Control system for electric vehicle

Abstract

To provide a technique for appropriately transferring a mode to a retreat-traveling mode.SOLUTION: A control system comprises a first control device, a processor and a logic circuit that monitors whether the processor has failed. When it is detected that the processor has failed, the first control device determines whether a retreat-travelling mode in which an electric vehicle is made to retreat-travel can be executed. When determining that the retreat-travelling mode can be executed, the first control device outputs, to the logic circuit, a mode-transfer request for transferring a mode of the logic circuit to the retreat-travelling mode. When obtaining the mode-transfer request from the first control device, the logic circuit can determine whether the retreat-travelling mode should be executed, on the basis of a monitored result. When the mode-transfer request is obtained from the first control device and when it is determined that the retreat-travelling mode should be executed, the mode of the logic circuit is transferred to the retreat-travelling mode.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The technology disclosed in this specification relates to a control system for electric vehicles.

Background Art

[0002] Patent Document 1 describes a motor control device including a microcomputer and an ASIC. The ASIC stores a program for causing an electric vehicle to perform a retreat travel when a defect of the microcomputer is detected.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] A configuration in which a host ECU and an ASIC are configured to be able to communicate with each other, and when the host ECU detects a defect of the microcomputer, the host ECU outputs a request to shift to a retreat travel mode to the ASIC is conceivable. In this configuration, it is possible to appropriately shift to the retreat travel mode, but if a malfunction occurs in the host ECU, there is a possibility that it will be unnecessarily shifted to the retreat travel mode. This specification provides a technology for appropriately shifting to the retreat travel mode.

Means for Solving the Problems

[0005] This specification discloses a control system for an electric vehicle. In a first aspect, the control system includes a power control device that adjusts the power supplied to the motor of the electric vehicle, a first control device that outputs a first command value indicating a target output of the motor, and a second control device that is configured to communicate with the first control device and outputs a drive signal to the power control device based on the first command value output from the first control device. The second control device is configured to communicate with the first control device, and includes a processor that processes the first command value output from the first control device by a program and outputs an operation command value for the motor, and a logic circuit that monitors whether the processor has failed and converts the operation command value output from the processor into the drive signal. The logic circuit is further configured to communicate with the first control device without passing through the processor. The first control device determines whether it is possible to execute an evacuation driving mode in which the electric vehicle performs evacuation driving when a failure of the processor is detected. When it is determined that the execution of the evacuation driving mode is possible, the first control device outputs a mode transition request to the logic circuit to cause the logic circuit to transition to the evacuation driving mode. The logic circuit is configured to be able to determine whether the evacuation driving mode should be executed based on the monitoring when the mode transition request is obtained from the first control device. When the mode transition request is obtained from the first control device and it is determined that the evacuation driving mode should be executed, the logic circuit transitions to the evacuation driving mode.

[0006] According to the above configuration, when a defect in the processor is detected, the first control device outputs a mode transition request to the logic circuit to shift the logic circuit to the fallback running mode. The logic circuit is configured to be able to determine whether the situation is such that the fallback running mode should be executed. The logic circuit acquires the mode transition request from the first control device and, when it determines that the situation is such that the fallback running mode should be executed, shifts to the fallback running mode. In this way, the logic circuit can shift to the fallback running mode in a situation where the fallback running mode should be executed. That is, it appropriately shifts to the fallback running mode.

[0007] In a second aspect, in the above first aspect, the logic circuit is further configured to monitor a state indicator indicating the state of the power control device and output the state indicator to the first control device, and the first control device may determine whether it is possible to execute the fallback running mode based on the state indicator output from the logic circuit when a defect in the processor is detected. According to the above configuration, the electric vehicle can be appropriately made to perform fallback running.

[0008] In a third aspect, in the above first aspect or second aspect, when the logic circuit shifts to the fallback running mode, the logic circuit outputs a signal indicating that the logic circuit has shifted to the fallback running mode to the first control device, and when the first control device acquires the signal, instead of the first command value, the first control device may output a second command value based on the fallback running mode to the logic circuit. According to the above configuration, when the logic circuit shifts to the fallback running mode, the electric vehicle can be made to perform fallback running based on the second command value.

[0009] In the fourth aspect, in any one of the first to third aspects, when the logic circuit acquires the mode transition request from the first control device and determines that the situation is not such that the evacuation driving mode should be executed, it may not transition to the evacuation driving mode. According to the above configuration, for example, when a mode transition request is output to the logic circuit due to a malfunction of the first control device but the situation is not actually such that the evacuation driving mode should be executed, the electric vehicle can be, for example, normally driven without performing evacuation driving.

Brief Description of Drawings

[0010]

Figure 1

Figure 2

Figure 3

Embodiments for Carrying Out the Invention

[0011] (Circuit Configuration of Control System 2; FIG. 1) The control system 2 of this embodiment is mounted on an electric vehicle (for example, an electric car, a hybrid car, a plug-in hybrid car, a fuel cell car, etc.) having a traveling motor for driving wheels. As shown in FIG. 1, the control system 2 includes an upper ECU (abbreviation for Electronic Control Unit) 10, a motor ECU 20, two inverters 32a, 32b, and two traveling motors 34a, 34b.

[0012] The upper ECU 10 outputs torque command values indicating the respective target outputs of the motors 34a, 34b based on, for example, the accelerator opening degree. The motor ECU 20 is configured to be communicable with the upper ECU 10. The motor ECU 20 outputs drive signals to the inverters 32a, 32b based on the torque command values output from the upper ECU 10.

[0013] The motor ECU 20 includes a microcomputer 22 and an ASIC (Application Specific Integrated Circuit) 24. The microcomputer 22 is configured to be communicable with the upper ECU 10. The microcomputer 22 processes the torque command value output from the upper ECU 10 by a program and outputs a current command value for the motors 34a and 34b. The microcomputer 22 includes, for example, a CPU (Central Processing Unit), and the CPU can process the torque command value output from the upper ECU 10 by a program.

[0014] The ASIC 24 has a circuit structure that converts the current command value output from the microcomputer 22 into a drive signal. In particular, the above circuit structure of the ASIC 24 is a circuit structure for controlling the motors 34a and 34b. Such a circuit structure includes, for example, part or all of the hardware parts specialized for motor control such as a resolver digital converter, an analog-digital converter, and a motor IP. Although not shown in the figure, the microcomputer 22 and the ASIC 24 are configured to be communicable with each other.

[0015] The inverters 32a and 32b convert the DC power output from a battery (not shown) into three-phase AC power and supply it to the motors 34a and 34b. That is, each of the inverters 32a and 32b is a device that adjusts the power supplied to the motors 34a and 34b. The electric vehicle can travel by driving the motors 34a and 34b. The inverters 32a and 32b can also convert the regenerative power (three-phase AC power) of each motor 34a and 34b into DC power and supply it to a battery (not shown). Since the specific circuit configuration of the inverters 32a and 32b is well known, a detailed description thereof is omitted.

[0016] Current sensors 36a and 36b are respectively connected to inverters 32a and 32b. The current sensors 36a and 36b are sensors that respectively detect the current values of the output currents of the inverters 32a and 32b (i.e., the currents supplied to the respective motors 34a and 34b). The current values detected by each of the current sensors 36a and 36b are output to the ASIC 24.

[0017] Angle sensors 38a and 38b are respectively connected to motors 34a and 34b. The angle sensors 38a and 38b are, for example, resolvers. The angle sensors 38a and 38b respectively detect the rotation angles of the motors 34a and 34b (specifically, the rotors). The rotation angles detected by each of the angle sensors 38a and 38b are input to the ASIC 24.

[0018] The ASIC 24 is further configured to be able to communicate with the upper-level ECU 10 without going through the microcomputer 22. The ASIC 24 is configured to repeatedly output (for example, every time a predetermined time elapses) a state indicator indicating the state of the inverters 32a and 32b, such as the current values detected by the current sensors 36a and 36b. The state indicator includes, in addition to the current value, the temperature of the inverters 32a and 32b, the power supply state of the control boards of the inverters 32a and 32b, and the like. In this embodiment, the state indicator is used by the upper-level ECU 10 in determining whether the retreat running mode described later can be executed.

[0019] The ASIC 24 is further configured to monitor whether the microcomputer 22 has failed. For example, the ASIC 24 may transmit a signal to the microcomputer 22 at predetermined intervals and, if it does not receive a response to the signal, determine that the microcomputer 22 has failed. The result of this monitoring is used to determine whether the situation is such that the retreat running mode should be executed when a retreat running mode transition request is received from the upper-level ECU 10. Note that the ASIC 24 may be configured to output failure information indicating that to the upper-level ECU 10 when the microcomputer 22 has failed.

[0020] Further, the upper ECU 10 is configured to be able to detect that the microcomputer 22 has failed. For example, the upper ECU 10 may transmit a signal to the microcomputer 22 at predetermined intervals and detect a failure of the microcomputer 22 when it does not receive a response to the signal. In another example, the upper ECU 10 may detect that the microcomputer 22 has failed when failure information is acquired from the ASIC 24. Also, in another example, the upper ECU 10 may transmit a signal to the microcomputer 22 when failure information is acquired from the ASIC 24 and detect that the microcomputer 22 has failed when it does not receive a response to the signal.

[0021] As described above, in the control system 2 of this embodiment, the upper ECU 10 and the motor ECU 20 (i.e., the microcomputer 22 and the ASIC 24) cooperate with each other to control the inverters 32a, 32b, etc. Specifically, first, the upper ECU 10 outputs a torque command value that is the target output of the motors 34a, 34b based on the accelerator opening degree, etc. to the microcomputer 22. The microcomputer 22 processes the torque command value by a program and outputs a current command value for the motors 34a, 34b to the ASIC 24. The ASIC 24 converts the current command value into a drive signal.

[0022] In such a control system 2, assume a situation where a failure occurs in a part of the configuration of the motor ECU 20 (specifically, the microcomputer 22). In such a situation, the torque command value output from the upper ECU 10 is not acquired by the microcomputer 22. Therefore, the ASIC 24 cannot acquire the current command value from the microcomputer 22 and thus cannot output a drive signal. That is, normally, when the microcomputer 22 fails in such a control system 2, the control system 2 cannot drive the electric vehicle.

[0023] Therefore, in the control system 2 of this embodiment, when the host ECU 10 detects a failure of the microcomputer 22, it determines whether it is possible to execute an evacuation driving mode in which the electric vehicle is driven for evacuation based on the state indicator output from the ASIC 24. Then, when the host ECU 10 determines that it is possible to execute the evacuation driving mode, it outputs an evacuation driving mode transition request to the ASIC 24. Then, when the ASIC 24 acquires the evacuation driving mode transition request from the host ECU 10 and determines that the microcomputer 22 has failed based on the above monitoring, it transitions to the evacuation driving mode. After the ASIC 24 has transitioned to the evacuation driving mode, the host ECU 10 outputs a torque command value based on the evacuation driving mode to the ASIC 24 instead of the microcomputer 22. The ASIC 24 has a control logic (i.e., circuit structure) for driving the electric vehicle for evacuation. That is, the ASIC 24 also includes a circuit structure that converts the torque command value output from the host ECU 10 into a drive signal. As a result, even if a failure of the microcomputer 22 is detected, the electric vehicle can be driven for evacuation. The detailed processing will be described with reference to FIGS. 2 and 3 below.

[0024] (Specific processing; FIGS. 2 and 3) Subsequently, with reference to FIGS. 2 and 3, the specific processing of this embodiment will be described. The host ECU 10 detects a failure of the microcomputer 22 in S12 of FIG. 2. For example, the host ECU 10 detects a failure of the microcomputer 22 in response to not acquiring a response to a signal transmitted to the microcomputer 22 at each predetermined period.

[0025] Also, although not shown, when the host ECU 10 detects a failure of the microcomputer 22 in S12, it transmits a shutdown request to the ASIC 24. This is because since the microcomputer 22 has failed, the microcomputer 22 and the ASIC 24 cannot cooperate to control the motors 34a and 34b. When the ASIC 24 receives the shutdown request, it shuts down the circuit for outputting a drive signal to the inverters 32a and 32b.

[0026] As described above, the ASIC 24 is configured to output the status indicator to the upper ECU 10. In S14, the ASIC 24 transmits the status indicator to the upper ECU 10. In a modified example, when the upper ECU 10 detects a defect in the microcomputer 22, it may transmit a transmission request for the status indicator to the ASIC 24. And when the ASIC 24 receives the transmission request from the upper ECU 10, it may transmit the status indicator to the upper ECU 10 in S14. In addition to the status indicator, the ASIC 24 may transmit other information such as the temperature of components of the electric vehicle such as the transaxle and the motor to the upper ECU 10.

[0027] In S16, when the upper ECU 10 receives the status indicator from the ASIC 24, in S20, based on the status indicator (i.e., the current value, the temperature, the power state of the inverter), it determines whether an abnormality has occurred in each of the inverters 32a and 32b. For example, when the temperature of at least one of the inverters 32a and 32b is higher than the threshold temperature, it is detected that an abnormality has occurred in the inverter. When an abnormality is detected, the upper ECU 10 determines that the evacuation driving mode cannot be executed (YES in S20), proceeds to S22, and turns off the switch of the electric vehicle. This is because it is not preferable to drive the electric vehicle in a situation where an abnormality is detected. On the other hand, when the upper ECU 10 does not detect an abnormality, it determines that the execution of the evacuation driving mode is possible (NO in S20) and proceeds to S30.

[0028] In S30, the upper ECU 10 shifts to the evacuation driving mode preparation state. The evacuation driving mode preparation state is a mode in which various processes are executed with the ASIC 24 in order to shift the operation mode of the upper ECU 10 from the normal driving mode to the evacuation driving mode. Various processes executed with the ASIC 24 in order to shift to the evacuation driving mode will be described later with reference to FIG. 3.

[0029] (Continuation of FIG. 2; FIG. 3) When the host ECU 10 shifts to the evacuation driving mode preparation state in S30 of FIG. 2, it transmits a request to shift to the evacuation driving mode to the ASIC 24 in S32 of FIG. 3. The request to shift to the evacuation driving mode is a signal for requesting the ASIC 24 to shift the state of the ASIC 24 to the evacuation driving mode.

[0030] When the ASIC 24 receives a request to shift to the evacuation driving mode from the host ECU 10 in S34, it determines in S36 whether the microcomputer 22 has failed. As described above, the ASIC 24 monitors whether the microcomputer 22 has failed. If the ASIC 24 determines that the microcomputer 22 has failed (YES in S36), it proceeds to S42, and if it determines that the microcomputer 22 has not failed (NO in S36), it proceeds to S40.

[0031] In S40, the host ECU 10 releases the evacuation driving mode preparation state and executes normal driving. When it is determined NO in S36, since the microcomputer 22 has not failed, the microcomputer 22 and the ASIC 24 can cooperate to drive the electric vehicle normally.

[0032] Here, as a situation where it is determined NO in S36, for example, a malfunction of the host ECU 10 can be considered. As described above, the host ECU 10 has detected a failure of the microcomputer 22 in S12 of FIG. 2. However, it is also assumed that due to a malfunction of the host ECU 10, although the microcomputer 22 has not actually failed, a failure of the microcomputer 22 is detected. In such a case, by executing the processes of S36 and S40, the electric vehicle can be driven normally.

[0033] When ASIC24 determines YES at S36, it shifts to the emergency running mode at S42 and, at S44, transmits an emergency running mode state indicating that ASIC24 has shifted to the emergency running mode to the upper ECU10. ASIC24 is configured to convert the torque command value output from the upper ECU10 into a drive signal in the emergency running mode. In particular, in the emergency running mode, the output is restricted compared to the normal state (i.e., the state where the microcomputer 22 has not failed).

[0034] Also, after transmitting an emergency running mode transition request to ASIC24 at S32, the upper ECU10 determines at S48 whether ASIC24 has shifted to the emergency running mode. Specifically, the upper ECU10 determines whether it has received the emergency running mode state from ASIC24. When the upper ECU10 has received the emergency running mode state from ASIC24 (at S46), it determines that ASIC24 has shifted to the emergency running mode (YES at S48) and proceeds to S50. On the other hand, when the upper ECU10 has not received the emergency running mode state from ASIC24, it determines that ASIC24 has not shifted to the emergency running mode (NO at S48) and executes the process of S32 again. For example, when the emergency running mode transition request is not properly transmitted from the upper ECU10 to ASIC24, or when there is a relatively long time lag from when the emergency running mode transition request is transmitted until the emergency running mode state is received, it may be determined NO at S48.

[0035] The upper ECU10 transmits a shutdown release request to ASIC24 at S50. As described above, the upper ECU10 has already transmitted a shutdown request to ASIC24 due to the failure of the microcomputer 22. However, in this case, even if the microcomputer 22 has failed, the electric vehicle can be emergency-run in the emergency running mode. Therefore, the upper ECU10 transmits a shutdown release request to ASIC24 in order to emergency-run the electric vehicle in the emergency running mode.

[0036] When the ASIC 24 receives a shutdown release request from the upper ECU 10 at S52, it releases the shutdown at S54. That is, the ASIC 24 releases the shutdown of the circuit for outputting drive signals to the inverters 32a and 32b. For this reason, the ASIC 24 becomes in a state where it can output drive signals based on the retreat driving mode to the inverters 32a and 32b.

[0037] Also, at S56, the ASIC 24 transmits a shutdown release state indicating that the ASIC 24 has released the shutdown to the upper ECU 10.

[0038] Also, after transmitting a shutdown release request to the ASIC 24 at S50, the upper ECU 10 determines at S60 whether the ASIC 24 has completed releasing the shutdown. Specifically, the upper ECU 10 determines whether it has received the shutdown release state from the ASIC 24. When the upper ECU 10 has received the shutdown release state from the ASIC 24 (at S58), it determines that the ASIC 24 has completed releasing the shutdown (YES at S60) and proceeds to S62. On the other hand, when the upper ECU 10 has not received the shutdown release state from the ASIC 24, it determines that the ASIC 24 has not completed releasing the shutdown (NO at S60) and executes the process of S50 again. For example, when the shutdown release request is not properly transmitted from the upper ECU 10 to the ASIC 24, or when there is a relatively long time lag from when the shutdown release request is transmitted until the shutdown release state is received, it may be determined as NO at S60.

[0039] The upper ECU 10 shifts to the evacuation driving mode in S62. In the evacuation driving mode, the upper limit value of the torque command value is set lower compared to the normal driving mode. When the upper ECU 10 shifts to the evacuation driving mode, based on the accelerator opening degree and the like, it outputs the torque command value based on the evacuation driving mode to the ASIC 24 instead of the microcomputer 22. As a result, the ASIC 24 converts the torque command value output from the upper ECU 10 into a drive signal and supplies it to the inverters 32a and 32b. As a result, even when the microcomputer 22 of the motor ECU 20 has failed, the electric vehicle can be driven in the evacuation driving mode.

[0040] According to the configuration of this embodiment, when a failure of the microcomputer 22 is detected (S12 in FIG. 2), the upper ECU 10 outputs a request to shift to the evacuation driving mode to the ASIC 24 (S32 in FIG. 3). The ASIC 24 is configured to monitor whether the microcomputer 22 has failed. When the ASIC 24 acquires a mode shift request from the upper ECU 10 and determines that the microcomputer 22 has failed (YES in S36), it shifts to the evacuation driving mode (S42). In this way, the ASIC 24 can shift to the evacuation driving mode in a situation where the microcomputer 22 has failed, that is, in a situation where the evacuation driving mode should be executed. That is, it appropriately shifts to the evacuation driving mode.

[0041] The upper ECU 10 and the motor ECU 20 are examples of the "first control device" and the "second control device" of the present technology, respectively. The microcomputer 22 and the ASIC 24 are examples of the "processor" and the "logic circuit" of the present technology, respectively. The inverters 32a and 32b are examples of the "power control device" of the present technology. The torque command value output from the upper ECU 10 to the microcomputer 22 and the torque command value output from the upper ECU 10 to the ASIC 24 are examples of the "first command value" and the "second command value" of the present technology, respectively. The current command value output from the microcomputer 22 to the ASIC 24 is an example of the "operation command value" of the present technology. The request to shift to the evacuation driving mode is an example of the "mode shift request" of the present technology.

[0042] Modifications of the above embodiments are described below. The processes of S44, S46, S56, and S58 in FIG. 3 can be omitted. As described above, the ASIC 24 repeatedly outputs the status indicators to the upper ECU 10. The ASIC 24 may transmit, to the upper ECU 10, information (such as the output upper limit value of the ASIC 24) that enables the upper ECU 10 to determine its own status (for example, the retreat running mode state, the shutdown release state) together with the status indicators. The upper ECU 10 may execute processes such as S48 and S60 based on this information.

[0043] In the control system 2 of this embodiment, the upper ECU 10 is configured to output a torque command value to the motor ECU 20. The torque command value in this embodiment is an example of a first command value indicating the target outputs of the motors 34a and 34b. However, in other embodiments, the upper ECU 10 may output, as the first command value to the motor ECU 20, other indicators indicating the target outputs of the motors 34a and 34b instead of the torque command value.

[0044] In the control system 2 of this embodiment, the microcomputer 22 of the motor ECU 20 is programmed to output a current command value to the ASIC 24 based on the torque command value (or other first command value). However, the current command value in this embodiment is an example of an operation command value for the motors 34a and 34b and does not limit the operation command value. In other embodiments, the microcomputer 22 may be programmed to determine other operation command values for the motors 34a and 34b based on the torque command value (or other first command value) and output them to the ASIC 24.

[0045] The processes of S14 to S22 in FIG. 2 can be omitted. That is, the ASIC 24 does not have to output the status indicators of the inverter 32a and the like to the upper ECU 10. In this case, the upper ECU 10 may determine whether it is possible to execute the retreat running mode based on an indicator different from the status indicator.

[0046] As described above, specific examples of the technology disclosed in this specification have been described in detail, but these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and changes of the specific examples illustrated above. The technical elements described in this specification or the drawings exhibit technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. Also, the technology illustrated in this specification or the drawings can achieve multiple objectives simultaneously, and achieving one of those objectives itself has technical utility.

Explanation of Reference Signs

[0047] 2: Control system, 10: Host ECU, 20: Motor ECU, 22: Microcomputer, 24: ASIC, 32a, 32b: Inverter, 34a, 34b: Motor, 36a, 36b: Current sensor, 38a, 38b: Angle sensor

Claims

1. A control system for an electric vehicle, comprising: a power control device for adjusting the power supplied to the motor of the electric vehicle; a first control device for outputting a first command value indicating a target output of the motor; a second control device configured to be communicable with the first control device and output a drive signal to the power control device based on the first command value output from the first control device; wherein the second control device comprises: a processor configured to be communicable with the first control device, process the first command value output from the first control device by a program, and output an operation command value for the motor; a logic circuit for monitoring whether the processor has failed and converting the operation command value output from the processor into the drive signal; wherein the logic circuit is further configured to be communicable with the first control device without passing through the processor; wherein the first control device is configured to: when a failure of the processor is detected, determine whether it is possible to execute an evacuation driving mode for causing the electric vehicle to perform evacuation driving; when it is determined that the execution of the evacuation driving mode is possible, output a mode transition request for causing the logic circuit to transition to the evacuation driving mode to the logic circuit; wherein the logic circuit is configured to: when the mode transition request is obtained from the first control device, be able to determine whether the situation is such that the evacuation driving mode should be executed based on the monitoring; when the mode transition request is obtained from the first control device and it is determined that the situation is such that the evacuation driving mode should be executed, transition to the evacuation driving mode. A control system.

2. The logic circuit is further configured to monitor a state indicator indicating a state of the power control device and output the state indicator to the first control device, and the first control device is configured to determine whether it is possible to execute the evacuation driving mode based on the state indicator output from the logic circuit when a failure of the processor is detected. The control system according to Claim 1.

3. When the logic circuit transitions to the evacuation driving mode, the logic circuit outputs a signal indicating that the logic circuit has transitioned to the evacuation driving mode to the first control device. ​ ​ When the signal is acquired, the first control device outputs, to the logic circuit, a second command value based on the evacuation travel mode instead of the first command value. The control system according to claim 1.

4. The control system according to claim 1, wherein when the logic circuit acquires the mode shift request from the first control device and determines that the situation is not such that the evacuation travel mode should be executed, the logic circuit does not shift to the evacuation travel mode.

Images