Control device, power supply control device and power supply control system

Abstract

To realize a fail-safe at low cost when a microcomputer in a power supply control device malfunctions.SOLUTION: A control device according to an embodiment is a first control device supplied with power via a power relay that receives a power hold signal output by a microcomputer in a power control device and supplies power to the first control device and a second control device. When detecting an abnormality in the microcomputer, the control device performs fail-safe control by outputting the power hold signal to the power relay in place of the power control device, causing the power relay to supply power to the second control device and the first control device.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The disclosed embodiments relate to a control device, a power supply control device, and a power supply control system. [Background technology]

[0002] Conventionally, a technology has been known in which a power supply relay is provided in a power supply ECU (Electronic Control Unit) in a vehicle, and a microcomputer in the power supply ECU controls the power relay to control the power supply to multiple ECUs other than the power supply ECU (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-166549 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when the above-described conventional technology is used, there is a problem in that if an abnormality occurs in the microcomputer of the power supply ECU, the power supply relay will be cut off, and the power supply to each ECU will be cut off.

[0005] One possible fail-safe measure in the event of an abnormality in the microcomputer of this power supply ECU is for each ECU to individually control the power supply relay corresponding to its own device. However, this method requires a mechanism for individually controlling the power supply relay for each ECU, which can lead to problems such as increased costs.

[0006] One aspect of the embodiment has been made in consideration of the above, and aims to provide a control device, a power supply control device, and a power supply control system that can achieve fail-safe at low cost in the event of an abnormality in the microcomputer of the power supply control device. [Means for solving the problem]

[0007] A control device according to one aspect of the embodiment is a first control device to which power is supplied via a power relay that receives a power hold signal output by a controller possessed by the power control device and supplies power to a first control device and a second control device, and when an abnormality in the controller is detected, the control device performs fail-safe control to output the power hold signal to the power relay instead of the power control device, causing the power relay to supply power to the second control device and the first control device. [Effects of the Invention]

[0008] According to one aspect of the embodiment, if the microcomputer (equivalent to an example of a "controller") of the power supply ECU (equivalent to an example of a "power supply control device") fails, a first control device, which is one of the ECUs, controls the power supply relay in place of the power supply ECU to supply power to each ECU. This allows for a fail-safe to be implemented without providing a mechanism for individually controlling the power supply relay in each ECU, thereby enabling a fail-safe to be implemented at low cost when an abnormality occurs in the microcomputer of the power supply ECU. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of a power supply control system according to an embodiment. [Figure 2] FIG. 2 is an explanatory diagram of the requirements for connecting / disconnecting the power relay. [Figure 3] FIG. 3 is an explanatory diagram of the ON / OFF requirements of the RHLD signal. [Figure 4] FIG. 4 is an explanatory diagram showing an example of the operation of the power supply control system in a normal state. [Figure 5] FIG. 5 is an explanatory diagram of mutual alive monitoring between the power supply ECU and the integrated control ECU. [Figure 6] FIG. 6 is an explanatory diagram (part 1) showing an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU. [Figure 7]FIG. 7 is an explanatory diagram (part 2) showing an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU. [Figure 8] FIG. 8 is a timing chart showing an example of the operation of the power supply control system. [Figure 9] FIG. 9 is a diagram showing a processing sequence executed by the power supply control system. [Figure 10] FIG. 10 is a flowchart showing the procedure of the state determination process executed by the control ECU. [Figure 11] FIG. 11 is a diagram illustrating an example of the configuration of a power supply control system according to a modified example. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of a control device, a power supply control device, and a power supply control system disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments described below.

[0011] In the following, the power supply control device according to the embodiment is assumed to be a power supply ECU 10 (see FIG. 1). Also, in the following, the first control device according to the embodiment is assumed to be an integrated control ECU 20 (see FIG. 1). Also, in the following, the second control device according to the embodiment is assumed to be a control ECU 30 (see FIG. 1).

[0012] In the following, when it is necessary to distinguish between multiple identical components, the symbol indicating the component may be followed by a number in the form "-n" (n is a natural number). When there is no particular need to distinguish between them, this numbering will not be used.

[0013] (Example of power supply control system configuration) 1 is a diagram showing an example of the configuration of a power supply control system 1 according to an embodiment. The power supply control system 1 is a system mounted on a vehicle. As shown in FIG. 1, the power supply control system 1 includes a plurality of power supply relays 3, a power supply ECU 10, an integrated control ECU 20, and a plurality of control ECUs 30.

[0014] In this embodiment, for convenience of explanation, it is assumed that there are three power supply relays 3, 3-1, 3-2, and 3-3, and there are two control ECUs 30, 30-1 and 30-2, as shown in FIG.

[0015] The power supply ECU 10, the integrated control ECU 20, and the control ECUs 30-1 and 30-2 are connected to each other via an in-vehicle network so that they can communicate with each other. In this embodiment, the in-vehicle network is exemplified by a CAN (Controller Area Network), but it is not limited to a CAN. Also, although FIG. 1 illustrates one CAN system, two or more CAN systems may be used for redundancy.

[0016] The power supply relay 3 is a circuit that connects / disconnects a power supply path (+B) from the vehicle battery (BATT) to the integrated control ECU 20 and each control ECU 30. The power supply relay 3 connects / disconnects the power supply path to the integrated control ECU 20 and each control ECU 30 in response to a relay drive signal (MREL signal) output from the power supply ECU 10. The power supply relay 3 may be provided inside the power supply ECU 10.

[0017] When each power supply relay 3 receives a Hi voltage MREL signal (hereinafter referred to as "MREL ON" where appropriate) from the power supply ECU 10, it connects the power supply path to the corresponding integrated control ECU 20 and each control ECU 30. When each power supply relay 3 receives a Lo voltage MREL signal (hereinafter referred to as "MREL OFF" where appropriate) from the power supply ECU 10, it cuts off the power supply path to the corresponding integrated control ECU 20 and each control ECU 30. "MREL ON" is an example of a power supply maintaining signal. "MREL OFF" is an example of a power supply cutting signal.

[0018] 1, power supply relay 3-1 connects / disconnects the power supply path to integrated control ECU 20 in response to an MREL-1 signal output individually from power supply ECU 10. Power supply relay 3-2 connects / disconnects the power supply path to control ECU 30-1 in response to an MREL-2 signal output individually from power supply ECU 10. Power supply relay 3-3 connects / disconnects the power supply path to control ECU 30-2 in response to an MREL-3 signal output individually from power supply ECU 10.

[0019] In addition, in this embodiment, when an abnormality occurs in the microcomputer 11 of the power supply ECU 10, the power supply relay 3 connects / disconnects the power supply path in response to a relay drive signal (RHLD signal) output from the integrated control ECU 20 during fail-safe control, which will be described later.

[0020] The power supply relays 3 simultaneously receive the RHLD signal output from the integrated control ECU 20, and simultaneously connect / disconnect the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30.

[0021] When each power supply relay 3 receives a Hi voltage RHLD signal (hereinafter referred to as "RHLD ON" where appropriate) from the integrated control ECU 20, it simultaneously connects the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30. When each power supply relay 3 receives a Lo voltage RHLD signal (hereinafter referred to as "RHLD OFF" where appropriate), it simultaneously cuts off the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30. "RHLD ON" is an example of a power supply maintaining signal. "RHLD OFF" is an example of a power supply shutoff signal.

[0022] The connection / disconnection requirements for the power relay 3 in this embodiment are shown in Fig. 2. Fig. 2 is an explanatory diagram of the connection / disconnection requirements for the power relay 3. As shown in Fig. 2, each power relay 3 is in a connected state when "MREL ON" or "RHLD ON". On the other hand, each power relay 3 is in a disconnected state when "MREL OFF" and "RHLD OFF" are both set.

[0023] Returning to the explanation of Figure 1, the power supply ECU 10 is an ECU that manages the power supply of the vehicle. The power supply ECU 10 has a microcomputer 11 and a delay mechanism 12.

[0024] The microcomputer 11 is a microcomputer having a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The microcomputer 11 corresponds to an example of a controller.

[0025] The microcomputer 11 may be configured in part or entirely with hardware such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0026] The microcomputer 11 has a power supply control unit 11a that functions by the CPU executing a program stored in the ROM using the RAM as a work area. The power supply control unit 11a controls the corresponding power supply relay 3 based on a vehicle scene signal input to the power supply control system 1 via a CAN or the like.

[0027] The vehicle scene signal corresponds to an example of a signal related to a situation. The vehicle scene signal is an identification signal corresponding to various vehicle scenes such as driving, charging, etc. The vehicle scene signal is an identification signal for each IG type, for example, IG2, IGB, etc.

[0028] Here, IG2 is a signal that is output when the ignition is turned ON (or "Ready ON"), and is a signal that is output from an external ECU (not shown) when the vehicle starts to drive, i.e., an identification signal that indicates the driving scene. IG2 becomes "IG2 ON" when the ignition is turned ON and the vehicle starts to drive, and becomes "IG2 OFF" when the ignition is turned OFF and the vehicle finishes driving. In other words, "IG2 ON" is a vehicle scene-specific signal that indicates that the vehicle is driving. "IG2 OFF" is a vehicle scene-specific signal that indicates that the vehicle has finished driving or is not driving.

[0029] The IGB is a signal output from an external ECU (not shown) when the vehicle is connected to an external charging device to charge the battery. It is a signal output when charging, i.e., an identification signal indicating the charging scene. The IGB becomes "IGB ON" when the vehicle is connected to the external charging device, and becomes "IGB OFF" when the connection is released. In other words, "IGB ON" is a vehicle scene-specific signal indicating that the vehicle is under charging control. "IGB OFF" is a vehicle scene-specific signal indicating that the vehicle has finished charging control or is not under charging control. Note that the vehicle scene-specific signal may also include information indicating various other vehicle conditions.

[0030] In this embodiment, the microcomputer 11 has three power supply control units 11a: power supply control units 11a-1, 11a-2, and 11a-3. The power supply control unit 11a-1 controls the power supply relay 3-1 by an MREL-1 signal in response to a vehicle scene signal. The power supply control unit 11a-2 controls the power supply relay 3-2 by an MREL-2 signal in response to a vehicle scene signal. The power supply control unit 11a-3 controls the power supply relay 3-3 by an MREL-3 signal in response to a vehicle scene signal. The microcomputer 11 is configured so that if an abnormality occurs in the microcomputer 11 itself, the output port to the delay mechanism 12 becomes Low voltage and "MREL OFF" is output.

[0031] The delay mechanism 12 is provided between the microcomputer 11 and the power relay 3, and is a mechanism that delays the MREL signal output from the microcomputer 11. The delay mechanism 12 includes various circuits and the like, and delays the MREL signal input from the microcomputer 11 by a predetermined first time before outputting it to the power relay 3.

[0032] The integrated control ECU 20 is an ECU that performs fail-safe control by controlling the power supply relay 3 in place of the power supply ECU 10 when an abnormality occurs in the microcomputer 11 of the power supply ECU 10. When the microcomputer 11 of the power supply ECU 10 is normal, the integrated control ECU 20 executes an app (application software) that realizes functions related to vehicle control that are originally assigned to the integrated control ECU 20.

[0033] The integrated control ECU 20 includes a microcomputer 21. The microcomputer 21 is a microcomputer including a CPU, a ROM, a RAM, etc. The microcomputer 21 may be configured in part or in whole using hardware such as an ASIC or an FPGA.

[0034] The microcomputer 21 includes a power supply control unit 21a and an application execution unit 21b, which function when the CPU executes a program stored in the ROM using the RAM as a work area.

[0035] The power supply control unit 21a performs mutual alive monitoring with the power supply ECU 10 via an in-vehicle network such as a CAN. Furthermore, when the power supply control unit 21a detects an abnormality in the microcomputer 11 of the power supply ECU 10 through alive monitoring, it performs fail-safe control to control the power supply relay 3 to maintain power by outputting an RHLD signal instead of the MREL signal of the power supply ECU 10.

[0036] The RHLD signal is output from the power supply control unit 21a to the power supply relay 3 without passing through the delay mechanism 12. That is, when the power supply control unit 21a detects an abnormality in the microcomputer 11 of the power supply ECU 10, it outputs "RHLD ON" for a second time period that is shorter than the above-mentioned first time period.

[0037] Specifically, when the microcomputer 11 of the power supply ECU 10 becomes abnormal, the time required for the microcomputer 21 to determine that the microcomputer 11 is abnormal and output "RHLD ON" is the second time. In other words, if the abnormal state of the microcomputer 11 continues for more than the second time, the microcomputer 21 determines that the microcomputer 11 is abnormal. When the microcomputer 11 becomes abnormal, the output port to the delay mechanism 12 immediately becomes "MREL OFF." Therefore, the power relay is shut off from the time the microcomputer 11 becomes abnormal until the integrated control ECU 20 outputs "RHLD ON." Therefore, by setting the delay time of the delay mechanism 12 to the first time, which is longer than the second time, "MREL ON" continues for the first time even if the microcomputer 11 becomes abnormal. Since "RHLD ON" is output during this time, the drive signal of the power supply relay 3 is not interrupted. This prevents the "MREL ON" output from the microcomputer 11 of the power supply ECU 10 from becoming a low voltage and becoming "MREL OFF" when an abnormality occurs in the microcomputer 11, thereby preventing the power supply relay 3 from cutting off the power supply.

[0038] Furthermore, the power supply control unit 21a performs fail-safe control and transmits information about the status during the fail-safe control via the CAN to each control ECU 30. The information about the status during the fail-safe control includes vehicle scene signals and the like.

[0039] In addition, the power supply control unit 21a receives the status of each control ECU 30 transmitted from each control ECU 30 based on the transmitted information on the situation, and determines whether or not the system can be shut down (whether or not the entire system can be shut down) based on each received status and the control status of the integrated control ECU 20 itself.

[0040] If the power supply control unit 21a determines that the system can be shut down, it outputs "RHLD OFF" to the power supply relay 3, causing the power supply relay 3 to cut off the supply of power to the integrated control ECU 20 and each control ECU 30.

[0041] The ON / OFF requirements for the RHLD signal in this embodiment are shown in Fig. 3. Fig. 3 is an explanatory diagram of the ON / OFF requirements for the RHLD signal. As shown in Fig. 3, the RHLD signal becomes "RHLD ON" when the microcomputer 11 of the power supply ECU 10 is abnormal and system shutdown is not possible.

[0042] On the other hand, the RHLD signal is "RHLD OFF" when the microcomputer 11 of the power supply ECU 10 is normal. Alternatively, the RHLD signal is "RHLD OFF" when the microcomputer 11 of the power supply ECU 10 is abnormal and the system can be shut down.

[0043] Returning to the explanation of Fig. 1, the application execution unit 21b executes an application that realizes the vehicle control functions originally assigned to the integrated control ECU 20 when the microcomputer 11 of the power supply ECU 10 is operating normally.

[0044] Each control ECU 30 is an ECU that executes an application that realizes a function related to vehicle control assigned to the control ECU 30.

[0045] Each control ECU 30 has a microcomputer 31. The microcomputer 31 is a microcomputer having a CPU, ROM, RAM, etc. The microcomputer 31 may be partially or entirely configured with hardware such as an ASIC or FPGA.

[0046] The microcomputer 31 has an application execution unit 31a that functions by the CPU executing a program stored in the ROM using the RAM as a work area. The application execution unit 31a executes applications that realize functions related to vehicle control assigned to each control ECU 30.

[0047] The microcomputer 31 also receives information about the status of the fail-safe control from the integrated control ECU 20 during the fail-safe control via the CAN, and determines whether or not control by the microcomputer 31 is necessary based on this information. If the microcomputer 31 determines that control is unnecessary, it transitions to a standby state before sleep. The standby state before sleep corresponds to an example of a waiting state.

[0048] The operation of the power supply control system 1 will be described in more detail below, taking into account the above explanation, using timing charts, processing sequences, and the like. In this embodiment, the control ECU 30-1 is a driving-related ECU (e.g., a motor control device, an engine control device, etc.), and the control ECU 30-2 is an ECU that controls charging. In this case, the control ECU 30-1 controls vehicle driving and must be activated when the power supply ECU 10 receives a vehicle scene-specific signal indicating "IG2 ON" for driving. The control ECU 30-2 controls charging and must be activated when the power supply ECU 10 receives a vehicle scene-specific signal indicating "IGB ON" for charging. The integrated control ECU 20 monitors the microcomputer 11 of the power supply ECU 10 in each vehicle scene and must perform fail-safe control. Therefore, the integrated control ECU 20 must be activated when the power supply ECU 10 receives a vehicle scene-specific signal indicating "IG2 ON" for driving or a vehicle scene-specific signal indicating "IGB ON" for charging. First, FIG. 4 is an explanatory diagram showing an example of the operation of the power supply control system 1 during normal operation.

[0049] (Example of normal operation) As shown in FIG. 4, under normal conditions, the power supply ECU 10 acquires vehicle scene-specific signals from an external device (not shown), and each power supply control unit 11a corresponding to the vehicle scene-specific signal individually controls each power supply relay 3 using the MREL signal (see arrows a1-1, a1-2, a1-3).

[0050] For example, when a vehicle scene-specific signal (e.g., "IG2 ON" or "IGB ON") that should activate the integrated control ECU 20 is input to the power supply ECU 10, the power supply control unit 11a-1 causes the power supply relay 3-1 to supply power to the integrated control ECU 20 using the MREL-1 signal of "MREL ON" (see arrow a2-1).

[0051] Furthermore, for example, when a vehicle scene-specific signal (e.g., IG2 ON) that should start the control ECU 30-1 is input, the power supply control unit 11a-2 causes the power supply relay 3-2 to supply power to the control ECU 30-1 using the MREL-2 signal of "MREL ON" (see arrow a2-2). When a vehicle scene-specific signal (e.g., "IG2 OFF") that should put the control ECU 30-1 into sleep mode is input, the power supply control unit 11a-2 causes the power supply relay 3-2 to cut off the supply of power to the control ECU 30-1 using the MREL-2 signal of "MREL OFF."

[0052] Furthermore, for example, when a vehicle scene-specific signal (e.g., "IGB ON") that should start the control ECU 30-2 is input, the power supply control unit 11a-3 causes the power supply relay 3-3 to supply power to the control ECU 30-2 using the MREL-3 signal of "MREL ON" (see arrow a2-3). When a vehicle scene-specific signal (e.g., "IGB OFF") that should put the control ECU 30-2 into sleep mode is input, the power supply control unit 11a-3 causes the power supply relay 3-3 to cut off the supply of power to the control ECU 30-2 using the MREL-3 signal of "MREL OFF."

[0053] That is, when a vehicle scene-specific signal "IG2 ON" indicating the start of driving is input, the power supply control units 11a-1 and 11a-2 output the MREL-1 and MREL-2 signals of "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-1. Also, when a vehicle scene-specific signal "IG2 OFF" indicating the end of driving is input, the power supply control units 11a-1 and 11a-2 output the MREL-1 and MREL-2 signals of "MREL OFF" to put the integrated control ECU 20 and the control ECU 30-1 to sleep.

[0054] Furthermore, when a vehicle scene signal "IGB ON" indicating charging is input, the power supply control units 11a-1 and 11a-3 output the MREL-1 and MREL-3 signals of "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-2. Furthermore, when a vehicle scene signal "IGB OFF" indicating the end of charging is input, the power supply control units 11a-1 and 11a-3 output the MREL-1 and MREL-3 signals of "MREL OFF" to put the integrated control ECU 20 and the control ECU 30-2 to sleep.

[0055] As indicated by arrows a1-1, a1-2, and a1-3, each MREL signal output from each power supply control unit 11a to each power supply relay 3 passes through each delay mechanism 12. For convenience, in this embodiment, the MREL signal output from each power supply control unit 11a is described as being delayed by each delay mechanism 12 for the first time period described above, but the delay mechanism 12 may delay the MREL signal only when an abnormality occurs in the microcomputer 11 of the power supply ECU 10. In other words, the MREL signal may be delayed only when the state changes from "MREL ON" to "MREL OFF" when an abnormality occurs in the microcomputer 11.

[0056] Furthermore, the power supply ECU 10 and the integrated control ECU 20 monitor each other's alive status via the CAN (see arrow a3). The alive status monitoring is a process of monitoring whether the other ECU and the mutual communication are normal or abnormal, and is performed by exchanging counter signals using a watchdog timer or the like, for example.

[0057] 5 is an explanatory diagram of mutual alive monitoring between the power supply ECU 10 and the integrated control ECU 20. Here, it is assumed that the power supply ECU 10 and the integrated control ECU 20 exchange counter signals with each other. The power supply ECU 10 periodically (e.g., every time it counts up) transmits a counter signal that counts up periodically (e.g., every 1 ms) to the integrated control ECU 20. The integrated control ECU 20 periodically transmits a counter signal that counts up periodically to the power supply ECU 10.

[0058] Then, in the "normal state," both the power supply ECU 10 and the integrated control ECU 20 can count up, and the count-up determination of the counter signal received from each other is normal.

[0059] However, when "the microcomputer of the power supply ECU 10 is abnormal," the integrated control ECU 20 can count up, but the power supply ECU 10 stops counting up. As a result, the integrated control ECU 20 determines that the count up of the power supply ECU 10 is abnormal. Specifically, if the counter signal received from the power supply ECU 10 does not change for a time period of Δt2 or more, the integrated control ECU 20 determines that the microcomputer 11 of the power supply ECU 10 has become abnormal. Furthermore, the power supply ECU 10 is unable to determine that the integrated control ECU 20 is counting up in the first place.

[0060] Furthermore, when "the microcomputer of the integrated control ECU 20 is abnormal," the power supply ECU 10 can count up, but the integrated control ECU 20 stops counting up. As a result, the power supply ECU 10 determines that the count up of the integrated control ECU 20 is abnormal. Specifically, if the counter signal received from the integrated control ECU 20 does not change for a time period of Δt2 or more, the power supply ECU 10 determines that the microcomputer 21 of the integrated control ECU 20 has become abnormal. Furthermore, the integrated control ECU 20 is unable to determine that the power supply ECU 10 is counting up in the first place.

[0061] By monitoring each other's status in this way, it becomes possible to detect not only abnormalities in the microcomputer 11 of the power supply ECU 10, but also abnormalities in the microcomputer 21 of the integrated control ECU 20. Note that this embodiment relates to fail-safe control when an abnormality occurs in the microcomputer 11 of the power supply ECU 10, and therefore the following description will focus on when an abnormality occurs in the microcomputer 11 of the power supply ECU 10.

[0062] The alive monitoring is not limited to the counter signal method described above, but may be a so-called Q&A method in which "questions" and "answers" are periodically exchanged.

[0063] (Example of operation when the power supply ECU microcomputer malfunctions) Next, an example of the operation of the power supply control system when an abnormality occurs in the microcomputer of the power supply ECU 10 will be described with reference to Figures 6 and 7. Figure 6 is an explanatory diagram (part 1) showing an example of the operation of the power supply control system 1 when an abnormality occurs in the microcomputer of the power supply ECU 10. Also, Figure 7 is an explanatory diagram (part 2) showing an example of the operation of the power supply control system 1 when an abnormality occurs in the microcomputer of the power supply ECU 10.

[0064] 6, it is assumed that the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 through the above-mentioned alive monitoring. In this case, each MREL signal output from each power supply control unit 11a of the power supply ECU 10 immediately becomes "MREL OFF" when the microcomputer 11 becomes abnormal (see arrows a4-1, a4-2, a4-3).

[0065] In this case, the power supply control unit 21a of the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 and simultaneously outputs an RHLD signal that becomes "RHLD ON" to each power supply relay 3 without going through each delay mechanism 12 (see arrow a5).

[0066] Upon receiving this RHLD signal, each power supply relay 3 simultaneously connects the power supply paths to the corresponding integrated control ECU 20 and each control ECU 30 (see arrows a6-1, a6-2, a6-3).

[0067] That is, the integrated control ECU 20 and each control ECU 30 that have already been powered and activated continue to be powered. Also, each control ECU 30 that has not been powered and is in a sleep state is powered and activated. That is, when the microcomputer 11 of the power supply ECU 10 becomes abnormal, the integrated control ECU 20 and all control ECUs 30 enter an activated state.

[0068] The power supply control unit 21a of the integrated control ECU 20 outputs an RHLD signal that turns "RHLD ON" to multiple power supply relays 3 at once, allowing the integrated control ECU 20 to comprehensively control the power supply in place of the power supply ECU 10. Furthermore, the power supply control unit 21a simultaneously outputs an RHLD signal to multiple power supply relays 3, putting all of the control ECUs 30 into an activated state, making it possible to acquire the state of each control ECU 30 required to determine whether or not to shut down the system.

[0069] Then, the integrated control ECU 20 transmits the vehicle scene-specific signal and the power supply control fail-safe information via the CAN (see arrow a7) to all the control ECUs 30. The vehicle scene-specific signal and the power supply control fail-safe information correspond to an example of the information regarding the situation during the fail-safe control described above.

[0070] During alive monitoring, the integrated control ECU 20 can receive vehicle scene signals along with the counter signal from the power supply ECU 10. However, when an abnormality occurs in the microcomputer 11, the vehicle scene signals from the power supply ECU 10 are considered to be unreliable, so the integrated control ECU 20 receives the vehicle scene signals from the CAN or the like instead of the power supply ECU 10.

[0071] The power supply control fail-safe information also includes, for example, information indicating that an abnormality has been detected in the power supply ECU 10 and that the integrated control ECU 20 is currently performing fail-safe control.

[0072] 7, each control ECU 30 determines the state of its own device based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20. Specifically, each control ECU 30 determines whether or not control by its own device is necessary based on the vehicle scene-specific signal and the power supply control fail-safe information.

[0073] For example, in a scene in which the vehicle is moving, the control ECU 30-1 that performs vehicle control related to the vehicle's movement determines that control by the control ECU 30-1 itself is necessary. Also, in the same scene in which the vehicle is moving, the control ECU 30-2 that performs vehicle control unrelated to the vehicle's movement determines that control by the control ECU 30-2 itself is unnecessary.

[0074] If each control ECU 30 determines that control is not necessary, it transitions to the standby state before sleep. If each control ECU 30 determines that control is necessary, it continues control by its own device. Then, each control ECU 30 transmits the determined state of its own device to the integrated control ECU 20 (see arrows a8-1 and a8-2).

[0075] The power supply control unit 21a of the integrated control ECU 20 determines whether the system can be shut down based on the status of each control ECU 30 received from each control ECU 30 and the control status of the integrated control ECU 20 itself. Specifically, if one or more control ECUs 30, including the power supply control unit 21a, require control (control is required), the power supply control unit 21a determines that the system cannot be shut down and therefore cannot be shut down. However, if the power supply control unit 21a and all control ECUs 30 do not require control, the power supply control unit 21a determines that the system can be shut down. If the power supply control unit 21a determines that the system cannot be shut down, it periodically receives the latest vehicle scene-specific signal from a CAN or the like and transmits it to each control ECU 30 along with power supply control fail-safe information periodically or when the vehicle scene-specific signal changes.

[0076] At this time, the power supply control unit 21a may transmit the vehicle scene-specific signal and the power supply control fail-safe information to each control ECU 30 that is not yet in the standby state, based on the state of each control ECU 30 that has already been received.

[0077] The control ECU 30 that has received the vehicle scene-specific signal again determines whether control is necessary and transmits the determined state of its own device to the integrated control ECU 20. For example, when the integrated control ECU 20 detects an abnormality in the microcomputer 11, the control ECU 30-1 receives the vehicle scene-specific signal "IG2 ON" and determines that control is necessary. If the control ECU 30-1 subsequently receives the vehicle-specific signal "IG2 OFF" indicating the end of driving from the integrated control ECU 20, the control ECU 30-1 performs termination processing and then transmits "control not required" to the integrated control ECU 20. In this way, when the integrated control ECU 20 receives "control not required" from all control ECUs 30 and also terminates the vehicle control originally assigned to the integrated control ECU 20, it determines that the system can be terminated.

[0078] When the power supply control unit 21a determines that the system can be shut down, it outputs an RHLD signal that becomes "RHLD OFF" to each power supply relay 3 simultaneously without going through each delay mechanism 12 (see arrow a9).

[0079] Upon receiving this RHLD signal, each power supply relay 3 simultaneously cuts off the power supply path to the corresponding integrated control ECU 20 and each control ECU 30. As a result of this cutoff, the integrated control ECU 20 and each control ECU 30, which have had their power supply cut off, simultaneously transition to a sleep state.

[0080] The integrated control ECU 20 acquires the state determination results of each control ECU 30 based on the vehicle scene signals and power supply control fail-safe information sent to each control ECU 30 and uses the results to determine whether or not the system can be shut down, thereby enabling safer power supply shutdown control. Furthermore, the integrated control ECU 20 can cause each power supply relay 3 to simultaneously cut off the power supply path, thereby quickly transitioning the power supply control system 1 to a safe power supply shutdown state after determining that the system can be shut down.

[0081] (Timing chart) Next, a description will be given of a timing chart in the above-described operation example of the power supply control system 1. Fig. 8 is a diagram showing a timing chart in the operation example of the power supply control system 1.

[0082] As described above, the control ECU 30-1 is a driving system ECU (activated when "IG2 ON"), and the control ECU 30-2 is a charge control ECU (activated when "IGB ON").

[0083] First, when the vehicle scene-specific signal turns "IG2 ON" at time t1, the microcomputer 11 of the power supply ECU 10 sets the MREL-1 signal and the MREL-2 signal to "MREL ON" to start up the integrated control ECU 20 and the control ECU 30-1. Because the control ECU 30-2 is not involved in driving, the MREL-3 signal remains "MREL OFF."

[0084] The power relay 3-1 corresponding to the MREL-1 signal receives the MREL-1 signal via the delay mechanism 12-1 and turns ON at time t1+Δt1. Similarly, the power relay 3-2 corresponding to the MREL-2 signal receives the MREL-2 signal via the delay mechanism 12-2 and turns ON at time t1+Δt1. Δt1 corresponds to the first time period mentioned above.

[0085] Then, at time t2, when microcomputer 11 of power supply ECU 10 becomes abnormal, MREL-1 signal and MREL-2 signal immediately become "MREL OFF", but power supply relays 3-1 and 3-2 continue to be ON for Δt1 by delay mechanisms 12-1 and 12-2.

[0086] On the other hand, when the microcomputer 21 of the integrated control ECU 20 detects an abnormality in the microcomputer 11 of the power supply ECU 10 because the abnormality has continued for Δt2 (<Δt1), it sets the RHLD signal to "RHLD ON" at time t2+Δt2.

[0087] As a result, all the power supply relays 3 are simultaneously connected, the power supply relays 3-1 and 3-2 remain in the ON state, the power supply relay 3-3 changes from the OFF state to the ON state, and the control ECU 30-2 is also activated. That is, all the control ECUs 30 are activated.

[0088] At this time, the microcomputer 21 of the integrated control ECU 20 transmits the current vehicle scene-specific signal (IG2 ON) to the integrated control ECU 30. In response to this, the control ECU 30-1 determines the state of its own device and transmits a "control required" signal indicating that control by its own device is required to the integrated control ECU 20. The control ECU 30-2 also determines the state of its own device and transmits a "control not required" signal indicating that control by its own device is not required to the integrated control ECU 20.

[0089] The integrated control ECU 20 determines that the system cannot be shut down because the control ECU 30-1 is in a "control required" state, and maintains the "RHLD ON" state of the RHLD signal as the relay hold period.

[0090] Then, at time t3, when the vehicle stops traveling and the vehicle scene signal changes to “IG2 OFF”, the integrated control ECU 20 transmits the vehicle scene signal (IG2 OFF) to the overall control ECU 30.

[0091] In response to this, the control ECU 30-1 performs termination processing, including storing control data in a non-volatile memory, and when this is complete, transmits "control not required" to the integrated control ECU 20. The control ECU 30-2 continues to transmit "control not required" to the integrated control ECU 20.

[0092] Then, when both the control ECU 30-1 and the control ECU 30-2 become "control-unnecessary," the integrated control ECU 20 determines that the system can be shut down if the integrated control ECU 20 itself also does not require control, and at time t4, it sets the RHLD signal to "RHLD OFF" and shuts off all power supply relays 3 at once.

[0093] As a result, the main control ECU 30, which has been cut off from the power supply, transitions to a sleep state. The integrated control ECU 20 also transitions to a sleep state at the same time as the main control ECU 30.

[0094] (Processing sequence) Next, a description will be given of a processing sequence executed by the power supply control system 1. Fig. 9 is a diagram showing a processing sequence executed by the power supply control system 1. Fig. 10 is a flowchart showing the processing procedure of the state determination process executed by the control ECU 30.

[0095] The power supply ECU 10 transmits a counter signal to the integrated control ECU 20 (step S101). On the other hand, the integrated control ECU 20 transmits a counter signal to the power supply ECU 10 (step S102).

[0096] Then, the integrated control ECU 20 determines whether or not the counting based on the counter signal from the power supply ECU 10 has stopped (step S103). If the counting has not stopped (step S103, No), the integrated control ECU 20 determines that the microcomputer 11 of the power supply ECU 10 is normal, and repeats the processing from step S101.

[0097] On the other hand, if the counting has stopped for time Δt2 or more (step S103, Yes), the integrated control ECU 20 determines that an abnormality has been detected in the microcomputer 11 of the power supply ECU 10 and outputs "RHLD ON" to all the power supply relays 3-1, 3-2, and 3-3 (step S104). As a result, all the power supply relays 3-1, 3-2, and 3-3 are turned on, power is supplied to all the control ECUs 30-1 and 30-2, and all the control ECUs 30-1 and 30-2 are started up.

[0098] Subsequently, the integrated control ECU 20 acquires the latest vehicle scene-specific signals via the CAN or the like (step S105). Then, the integrated control ECU 20 transmits the acquired vehicle scene-specific signals and power supply control fail-safe information to the control ECUs 30-1 and 30-2 (step S106).

[0099] The control ECU 30-1 executes a state determination process based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20 (step S107). The control ECU 30-2 also executes a state determination process based on the vehicle scene-specific signal and the power supply control fail-safe information received from the integrated control ECU 20 (step S108).

[0100] In the state determination process, as shown in FIG. 10, the control ECUs 30-1 and 30-2 determine whether or not control by their own devices is necessary based on the vehicle scene-specific signal and the power supply control fail-safe information (step S201).

[0101] If the control is not necessary (step S202, Yes), the control ECUs 30-1 and 30-2 transition to the standby state before sleep (step S203). On the other hand, if the control cannot be ended (step S202, No), the control ECUs 30-1 and 30-2 continue the control by their own devices (step S204). Then, the control ECUs 30-1 and 30-2 end the state determination process.

[0102] Returning to the description of Fig. 9, the control ECU 30-1 transmits the device state of the control ECU 30-1, which is the determination result of the state determination process (for example, a status value indicating "control not required" corresponding to a standby state or "control required" corresponding to a control continuation state), to the integrated control ECU 20 (step S109).

[0103] Similarly, the control ECU 30-2 transmits the device state of the control ECU 30-2 (for example, the above-mentioned status value), which is the determination result of the state determination process, to the integrated control ECU 20 (step S110).

[0104] The integrated control ECU 20 determines whether or not the system can be shut down based on the device status of the integrated control ECU 20 itself and the device status received from the control ECUs 30-1 and 30-2 (step S111). If the system cannot be shut down (No in step S111), the integrated control ECU 20 repeats the process from step S105.

[0105] If system shutdown is permitted (step S111, Yes), the integrated control ECU 20 outputs "RHLD OFF" to all power supply relays 3-1, 3-2, and 3-3 (step S112). As a result, all power supply relays 3-1, 3-2, and 3-3 are turned OFF, and power supply to the integrated control ECU 20 and all control ECUs 30-1 and 30-2 is cut off. Then, the integrated control ECU 20 and all control ECUs 30-1 and 30-2 transition to a sleep state (steps S113, S114, and S115).

[0106] (Variation) Next, a configuration example of a power supply control system 1A according to a modified example will be described. Fig. 11 is a diagram showing a configuration example of a power supply control system 1A according to a modified example. Note that Fig. 11 corresponds to Fig. 1, and therefore differences from Fig. 1 will be mainly described here.

[0107] While the power supply control system 1 in Figure 1 has multiple power supply control units 11a, multiple delay mechanisms 12, and multiple power supply relays 3, the power supply control system 1A has only one power supply control unit 11a, one delay mechanism 12, and one power supply relay 3, as shown in Figure 11.

[0108] That is, in the power supply control system 1A, when the microcomputer 11 is operating normally, the power supply relay 3 always simultaneously connects / disconnects the power supply paths to the integrated control ECU 20 and each control ECU 30 in response to a single MREL signal from the power supply control unit 11a.

[0109] Furthermore, in the power supply control system 1A, when an abnormality occurs in the microcomputer 11, the power supply relay 3 always simultaneously connects / disconnects the power supply paths to the integrated control ECU 20 and each control ECU 30 in response to a single RHLD signal from the integrated control ECU 20. In other words, the operation when an abnormality occurs in the microcomputer 11 is the same as in the case of the power supply control system 1.

[0110] The power supply control system 1A has the advantage of being more cost-effective than the power supply control system 1, since it requires fewer terminals and components in the power supply ECU 10. On the other hand, in the power supply control system 1A, even when the microcomputer 11 is normal, the integrated control ECU 20 and each control ECU 30 are always started or stopped all at once, but when the microcomputer 11 is abnormal, the same fail-safe control as the power supply control system 1 can be performed. Therefore, the power supply control system 1A according to the modified example can also achieve fail-safe at low cost when the microcomputer in the power supply ECU 10 is abnormal.

[0111] (Conclusion) As described above, the integrated control ECU 20 (corresponding to an example of a "controller") according to the embodiment is the first control device to which power is supplied via the power supply relay 3, which receives a power supply hold signal output by the microcomputer 11 (corresponding to an example of a "controller") included in the power supply ECU 10 (corresponding to an example of a "power supply control device") and supplies power to the first control device and the second control device. When the integrated control ECU 20 detects an abnormality in the microcomputer 11, it performs fail-safe control by outputting a power supply hold signal to the power supply relay 3 instead of the power supply ECU 10, and causes the power supply relay 3 to supply power to the second control device and the integrated control ECU 20.

[0112] Therefore, according to the integrated control ECU 20 of this embodiment, if the microcomputer 11 of the power supply ECU 10 fails, the integrated control ECU 20, which is one of the ECUs other than the power supply ECU 10, controls the power supply relay 3 in place of the power supply ECU 10 to supply power to each ECU. This allows a fail-safe to be implemented without providing each ECU with a mechanism for individually controlling the power supply relay 3, making it possible to implement a fail-safe at low cost when an abnormality occurs in the microcomputer of the power supply ECU 10.

[0113] Further advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described above. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents. [Explanation of symbols]

[0114] 1.1A Power Control System 3 Power Relay 10 Power ECU 11 Microcomputer 11a Power supply control unit 12 Delay mechanism 20 Integrated Control ECU 21 Microcomputer 21a Power supply control unit 21b Application execution section 30 Control ECU 31 Microcomputer 31a Application execution section

Claims

1. A first control device is supplied with power via a power relay that receives a power hold signal output by a controller included in the power control device and supplies power to the first control device and the second control device, When an abnormality in the controller is detected, fail-safe control is performed to output the power supply hold signal to the power supply relay in place of the power supply control device, and the power supply relay supplies power to the second control device and the first control device. Control device.

2. detecting an abnormality at least in the controller based on mutual alive monitoring between the controller and the power supply control device; The control device according to claim 1 .

3. the power supply control device outputs the power supply maintenance signal with a delay of a first time period that is set in advance; The first control device When an abnormality in the controller is detected, the power supply holding signal is output for a second time period that is shorter than the first time period. The control device according to claim 1 .

4. The first control device When an abnormality in the controller is detected, the power supply holding signal is output to the power supply relays corresponding to the second control device and the first control device. The control device according to claim 1 .

5. outputting the power supply holding signal simultaneously to the power supply relays corresponding to the second control device and the first control device; The control device according to claim 4.

6. When an abnormality of the controller is detected, the fail-safe control is performed and information regarding the status during the fail-safe control is transmitted to the second control device; receiving a status of the second control device transmitted from the second control device based on the information; determining whether or not to shut down the system based on the state of the second control device; When it is determined that the power supply can be terminated, a power supply cutoff signal is output to the power supply relay to cut off the supply of power to the power supply relay. The control device according to any one of claims 1 to 5.

7. outputting the power supply cutoff signal simultaneously to the second control device and the power supply relay corresponding to the device itself; The control device according to claim 6.

8. a controller that receives the power supply hold signal, outputs the power supply hold signal to a power supply relay that supplies power to the first control device and the second control device, and controls the power supply relay; Equipped with receiving the power supply holding signal output from the first control device by fail-safe control performed by the first control device when an abnormality occurs in the controller, and outputting the signal to the power supply relay; Power control device.

9. a second control device to which power is supplied via a power relay that receives a power hold signal output by a controller included in the power control device and supplies power to the first control device and the second control device, receiving information about a state during the fail-safe control from the first control device that performs fail-safe control to output the power supply holding signal to the power supply relay in place of the power supply control device when an abnormality in the controller is detected; determining whether or not control by the device itself is necessary based on the information; a determination result of whether or not control is necessary is transmitted to the first control device, and when it is determined that control is unnecessary, the state transitions to a standby state; Control device.

10. a power supply control device, a first control device, and a power supply relay that receives a power supply hold signal and supplies power to the first control device and the second control device; The power supply control device includes: A controller that outputs the power supply holding signal and controls the power supply relay Equipped with The first control device When an abnormality in the controller is detected, fail-safe control is performed to output the power supply holding signal to the power supply relay in place of the power supply control device; The power relay is receiving the power supply holding signal output from the first control device by the fail-safe control, and supplying power to the first control device and the second control device; Power control system.

Images