controller

Abstract

To provide a controller capable of continuing abnormality monitoring and operation of a control object even when abnormality occurs.SOLUTION: An ECU 15 includes micro computers 21 and 23, a power supply source, and a clock source. The micro computers 21 and 23 have operation cores 211, 212, 231 and 232 for performing control operation. The power supply source supplies power to the micro computers 21 and 23. The clock source supplies a clock to the operation cores 211, 212, 231 and 232. At least one of the operation cores 211, 212, 231 and 232, the power supply source and the clock source is made of three and more redundant configurations, specifies an abnormal part when abnormality occurs in a part which has three or more redundant configurations, and continues abnormality monitoring and operation by using two or more normal configurations.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to a control device.

Background Art

[0002] Conventionally, a motor control device for controlling a motor having two sets of motor windings is known. For example, in Patent Document 1, it has a two-system configuration in which an inverter circuit and a control unit are provided corresponding to the motor windings.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In Patent Document 1, when a further failure occurs during control continuation at the time of one failure, there is a risk that the driving of the motor cannot be continued.

[0005] The present invention has been made in view of the above problems, and an object thereof is to provide a control device capable of continuing abnormal monitoring and the operation of a control target even when an abnormality occurs.

Means for Solving the Problems

[0006] The control device of the present invention includes a control unit (21 to 24), a power source (31 to 34), and a clock source (41 to 44, 415). The control unit has arithmetic circuits (211, 212, 231, 232) that perform control arithmetic. The power source supplies power to the control unit. The clock source supplies a clock for control arithmetic in the arithmetic circuit.

[0007] At least one of the arithmetic circuit, the power source, and the clock source has a redundant configuration of three or more. When an abnormality occurs in a part with a redundancy of three or more, the abnormal part is specified, and the abnormality monitoring and operation are continued using two or more that are normal. By making the redundancy three or more, even if an abnormality occurs in part, as long as two or more configurations are normal, the abnormality monitoring and the operation of the control target can be continued.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

Figure 23

Figure 24

Figure 25

Figure 26

Figure 27

Figure 28

Figure 29

Figure 30

Figure 31

Figure 32

Figure 33

Figure 34

Figure 35

Figure 36

Figure 37

Figure 38

Figure 39

Figure 40

Figure 41

Figure 42

Figure 43

Figure 44

Figure 45

Figure 46

Figure 47

Figure 48

Figure 49

Figure 50

Figure 51

Figure 52

Figure 53

Figure 54

Figure 55

Figure 56

Modes for Carrying Out the Invention

[0009] Hereinafter, a control device according to the present invention will be described with reference to the drawings. In the following, in a plurality of embodiments, substantially the same configurations are denoted by the same reference numerals and the description thereof is omitted.

[0010] (First Embodiment) The first embodiment is shown in FIGS. 1 to 28. As shown in FIG. 1, the drive device 10 includes a motor 11 and an ECU 15 as a communication device, and is applied to an electric power steering device 5 which is a steering device for assisting a steering operation of a vehicle, for example. FIG. 1 shows the overall configuration of a steering system 90 including the electric power steering device 5. The steering system 90 includes a steering wheel 91 as a steering member, a steering shaft 92, a pinion gear 96, a rack shaft 97, wheels 98, and the electric power steering device 5 and the like.

[0011] The steering wheel 91 is connected to the steering shaft 92. A torque sensor 93 for detecting a steering torque is provided on the steering shaft 92. A pinion gear 96 is provided at the tip of the steering shaft 92. The pinion gear 96 meshes with the rack shaft 97. A pair of wheels 98 are connected to both ends of the rack shaft 97 via tie rods or the like.

[0012] When the driver rotates the steering wheel 91, the steering shaft 92 connected to the steering wheel 91 rotates. The rotational motion of the steering shaft 92 is converted into a linear motion of the rack shaft 97 by the pinion gear 96. A pair of wheels 98 is steered at an angle corresponding to the displacement amount of the rack shaft 97.

[0013] The electric power steering device 5 includes a drive device 10 and a reduction gear 6 or the like as a power transmission unit that decelerates the rotation of the motor 11 and transmits it to the rack shaft 97. The electric power steering device 5 of the present embodiment is a so-called "rack assist type", but it may be a so-called "column assist type" or the like that transmits the rotation of the motor 11 to the steering shaft 92.

[0014] The drive device 10 has an ECU 15 integrally provided on one side in the axial direction of the motor 11, and is a so-called "mechatronic type". The ECU 15 has a connector 16 and is connected to the vehicle power supply 7, the vehicle communication network 8, and the torque sensor 93 via the connector 16. The vehicle power supply 7 includes power supplies 501 and 502 described later. The vehicle communication network 8 is, for example, a CAN (Controller Area Network) and is described as "CAN" in the figure.

[0015] The ECU 15 is arranged coaxially with the motor 11 on the side opposite to the output shaft of the motor 11. Here, "coaxial" means that, for example, errors and misalignments related to assembly and design are allowed. Hereinafter, the axial direction of the motor 11 is regarded as the axial direction of the drive device 10 and is simply referred to as the "axial direction". The same applies to the "radial direction" and the "circumferential direction".

[0016] As shown in FIG. 2, the motor 11 is, for example, a three-phase brushless motor and has four motor windings 121 to 124. The motor 11 outputs part or all of the torque required for steering, is driven by the electric power supplied from the power supplies 501 and 502, and rotates the reduction gear 6 forward and backward.

[0017] ECU 15 includes a microcomputer 21, 23, power supply ICs 31, 33, communication units 36, 38, oscillators 41, 43, driver circuits 51 to 54, pre-driver ICs 61 to 64, and position sensors 66 to 69, etc. Note that the descriptions with subscripts such as "1", "2", "1A", "2A", "1B", "2B", etc. indicate that they are provided correspondingly, and for the components that can be identified by subscripts, the symbols are appropriately omitted. Each component constituting ECU 15 is mounted on a substrate 75 provided substantially parallel to one end face in the axial direction of the motor 11 (see FIG. 1). In FIG. 1, one substrate 75 is shown, but it may also be a plurality of substrates.

[0018] The microcomputer 21 has arithmetic cores 211, 212 with lockstep. The microcomputer 23 has arithmetic cores 231, 232 with lockstep. The microcomputers 21, 23 are provided so as to be able to transmit and receive information to and from each other through inter-microcomputer communication. In this embodiment, the microcomputers 21, 23 are similarly configured, but their performance and configuration details may be different. The details of the microcomputers 21, 23 will be described later.

[0019] The microcomputer 21 is supplied with power from the power supply IC 31, and the microcomputer 23 is supplied with power from the power supply IC 33. The power supply ICs 31, 33 are power management ICs (PMIC). In this embodiment, the components above the dashed-dotted line in FIG. 2 are supplied with power from the power supply 501, and the components below the dashed-dotted line are supplied with power from the power supply 502. That is, the drive device 10 of this embodiment is a "two-power-supply system" supplied with power from two power supplies 501, 502.

[0020] The communication units 36, 38 are used for transmitting and receiving various information. The communication units 36, 38 are connected to the vehicle communication network 8 and acquire vehicle signals from the vehicle communication network 8. The oscillators 41, 43 are clock sources such as crystal or ceramic oscillators, etc.

[0021] As shown in FIG. 3, the driver circuit 51 has six switching elements 511 to 516 and is provided corresponding to the winding 121. The driver circuit 52 has six switching elements 521 to 526 and is provided corresponding to the winding 122. The driver circuit 53 has six switching elements and is provided corresponding to the winding 123. The driver circuit 54 has six switching elements and is provided corresponding to the winding 124. Motor relays 131 to 134 are provided between the driver circuits 51 to 54 and the windings 121 to 124 (see FIG. 39).

[0022] In the driver circuit 51, the switching elements 511 to 513 are provided on the high potential side, the switching elements 514 to 516 are provided on the low potential side, and they are bridge-connected. The switching elements 511 and 514 are connected to the U phase of the winding 121, the switching elements 512 and 515 are connected to the V phase of the winding 121, and the switching elements 513 and 516 are connected to the W phase of the winding 121.

[0023] Also, in the driver circuit 52, the switching elements 521 to 523 are provided on the high potential side, the switching elements 524 to 526 are provided on the low potential side, and they are bridge-connected. The switching elements 521 and 524 are connected to the U phase of the winding 122, the switching elements 522 and 525 are connected to the V phase of the winding 122, and the switching elements 523 and 526 are connected to the W phase of the winding 122. Hereinafter, the switching element on the high potential side is appropriately referred to as the upper arm element, and the switching element on the low potential side is referred to as the lower arm element. The switching element of this embodiment is a MOSFET, but it may be an IGBT, a bipolar transistor, or the like.

[0024] The driver circuits 51 and 52 are connected to the power supply 501. Between the power supply 501 and the driver circuit 51, a power relay 551, a reverse connection protection relay 556, a choke coil 562, and a capacitor 566 are provided. The choke coil 561 and the capacitor 566 constitute a filter circuit. Between the power supply 501 and the driver circuit 52, a power relay 552, a reverse connection protection relay 557, a choke coil 562, and a capacitor 567 are provided. The choke coil 562 and the capacitor 567 constitute a filter circuit. The driver circuits 53 and 54 are connected to the power supply 502. The circuit configurations of the driver circuits 53 and 54 and the power relays, reverse connection protection relays, and filter circuits provided between the power supply 502 and the driver circuits 53 and 54 are the same as those of the driver circuits 51 and 52, the power relays 551 and 552, etc., and thus the description thereof is omitted.

[0025] Returning to FIG. 2, the pre-driver ICs 61 to 64 are provided corresponding to the driver circuits 51 to 54. The pre-driver ICs 61 and 62 are provided so as to be digitally communicable with the microcomputer 21, and the pre-driver ICs 63 and 64 are provided so as to be digitally communicable with the microcomputer 23. The microcomputers 21 and 23 transmit drive commands for three phases of the motor 11 as a set of digital signals to each of the pre-driver ICs 61 to 64.

[0026] Specifically, the pre-driver IC 61 is communicably connected to the arithmetic core 211, the pre-driver IC 62 is communicably connected to the arithmetic core 212, the pre-driver IC 63 is communicably connected to the arithmetic core 231, and the pre-driver IC 64 is communicably connected to the arithmetic core 232. Further, the communication lines connecting the pre-driver ICs 61 to 64 and the arithmetic cores 211, 212, 231, and 232 are connected by the inter-system connection line 25.

[0027] By digitizing the communication between the microcomputer and the pre-driver and providing the inter-system connection line 25, even if an abnormality occurs in, for example, one arithmetic core, it is possible to continue issuing commands from other normal arithmetic cores to all the pre-driver ICs 61 to 64. Note that the inter-system connection line 25 means that the four connection lines connecting the core and the pre-driver IC are connected so as to have the same potential. Therefore, even if there is a disconnection, for example, at the location indicated by the arrow mid in FIG. 2, it is possible to exchange signals between the arithmetic cores 1A, 1B and the pre-drivers 2A, 2B.

[0028] An isolator 28, which will be described later, is provided in the inter-system connection line 25 (not shown in FIG. 2). The isolator 28 may be provided at any location on the inter-system connection line 25. Also, the same effect can be obtained by imparting an isolator function to necessary components.

[0029] The position sensors 66 to 69 detect the rotation of the motor 11. The position sensors 66 to 69 are respectively connected to the arithmetic cores 211, 212, 231, and 232. The communication lines connecting the position sensors 66 to 69 and the microcomputers 21 and 23 are connected by the inter-system connection line 256. The communication lines connecting the power supply ICs 31 and 33 and the microcomputers 21 and 23 are connected by the inter-system connection line 257, and the communication lines connecting the communication units 36 and 38 and the microcomputers 21 and 23 are connected by the inter-system connection line 258. Note that the inter-system connection lines 256 to 258 may be omitted.

[0030] The pre-driver IC will be described with reference to FIG. 4. Here, the pre-driver IC 61 will be described as an example. As shown in FIG. 4, the pre-driver IC 61 includes a three-phase pre-driver circuit 611 that transmits a gate signal to the switching elements constituting the driver circuit 51. The pre-driver IC 61 also includes a current detection circuit 612, a temperature detection circuit 613, an abnormality detection unit 614, a relay driver circuit 621, and the like.

[0031] The pre-driver circuit 611 outputs a gate signal as a drive signal to the switching elements 511 to 516 based on a drive command from the microcomputer 21. The current detection circuit 612 detects the motor current based on the detection values of the current detection elements 517 to 519. The current detection elements 517 to 519 in the present embodiment are current sense MOSs, which are built in the low-side chip 713 described later. The current sense MOS may be built in the high-side chip 712, or may be a chip separate from the upper and lower arm elements.

[0032] Also, as shown in FIG. 5, the current detection element 531 may be a shunt resistor provided in each phase arm. In the example of FIG. 5, a shunt resistor is provided on the low potential side of the lower arm element, but it may be provided on the high potential side of the upper arm element. Furthermore, as shown in FIG. 6, the current detection element 532 may be a Hall element provided between the connection point of the upper and lower arm elements and the motor winding. In FIGS. 5 and 6, the current detection elements 531 and 532 are described as being provided in the driver component 701 described later, but they may be provided outside the driver component 701. Note that the description of the motor relay 131 is omitted in FIG. 6.

[0033] Returning to FIG. 4, the temperature detection circuit 613 detects the temperature of the driver circuit 50 and the pre-driver IC 60 itself based on the detection value of a temperature detection element (not shown). The abnormality detection unit 614 monitors the abnormality of the driver circuit 50 based on the potential difference between the gate and source of the elements constituting the driver circuit 50, the potential difference between the drain and source, and the drive command from the microcomputer 21. For example, the abnormality detection unit 614 monitors abnormalities such as short circuits and terminal open circuits based on the potential difference. Also, the abnormality detection unit 614 monitors overheat abnormalities based on temperature information and abnormalities of the pre-driver IC 61 itself.

[0034] The relay driver circuit 621 outputs a gate signal as a drive signal to the power relay 551, the reverse connection protection relay 556, and the motor relay 131 based on a drive command from the microcomputer 21.

[0035] The pre-driver IC 61 transmits the current detection value, temperature information, and abnormality information to the microcomputer 21. The information transmission from the pre-driver IC 61 to the microcomputer 21 may be digital communication or analog communication.

[0036] In this embodiment, the corresponding driver circuits 51 to 54 and the pre-driver ICs 61 to 64 are provided in the same package as one driver component 701 to 704. In FIGS. 7 and 8, the driver component 701 having the driver circuit 51 and the pre-driver IC 61 is illustrated. In FIG. 7, the sealing portion 749 is omitted for the purpose of explaining the inside of the component, and in FIG. 8, the hatching of the sealing portion 749 is omitted.

[0037] As shown in FIGS. 7 and 8, the driver component 701 includes a control chip 711, a high-side chip 712, a low-side chip 713, an intermediate clip 715, a ground clip 716, and a lead frame 72, etc., and is sealed with a sealing portion 749. The sealing portion 749 is formed in a substantially rectangular shape in plan view, and terminals are formed along the outer edge. Regardless of the terminal arrangement and shape, it may be a non-lead type or may be formed to protrude outside the sealing portion 749. Further, a temperature detection element such as a temperature-sensitive diode is provided in the driver component 701. The temperature detection element may be built in the high-side chip 712 or the low-side chip 713, similar to the current detection elements 517 to 519.

[0038] The lead frame 72 includes a control land 721, a power land 722, an output land 723, and a ground land 724. The back side of the lead frame 72 is exposed from the sealing portion 749 and is electrically connected to the wiring pattern of the substrate 75 by soldering or the like. Note that not all lands need to be connected to the back side of the substrate 75. Hereinafter, the region on the control land 721 side is defined as the IC region Ric, and the region on the power land 722 side is defined as the drive element region Rd. Also, in the driver component 701, the end on the power land 722 side (the upper side on the paper surface of FIG. 7) is defined as the element side end, and the end on the control land 721 side (the lower side on the paper surface of FIG. 7) is defined as the IC side end.

[0039] The control chip 711 constitutes the pre-driver IC 61 and is arranged on the control land 721. In this embodiment, the control land 721 on which the control chip 711 is mounted has a ground potential. However, when using a case where the back side of the control chip 711 is insulated, the potential of the control land 721 may be a potential other than the ground potential, such as a power supply potential.

[0040] The control terminal, which is a terminal provided in the control region Rc, is connected to the microcomputer 21, the power supply IC 31, and other pre-driver ICs 62 to 64, etc. The control terminal includes a clock signal terminal, a PWM frequency synchronization terminal, a sample hold terminal, and the like. Also, when the communication between the microcomputer 21 and the pre-driver IC 61 is, for example, SPI communication, it includes a chip select terminal, a MISO terminal, a MOSI terminal, and the like.

[0041] Each of the three high-side chips 712 incorporates an upper arm element for each phase, and each of the three low-side chips 713 incorporates a lower arm element for each phase. Also, current detection elements 517 to 519 are incorporated in the low-side chip 713.

[0042] The three high-side chips 712 are arranged on the power land 722, which is at the power supply potential. The high-side chips 712 are arranged side by side horizontally such that the gate electrodes face the control chip 711 side and are along the long side of the control chip 711. For the high-side chip 712, the source electrode faces upward, and the drain electrode provided on the back side is connected to the power land 722. On the upper side of the high-side chip 712, an intermediate clip 715, a low-side chip 713, and a ground clip 716 are stacked in this order from the high-side chip 712 side, forming a stack structure.

[0043] The intermediate clip 715 is a conductive metal plate formed of, for example, copper or the like, and is provided for each of the three high-side chips 712. The intermediate clip 715 is connected to the source electrode of the high-side chip 712 on the lower surface side, and is connected to the drain electrode of the low-side chip 713 on the upper surface side. The intermediate clip 715 is arranged so as to be shifted to such an extent that the signal line 718 can be connected on the control chip 711 side of the high-side chip 712. The end portion of the intermediate clip 715 on the side opposite to the control chip 711 is bent downward and connected to the output land 723. The output land 723 is connected to the motor terminal and is connected to each phase of the motor winding 121 via the substrate wiring or the like.

[0044] Assuming that the direction in which the high-side chips 712 are adjacent to each other is the width direction (the "first direction" in the figure), the intermediate clip 715 is spaced apart in the width direction to such an extent that insulation can be ensured from the adjacent frames, and is formed wider than the high-side chips 712. The area of the intermediate clip 715 is formed larger than that of the high-side chips 712. By forming the area of the intermediate clip 715 as large as possible, the heat dissipation efficiency is enhanced.

[0045] The ground clip 716 is a conductive plate formed of, for example, copper or the like, and is provided across the three low-side chips 713. The ground clip 716 is arranged so as to be shifted to such an extent that the signal line 718 can be connected on the control chip 711 side of the low-side chip 713. The ground clip 716 is bent downward on one side in the width direction and connected to the ground land 724. In the present embodiment, the ground clip 716 is provided in the sealing portion 749, but the top surface side may be exposed from the sealing portion 749.

[0046] The high-side chip 712 and the low-side chip 713 are connected to the control chip 711 via the signal line 718. In this embodiment, the high-side chip 712 and the low-side chip 713 are stacked, but are offset and stacked in a stepped manner to ensure a non-overlapping area that does not overlap with the components provided on the upper side. Therefore, the signal line 718 can be connected in the non-overlapping area. The connection ends of the signal line 718 on the control chip 711 side are aggregated on one side of the control chip 711. The signal line 718 includes those for gate driving, current detection, and temperature detection. Thereby, inside the driver component 701, the drive element region Rd where a large current is energized and the IC region Ric can be regionally separated.

[0047] The component arrangements on the substrate 75 are shown in FIGS. 9 to 11. FIGS. 9 and 11 show the surface of the substrate 75 on the motor 11 side, and FIG. 10 shows the surface of the substrate 75 opposite to the motor 11. Note that FIG. 11 schematically shows the arrangements of the driver components 701 to 704 and the motor windings 121 to 124 on the substrate 75, and the corresponding pre-driver ICs 61 to 64 and driver circuits 51 to 54 are numbered in parentheses for the control chip 711, the high-side chip 712, and the low-side chip 713. The same applies to FIG. 42 and the like.

[0048] As shown in FIGS. 9 and 11, the driver components 701 to 704 are mounted on the substrate 75. The four driver components 701 to 704 are provided on the surface of the substrate 75 on the motor 11 side. The four driver components 701 to 704 are arranged on concentric circles at approximately equal intervals. Also, the driver components 701, 702 and the driver components 703, 704 are arranged symmetrically with respect to the substrate partition line D1. The substrate partition line D1 is a partition line that divides regions with different supply power sources.

[0049] The driver components 701 to 704 are arranged such that the end portions on the element side face radially outward. The motor windings 121 to 124 are connected to the substrate 75 on the radially outer side of the driver components 701 to 704. That is, they are arranged in the order of the control chip 711, the high-side chip 712, the low-side chip 713, and the motor wire connection portion from the radially inner side. The lead wires of the motor windings 121 to 124 are arranged substantially parallel to the end portions on the element side of the driver components 701 to 704 so as to correspond to the phase arrangement of the switching elements in the driver components 701 to 704. Note that the phase arrangement shown in FIG. 11 is an example and may be different. In FIGS. 9 to 11, the winding connection locations to which the lead wires of the motor windings are connected are numbered as the motor windings 121 to 124. The same applies to the power terminals and the signal terminals.

[0050] On the surface of the substrate 75 on the motor 11 side, a rotation detection unit 65 is mounted at a position facing a magnet provided at the end of a shaft (not shown) of the motor 11. In the present embodiment, the rotation detection unit 65 is mounted at the center of the substrate 75. The rotation detection unit 65 includes position sensors 66 to 69.

[0051] The power terminals 761 and 763 are connected to a region on the outer edge side of the substrate 75 that straddles the substrate center line D2 orthogonal to the substrate partition line D1. The power terminals 761 and 763 include a power supply terminal and a ground terminal. Power from the power supply 501 is supplied to the power terminal 761, and power from the power supply 502 is supplied to the power terminal 763. On the substrate 75, power supply ICs 31 and 33 are mounted on the substrate center line D2, between the rotation detection unit 65 and the power terminals 761 and 763. The power supply ICs 31 and 33 may be arranged at locations other than on the substrate center line D2 as long as they are locations where they can be easily connected to the power terminals 761 and 763 and the microcontrollers 21 and 23. Also, a signal terminal 77 is connected to a region on the outer edge side of the substrate 75 that straddles the substrate partition line D1.

[0052] As shown in FIG. 10, on the surface opposite to the motor 11, on the substrate partition line D1, and on both sides of the substrate center line D2 across it, the microcontrollers 21 and 23 are mounted. The microcontroller 21 is supplied with power from the power terminal 761, and the microcontroller 23 is supplied with power from the power terminal 763, and a wiring pattern is formed accordingly. The microcontrollers 21 and 23 are communicably connected, and an isolator 28 is mounted at the connection location of the microcontrollers 21 and 23. In the present embodiment, the isolator 28 is provided at the center of the substrate. Also, on the surface opposite to the motor 11, components such as capacitors and coils constituting the filter circuit are mounted.

[0053] In the present embodiment, the drive device 10 is applied to the electric power steering device 5. Not limited to the electric power steering device 5, for example, when the drive device 10 is applied to a main motor or a brake motor, various components may be made redundant so that safety can be ensured even when a part of the components fails.

[0054] In FIGS. 12 to 15, the communication configuration between the microcontroller and the components is conceptually shown. As conceptually shown in FIG. 12, assuming that the combination of the microcontrollers (or arithmetic cores) M1 and M2 and the components P1 and P2 communicably connected by the communication lines C1 and C2 is a control system, when a failure occurs in the microcontroller M1 or the component P1, which is the first control system, the microcontroller M2 and the component P2, which are the second control system, can continue to operate with 50% of the functions remaining. Here, if a failure occurs at any point in the second control system, control cannot be continued.

[0055] As shown in FIG. 13, for further redundancy, for example, when the control system is made into three systems, it is possible to continue operating with 66% of the functions remaining at the first failure, and even if a further failure occurs during the operation continuation with one failure and two control systems, it is possible to continue operating with 33% of the functions remaining in the remaining one control system. However, increasing the number of control systems increases the number of components.

[0056] Here, as shown in FIGS. 14(a) and 14(b), assume that microcontrollers M1 and M2 correspond to microcontrollers 21 and 23, and components P1 and P2 correspond to driver components 701 and 703. The driver components 701 and 703 include pre-driver ICs 61 and 63 that control driver circuits 51 and 53, and output drive signals for driving the driver circuits 51 and 53 according to commands transmitted from the microcontrollers 21 and 23. Further, current detection values, driver outputs, abnormality information, temperature information, etc. are transmitted from the driver components 701 and 703 to the microcontrollers 21 and 23 side.

[0057] As shown in FIG. 14(a), when the driver components 701 and 703 are capable of digital communication, by connecting the first communication line C1 and the second communication line C2 with the inter-system connection line 25, for example, when a failure occurs in the microcontroller 21, the microcontroller 23 commands the driver components 701 and 703. Thereby, control can be continued. Also, if the second failure is in either of the driver components 701 and 703, control can be continued with the normal microcontroller and driver component. Thereby, even for two control systems, the possibility of continuing operation during a failure can be increased. Also, as shown in FIG. 14(b), the driver components 701 and 703 may be connected with the inter-system connection line 25.

[0058] The communication between the microcontrollers 21 and 23 and the components 701 and 703 is, for example, SPI communication, but communication methods other than SPI such as PSI5, SENT, CAN, Ethernet, Flexray, etc. may also be used, or wireless communication may also be used. Also, in FIG. 14 and the like, one communication line is described, but the number of communication lines and terminals can be arbitrarily set according to the communication method and the like.

[0059] As shown in FIG. 14, when the communication lines C1 and C2 are connected with the inter-system connection line 25, there is a failure mode in which all connected microcontrollers and components cannot operate if the communication line is connected to a power supply or ground and the voltage is fixed. Also, when the microcontrollers M1 and M2 are connected to different power supplies, there is a risk of failure due to a high voltage being applied to the normal system or a large current flowing into the normal system due to a failure in one control system.

[0060] Therefore, as shown in FIG. 15, an isolator 28 as a system separation component is provided at a location where simultaneous failures are not desired to occur. Note that the description of the isolator 28 is omitted in FIG. 2 and the like. In the example of FIG. 15, the isolator 28 is provided on the inter-system connection line 25, but it may be provided inside, for example, the microcontrollers M1 and M2 or the components P1 and P2. As a configuration for separating between systems, it is only necessary that information can be transmitted while maintaining the potential difference. As the system separation component, instead of the isolator, for example, passive blocking such as a resistor or a buffer may be provided. Also, by making the communication wireless communication, common-mode failures may not occur.

[0061] Specific examples of the communication configuration are shown in FIGS. 16 and 17. In FIGS. 16 and 17, for simplicity, the signal lines of the two cores of each microcontroller are grouped together and the inter-system connection lines are omitted. As shown in FIG. 16, the microcontrollers 21 and 23 can transmit a common clock signal SCLK and MOSI signal to the corresponding driver components 701 to 704 provided respectively, and can transmit a chip select signal CS_A to the driver components 701 and 703 and a chip select signal CS_B to the driver components 702 and 704. From each of the driver components 701 to 704, an MISO signal can be transmitted to the corresponding microcontrollers 21 and 23 provided respectively.

[0062] The microcontrollers 21 and 23 are provided so as to be capable of communicating between the microcontrollers, and perform synchronization of PWM, synchronization of duty update timing, and synchronization of sample hold timing for the four driver components 701 to 704. The microcontrollers 21 and 23 perform PWM update confirmation using the PWM reflection value and the current detection value by the MISO signal. Also, by configuring to return the driver output from the driver components 701 to 704 to the microcontrollers 21 and 23, PWM update confirmation may be performed. When the driver output is not returned to the microcontrollers 21 and 23 side, the terminals and wirings for returning the driver output can be omitted.

[0063] As shown in FIG. 17, the microcontrollers 21, the driver components 701, and the driver components 702 may be connected in a so-called "daisy chain connection" in which communication lines are connected in a ring. Similarly, the microcontrollers 23, the driver components 703, and the driver components 704 may be connected in a daisy chain connection.

[0064] Specifically, signals from the microcontrollers 21 and 23 are transmitted to the driver components 701 and 703, and the signals are transmitted from the driver components 701 and 703 to the driver components 702 and 704. Then, MISO signals are transmitted from the driver components 702 and 704 to the microcontrollers 21 and 23. In this case, the chip select signal and the sample hold may be shared. Thereby, the number of terminals and the number of wirings can be reduced.

[0065] In this embodiment, since the communication lines of each control system are connected by the inter-system connection line 25, in the microcontrollers 21 and 23, when communication from other microcontrollers starts, the microcontrollers 21 and 23 do not issue commands, or a command is output after a predetermined time has elapsed from the response from the driver components 701 and 703 sides, so that data does not mix on the communication lines. Further, for commands from the microcontrollers 21 and 23 sides, the command destination may be specified by chip select, ID assignment, or the like.

[0066] FIG. 18 illustrates an example of data transmission and reception. In this embodiment, the microcontrollers 21 and 23 output an ID and a command to specify the component to be driven. For example, the component to be driven is specified by the ID, and a current command value or an on-duty is transmitted to the component side via MOSI. In the ID method, the component to be driven is specified by the ID, but it is also possible to set an ID for simultaneously commanding a plurality of components. Thereby, for example, the current detection timings of a plurality of components can be made uniform. The specification of the component to be driven may be by the chip select method.

[0067] The driver components 701 and 703 transmit the current value and status information to the microcontrollers 21 and 23. Since data transmission from the driver components 701 and 703 is performed via MISO, information can be transmitted even during command transmission from the microcontrollers 21 and 23. However, in order to prevent data transmission timings from different driver components from overlapping, for example, when the transmission from the driver component 701 is completed, the transmission from the driver component 703 is set to start. Also, data arbitration may be performed, for example, by setting to transmit in ID order.

[0068] Figures 19 and 20 schematically show the arrangement of motor windings, and the three-phase wiring is described by a single line. In a concentrated winding motor, there are multiple windings in the stator, and by connecting the multiple windings, a three-phase motor with three input terminals is formed. Depending on the connection method of the windings, it is possible to form a set of three-phase windings or multiple sets of three-phase windings. Figure 19 shows an example of forming two sets of three-phase windings. When connecting windings facing each other at 180°, the wiring related to the connection of multiple windings and the configuration of the bus bar carrying the wiring tend to become complicated.

[0069] In this embodiment, the configuration is two power supplies and four motor windings. As shown in Figure 20, for example, when forming four sets of three-phase windings using a concentrated winding motor with a stator of 14 poles and 18 slots, 10 poles and 12 slots, or 8 poles and 12 slots, the connection between the windings arranged opposite each other becomes unnecessary, so the wiring can be simplified.

[0070] In this embodiment, the substrate 75 is provided on one side in the axial direction of the motor 11, and the configurations corresponding to the respective power supplies are intensively arranged in the regions partitioned by the substrate partition line D1 (see FIGS. 1, 9 to 11). Further, four sets of motor windings 121 to 124 are assigned to two power supplies 501, 502 and two microcontrollers 21, 23. When driving the motor 11 with the four sets of motor windings 121 to 124, the winding sets facing each other at 180° are often driven in the same phase. If the winding sets driven in the same phase are assigned to the same power supply, there is a risk of an increase in size due to the complexity of the member for bundling the wirings, a deterioration in layout due to the cross arrangement of the wirings on the substrate 75, and a common cause failure due to a wiring short circuit.

[0071] Therefore, windings with different driving phases arranged adjacent to each other in the stator are assigned to one power supply system. Specifically, it is configured such that power is supplied from the power supply 501 to the windings 121 and 122, and power is supplied from the power supply 502 to the windings 123 and 124. In this embodiment, since the inter-system connection line 25 is provided, commands to the windings assigned to other power supplies can also be output with one core. Therefore, even if two windings arranged adjacent to each other in the stator and having different driving phases are assigned to the same power supply and arranged, the drivers driven in the same phase can be operated by commands from the same core.

[0072] Further, since the energization phases of the windings assigned to the same power supply are different, the timing at which the drawing current becomes maximum during motor driving is shifted. As a result, compared with the case where a driver circuit driven in the same phase is assigned to the same power supply, the power consumption in the driver circuit can be smoothed, and for example, the smoothing capacitor can be downsized. Also, it is possible to achieve the intensification of the components assigned to the same power supply system on one side of the substrate, the improvement of the layout, and the reduction of the occurrence of common cause failures due to wiring shorts. In FIG. 20, the windings 121 and 123 energized in the same phase are shown in white, and the windings 122 and 124 energized in the same phase with a phase different from that of the windings 121 and 123 are shown in embossed pattern.

[0073] The communication between the arithmetic cores 211, 212, 231, 232 and the pre-driver ICs 61 to 64 will be described with reference to FIG. 21. In the description of the communication, for the sake of simplicity, the arithmetic core 211 is referred to as "core 1A", the arithmetic core 212 is referred to as "core 1B", the arithmetic core 231 is referred to as "core 2A", the arithmetic core 232 is referred to as "core 2B", the pre-driver IC 61 is referred to as "pre-driver 1A", the pre-driver IC 62 is referred to as "pre-driver 1B", the pre-driver IC 63 is referred to as "pre-driver 2A", and the pre-driver IC 64 is referred to as "pre-driver 2B".

[0074] In this embodiment, windings 121 and 123 provided corresponding to pre-drivers 1A and 2A are wound around the stator facing each other and energized in the same phase. Windings 122 and 124 provided corresponding to pre-drivers 1B and 2B are wound around the stator facing each other and energized in the same phase. The energization phases of windings 121 and 123 and the energization phases of windings 122 and 124 are different. It is assumed that the amplitudes of the currents flowing through windings 121 to 124 are equal.

[0075] As shown in FIG. 21, cores 1A and 2A transmit command signals such as duty command values and various drive permission signals to pre-drivers 1A and 2A that are driven in the same phase. The pre-drivers 1A and 2A transmit current detection values and status information (such as driver output, abnormality information, and temperature information) to cores 1A and 2A. Also, cores 1B and 2B transmit command signals such as duty command values and various drive permission signals to pre-drivers 1B and 2B that are driven in the same phase. The pre-drivers 1B and 2B transmit current detection values and status information to cores 1B and 2B.

[0076] In this embodiment, cores 1A and 2A send drive commands to pre-drivers 1A and 2A, and do not send drive commands to pre-drivers 1B and 2B. Here, the pre-drivers 1B and 2B may be configured to also send current detection values and status information to the cores 1A and 2A that have not received drive commands. Similarly, the pre-drivers 1A and 2A may be configured to also send current detection values and status information to the cores 1B and 2B that have not received drive commands. Thereby, in each core, the control state of the entire drive device 10 can be grasped.

[0077] Cores 1A and 2A alternately send commands to pre-drivers 1A and 2A. Similarly, cores 1B and 2B alternately send commands to pre-drivers 1B and 2B. Thereby, the arithmetic load of each core can be reduced.

[0078] As shown in FIG. 22, when one core fails, even if the processing is not changed from the normal state, although the update cycle is extended, control can be continued without causing a fatal impact. Specifically, for example, when core 2A fails, in group A, the information at the update timing by the command of core 2A is not updated, and the update cycle is extended. In this case, the previous command value is held at the update timing of core 2A. By using the estimated value from past data at the update timing of core 2A, the influence of the failure can be reduced.

[0079] At the command update timing of the failed core 2A, commands may be sent from the normal core 1A instead of core 2A. Thereby, a performance degradation including the update cycle can be prevented. Also, the pre-drivers 1B and 2B that do not use the commands of core 2A can continue control without being affected by the failure of core 2A.

[0080] As shown in FIG. 23, the inter-system connection line 25 may be divided between Group A and Group B, which are driven in the same phase. In FIG. 23, the inter-system connection line of Group A is denoted as "25A", and the inter-system connection line of Group B is denoted as "25B". By dividing the communication lines for each phase, the amount of information on the communication lines can be suppressed. In addition, since a common failure mode on the communication lines can be avoided, control can be continued even when an abnormality occurs in one of the communication lines.

[0081] Next, the driving of the power relay and the reverse connection protection relay will be described. As shown in FIG. 24, in this embodiment, the power relays 551 to 554 and the reverse connection protection relays 556 to 559 are provided for each of the driver circuits 51 to 54, and are driven by receiving individual commands from the relay driver circuits 621 to 624 of the corresponding driver circuits 51 to 54 during normal operation. In FIG. 24, the reverse connection protection relays and the reverse connection protection relays are collectively referred to as "power / reverse connection relays", and the description of the arithmetic core in the microcomputer is omitted. Also, in FIG. 24, although it is described as if the inter-system connection line is divided between Group A and Group B as in FIG. 23, the inter-system connection lines may be grouped together as in FIG. 2.

[0082] When an abnormality occurs in the pre-driver IC 61, the power relay 551, or the reverse connection protection relay 556, the pre-driver IC 61 side is configured to be in a pull-down (off side) state, and driving by the other pre-driver ICs 62 to 64 is not performed. The same applies when an abnormality occurs in the other pre-driver IC, power relay, reverse connection protection relay, or motor relay (not shown in FIG. 24).

[0083] Also, when an abnormality occurs in the microcomputer 21, the microcomputer 23 commands the relay driver circuits 621 and 622 in the pre-driver ICs 61 and 62 to drive the power relays 551 and 552 and the reverse connection protection relays 556 and 557. Similarly, when an abnormality occurs in the microcomputer 23, the microcomputer 21 commands the relay driver circuits 623 and 624 in the pre-driver ICs 63 and 64 to drive the power relays 553 and 554 and the reverse connection protection relays 558 and 559. Thus, even when an abnormality occurs in one of the microcomputers, the motor 11 can continue to be driven by the command from the other microcomputer to drive the relays.

[0084] Next, the redundant configuration in the microcomputer will be described with reference to FIG. 25. Here, the microcomputer 21 will be described as an example. The microcomputer 21 includes arithmetic cores 211 and 212, a power control unit 213, a clock control unit 217, and the like.

[0085] The power control unit 213 includes a power monitoring unit 214. The power control unit 213 is connected to a plurality of power circuits PM1 to PM3. The power circuits PM1 and PM2 correspond to the power IC 31, and the power circuit PM3 corresponds to the power IC 33. The power IC 31 has, for example, a core power supply voltage output (e.g., about 1.2 [V]) and a power supply output different from the core power supply voltage (e.g., 5 [V]). The core power supply corresponds to the power circuit PM1, and the 5V power supply corresponds to the power circuit PM2. Although the power circuits PM1 and PM2 correspond to the same power IC 31, different voltages are generated inside the power IC 31, and they can be regarded as "different power sources". That is, it can be said that the power control unit 213 of the present embodiment has a redundant configuration in which power is supplied from three different power sources.

[0086] The power supply circuit PM1 is input to the power control unit 213 at the original voltage and used by the arithmetic cores 211 and 212. The power from the power supply circuit PM2 is stepped down by the built-in step-down circuit 215, input to the power control unit 213, and used for core arithmetic operations. The power from the power supply circuit PM3 is stepped down by the step-down circuit 216 outside the microcomputer and input to the power control unit 213. Note that the power supply circuit PM2 may be supplied with power from a power source separate from the power supply IC31, such as the power supply IC33, etc., or may be configured to be stepped down by a step-down circuit outside the microcomputer. The power supply monitoring unit 214 monitors the voltages supplied from each power supply circuit.

[0087] The clock control unit 217 includes a clock monitoring unit 218. The clock control unit 217 obtains a clock signal from the oscillator 41 via the phase-locked loop (PLL) 411. Also, the clock control unit 217 obtains clock signals from the built-in clock circuit 415 and the external clock circuit. In this embodiment, the external clock circuit is another system microcomputer 23, and a clock signal is obtained from the microcomputer 23. Note that the external clock circuit is not limited to another system microcomputer and may be a separately provided clock circuit.

[0088] That is, it can be said that the clock control unit 217 of this embodiment has a redundant configuration in which clocks are supplied from three different clock sources. Hereinafter, the clock signal obtained from the oscillator 41 via the phase-locked loop 411 is referred to as "PLL clock", the clock signal obtained from the built-in clock circuit 219 is referred to as "built-in clock", and the clock signal obtained from the external clock circuit is referred to as "external clock".

[0089] The clock monitoring process of this embodiment will be described based on the flowchart of FIG. 26. Here, it will be described as the process in the microcomputer 21, but the same process is also performed in the microcomputer 23. Each process in the microcomputers 21 and 23 may be a software process in which a program stored in advance in a physical memory device such as a ROM (that is, a readable non-transitory tangible recording medium) is executed by the CPU, or may be a hardware process by a dedicated electronic circuit. Hereinafter, the "step" such as step S101 will be omitted and simply denoted by the symbol "S".

[0090] In S101, the clock monitoring unit 218 determines whether the PLL clock and the internal clock match. Note that a deviation within an allowable error range is permitted and it is determined that they match. The same applies to other match determinations. If it is determined that the PLL clock and the internal clock match (S101: YES), the process proceeds to S104. If it is determined that the PLL clock and the internal clock do not match (S101: NO), the process proceeds to S102.

[0091] In S102, the clock monitoring unit 218 determines whether the internal clock and the external clock match. If it is determined that the internal clock and the external clock match (S102: YES), the process proceeds to S105. If it is determined that the internal clock and the external clock do not match (S102: NO), the process proceeds to S103.

[0092] In S103, the clock monitoring unit 218 determines whether the PLL clock and the external clock match. If it is determined that the PLL clock and the external clock match (S103: YES), the process proceeds to S104. If it is determined that the PLL clock and the external clock do not match (S103: NO), the process proceeds to S106.

[0093] In S104, which is the step to proceed when the PLL clock matches the internal clock or the external clock, the clock control unit 217 operates the arithmetic cores 211 and 212 using the PLL clock.

[0094] In S105, which is entered when the PLL clock does not match the built-in clock and the built-in clock matches the external clock, the clock control unit 217 operates the arithmetic cores 211 and 212 using the built-in clock. That is, normally the PLL clock is used, but when the PLL clock is abnormal, it is switched to the built-in clock as a backup clock. At this time, the switched clock is output to the microcontrollers of other control systems, and the arithmetic operations are performed synchronously with the clock received by the other-system microcontrollers. Also, the abnormality monitoring by comparing the built-in clock and the external clock is continued.

[0095] In S106, which is entered when none of the PLL clock, the built-in clock, and the external clock match, the clock control unit 217 stops the operations of the arithmetic cores 211 and 212 and notifies the external IC of the clock abnormality.

[0096] The power supply monitoring process will be described based on the flowchart of FIG. 27. In S201, the power supply monitoring unit 214 determines whether the core power supply voltage supplied from the power supply circuit PM1 is normal. If it is determined that the core power supply voltage from the power supply circuit PM1 is normal (S201: YES), the process proceeds to S202, and the arithmetic cores 211 and 212 are operated with the core power supply voltage from the power supply circuit PM1. If it is determined that the core power supply from the power supply circuit PM1 is not normal (S201: NO), the process proceeds to S203, and the power supply used for the core arithmetic operation is switched from the power supply circuit PM1 to the power supply circuit PM2 or the power supply circuit PM3. Here, the case of switching to the power supply circuit PM2 as the backup power source will be described as an example. For the case of switching to the power supply circuit PM3, since it suffices to replace the power supply circuit PM2 with the power supply circuit PM3, the description will be omitted.

[0097] In S204, the power supply monitoring unit 214 determines whether the core power supply voltage supplied from the power supply circuit PM2 via the step-down circuit is normal. If it is determined that the core power supply voltage derived from the power supply circuit PM2 is normal (S204: YES), the process proceeds to S205, and the arithmetic cores 211 and 212 are operated with the core power supply voltage derived from the power supply circuit PM2. If it is determined that the core power supply voltage derived from the power supply circuit PM2 is not abnormal (S204: NO), the process proceeds to S206, the operations of the arithmetic cores 211 and 212 are stopped, and the core power supply voltage abnormality is notified to the external IC. Thus, even when a core power supply abnormality occurs in the power supply circuit PM1, the operations of the arithmetic cores 211 and 212 can be continued by using the power supply circuits PM2 and PM3 as backup core power supplies.

[0098] As described above, the ECU15 includes the microcontrollers 21 and 23, a power source, and a clock source. The microcontrollers 21 and 23 have arithmetic cores 211, 212, 231, and 232 that perform control operations. The power source mainly includes the power supply ICs 31 and 33, which supply power to the microcontrollers 21 and 23. The clock source mainly includes the oscillators 41 and 43 and the built-in clock circuit 415, which supply clocks to the arithmetic cores 211, 212, 231, and 232.

[0099] At least one of the arithmetic cores 211, 212, 231, 232, the power source, and the clock source has a redundant configuration of three or more. When an abnormality occurs at a location that is redundant by three or more, the abnormal location is identified, and the abnormality monitoring and operation are continued using two or more that are normal. By making the redundancy three or more, even when an abnormality occurs in part, as long as two or more configurations are normal, the abnormality monitoring and operation can be continued.

[0100] The microcontroller 21 can acquire clocks from three or more different clock sources and has a clock control unit 217 that can monitor clock abnormalities. When the clock from the clock source that is being used normally becomes abnormal, the clock control unit 217 switches to a backup clock and continues the operation while performing abnormality monitoring.

[0101] Specifically, in the microcomputer 21, the oscillator 41, the built-in clock circuit 415, and the microcomputer 23 which is another microcomputer are "three different clock sources". Normally, the PLL signal obtained from the oscillator 41 via the phase-locked loop circuit 411 is used. When the PLL signal becomes abnormal, the built-in clock is used as a backup clock to continue the operation, and the abnormality monitoring is continued by mutually comparing the built-in clock and the external clock. Thereby, even when some clocks become abnormal, the operation and the abnormality monitoring can be appropriately continued.

[0102] There are a plurality of microcomputers 21 and 23. A control unit that performs control using the backup clock due to clock abnormality and a clock abnormality control unit, and a normal control unit that is a normal control unit. Here, the clock abnormality control unit is the microcomputer 21, and the normal control unit is the microcomputer 23. The microcomputers 21 and 23 transmit the clock used for the operation from one to the other, and perform the operation in the arithmetic core in synchronization with the backup clock. In the present embodiment, the backup clock is output from the abnormal-side microcomputer 21 to the normal-side microcomputer 23, and in the microcomputer 23, the operation in the arithmetic core is performed in synchronization with the backup clock received from the microcomputer 21. Further, a normal clock may be sent from the normal-side microcomputer 23 to the abnormal-side microcomputer 21 and synchronized in the microcomputer 21. Thereby, even when a clock abnormality occurs in some microcomputers, the control can be continued by synchronizing a plurality of microcomputers.

[0103] The microcomputer 21 has a power supply control unit 213 to which power is input from at least three power sources. When the power source normally used becomes abnormal, the operation of the arithmetic core is continued using the power from the backup power source. In the present embodiment, the power supply circuits PM1 to PM3 are "three different power sources". Normally, the power supply circuit PM1 is used as the power source. When the power supply circuit PM1 becomes abnormal, the core operation is continued using the power supply circuit PM2 which is a power supply circuit other than the power supply circuit PM1. Thereby, even when a power source abnormality occurs, the operation can be appropriately continued.

[0104] The arithmetic cores 211, 212, 231, and 232 have a lockstep function for abnormal monitoring by performing the same operation with a plurality of cores. Thereby, abnormalities in the arithmetic cores 211, 212, 231, and 232 can be appropriately detected.

[0105] (Second Embodiment, Third Embodiment) The second embodiment is shown in FIG. 28. FIG. 28 is a diagram corresponding to FIG. 24 of the first embodiment, and the power relays and reverse connection protection relays are different from those in the above embodiment. In this embodiment, the power relays 551, 553 and the reverse connection protection relays 556, 558 are provided for each power supply. The power relay 551 and the reverse connection protection relay 556 are shared by the driver circuits 51, 52, and the power relay 553 and the reverse connection protection relay 558 are shared by the driver circuits 53, 54.

[0106] The relay driver circuits 621, 622 drive the power relay 551 and the reverse connection protection relay 556 via the arbitration circuit 571. The relay driver circuits 623, 624 drive the power relay 553 and the reverse connection protection relay 558 via the arbitration circuit 573. By providing the arbitration circuits 571, 573, the number of relays can be reduced.

[0107] During normal operation, the arbitration circuit 571 receives the same command from the relay driver circuits 621, 622, and drives the power relay 551 and the reverse connection protection relay 556 after taking consistency. When one of the relay driver circuits 621, 622 is abnormal, the arbitration circuit 571 drives the power relay 551 and the reverse connection protection relay 556, giving priority to the signal from the normally operating side because the signals received from the relay driver circuits 621, 622 are different.

[0108] During normal operation, the arbitration circuit 573 receives the same commands from the relay driver circuits 623 and 624, and drives the power relay 553 and the reverse connection protection relay 558 in a coordinated manner. When one of the relay driver circuits 623 and 624 is abnormal, the arbitration circuit 573 receives different signals from the relay driver circuits 623 and 624, and drives the power relay 553 and the reverse connection protection relay 558, giving priority to the signal from the normally operating side.

[0109] The third embodiment is shown in Fig. 29. In this embodiment, power relays 551 to 554 and reverse connection protection relays 556 to 559 are provided for each of the driver circuits 51 to 54. In addition, arbitration circuits 571 to 574 are provided.

[0110] The arbitration circuit 571 receives commands from the relay driver circuits 621 and 622, and drives the power relay 551 and the reverse connection protection relay 556. The arbitration circuit 572 receives commands from the relay driver circuits 621 and 622, and drives the power relay 552 and the reverse connection protection relay 557. The arbitration circuit 573 receives commands from the relay driver circuits 623 and 624, and drives the power relay 553 and the reverse connection protection relay 558. The arbitration circuit 574 receives commands from the relay driver circuits 623 and 624, and drives the power relay 554 and the reverse connection protection relay 559. The operations of the arbitration circuits 571 to 574 are generally the same as those in the second embodiment. As a result, the operation of the motor 11 can be continued even in a wider range of failure modes. Also, the same effects as those in the above embodiments are achieved.

[0111] (Fourth to Eighth Embodiments) Embodiments 4 to 8 are variations of the redundant configuration. In the description of the redundant system, the power supply, vehicle signal input, and torque signal input are collectively referred to as the "external input system" as appropriate, the power supply IC, communication unit, and oscillator are collectively referred to as the "microcontroller input system", and the pre-driver IC and driver circuit are collectively referred to as the "driver system". The external input system corresponds to the input from connector 16. Also, the oscillator and inter-system connection lines are omitted as appropriate. FIG. 30 shows a simplified configuration of the first embodiment. When not referring to the number of cores in the microcontroller, the microcontroller is assumed to have one arithmetic core with lockstep.

[0112] As shown in FIG. 31, in the fourth embodiment, four microcontrollers each having one arithmetic core with lockstep are provided. The other configurations are generally the same as those of the first embodiment. As shown in FIG. 32, in the fifth embodiment, four external input systems are provided, and all of the power supply, microcontroller, driver, and motor windings are quadrupled. By quadrupling the power supply, microcontroller, and driver, it is easy to combine with a four-phase motor. Also, when adopting a two-power-supply configuration, it is easy to divide it into two power supply lines.

[0113] By providing three or more of all components, control can be continued even if two of the same components fail. Also, as described in the first embodiment, by connecting the signal lines with inter-system connection lines, the same output as in the normal state can be obtained as long as it is not a failure on the driving side. When providing inter-system connection lines, it is preferable to insert isolators as appropriate to avoid common-cause failures.

[0114] Also, it is not limited to even numbers such as two-phase and four-phase, and it may be an odd number, or a mixture of components with odd and even numbers may be present. The sixth embodiment shown in FIG. 33 is an example of a three-phase configuration in which three each of the external input system, microcontroller input system, driver system, and motor windings are provided. As shown in FIG. 34, when the driver system is three-phase, by making the motor windings also three-phase, wiring can be performed efficiently.

[0115] On the other hand, if redundancy is achieved by providing a plurality of components, there are concerns about an increase in the number of components, an increase in size, and an increase in the arithmetic processing load. In that case, three or four systems of components that are relatively likely to fail may be provided, and two systems of components that are relatively unlikely to fail may be provided. For example, when the driver circuit is most likely to fail, as in the seventh embodiment shown in FIG. 35, the driver system may have four systems and the others may have two systems. Even with this configuration, the same effects as those of the above-described embodiment can be obtained.

[0116] Also, as in the eighth embodiment shown in FIG. 36, the ECU 15 is provided with four power supply ICs 31 to 34 and four oscillators 41 to 44, and a plurality (two in FIG. 36) of power supply ICs and oscillators may be provided for one microcomputer. In the present embodiment, a total of four arithmetic cores are provided, and each arithmetic core uses a different power supply IC as a power source and a different oscillator as a clock source.

[0117] In the eighth embodiment, the ECU 15 is provided with three or more (four in the present embodiment) arithmetic cores that operate with different clock sources. Also, the ECU 15 is provided with two or more (four in the present embodiment) arithmetic cores that operate with different power sources. Thereby, even when an abnormality occurs in some of the clock sources or power sources, the operation of the motor 11 to be controlled can be continued. Also, the same effects as those of the above-described embodiment can be obtained.

[0118] (Ninth Embodiment) The ninth embodiment is shown in FIGS. 37 and 38. In the above-described embodiment, the arithmetic core has been described as having lockstep. When the arithmetic core has lockstep, redundant arithmetic is performed with the lockstep core, and abnormality detection is performed by comparing the arithmetic results. On the other hand, when the arithmetic core does not have a lockstep core, detection of arithmetic errors cannot be performed. In the seventh embodiment, it is an example in which the arithmetic core does not have a lockstep core, and the microcomputers 21 and 23 each have three arithmetic cores, and abnormality monitoring is performed by majority voting of the arithmetic results.

[0119] As shown in FIG. 38, the three arithmetic cores 261 to 263 can operate independently and can operate simultaneously based on a common clock. In this case, for example, when momentary noise is input, the operations in the three arithmetic cores 261 to 263 may be affected in the same way. Therefore, by shifting the operation timing using the clock delay device 265, it is possible to prevent the simultaneous occurrence of operation errors. Note that since the comparator 267 that compares the operation results needs to compare the operation results at the same timing, the delay amounts among the multiple cores are made uniform. By dynamically comparing using the comparator 267, a determination can be made at high speed. Also, instead of comparing with the comparator 267, data may be stored for a certain period of time and then compared collectively by the arithmetic cores 261 to 263.

[0120] In the present embodiment, the microcontrollers 21 and 23 have three or more arithmetic cores 261 to 263 that perform the same operation, and control the motor 11 based on the mutual comparison result of the operation results. Specifically, based on the majority theory, the motor 11 is controlled using the operation result that has been normally determined. Thereby, even when an abnormality occurs in the operation result of some of the arithmetic cores, the control of the motor 11 can be continued.

[0121] Three or more arithmetic cores 261 to 264 perform the same operation at different timings, and the operation results are compared by inputting the values adjusted in timing so that the same operation results can be compared to a comparator 267 which is a comparator. Thereby, the detection coverage of abnormality detection against the simultaneous occurrence of operation errors can be increased. Also, the same effects as those of the above embodiment are achieved.

[0122] (Embodiment 10) Embodiment 10 is shown in FIGS. 39 to 41. In Embodiment 10, the operation method in the redundant configuration will be described. For example, in the case of a configuration in which four microcontrollers and four motor windings are provided (see FIG. 32), the four microcontrollers may be driven evenly, and the output per set of motor windings may be 25% each.

[0123] Also, use two microcontrollers and two sets of motor windings as the drive system, and the other two sets as the backup system. During normal operation, drive them with the drive system so that the output per set of motor windings is 50% each. Also, when an abnormality occurs in the drive system, switch to driving with the backup system.

[0124] FIG. 39 shows an example where there are four microcontrollers 21 to 24 and driver circuits 51 to 54, and two sets of motor windings 121 and 123. The microcontrollers 21 and 22 and the driver circuits 51 and 52 are connected to the motor winding 121, and the microcontrollers 23 and 24 and the driver circuits 53 and 54 are connected to the motor winding 123. A motor relay 131 is provided between the driver circuit 51 and the motor winding 121, a motor relay 132 is provided between the driver circuit 52 and the motor winding 122, a motor relay 133 is provided between the driver circuit 53 and the motor winding 123, and a motor relay 134 is provided between the driver circuit 54 and the motor winding 124. Each of the motor relays 131 to 134 includes three switching elements corresponding to each phase. In the figure, the motor relay is described as "SW".

[0125] As shown in FIG. 40, during normal operation, turn on the motor relays 131 and 133 to energize the motor windings 121 and 123 using the driver circuits 51 and 53 to drive the motor 11. When an abnormality occurs in the microcontroller 21, turn off the motor relay 131 and turn on the motor relay 132 to energize the motor winding 121 using the driver circuit 52 instead of the driver circuit 51. If the microcontroller 23 is normal, the state where the motor relay 133 is on and the motor relay 134 is off continues.

[0126] Similarly, when an abnormality occurs in the microcomputer 23, by turning off the motor relay 133 and turning on the motor relay 134 from off, the energization of the motor winding 123 is performed using the driver circuit 54 instead of the driver circuit 53. If the microcomputer 21 is normal, the state where the motor relay 131 is on and the motor relay 132 is off continues. Thereby, even when an abnormality occurs in the microcomputers 21 and 23, the driving of the motor 11 can be continued in the same state as before the occurrence of the abnormality.

[0127] As shown in FIG. 41, the components related to the energization of the motor winding 121 are intensively arranged on one side of the substrate 75 (the left side of the paper surface in the example of FIG. 41), and the components related to the energization of the motor winding 123 are intensively arranged on the other side of the substrate 75 (the right side of the paper surface in the example of FIG. 41).

[0128] On the substrate 75, the power terminals are arranged line-symmetrically with respect to the substrate partition line D1. Also, the lead wires of the motor windings 121 and 123, the driver components 73, and the motor relays 131 to 134 between the motor wires and the driver components are arranged line-symmetrically with respect to the substrate partition line D1 in the configuration corresponding to the motor winding 121 and the configuration for the motor winding 123, and the phase arrangements are arranged in reverse order.

[0129] The driver component 73 has one high-side chip 712, one low-side chip 713 corresponding to each phase, and a control chip 711 incorporating a corresponding pre-driver IC integrally sealed. The six driver components 73 are arranged side by side with the element-side end facing the motor windings 121 and 123 side and the IC-side end facing the substrate partition line D1 side.

[0130] Inside the driver component 73, they are arranged in the order of the low-side chip 713, high-side chip 712, and control chip 711, starting from the motor windings 121 and 123. The low-side chip 713 is laminated with a shift relative to the high-side chip 712, but it may be placed flat without lamination, or the control chip 711 may be separate. Also, the driver components 701 to 704 of the above-described embodiment in which a total of six switching elements are modularized may be used. In this case, the phase arranged in the middle (phase V in the example of FIG. 41) has the elements of the drive system and the elements of the backup system assigned to different modules.

[0131] In FIG. 41, the components of the drive system are shown by solid lines, and the components of the backup system are shown by two-dot chain lines. The driver components of the drive system and the driver components of the backup system corresponding to each phase are adjacent and arranged alternately. Therefore, the high-side chip 712 and the low-side chip 713 used for driving the same phase are arranged adjacent to each other. This makes it easy to wire the driver component 73 and the motor windings 121 and 123, and the mounting area of the power section on the substrate can be suppressed. Even with this configuration, the same effects as the above-described embodiment can be achieved.

[0132] (Embodiments 11 to 13) Embodiments 11 to 13 are variations in the power terminal arrangement and connection. As in the 11th embodiment shown in FIG. 42, when four external input systems are provided (see FIG. 32), the power terminals 761 to 764 corresponding to the four connectors are arranged evenly at 90° intervals.

[0133] As in the twelfth embodiment shown in FIGS. 43 and 44, on the outer edge side of the substrate 75, at two locations on both sides sandwiching the substrate partition line D1, the power terminal 761 and the power terminal 762, and the power terminal 763 and the power terminal 763 may be arranged side by side. When four sets of power terminals 761 to 764 corresponding to four connectors are provided for the two power supply ICs 31 and 33, two sets of power terminals 76 are connected to the respective power supply ICs 31 and 33 via the diodes 781 to 784. By electrically connecting between a plurality of power inputs, even when an abnormality such as a connector abnormality or a harness disconnection occurs, power supply can be appropriately continued.

[0134] Also, as in the thirteenth embodiment shown in FIGS. 45 to 47, switching elements 786 to 789 may be provided between the connector and the power supply IC instead of the diodes 781 to 784. The switching elements 786 and 787 are connected to the power supply IC 31, and the switching elements 788 and 789 are connected to the power supply IC 33.

[0135] As shown in FIG. 46, during normal operation, both switching elements 786 and 787 are turned on. When an abnormality occurs in power supply 1A, the switching element 786 on the side where the abnormality occurs is turned off. When an abnormality occurs in power supply 1B, the switching element 787 is turned off. By keeping both switching elements 786 and 787 turned on during normal operation, the power supply to be used can be quickly switched when an abnormality occurs.

[0136] Also, as shown in FIG. 47, during normal operation, the switching element 786 is turned on and the switching element 787 is turned off so that power is supplied from one power supply (for example, power supply 1A). When an abnormality of power supply 1A is detected, the switching element 786 is turned off, and a wake-up signal is sent from the normal microcomputer to the switching element 787 to turn on the switching element 787. Thereby, the current consumption during normal operation can be suppressed. The control of the switching elements 788 and 789 connected to the power supply IC 33 is the same. Even with this configuration, the same effects as those of the above embodiment can be obtained.

[0137] (Embodiment 14, Embodiment 15) Embodiment 14 and Embodiment 15 are variations in the substrate arrangement. In Embodiment 1, the motor windings 121 to 124 are provided on the radially outer side of the driver components 701 to 704 (see FIG. 11). In Embodiment 14 shown in FIG. 48, the motor windings 121 to 124 are provided on the radially inner side of the driver component 701.

[0138] Also, in Embodiment 15 shown in FIG. 49, the driver components 701 and 702 are arranged symmetrically with respect to the substrate center line D2 such that the pre-driver ICs 61 and 62 face the power terminal 76 side. Also, the driver components 703 and 704 are arranged symmetrically with respect to the substrate center line D2 such that the pre-driver ICs 63 and 64 face the power terminal 76 side. The motor windings 121 to 124 are provided on the driver circuit 51 to 54 sides of the driver components 701 to 704. Even with this configuration, the same effects as those of the above embodiments are achieved.

[0139] (Embodiment 16) Embodiments 16 to 18 are modified examples of the driver components. Embodiment 16 is shown in FIGS. 50 to 52. FIG. 50 is a diagram corresponding to FIG. 7 and shows each component in a simplified manner. In the driver component 705 of this embodiment, the stacked structure of the chips 712 and 713 is generally the same as that in Embodiment 1.

[0140] The ground land 724 of the lead frame 725 is provided on both sides of the power land 722. The ground clip 741 is bent downward on both sides in the width direction and is connected to the ground land 724.

[0141] As shown in FIG. 52, the control land 726 where the control chip 711 is disposed is exposed from the back surface side of the sealing portion 749 at the intermediate portion in the width direction, and is not exposed from the sealing portion 749 on the outer side in the width direction. In other words, as shown by the dashed square, a part of the control land 726 is in a floating state from the substrate 75. Thereby, the routing property of the substrate of the high-side chip 712 and the power line can be ensured. Further, since the power + line and the GND line are aligned, it becomes easier to arrange noise prevention elements such as snubber elements (not shown). Also, the noise loop can be reduced. Further, the same effects as those of the above-described embodiment are obtained.

[0142] (17th Embodiment) The 17th embodiment is shown in FIGS. 53 to 55. In the driver component 706 of the present embodiment, the control chip 711 is not built in, and the lead frame 727 does not have the control land 726. The stacked structure of the chips 712 and 713 is substantially the same as that of the first embodiment. Note that the control chip 711 may also be built in this embodiment. Further, in the embodiments such as the first embodiment, the control chip 711 may be provided separately without being built in the driver component.

[0143] In this embodiment, the ground land 724 is divided for each phase and is arranged on the opposite side of the output land 723 with the power land 722 interposed therebetween. The ground clip 742 is provided for each phase. The ground clip 742 is provided above the low-side chip 713 and is bent downward to be connected to the ground land 724. The ground clip 742 is formed with a notch 743 so that a part of the high-side chip 712 and the low-side chip 713 is exposed on the top surface side. Thereby, a non-overlapping region is secured, and the high-side chip 712 and the low-side chip 713 can be connected to the signal line.

[0144] By separating the ground clip 742 for each phase and detecting the voltage at both ends on the side of the low-side chip 713 and the side of the ground land 724, the motor current can be detected. That is, in this embodiment, the ground clip 742 also functions as a current detection element. As a result, the motor current can be detected with a relatively simple configuration.

[0145] (Embodiment 18) Embodiment 18 is shown in FIG. 56. In the driver component 707 of this embodiment, the high-side chip 712 and the low-side chip 713 are not stacked but are placed flat. In this embodiment, from one side, the control chip 711, the high-side chip 712, and the low-side chip 713 are arranged in this order.

[0146] The lead frame 728 of this embodiment has a control land 721, a power land 722, an output land 729, and a ground land 724, and the low-side chip 713 is arranged on the output land 729. The intermediate clip 715 is provided above the high-side chip 712, respectively, and one end side is bent downward and connected to the output land 729.

[0147] In this embodiment, since the high-side chip 712 is arranged between the low-side chip 713 and the control chip 711, it is difficult to directly connect the gate electrode of the low-side chip 713 and the control chip 711. Therefore, in this embodiment, a bonding pad is provided on the high-side chip 712, and the gate terminal of the low-side chip 713 and the control chip 711 are connected via the bonding pad of the high-side chip 712. By relaying the high-side chip 712 provided in between, the control chip 711 and the low-side chip 713 can be appropriately connected. Also, the same effects as the above embodiment are achieved.

[0148] In the embodiment, the motor 11 corresponds to the "control target", the ECU 15 corresponds to the "control device", the microcontrollers 21 to 24 correspond to the "control unit", and the arithmetic cores 211, 212, 231, 232 correspond to the "arithmetic circuit".

[0149] (Other embodiments) In the above embodiment, examples where the power supply system is 2 to 4 systems and the control system is 2 to 4 systems were mainly described. In other embodiments, the number of power supply ICs, microcontrollers, arithmetic cores, pre-driver ICs, driver circuits, motor windings, etc. can be arbitrarily set according to the required redundancy, mounting space, etc. Also, the number of easily breakable components (for example, microcontrollers and driver circuits) can be four, and the others can be three, etc., so the number of components may be different.

[0150] In the above embodiment, the electronic components are mainly driver components with a built-in pre-driver IC. In other embodiments, the electronic components only need to be digitally communicable with the microcontroller, and may be, for example, a pre-driver IC or a sensor provided separately from the driver circuit. Also, in the above embodiment, the electronic components of each system were described as being the same. In other embodiments, the electronic components of each system may have different outputs, accuracies, etc.

[0151] In the above embodiment, the control target of the ECU is the motor. In other embodiments, the control target may be an actuator other than the motor or other devices. In the above embodiment, the communication device is applied to an electric power steering device. In other embodiments, it may be applied to in-vehicle devices other than the electric power steering device, or may be applied to devices other than in-vehicle devices.

[0152] In the present disclosure, "the arithmetic circuit has a lockstep function for abnormal monitoring by performing the same arithmetic with a plurality of cores, and the control device according to any one of items 1 to 6." and "the control unit has three or more of the arithmetic circuits that perform the same arithmetic, and controls the control target (11) based on mutual comparison of the arithmetic results, and the control device according to any one of items 1 to 7." may also be used.

[0153] The control unit and its method described in the present disclosure may be implemented by a dedicated computer configured by a processor and a memory programmed to execute one or more functions embodied by a computer program. Alternatively, the control unit and its method described in the present disclosure may be implemented by a dedicated computer configured by a processor constituted by one or more dedicated hardware logic circuits. Or, the control unit and its method described in the present disclosure may be implemented by one or more dedicated computers configured by a combination of a processor programmed to execute one or more functions and a memory and a processor constituted by one or more hardware logic circuits. Also, the computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions to be executed by a computer. As described above, the present invention is not limited to the above embodiments and can be implemented in various forms without departing from the spirit of the invention.

Explanation of Signs

[0154] 10 ··· Driving device 11 ··· Motor (control target) 15 ··· ECU (control device) 21~24 ··· Microcomputer (control unit) 211, 212, 231, 232 ··· Arithmetic core (arithmetic circuit) 213 ··· Power control unit 217 ··· Clock control unit 31~34 ··· Power supply IC (power source) 41~44 ··· Oscillator (clock source) 415 ··· Built-in clock (clock source)

Claims

1. A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations, A power source (31-34) that supplies power to the control unit, The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit, Equipped with, At least one of the power source and the clock source has a redundant configuration of three or more components. A control device that, if an abnormality occurs in a section with 3 or more redundant units, identifies the abnormal location and continues monitoring and operation using 2 or more of the normal units.

2. A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations, A power source (31-34) that supplies power to the control unit, The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit, Equipped with, At least one of the arithmetic circuit, the power supply source, and the clock source has a redundant configuration of three or more components. If an anomaly occurs in a section with 3 or more redundant sections, the anomaly is identified, and the 2 or more functioning sections are used to continue monitoring the anomaly and the operation continues. The control unit has a clock control unit (217) that can acquire clocks from three or more different clock sources and can monitor clock abnormalities. The aforementioned clock control unit is a control device that, when the clock from the clock source used under normal conditions becomes abnormal, switches to a backup clock to continue operation and monitors for abnormalities.

3. If the control units are multiple in number, and the control unit that performs control using the backup clock due to a clock anomaly is designated as the clock anomaly control unit, and the control unit that is functioning normally is designated as the normal control unit, The control device according to claim 2, wherein the normal control unit and the clock abnormality control unit transmit the clock used for calculations from one to the other, and perform calculations in the calculation circuit in synchronization with the backup clock.

4. A control unit (21-24) having arithmetic circuits (211, 212, 231, 232, 261-263) that perform control calculations, A power source (31-34) that supplies power to the control unit, The clock sources (41-44, 415) that supply the clock for the control calculation in the aforementioned arithmetic circuit, Equipped with, At least one of the arithmetic circuit, the power supply source, and the clock source has a redundant configuration of three or more components. If an anomaly occurs in a section with 3 or more redundant sections, the anomaly is identified, and the 2 or more functioning sections are used to continue monitoring the anomaly and the operation continues. The control unit has a power control unit (213) to which power is input from at least three different power sources, and is a control device that, if the power source used under normal conditions becomes abnormal, continues the operation of the calculation circuit using power from a backup power source.

5. The control device according to claim 1, wherein three or more arithmetic circuits are provided, each operating with a different clock source.

6. The control device according to claim 1, wherein three or more arithmetic circuits are provided, each operating on a different power source.

7. The control device according to claim 1, 2, or 4, wherein the arithmetic circuit has a lockstep function that monitors for abnormalities by performing the same calculation with multiple cores.

8. The control device according to claim 1, 2, or 4, wherein the control unit has three or more calculation circuits (261 to 263) that perform the same calculation, and controls the control target (11) based on the results of a comparison of the calculation results.

9. The control device according to claim 8, wherein three or more calculation circuits perform the same calculation at different timings and compare the calculation results using values ​​whose timings have been adjusted so that the same calculation results can be compared.

Images