECU 20A, ECU 20B, ECU 20C, ECU 20D, ECU 20E, and ECU 20F. In the ring shape arrangement, for example, ECUs 20B and 20F are arranged next to ECU 20A. ECUs 20B and 20D are arranged next to ECU 20C. A power supply 10A is connected to the power supply line 13 connecting ECU 20A and ECU 20F. A power supply 10B is connected to the power supply line 13 connecting ECU 20C and ECU 20D.

[0176] For example, ECU 20A is supplied with power from power supply 10A via power supply line 13, and power is supplied from power supply 10B via power supply line 13 and ECUs 20B and 20C. ECU 20F is supplied with power from power supply 10A via power supply line 13, and power is supplied from power supply 10B via power supply line 13 and ECUs 20D and 20E. ECU 20B is supplied with power from power supply 10A via power supply line 13 and ECU 20A, and power is supplied from power supply 10B via power supply line 13 and ECU 20C.

[0177] The multiple ECUs 20 can communicate with each other via the communication bus 12. In this embodiment, as an example, adjacent ECUs 20 share part of the information acquired from the INT terminals. As in the previous embodiment, the load 11 can communicate with other devices, other loads 11, and ECUs 20 other than the connection target via the communication bus 12.

[0178] <Control Unit> Fig. 38 shows the configuration of the control unit 70 in the ECU 20 according to this embodiment. Fig. 39 shows threshold values. The control unit 70 includes a microcomputer 71, a DAC 72, a plurality of comparators 73, a plurality of latches 74, and a plurality of gate circuits.

[0179] The comparator 73 is configured by removing comparators 73AH1, 73AH2, 73VA1, 73VA2, 73VB1, and 73VB2 from the configuration shown in the preceding embodiment (see FIG. 6), and adding comparators 73VA and 73VB. The comparator 73 includes comparators 73A1, 73A2, 73A3, 73B1, 73B2, 73B3, 73VA, and 73VB. The thresholds of the comparators 73VA and 73VB are, for example, a common value.

[0180] FIG. 39 shows an example of thresholds to be set. As in FIG. 8, FIG. 39 shows the threshold for detecting a ground fault, the overcurrent threshold, and the normal operating current range. The positive and negative directions are the same as in the preceding embodiment. Due to the ring-shaped connection, the currents Ia1 and Ib1 can also flow in both positive and negative directions during normal operation. The ground fault detection threshold for the currents Ia1 and Ib1 is a positive (+) value, and is set between the normal operating current range and the overcurrent threshold. The ground fault detection threshold for the currents Ia1 and Ib1 and the ground fault detection threshold on the B side of the current Ic are approximately equal in value.

[0181] The latch 74 has a configuration in which the latches 74AH1, 74AH2, and 74C are excluded from the configuration shown in the preceding embodiment (see FIG. 6). The latch 74 includes latches 74A1, 74A2, 74A3, 74B1, 74B2, and 74B3.

[0182] The gate circuit is configured by removing the gate circuits 75C, 76A1, 76B1, and 771 to 777 from the configuration shown in the preceding embodiment (see FIG. 6) and adding gate circuits 790, 791, and 792. The gate circuits 790, 791, and 792 are all OR gates. The gate circuit 790 outputs a Cb signal. The Cb signal is input to the gate circuit 76C and the INT terminal of the microcomputer 71. The output signals of the gate circuits 791 and 792 are input to the gate circuit 790. The A2b signal output from the latch 74A2 and the A3b signal output from the latch 74A3 are input to the gate circuit 791. The B2b signal output from the latch 74B2 and the B3b signal output from the latch 74B3 are input to the gate circuit 792. The other configurations are the same as those of the ECU 20 described in the preceding embodiment.

[0183] <Blocking conditions> Fig. 40 shows the shutoff conditions of shutoff circuits 50 by microcomputer 71. Microcomputer 71 and control unit 70 shut off (turn off) corresponding shutoff circuits 50 according to the shutoff logic shown in Fig. 40. Based on ground fault detection (latch) information from the INT terminal and ground fault detection (latch) information acquired from adjacent ECU 20 through communication, microcomputer 71 outputs an L-level control signal to shutoff circuits 50A1, 50B1, and 50C arranged on main line 41, and shuts them off. Shutoff circuits 50A2, 50A3, 50B2, and 50B3 are shut off in a hardware manner by the ground fault detection (latch) circuit. As described above, 1 in each signal corresponds to H level.

[0184] A control signal output from a PT terminal (PT_A1) of the microcomputer is input to the interruption circuit 50A1. The microcomputer 71 outputs an L-level signal as a control signal when the A1b signal input from the INT terminal is 1 and at least one of the B1b signal, B2b signal, and B3b signal acquired from the left adjacent ECU 20 is 1. That is, when the voltage Va drops and the current Ia1 exceeds a threshold in the own ECU 20 and / or the voltage Vb drops and at least one of the currents Ib1, Ib2, and Ib3 exceeds a threshold in the left adjacent ECU 20, the microcomputer 71 outputs an OFF signal to the interruption circuit 50A1.

[0185] The output signal of the gate circuit 76A2 is input to the interruption circuit 50A2. The control signal output from the PT terminal (PT_A2) of the microcomputer 71 and an inverted signal of the A2b signal are input to the gate circuit 76A2. The gate circuit 76A2 outputs an off signal to the interruption circuit 50A2 when the control signal is at an L level and / or the A2b signal output from the latch 74A2 is at an H level.

[0186] An output signal from gate circuit 76A3 is input to shutoff circuit 50A3. A control signal output from a PT terminal (PT_A3) of microcomputer 71 and an inverted signal of the A3b signal are input to gate circuit 76A3. When the control signal is at an L level and / or the A3b signal output from latch 74A3 is at an H level, gate circuit 76A3 outputs an OFF signal to shutoff circuit 50A3.

[0187] A control signal output from a PT terminal (PT_B1) of the microcomputer is input to the interruption circuit 50B1. The microcomputer 71 outputs an L-level signal as a control signal when the B1b signal input from the INT terminal is 1 and at least one of the A1b signal, A2b signal, and A3b signal acquired from the ECU 20 adjacent to the right is 1. In other words, when the voltage Vb drops and the current Ib1 exceeds a threshold in the own ECU 20 and / or the voltage Va drops and at least one of the currents Ia1, Ia2, and Ia3 exceeds a threshold in the ECU 20 adjacent to the right, the microcomputer 71 outputs an OFF signal to the interruption circuit 50B1.

[0188] The output signal of the gate circuit 76B2 is input to the interruption circuit 50B2. The control signal output from the PT terminal (PT_B2) of the microcomputer 71 and an inverted signal of the B2b signal are input to the gate circuit 76B2. The gate circuit 76B2 outputs an off signal to the interruption circuit 50B2 when the control signal is at an L level and / or when the B2b signal output from the latch 74B2 is at an H level.

[0189] The output signal of the gate circuit 76B3 is input to the interruption circuit 50B3. The control signal output from the PT terminal (PT_B3) of the microcomputer 71 and an inverted signal of the B3b signal are input to the gate circuit 76B3. When the control signal is at an L level and / or the B3b signal output from the latch 74B3 is at an H level, the gate circuit 76B3 outputs an OFF signal to the interruption circuit 50B3.

[0190] An output signal of the gate circuit 76C is input to the interruption circuit 50C. A control signal output from the PT terminal (PT_C) of the microcomputer 71 and a Cb signal output from the gate circuit 790 are input to the gate circuit 76C. The microcomputer 71 outputs an L-level signal as a control signal when at least one of the A2b signal, A3b signal, B2b signal, and B3b signal input from the INT terminal is 1, the B1b signal acquired from the left adjacent ECU 20 is 1, and the A1b signal acquired from the right adjacent ECU 20 is 1. The gate circuit 76C outputs an OFF signal to the interruption circuit 50C when the control signal is L-level and / or the Cb signal output from the gate circuit 790 is H-level.

[0191] <Example of operation during a ground fault> 41 shows an example of the operation when a ground fault occurs in the power supply line 13 connecting the ECU 20B and the ECU 20C. That is, the example shows the operation when a ground fault occurs between the terminal 30B1 of the ECU 20B and the terminal 30A1 of the ECU 20C.

[0192] As indicated by solid arrows, current flows from power sources 10A and 10B to the ground-fault location. In ECU 20B, a divided voltage value Vb corresponding to the voltage of trunk 41B on the ground-fault side drops, and a current Ib1 flowing through interrupter circuit 50B1 closest to the ground-fault location exceeds a threshold value, so that a B1b signal becomes H level. In ECU 20C, a divided voltage value Va corresponding to the voltage of trunk 41A on the ground-fault side drops, and a current Ia1 flowing through interrupter circuit 50A1 closest to the ground-fault location exceeds a threshold value, so that a A1b signal becomes 1 (H level). Since the B1b signal of ECU 20B is 1 and the A1b signal of ECU 20C, which is adjacent to the right and which is acquired by communication, is 1, the microcomputer 71 of ECU 20B outputs a control signal of L level to interrupter circuit 50B1. Since the A1b signal of the ECU 20C adjacent to the right is 1, the microcomputer 71 of the ECU 20B outputs an L-level control signal to the interrupter circuit 50C.

[0193] Similarly, the microcomputer 71 of ECU 20C outputs an L-level control signal to the interruption circuit 50A1 because the A1b signal of ECU 20C is 1 and the B1b signal of the adjacent ECU 20B acquired through communication to the left is 1. The microcomputer 71 of ECU 20C outputs an L-level control signal to the interruption circuit 50C because the B1b signal of the adjacent ECU 20B to the left is 1.

[0194] As a result, as shown in Fig. 41, the shutoff circuits 50B1 and 50C of the ECU 20B and the shutoff circuits 50A1 and 50C of the ECU 20C are turned off. Therefore, power can be supplied from the power source 10A to the loads 11A and 11C of the ECU 20B. Power can be supplied from the power source 10B to the loads 11A and 11C of the ECU 20B via a route passing through the ECUs 20D, 20E, and 20F. Power can also be supplied from the power source 10B to the loads 11B and 11C of the ECU 20B. Power can be supplied from the power source 10A to the loads 11B and 11C of the ECU 20C via a route passing through the ECUs 20F, 20E, and 20D. Even if the shutoff circuit 50C is turned off, the power supply to the load 11C, which has a high priority for power supply, can be maintained. Furthermore, by turning off both interrupter circuits 50C of ECUs 20B and 20C, even if a fault occurs in interrupter circuit 50A1 of ECU 20C that prevents it from being turned off, such as a short circuit, power supply to load 11C with high priority can be maintained.

[0195] 42 shows an example of the operation when a ground fault occurs at the terminal 30B3 of the ECU 20B. That is, it shows an example of the operation when a ground fault occurs in the power supply line connecting the terminal 30B3 of the ECU 20B and the load 11B.

[0196] As shown by the solid arrow, current flows from the power sources 10A and 10B to the ground fault location. In the ECU 20B, the divided voltage value Vb corresponding to the voltage of the trunk line 41B on the ground fault side drops, and the current Ib3 flowing through the interrupter circuit 50B3 closest to the ground fault location exceeds the threshold, so that the B3b signal becomes 1. Furthermore, the gate circuit 76B3 and the gate circuits 792, 790, and 76C output a control signal of L level to the interrupter circuits 50B3 and 50C. Thus, power can be supplied from the power source 10A to the loads 11A and 11C of the ECU 20B. Power can be supplied from the power source 10B to the loads 11A and 11C of the ECU 20B via a route that passes through the ECUs 20D, 20E, and 20F. Even if the interrupter circuit 50C is turned off, the power supply to the load 11C, which has a high priority for power supply, can be maintained.

[0197] Furthermore, since the B3b signal of the ECU 20B adjacent to the left, acquired through communication, is 1, the microcomputer 71 of the ECU 20C outputs an L-level control signal to the interrupter circuit 50A1. Thus, power can be supplied from the power source 10B to the loads 11 (11A, 11B, 11C) of the ECU 20B. Power can be supplied from the power source 10A to the loads 11 of the ECU 20C via a route that passes through the ECUs 20F, 20E, and 20D. Furthermore, even if a fault that cannot be turned off, such as a short fault, occurs in the interrupter circuit 50B3 of the ECU 20B or the interrupter circuit 50A1 of the ECU 20C because the interrupter circuit 50C of the ECU 20B is turned off, the power supply to the load 11C with high priority of the ECU 20B can be maintained.

[0198] As shown in the previous embodiment, the interruption circuits 50A1, 50A2, 50A3, 50B1, 50B2, and 50B3 corresponding to the terminal 30 may be turned off first, and then the interruption circuit 50C may be turned off. If the voltage becomes equal to or higher than the threshold value after the interruption circuit 50C is turned off, the interruption circuit 50C may be turned back on.

[0199] <Summary of the Fifth Embodiment> The ECU 20 of this embodiment can achieve the same effects as those of the configurations described in the preceding embodiments.

[0200] (Other embodiments) The disclosure in this specification and drawings, etc. is not limited to the exemplified embodiments. The disclosure includes the exemplified embodiments and modifications by those skilled in the art based thereon. For example, the disclosure is not limited to the combination of parts and / or elements shown in the embodiments. The disclosure can be implemented by various combinations. The disclosure can have additional parts that can be added to the embodiments. The disclosure includes the omission of parts and / or elements of the embodiments. The disclosure includes the substitution or combination of parts and / or elements between one embodiment and another embodiment. The disclosed technical scope is not limited to the description of the embodiments. Some disclosed technical scopes are indicated by the description of the claims, and should be interpreted as including all modifications within the meaning and scope equivalent to the description of the claims.

[0201] The disclosure in the specification and drawings is not limited by the claims. The disclosure in the specification and drawings includes the technical ideas described in the claims, and extends to more diverse and broader technical ideas than the technical ideas described in the claims. Therefore, various technical ideas can be extracted from the disclosure in the specification and drawings without being bound by the claims.

[0202] When an element or layer is referred to as being "on," "coupled," "connected," or "bonded," it may be directly coupled, connected, or bonded to another element or layer, and intervening elements or layers may be present. In contrast, when an element is referred to as being "directly on," "directly coupled," "directly connected," or "directly bonded" to another element or layer, there are no intervening elements or layers. Other words used to describe relationships between elements should be construed in a similar manner (e.g., "between" vs. "directly between," "adjacent" vs. "directly adjacent," etc.). As used in this specification, the term "and / or" includes any and all combinations of one or more of the associated listed items. That is, a reference to A and / or B means at least one of A and B.

[0203] Spatially relative terms such as "inside," "outside," "back," "bottom," "low," "top," "top," and the like are utilized herein to facilitate the description of the relationship of one element or feature to another element or feature as depicted in the figures. Spatially relative terms may be intended to encompass different orientations of the device during use or operation in addition to the orientation depicted in the figures. For example, if the device in the figures is turned over, elements described as "below" or "directly below" other elements or features would be oriented "above" the other elements or features. Thus, the term "bottom" can encompass both an orientation of top and bottom. The device may be otherwise oriented (rotated 90 degrees or at other orientations) and the spatially relative descriptors used in this specification would be interpreted accordingly.

[0204] Although the example of the processor is a CPU provided in the microcomputer 71, the present invention is not limited to this. An MPU, a GPU, a DFP, etc. can be used. MPU is an abbreviation for Micro-Processing Unit. GPU is an abbreviation for Graphics Processing Unit. DFP is an abbreviation for Data Flow Processor. Also, an SoC may be used instead of the microcomputer 71. SoC is an abbreviation for System on Chip. An ASIC, an FPGA, etc. may be used. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field-Programmable Gate Array.

[0205] The control program may be stored in a computer-readable non-transitory tangible storage medium as instructions executed by a computer. The storage medium for the control program may be an HDD, an SSD, a flash memory, or the like. HDD is an abbreviation for Hard-disk Drive. SSD is an abbreviation for Solid State Drive.

[0206] (Disclosure of technical ideas) This specification discloses multiple technical ideas described in the following multiple dependent claims. Some of the claims may be described in a multiple dependent form, where the subsequent claim alternatively refers to the preceding claim. Furthermore, some of the claims may be described in a multiple dependent form, where the subsequent claim alternatively refers to the preceding claim. The claims described in these multiple dependent forms define multiple technical ideas.

[0207] <Technical philosophy 1> An electronic control device that receives power from a plurality of power sources (10) and distributes the power to a plurality of loads, a terminal (30) including a plurality of power supply terminals (30A1, 30B1) electrically connected to the plurality of power supplies, and a plurality of load terminals (30A2, 30A3, 30B2, 30B3) electrically connected to the plurality of loads; a power supply wiring (40) including a trunk line (41) electrically connecting a first power supply terminal, which is one of the plurality of power supply terminals, and a second power supply terminal, which is another of the power supply terminals, and a plurality of branch lines (42) electrically connecting the trunk line and the load terminal; a plurality of interrupting circuits (50) provided in each of the trunk line and the branch line for passing or interrupting the current of the electric power supplied from the power source; A control unit (70) that controls the plurality of interruption circuits; Equipped with the interruption circuit includes a trunk line interruption circuit (50C) provided in the trunk line, and a plurality of terminal interruption circuits (50A1, 50A2, 50A3, 50B1, 50B2, 50B3) provided corresponding to the terminals, the terminal interruption circuit includes a plurality of load interruption circuits provided on each of the branch lines corresponding to the load terminals, a first power supply interruption circuit provided in a first trunk line (41A) that is the trunk line between the trunk interruption circuit and the first power supply terminal, between a connection portion of the branch line and the first power supply terminal, and a second power supply interruption circuit provided in a second trunk line (41B) that is the trunk line between the trunk interruption circuit and the second power supply terminal, between a connection portion of the branch line and the second power supply terminal, The control unit controls some of the multiple terminal interruption circuits and the main line interruption circuit to an interrupted state when at least one of the current flowing through the interruption circuit and the voltage of the power supply wiring satisfies a predetermined abnormality detection condition.

[0208] <Technical philosophy 2> The loads include a first load and a second load having a lower priority for power supply than the first load; The electronic control device according to technical idea 1, wherein one of the load terminals electrically connected to the first trunk line and one of the load terminals electrically connected to the second trunk line are connected to the first load.

[0209] <Technical philosophy 3> The electronic control device according to Technical Idea 2, wherein the control unit controls the main line interruption circuit to an interrupted state, or controls at least one of the load interruption circuits corresponding to the second load to an interrupted state in conjunction with controlling the first power supply interruption circuit to an interrupted state.

[0210] <Technical philosophy 4> The electronic control device according to Technical Idea 2, wherein the control unit transmits an operation restriction request for reducing power consumption to at least one of the second loads in response to controlling the main line cutting circuit to a cut-off state or controlling the first power supply cutting circuit to a cut-off state.

[0211] <Technical philosophy 5> The electronic control device according to any one of Technical Ideas 1 to 4, wherein the control unit controls the main line interruption circuit to an interrupted state when at least one of the voltage of the first main line and the voltage of the second main line falls below a predetermined threshold voltage.

[0212] <Technical philosophy 6> The electronic control device according to any one of Technical Ideas 1 to 4, wherein the control unit controls the main line interruption circuit to an interrupted state when at least one of the voltage of the first main line and the voltage of the second main line falls below a predetermined threshold voltage and the current flowing through the main line interruption circuit exceeds a predetermined threshold current.

[0213] <Technical philosophy 7> The electronic control device described in Technical Idea 5, wherein the control unit controls the corresponding terminal interruption circuit to a cut-off state when at least one of the voltage of the first main line and the voltage of the second main line falls below a predetermined threshold voltage and the current flowing through the terminal interruption circuit exceeds a predetermined threshold current.

[0214] <Technical philosophy 8> The electronic control device according to Technical Idea 7, wherein a threshold voltage for interrupting the main line interrupting circuit is lower than a threshold voltage for interrupting the terminal interrupting circuit.

[0215] <Technical philosophy 9> The electronic control device according to any one of Technical Ideas 5 to 8, wherein the control unit controls the main line interruption circuit to a conductive state when the voltage of the first main line and the voltage of the second main line become equal to or higher than a threshold voltage after controlling the main line interruption circuit to a cut-off state.

[0216] <Technical Thought 10> A capacitor (63) connected to a power supply path from the power supply to the control unit is further provided. The electronic control device according to any one of Technical Ideas 1 to 9, wherein the control unit has a latch function for retaining data correlated with satisfying the abnormality detection condition.

[0217] <Technical Thought 11> An electronic control device described in any one of Technical Ideas 1 to 9, wherein the power supply capacity of a first power source electrically connected to the first power source terminal is higher than the power supply capacity of a second power source electrically connected to the second power source terminal.

[0218] <Technical Thought 12> If the direction of current flow from the first power supply interruption circuit to the first power supply terminal is defined as a positive direction, The electronic control device according to Technical Idea 11, wherein the control unit controls the first power supply cut-off circuit to a cut-off state when the current flowing through the first power supply cut-off circuit is a positive value or zero.

[0219] <Technical Thought 13> The electronic control device according to Technical Idea 11 or Technical Idea 12, wherein the control unit controls the first power supply cut-off circuit and the main line cut-off circuit to a cut-off state when the voltage of the first main line exceeds an overvoltage threshold.

[0220] <Technical Thought 14> The electronic control device according to technical idea 13, wherein an overvoltage threshold for interrupting the main line interruption circuit is higher than an overvoltage threshold for interrupting the first power supply interruption circuit.

[0221] <Technical Thought 15> The electronic control device according to any one of Technical Ideas 1 to 14, wherein the control unit performs a fault diagnosis of the interruption circuit based on a current flowing through the main line interruption circuit and a current flowing through the terminal interruption circuit. [Explanation of symbols]

[0222] 10...power supply, 10A...power supply A, 10B...power supply B, 11...load, 11A...load A, 11B...load B, 11C...load C, 12...communication bus, 13...power supply line, 20, 20A, 20B, 20C, 20D, 20E, 20F...ECU, 30, 30A1, 30A2, 30A3, 30B1, 30B2, 30B3...terminal, 40...power supply wiring, 41, 41A, 41B...main line, 42 ...branch line, 50, 50A1, 50A2, 50A3, 50B1, 50B2, 50B3, 50C...shutdown circuit, 51, 52...MOSFET, 53, 54...diode, 55, 56...drive unit, 57...current detection unit, 60...power supply circuit, 61, 62...diode, 63...capacitor, 64, 65...voltage division circuit, 66...communication IC, 70...control unit, 71...microcomputer, 72...DAC, 73, 73A1, 73A2, 73A3, 73AH1, 73AH2, 73B1, 73B2, 73B3, 73C1, 73C2, 73VA, 73VA1, 73VA2, 73VB, 73VB1, 73VB2...Comparators, 74, 74A1, 74A2, 74A3, 74AH1, 74AH2, 74B1, 74B2, 74B3, 74C, 74C1, 74C2...Latches, 7 5A1, 75A2, 75A3, 75B1, 75B2, 75B3, 75C, 76A1, 76A2, 76A3, 76B1, 76B2, 76B3, 76C, 771, 772, 773, 774, 775, 776, 777, 778, 779, 780, 781, 782, 783, 784, 785, 786, 787, 788, 789, 790, 791, 792...Gate circuit< / ecu>

Claims

1. An electronic control device that receives power from a plurality of power sources (10) and distributes the power to a plurality of loads, A terminal (30) including a plurality of power supply terminals (30A1, 30B1) electrically connected to the plurality of power supplies, and a plurality of load terminals (30A2, 30A3, 30B2, 30B3) electrically connected to the plurality of loads; a power supply wiring (40) including a trunk line (41) electrically connecting a first power supply terminal, which is one of the plurality of power supply terminals, and a second power supply terminal, which is another of the power supply terminals, and a plurality of branch lines (42) electrically connecting the trunk line and the load terminal; a plurality of interruption circuits (50) provided in each of the trunk line and the branch line, for passing or interrupting the current of the electric power supplied from the power source; A control unit (70) for controlling the plurality of interruption circuits; Equipped with the interruption circuit includes a trunk line interruption circuit (50C) provided in the trunk line, and a plurality of terminal interruption circuits (50A1, 50A2, 50A3, 50B1, 50B2, 50B3) provided corresponding to the terminals, the terminal interruption circuit includes a plurality of load interruption circuits provided on each of the branch lines corresponding to the load terminals, a first power supply interruption circuit provided in a first trunk line (41A) that is the trunk line between the trunk interruption circuit and the first power supply terminal, between a connection portion of the branch line and the first power supply terminal, and a second power supply interruption circuit provided in a second trunk line (41B) that is the trunk line between the trunk interruption circuit and the second power supply terminal, between a connection portion of the branch line and the second power supply terminal, The control unit controls some of the multiple terminal interruption circuits and the main line interruption circuit to an interrupted state when at least one of the current flowing through the interruption circuit and the voltage of the power supply wiring satisfies a predetermined abnormality detection condition.

2. The loads include a first load and a second load having a lower priority for power supply than the first load; 2. The electronic control device according to claim 1, wherein one of the load terminals electrically connected to the first trunk and one of the load terminals electrically connected to the second trunk are connected to the first load.

3. 3. The electronic control device according to claim 2, wherein the control unit controls the main line interruption circuit to an interrupted state, or controls at least one of the load interruption circuits corresponding to the second load to an interrupted state in conjunction with controlling the first power supply interruption circuit to an interrupted state.

4. 3. The electronic control device according to claim 2, wherein the control unit transmits an operation restriction request for reducing power consumption to at least one of the second loads when the control unit controls the main line interruption circuit to an interrupted state or when the control unit controls the first power supply interruption circuit to an interrupted state.

5. The electronic control device according to claim 1 , wherein the control unit controls the main line interruption circuit to be in an interrupted state when at least one of a voltage of the first main line and a voltage of the second main line falls below a predetermined threshold voltage.

6. 2. The electronic control device according to claim 1, wherein the control unit controls the main line interruption circuit to an interrupted state when at least one of the voltage of the first main line and the voltage of the second main line falls below a predetermined threshold voltage and a current flowing through the main line interruption circuit exceeds a predetermined threshold current.

7. 6. The electronic control device according to claim 5, wherein the control unit controls the corresponding terminal interruption circuit to a cut-off state when at least one of the voltage of the first main line and the voltage of the second main line falls below a predetermined threshold voltage and a current flowing through the corresponding terminal interruption circuit exceeds a predetermined threshold current.

8. The electronic control device according to claim 7 , wherein a threshold voltage for interrupting the main line interrupting circuit is lower than a threshold voltage for interrupting the terminal interrupting circuit.

9. The electronic control device according to any one of claims 5 to 8, wherein the control unit controls the main line cutting circuit to a conductive state when the voltage of the first main line and the voltage of the second main line become equal to or higher than a threshold voltage after controlling the main line cutting circuit to a cut-off state.

10. A capacitor (63) connected to a power supply path from the power supply to the control unit is further provided, 9. The electronic control device according to claim 1, wherein the control unit has a latch function for holding data correlated with satisfying the abnormality detection condition.

11. The electronic control device according to any one of claims 1 to 8, wherein a power supply capacity of a first power source electrically connected to the first power source terminal is higher than a power supply capacity of a second power source electrically connected to the second power source terminal.

12. If the direction in which a current flows from the first power supply interruption circuit to the first power supply terminal is defined as a positive direction, then: The electronic control device according to claim 11 , wherein the control unit controls the first power supply cut-off circuit to be in the cut-off state when a current flowing through the first power supply cut-off circuit is a positive value or zero.

13. The electronic control device according to claim 11 , wherein the control unit controls the first power supply cutoff circuit and the main line cutoff circuit to be in a cut-off state when a voltage of the first main line exceeds an overvoltage threshold.

14. The electronic control device according to claim 13 , wherein an overvoltage threshold for interrupting the main line interrupting circuit is higher than an overvoltage threshold for interrupting the first power supply interrupting circuit.

15. 9. The electronic control device according to claim 1, wherein the control unit performs a fault diagnosis of the interrupting circuit based on a current flowing through the main line interrupting circuit and a current flowing through the terminal interrupting circuit.

Images